DPPA Permissible Uses: The Fourteen Exceptions in 18 U.S.C. § 2721(b)

Personal Information From a Motor Vehicle Record

The Driver's Privacy Protection Act of 1994 starts from a prohibition. Under 18 U.S.C. § 2721(a), a state department of motor vehicles, and any officer, employee or contractor of one, "shall not knowingly disclose or otherwise make available" personal information obtained in connection with a motor vehicle record, except as subsection (b) provides. Everything else in the permissible-use scheme is an exception to that rule, which is why courts construing the exceptions keep returning to it.

Two definitions in § 2725 fix what the rule protects. A "motor vehicle record" is any record that pertains to an operator's permit, a title, a registration or an identification card issued by a department of motor vehicles. "Personal information" is information that identifies an individual, and the statute gives examples: photograph, Social Security number, driver identification number, name, address, telephone number, and medical or disability information.

The definition also carves three things out. The five-digit ZIP code is expressly excluded from "address," and personal information "does not include information on vehicular accidents, driving violations, and driver's status." A driving history, read on its own terms, therefore sits outside the definition, while the name and address printed alongside it do not.

Highly Restricted Personal Information

The 2000 amendments (Pub. L. 106-346) created a second, narrower tier. Section 2725(4) defines "highly restricted personal information" as an individual's photograph or image, Social Security number, and medical or disability information. Section 2721(a)(2) bars release of that tier "without the express consent of the person to whom such information applies," with four exceptions only: government functions in (b)(1), legal proceedings in (b)(4), insurance claims and underwriting in (b)(6), and commercial driver's license verification in (b)(9).

"Express consent" is itself defined. Under § 2725(5) it means consent in writing, including consent conveyed electronically that bears an electronic signature as defined in the federal E-SIGN Act. The same subsection (a)(2) contains a proviso that it does not affect the use of organ donation information on a driver's license or the administration of state organ donation programs.

The practical effect is a two-level structure. A name and address can travel under any of the fourteen exceptions. A license photograph or a Social Security number can travel without written consent under four of them, and the Supreme Court has pointed to that fact as a reason to read those four carefully.

The Fourteen Permissible Uses

Subsection (b) opens with a mandatory clause before it reaches the list. Personal information "shall be disclosed" for use in connection with motor vehicle or driver safety and theft, emissions, product alterations, recalls or advisories, manufacturer performance monitoring, and removal of non-owner records, to carry out the Anti Car Theft Act, the Automobile Information Disclosure Act, the Clean Air Act and specified chapters of Title 49. The fourteen numbered uses that follow are permissive: information "may be disclosed" for them, subject to the highly restricted tier in (a)(2).

Several of the entries carry internal limits that are easy to miss in a summary. The business-verification use in (b)(3) is not a general commercial license: it runs only to checking information "submitted by the individual" and correcting it for the three stated purposes. The research use in (b)(5) forbids contacting anyone. And (b)(8) does not give licensed investigators a use of their own; it lets them act for a purpose that some other paragraph already permits.

Express Consent for Marketing and Bulk Distribution

Three paragraphs turn on consent, and they allocate it differently. Under (b)(11) and (b)(12) the state is the party that must have obtained the driver's express consent, for individual record requests and for bulk marketing lists respectively. Under (b)(13) the requester carries the burden, and must demonstrate that it holds the individual's written consent.

The consent requirement in (b)(11) and (b)(12) is not the version Congress enacted in 1994. The editorial notes to § 2721 in the U.S. Code record that the original text allowed these disclosures if the department had given drivers a clear and conspicuous opportunity on license and registration forms to prohibit them. Pub. L. 106-69, § 350, enacted October 9, 1999, replaced that opt-out with the present requirement that the state obtain express consent, effective June 1, 2000, with later compliance dates written in for nine named states. Congress added § 2721(e) the following year, forbidding any state to condition or burden the issuance of a motor vehicle record on obtaining that consent, while allowing an administrative fee.

The Supreme Court described the switch in Maracich v. Spears as evidence of how much weight Congress placed on consent before driver data could be used for solicitation. Whether a recipient under (b)(12) may pass a marketing list along to others is a resale question governed by § 2721(c), covered in the companion post on DPPA resale and redisclosure.

Litigation Use and Its Limits

Maracich is a Supreme Court decision construing one of the permissible uses directly. South Carolina lawyers had used state freedom-of-information requests to obtain names and addresses of car buyers from the DMV, then mailed letters headed "ADVERTISING MATERIAL" to more than 34,000 of them, describing a pending suit against dealerships and inviting recipients to join. The Fourth Circuit held the mailings exempt under (b)(4) because the solicitation was "inextricably intertwined" with litigation.

The Court vacated that judgment in a 5-4 decision written by Justice Kennedy, with Justice Ginsburg dissenting for four Justices. The majority held that "an attorney's solicitation of clients is not a permissible purpose" under (b)(4). Its reasons came from the statute's structure: (b)(4) is one of the four paragraphs that reach highly restricted information, so a broad reading would expose the most sensitive data; the examples in (b)(4), such as service of process and execution of judgments, describe a lawyer acting as an officer of the court rather than as a commercial actor; and reading solicitation into (b)(4) would let lawyers do without consent what (b)(12) allows only with it.

The Court also set the test courts now apply. Because one letter can serve several ends, the inquiry is whether solicitation was the "predominant purpose" of obtaining or using the information, judged objectively from the communication and the defendant's course of conduct. "Investigation in anticipation of litigation," in the Court's reading, covers background research on whether a claim is supportable and locating witnesses. The case was remanded to apply that standard.

A second limit comes from the Seventh Circuit. In Senne v. Village of Palatine (en banc, 2012), a parking ticket left on a windshield displayed the owner's name, address, driver's license number, date of birth, sex, height and weight. The majority held that "any disclosure must comply with those legitimate uses of information identified in the statutory exceptions," so a disclosure falling within a listed purpose could still exceed it if it released information not used for that purpose. Four judges dissented, reading the text to contain no such limit.

State Opt-In Choices

The statute leaves states several decisions. They choose whether to obtain the express consent that unlocks (b)(11) and (b)(12) at all, and how to collect it, subject to the § 2721(e) bar on conditioning a record on consent. Under (b)(14) a state may authorize by its own law additional uses, but only uses related to the operation of a motor vehicle or to public safety.

States are also bound by the scheme rather than just administering it. The Supreme Court upheld that arrangement against a Tenth Amendment challenge in Reno v. Condon (2000), discussed with the resale provisions in the resale post. What happens when a person obtains or uses information outside every paragraph above, including the $2,500 liquidated damages figure, is the subject of the post on the DPPA's civil action.

Where the Exceptions Stop

Read together, the text and the two decisions describe a list that is closed but not self-applying. Whether a given request fits a paragraph depends on who is asking, which category of information is released, whether consent was obtained and by whom, and, after Maracich and Senne, what the information was predominantly used for and whether each item released served that use. Those are factual questions; the statute supplies the categories, not the answers for any particular requester.

Frequently Asked Questions