Reselling Driver Data Under the DPPA: Authorized Recipients, Five-Year Records and Reseller Liability

Authorized Recipients Under § 2721(c)

The first two subsections of 18 U.S.C. § 2721 govern what a state motor vehicle department may release; the uses they permit are catalogued in the post on DPPA permissible uses. Subsection (c), headed "Resale or Redisclosure," governs what the recipient may do next. It sorts recipients into three groups according to the paragraph of subsection (b) under which they obtained the data.

The statute does not define "authorized recipient." That gap is where most of the resale litigation has taken place, because the plaintiffs in those cases argued that a company buying records only to sell them had no permitted use of its own and so was never authorized to receive them in the first place.

Resale Only for a Permissible Use

Four federal courts of appeals rejected that argument, or its close cousin aimed at bulk buyers, between 2010 and 2013.

• Fifth Circuit. Taylor v. Acxiom Corp. (2010) consolidated six putative class actions against more than seventy-five defendants that had bought Texas driver records in bulk. The court held that "the only reasonable construction of 'authorized recipient' requires no actual use": an authorized recipient is one authorized to resell for one or more of the purposes in § 2721(b). It separately held that bulk purchases for a permitted use do not violate the Act merely because some records go unused.
• Ninth Circuit. Howard v. Criminal Information Services (2011) involved buyers in Oregon and Washington, including a newspaper, a background-check company and a parking operator, that bought whole databases for their own later use. The court held that "stockpiling information for a permitted use does not constitute a violation," because the purpose of obtaining the data was the eventual permitted use, not merely having it.
• Seventh Circuit. Graczyk v. West Publishing Co. (2011) affirmed dismissal of claims that West compiled DMV records for resale. Because the plaintiffs conceded West could fetch a record from the state on a customer's behalf, the court saw "no meaningful difference" between that and compiling the records first, where every buyer has a permitted use.
• Eighth Circuit. Cook v. ACS State & Local Solutions (2011) held that § 2721(c) "explicitly permits the resale of drivers' information, and it does not require that resellers must first use the information themselves." In Johnson v. West Publishing Corp. (2013), an unpublished per curiam decision quoting Cook, the court reversed a district court ruling that had let the claims proceed on the contrary view, and with it the certification of a class of drivers from 29 states and the District of Columbia. It held Cook controlling although West obtained records from other entities as well as from states, because Cook's holdings "were not premised on where the reseller first obtained the information."

None of these decisions says a reseller may sell to anyone. Each turned on the plaintiffs not alleging that the ultimate buyers lacked a permitted use. The Fifth Circuit noted that "the DPPA's criminal and civil sanctions police unauthorized recipients and users without a permissible actual use," which is the civil action described in the post on § 2724 and liquidated damages.

The Five-Year Recordkeeping Duty

The last sentence of § 2721(c) is the compliance provision in the resale scheme. Any authorized recipient, except a recipient under (b)(11), that resells or rediscloses covered information "must keep for a period of 5 years records identifying each person or entity that receives information and the permitted purpose for which the information will be used and must make such records available to the motor vehicle department upon request."

Three features of the text stand out. The duty is triggered by reselling or redisclosing, not by receiving, so a recipient that uses the data internally and passes it to no one is outside the sentence on its terms. The record has two required contents: who received the information and the permitted purpose it will be used for. And the party entitled to see the records is the state motor vehicle department; the sentence does not give drivers access to them.

The statute prescribes no format for the records. The Supreme Court's summary in Reno v. Condon described the obligation in the same terms: any person who rediscloses or resells personal information from DMV records must, for five years, maintain records identifying to whom the records were disclosed and the permitted purpose.

Bulk Distribution and Express Consent

Marketing lists follow their own track. A recipient under (b)(12) obtained a bulk list because the state had the driver's express consent to release it "for bulk distribution for surveys, marketing or solicitations," and § 2721(c) confines that recipient's resale to the same channel. The first sentence of subsection (c) withholds both (b)(11) and (b)(12) purposes from the general class of recipients, while the second sentence lets a (b)(11) recipient resell for any purpose.

The Fifth Circuit read the bulk language in the other direction as well. In Taylor, it observed that only (b)(12) mentions bulk distribution and only (b)(11) limits itself to individual records, and inferred that the other twelve uses permit both. Subsection (d) sits beside these rules: a state may adopt a procedure under which, when a request falls outside subsection (b), it mails the request to the driver and releases nothing unless the driver waives the right to privacy under the section.

Why Reno v. Condon Upheld the Scheme

South Carolina, whose law then released DMV information to any person or entity that filled out a form stating it would not be used for telephone solicitation, sued to block the DPPA, and the Fourth Circuit held the Act unconstitutional. The Supreme Court reversed on January 12, 2000, in an opinion by Chief Justice Rehnquist.

The resale provisions were part of the reasoning. On the Commerce Clause, the Court held that drivers' information is "an article of commerce" whose sale or release into the interstate stream supports federal regulation, noting that Wisconsin alone received about $8 million a year from such sales. On the Tenth Amendment, it held the DPPA regulates "the States as the owners of databases" rather than directing them to regulate their citizens. And to South Carolina's argument that the Act regulates states exclusively, the Court answered that the DPPA is generally applicable because it "regulates the universe of entities that participate as suppliers to the market for motor vehicle information," which it described as "the States as initial suppliers of the information in interstate commerce and private resellers or redisclosers of that information in commerce."

Where Downstream Liability Has Been Litigated

The question left by the no-actual-use cases is what a reseller must do about a buyer who lies. Gordon v. Softech International (2d Cir. 2013) answered it for private resellers. After a street altercation, a man wrote down a license plate number, paid $39 on Docusearch.com, a service run by the investigative agency Arcanum, and received the owner's name and home address, which Arcanum had obtained through the data broker Softech. He then harassed the owner and his family.

The Second Circuit held, from the statute's text, structure and legislative history, "that resellers are subject to a duty of reasonable care before disclosing DPPA-protected personal information," and that a reseller "is liable for actual (or liquidated) damages when it fails to use reasonable care to ensure that personal information is being obtained for a permissible purpose." It limited the holding to private resellers and did not decide the standard for state DMVs.

Applied to the two resellers, the duty produced different results. Softech released the record to a licensed private investigative agency with which it had an ongoing relationship and a signed affidavit of intended use, and nothing suggested further inquiry would have revealed a red flag, so its judgment was affirmed. Arcanum's claim went back for trial: the buyer used an alias, a credit card in a different name and a business that was not operating, chose "Insurance Other" from a drop-down menu requiring one of fourteen listed purposes, and was never asked to show he was an insurer. Judge Jacobs concurred in part and dissented in part. The opinion also noted that each of the four circuits to consider it had held resellers need not use the information themselves.

Frequently Asked Questions