What is the DPPA?

Sometimes the name of the law is purposely written so that it appears to be something it is not. The Driver’s Privacy Protection Act doesn’t actually protect the privacy of drivers. This federal law, part of the Violent Crime Control and Law Enforcement Act of 1994, allows states to sell information from driver’s licenses, including personal data that can be used against an individual.

Aside from voluntary driver’s license information the harvesting and sale of data from computer and connected device users blossomed from $7.6 billion to $64 billion worldwide in the 10-year period of 2011-2021. Tracking cookies have become less effective recently as internet browsers were designed to block them,  but more mobile apps have sprung up, allowing location data to be collected along with personal information and even biometrics that reveal information about an individual’s health.

What is DPPA Permissible?

The law was written to keep driver’s license information out of the hands of private individuals after an actress named Rebecca Shaeffer was killed by a stalker, but in fact it allows the information to be sold to many others, such as:

• insurance companies
• tow companies
• private investigators and bounty hunters
• credit reporting agencies
• marketing companies
• banks and
• employers.

States may set their own standards or exploit loopholes in the law for profiting off driver’s license data; dozens sell the information in bulk for millions of dollars in profit. States identified by journalists as selling such information included New Jersey, Delaware, California, Virginia, Florida, Indiana, Rhode Island, Wisconsin, and South Carolina. Arizona was identified as selling driver’s photos and Social Security numbers in violation of the law’s intent and application.

Sharing of driver’s license information, including driving records, is not uncommon among states. A Driver License Compact was established among 45 states in order to allow access to all license information for the purposes of law enforcement. The only states that are not included are Massachusetts, Michigan, Tennessee, Georgia, and Wisconsin. However, you can perform a license plate owner lookup through RecordsFinder online tools.

What Information Does the DPPA Restrict?

Home addresses are frequently sold as part of driver’s license information that states market to third parties. States do not release:

• photos,
• information about disabilities, or
• Social Security numbers (some states use the numbers as identification for drivers)

unless it’s officially approved under the law and for specifically allowed uses. However, states have been found in violation of these rules and some approved users have re-sold information to others who do not qualify for legal access. All other information, including birth dates, phone numbers, and email addresses have all ended up in the hands of third-party companies allowed to purchase driver’s license information under DPPA, according to published reports.

What States Do Not Share DMV Information?

Tennessee is one state that allows residents to opt-out of having their personal information shared, however, there are several exceptions to that exclusion. A journalist discovered that the state may still sell individual information to five companies despite the appearance of such a sale is expressly prohibited.

Each state is entitled to create its own regulations that augment the DPPA, resulting in a patchwork of laws and loopholes. The Supreme Court held in 2000 that the DPPA is an appropriate use of federal legislation.

History of the DPPA

An actress, Rebecca Shaeffer was starring in the sitcom My Sister Sam in 1993 when a stalker used a driver’s license information to track her to her home and commit murder. Others had used the information of abortion providers to harass doctors and clinicians at their homes. A burglary ring in Iowa wrote down the license plate numbers of expensive cars then purchased the information about their owners in order to rob them. By 1994 when violent crime was rampant, legislators decided to close one source of personal information: driver’s records.

In 2000 the act was supposed to be strengthened with the addition of the Shelby Act, which expressly prohibits releasing personal information without the specific consent of the individual involved.

Circumstances When the DMV Can Release Records

Privacy concerns of victim advocates are leading the complaints against the DPPA and its many loopholes. They point out that private investigators may access the records for as little as one penny apiece, then use the information against the individual in an investigation (which some claim violates the Constitutional right to avoid self-incrimination). Some states don’t require private investigators to be licensed or qualified in any way, raising concerns about misuse of the personal information available through DPPA.

Mississippi, Idaho, Alaska, Rhode Island, Pennsylvania, South Dakota, and Wyoming do not require licenses for private investigators. Without a licensing standard, driver’s information can be released to felons and others who may misuse it. In particular victims of domestic violence and witnesses to crimes may be at risk.

Insurance companies, attorneys, and statistical studies are all allowed access to driver’s license information under certain conditions. For instance, employers may only use the information to confirm data provided by the individual, and attorneys may only use the data in their official capacities.

Penalties for Violating the DPPA

States do periodic audits of the lists of companies and individuals authorized to access DMV records under DPPA. While the charge for misusing such records is generally a misdemeanor it may carry a $5,000 fine, according to the Department of Justice. More serious charges may result if the record is used to commit a  crime.

In 2020 the data broker Lexis-Nexis was fined $5 million for reselling driver’s license information it had obtained legally for use by companies that are not authorized to receive the information.