October 2, 2003 98-R-0184

TO:

FROM: Sandra Norman-Eady, Senior Attorney

James J. Fazzalaro, Principal Analyst

RE: Federal Driver's Privacy Protection Act

You asked if (1) the federal Driver's Privacy Protection Act has been declared unconstitutional because it violates the 10^th Amendment to the U.S. Constitution, (2) Connecticut passed its driver's privacy protection act to comply with the federal law, and (3) Connecticut's law has to be changed in light of the status of the federal law.

Last fall, the U. S. District Court for the District of South Carolina held that the federal Driver's Privacy Protection Act of 1994 (DPPA), which regulates the dissemination and use of certain information contained in state motor vehicle records, violated the 10^th Amendment to the U.S. Constitution and permanently enjoined the federal government from enforcing it in the State of South Carolina (Condon v. South Carolina Press Association, 972 F. Supp. 977 (September 11, 1997).

In finding the DPPA unconstitutional, the Court rejected the United States' argument that Congress enacted it pursuant to its power to regulate interstate commerce and, alternatively, that Congress was empowered to enact it by Section Five of the Fourteenth Amendment, which authorizes Congress to enact legislation to enforce that amendment.

An Oklahoma federal court has also held that the DPAA is unconstitutional under the 10^th Amendment. The court granted the State of Oklahoma a temporary injunction in a one-page order and promised to issue a detailed explanation in the future. We will provide a copy of the decision when it is available.

The DPPA imposes criminal and civil penalties on individuals who violate its requirements and authorizes the Attorney General of the United States to impose a civil penalty of $5,000 per day against any state department of motor vehicles (DMV) with a policy or practice in "substantial noncompliance" with the DPPA as of September 13, 1997. The General Assembly adopted legislation (PA 97-266) during its 1997 session to conform its law to the federal act. Following the South Carolina decision and a subsequent similar ruling by a federal district judge in Oklahoma, Attorney General Reno has apparently decided not to enforce the penalty provisions of the DPPA until Congress can determine if it will repeal or modify the federal law.

The DPPA has been stricken in South Carolina and Oklahoma because its mandates violate the state sovereignty provision of the federal constitution and not because its provisions on disclosure of DMV records violate any individual's right to access. Connecticut is under no obligation to change PA 97-266 because of the court's decision. Since the likelihood of federal civil sanctions is temporarily abated, Connecticut could change its law in any way the legislature sees fit, even if this would result in it being in "substantial noncompliance" with the federal law. But should the constitutional status of the DPPA change or Congress modify it in a way that Attorney General Reno determines would allow her to enforce it, the motor vehicles commissioner might find himself in the same position he would have been in had PA 97-266 not been enacted.

A summary of PA 97-266 is attached for your information.

The DPPA generally prohibits a state department of motor vehicles, and any of its officers, employees, or contractors from knowingly disclosing or otherwise making available to any person or entity personal information about any individual obtained by the department in connection with a motor vehicle record (18 USCA § 2721). The act contains a list of exceptions to the prohibition on disclosure. It also permits states to establish rules and procedures for its agents to carry out the law's provisions (18 USCA § 2721 (b) and (c)).

South Carolina has its own statutory provisions regarding the disclosure and use of its motor vehicle records that differ significantly from the DPPA (S.C. Code Ann. § 56-3-510 to –540). The undisputed evidence established that implementation of the DPPA would impose substantial costs and effort on the state department of motor vehicles.

The issue before the Court was whether Congress exceeded its constitutional power and infringed on the sovereignty of the states in enacting the DPPA, thereby violating the 10^th Amendment.

The state challenges the constitutionality of the DPPA on the grounds that it violates the 10^th Amendment to the federal constitution. The 10^th Amendment provides as follows:

The powers not delegated to the United States by the Constitution, nor prohibited

by it to the States, are reserved to the States respectively, or to the people.

The respondent contends that the DPPA is constitutional because Congress enacted it pursuant to its powers under the Commerce Clause and section five of the 14^th Amendment. Under the former, Congress has the power to regulate commerce among the states (Art. I, §8, cl. 3) and under the latter it has the power to enforce, by appropriate legislation, the provisions of the article.

In arguing that the DPPA infringed on the state's sovereignty in violation of the 10^th Amendment, the plaintiff relied principally on two U.S. Supreme Court decisions—New York v. United States, 505 U.S. 144 (1992) and Printz v. United States, 117 S. Ct. 2365 (1997)—where the court struck down federal legislation. In New York, the Court held that although Congress has substantial powers to govern the nation directly, including in areas of intimate concern to the states, it could not require the State of New York and two of its counties to take title to low-level radioactive waste generated within their borders. According to the Court, Congress has the power to require or prohibit certain acts but it does not have the power to directly compel the states to require or prohibit those acts.

In Printz, the Court took its holding in New York a step further. It held that not only can Congress not compel the states to enact or enforce, by legislation or executive action, a federal regulatory program but it also cannot issue directives requiring the states to address particular problems or command state officers or those of their political subdivisions to administer or enforce such a program. Printz was an action brought by two county sheriffs to challenge the constitutionality of a portion of the Brady Act that required the chief information officer of certain localities to participate, temporarily, in the administration of a federally enacted regulatory scheme.

In relying on these two cases the plaintiff sought to show that the federal constitution gives Congress the authority to regulate matters directly and to preempt contrary state regulation but not the authority to require the states to regulate. The Court agreed. By agreeing, the Court rejected the respondent's argument that the DPPA is not affected by New York and Printz because it does not compel the states to “regulate” within the meaning of those cases. When asserting its argument, the respondent tried to persuade the Court to apply a line of cases that follow Garcia v. San Antonio Metropolitan Transit Authority, 469 U.S. 528 (1985). The Garcia cases, according to the court, are applicable in cases involving consideration of whether the incidental application to the states of a federal law of general applicability excessively interferes with the functioning of state government and not to cases where the whole objective of the law is to direct the functioning of the state executive.

In short, the Court held that Congress exceeded its authority to act under the Commerce Clause in the field of motor vehicle records when it enacted the DPPA (i.e., by enacting the DPPA, Congress attempted to require states to enforce a federal program).

Relying primarily on Whalen v. Roe, 429 U.S. 589 (1977), the respondent argues that the 14^th Amendment protects the right to privacy by prohibiting the states from publicly disclosing personal information contained in state motor vehicle records and that Section Five of the Amendment empowered Congress to enact the DPPA to enforce the amendment. The plaintiff counters by arguing that the 14^th Amendment does not guarantee a right to privacy with respect to the information specified by the DPPA.

The Court acknowledged that Whalen establishes a constitutional right to privacy in the nondisclosure of personal information but it found that the respondent failed to cite any cases in which the U. S. Supreme Court or the Fourth Circuit has found a constitutional privacy violation based on public dissemination of personal information by the government. Without the benefit of a precedent-setting case, the Court began its analysis using a three-pronged test: (1) whether the information protected by the DPPA is the type of personal information for which the constitution recognizes a right to privacy, (2) whether the state's interest in obtaining the information outweighs the subject's privacy interest, and (3) whether the state's interest in allowing the information to be made public outweighs the subject's privacy interest.

According to the Court, a negative response to the first question ends the inquiry. But, before deciding the first question, the Court, in dicta, easily and summarily disposed of the second and third. With respect to the second, the Court found that the DPPA, by its very nature, implicitly recognized that any privacy expectation a person had with respect to information collected by motor vehicles was outweighed by the state's interest in obtaining it (i.e., the DPPA sought to prohibit the public distribution of “personal information” and not the state's right to collect it). The Court found that the plaintiff did not offer any specific interest to justify its need to allow its motor vehicle records to be publicly disseminated; thus, the third question was not satisfied.

The Court used the two-pronged test established in Walls v. City of Petersburg, 895 F.2d 188 (4^th Cir. 1990) to determine whether the information protected by the DPPA is the type protected by the constitution. The first test was whether the information was within the subject's reasonable expectation of confidentiality. Based on Walls the Court found that the DPPA sought to protect information that was freely available in public records and as such could not be considered confidential for constitutional purposes. The DPPA's definition of “personal information” includes all information that identifies a person. This definition is so broad, according to the Court, that it “encompasses a seemingly infinite set of information, some of which may in fact be entitled to privacy protection.” The Court, however, found it unworkable to determine, sever, and retain truly private information only, such as social security information. Furthermore, the Court found that the main purpose of the DPPA was to prohibit the disclosure of names and addresses in order to prevent people from being identified by motor vehicle records, thus, protecting information that is truly private would not have achieved Congress' purpose.

The Court denied the United State's motion to dismiss, granted the State of South Carolina's motion for summary judgment, and permanently enjoined the United States from enforcing the DPPA in South Carolina.

STATE ACTION TO COMPLY WITH THE DPPA

The DPPA's requirements became effective and enforceable against the states on September 13, 1997. Beside a criminal penalty and authority for civil action against any person who knowingly obtains or discloses personal information in violation of the act's requirements, it provides for a civil sanction against any motor vehicle agency with policy or practices that were in "substantial noncompliance" with the law. The sanction, a civil penalty of $5,000 per day, is enforceable by the Attorney General of the United States.

Bills to rewrite Connecticut's law to conform to the DPPA were first introduced in 1995, but legislation was not enacted until the 1997 session. PA 97-266 generally reflects the DPPA requirements and probably would have prevented imposition of noncompliance sanctions even though it was not identical to the federal law.

Following the Condon decision, a second federal judge in Oklahoma issued a temporary injunction against the DPPA. Based on these two rulings, Attorney General Reno apparently determined that she should not enforce the sanction provisions against state motor vehicle agencies until such time as Congress has an opportunity to decide if it wants to revise or repeal the DPPA. We believe this information may have been communicated informally as we have not seen it in any official form.

The current status of the DPPA does not compel Connecticut's law to be changed in that the constitutional issues that resulted in the ruling relate to state-federal sovereignty and not to specific provisions affecting privacy or individual rights. PA 97-266 establishes state statutory requirements and these can be followed in any case. The more difficult question seems to be whether actions that substantially change PA 97-266 put the state at risk of being in noncompliance. Given Attorney General Reno's current position on enforcing the DPPA, it seems that there probably would be no immediate consequences should the law be changed. But this could be only a temporary situation if her position were to change, Congress changes the DPPA to address the constitutional issue raised in the South Carolina and Oklahoma cases but retains the current sanction for noncompliance, or other court challenges result in different rulings.

JF:mw