Privacy and State Agencies

Federal Drivers Privacy Protection Act and the Dept. of Motor Vehicles

Some information collected and maintained by a state agency can have value and use to entities outside the agency. This value goes beyond a citizen's or newspaper's ease of accessibility to information showing how government operates and gets into areas that can be termed secondary uses. Motor vehicle records are a prime example. The Department of Motor Vehicles collects and maintains literally millions of records related to individuals and vehicles. There are 2.3 million licensed operators in Connecticut and 2.7 million registered motor vehicles.¹

Among DMV data are records about who owns what kinds of cars, information with many potential uses. When an auto defect is found in a three-year-old model, and recall notices are required, manufacturers go to motor vehicle departments for their registration information. This same information could be attractive for general marketing purposes, but as will be shown, under current DMV law, DMV information is not accessible for that use.

In contrast to the numerous state statutes that totally prohibit public disclosure, the law governing motor vehicle records is an example of a law that attempts to regulate, but not totally prohibit, disclosure of personal information.

Federal Drivers Privacy Protection Act. In 1994, Congress enacted the federal Drivers Privacy Protection Act (DPPA) in response to concerns about stalkers getting residential addresses from state motor vehicle departments. The act prohibited these departments from disclosing personal information about a person in connection with a motor vehicle record, except for "permissible uses" as provided in the federal law.² In 1997, the Connecticut state legislature responded by passing P.A. 97-266. The act, codified in C.G.S. Section 14-10, in large part copies the language of the federal act.

Under the Connecticut law, personal information is defined as: information that identifies an individual and includes an individual's photograph or computerized image, SS#, operators license number, name, address other than zipcode, telephone number, or medical or disability information, but does not include information on motor vehicle accidents or violations, or information relative to the status of an operator's license, registration or insurance coverage.

Permissible uses. Section 14-10(f) of the Connecticut General Statutes sets out to whom DMV can disclose personal information from a motor vehicle record³, which is as follows:

1. Any federal, state or local government agency in carrying out its functions or to anyone acting on behalf of any of those entities;

2. Any individual, organization or entity that files with the commissioner a form approved by the commissioner under penalty of false statement, along with "such supporting documentation or information as the commissioner may require" that says the information will be used for any of the following purposes:

• Implement federal law
  • In connection with matters of motor vehicle or driver safety and theft, motor vehicles emissions, motor vehicle product alterations, recalls or advisories, performance monitoring of motor vehicles and dealers by motor vehicle manufacturers and removal of nonowner records from the original owner records of motor vehicle manufacturers to implement provisions of several federal laws and any state laws enacted to comply with them;
•  
• Confirm personal information in normal course of business
  • In the normal course of business by the requesting party, but only to confirm the accuracy of personal information submitted by the individual to the requesting party;
• For judicial/litigation purposes
  • in connection with any civil, criminal, administrative or arbitral proceeding in any court or government agency or before any self-regulatory body, including the service of process, an investigation in anticipation of litigation and the execution or enforcement of judgments and orders, or pursuant to an order of any court provided the requesting party is a party in interest to such proceedings;
• Market research purposes
  • in connection with matters of motor vehicle or driver safety and theft, motor vehicle emissions, motor vehicle product alterations, recalls or advisories, performance monitoring of motor vehicles and motor vehicle parts and dealers, motor vehicle market research activities including survey research, motor vehicle product and service communications, and removal of nonowner records from the original owner records of motor vehicle manufacturers provided the personal information is not published, disclosed or used to contact individuals except as permitted to implement federal law;
• For insurance purposes
  • by any insurer or insurance support organization or by a self-insured entity or its agents, employees, or contractors in connection with the investigations of claims arising under insurance policies, antifraud activities, rating or underwriting;
• For towed, abandoned or impounded car notice
  • in providing any notice required by law to owners or lienholders named in the certificate of title of towed, abandoned, or impounded motor vehicles;
• For employer information about employee commercial driver license
  • by an employer or its agent or insurer to obtain or verify info about holder of passenger endorsement or commercial driver's license required under the federal Commercial Motor Vehicle Safety Act and state law;
• Union purpose other than campaign or political
  • in connection with any lawful purpose of a labor organization provided the organization has entered into a contract with the commissioner and the information will be used only for the purposes specified in the contract other than campaign or political purposes;
• For bulk surveys (express consent of individuals required)
  • for bulk distribution for surveys, marketing or solicitations provided the commissioner has obtained the express consent of the individual to whom such personal information pertains; (Note: According to DMV, although this provision is in statute, DMV has never provided information for this use and does not plan to)
• Verification of information for fraud prevention for legitimate business (express consent of individuals required)
  • for the purposes of preventing fraud by verifying the accuracy of personal information contained in a motor vehicle record, including an individual's photograph or computerized image, as submitted by an individual to a legitimate business or an agent, employee or contractor of a legitimate business, provided an individual has given express consent.
  • (express consent means an affirmative agreement given by the individual who is the subject of personal information that specifically grants permission to DMV to release such information to the requesting party. The agreement shall A) be in writing or such other form as the commissioner determines in regulations and B) specify a procedure for the individual to withdraw such consent, as per regulations.)

In addition to the permissible uses, the commissioner may disclose personal information contained in any motor vehicle record to any individual who is the subject of the information, or to any person who certifies under penalty of false statement that he or she has the express consent of the subject of the personal information.

How Law Implemented

Personal information is distributed in three ways under Connecticut's version of the Driver Privacy Protection Act at DMV. The common factor for information distribution is that any request must fit into one of the acceptable statutory reasons for disclosure.

• DMV distributes motor vehicle information to other governmental entities, including municipal tax assessors, state and federal agencies, mostly at no charge, under written agreements.⁴
• DMV responds to individual requests for information presented on a DMV form, the J-23, either by mail or in person at DMV's Wethersfield office.
• DMV has contracts with a number of entities to provide information for fees on a volume basis.
•  

Volume contracts. Currently, there are 18 volume contracts for DMV file information. The majority are for access to driver history data and registration data for parking ticket inquiries. DMV reports the largest user of driver history data, a company called Choicepoint, indicates almost all its business is insurance-related.

The contracts for driver history information have several specific provisions regulating the use of the information received from DMV.

• Under the driver history agreements, the state gives driver history records whose driver license numbers "equally match" the driver license numbers the contractor furnishes. (Thus the DMV only furnishes records with which the contractor has some connection, i.e., is inquiry-based)
• Each contractor cannot use or permit others to use any driver history record or license status information for direct mail advertising or other types of mailings.
• Each contractor agrees to not disseminate any data over the public Internet.
• For most driver history contracts, the minimum charge is $25,000 a year, with any search for records in excess of 5000 to be charged at $5.00 a piece.
• The contractor cannot disclose any names, addresses or other information except to the customer for whom the information is obtained.
• Contractors cannot create their own file of driver history information, and generally must erase information they get by 30 days after receipt (unless they need it for a legitimate reason.)
• The state can review documentation of any computer programs, inspect records, require the contractor to maintain information in a secure manner, and require the contractor to submit test runs of computer programs for inspection and review by the state. The state can always ask the contractor if a person or firm identified by the state is a customer or otherwise a recipient of information from the state. The state may from time to request list of customers.
• Any breaches of the contract will lead to termination, and there is a liquid damages clause of $15 per record for a first violation, and $30 for each subsequent violation (a recognition of the difficulty in fixing actual damages for violations).
• Contractors have to furnish performance surety bonds that vary in amount based on business volume.

The contracts for registration information for parking ticket inquiries contain similar restrictions. Similarly, the contractor supplies the state with registration numbers to match numbers on file with the state. The contractor is required to create a program to compare manufacturer's make and model on the parking ticket with the information provided from DMV registration information, to detect errors and prevent notices from being sent to the wrong person. No notice may be sent unless the inquiry matches all criteria-make and model and registration number.

According to DMV, until a year ago, little to no contract compliance monitoring occurred due to resource constraints. In the last year, one DMV employee has done some compliance testing, but the department believes more should be done.

In state FY 1999-2000, $8.6 million was received by the state from these volume contracts.

Non-volume requests. Motor vehicle record information can also be obtained by an individual request either by mail or in person at DMV, using a DMV form and paying the pertinent fees. Like the volume requestors, an individual request must be for one of the permitted uses listed above. No record information is given over the phone.

A copy of the J-23 form is attached for ease of understanding (Attachment B). For perspective, in state fiscal year 1999-2000, the two most frequently requested documents were driver history files (26,049) and registration file information (13,876).⁵ There are some key things to know about the J-23 process.

• The instructions for driver information requests say the name and full address of the licensee must be provided or the request will not be filled. There is no similar statement for registration and title information.
• If driver information is sought and the address the requestor provides is different than DMV records, DMV staff informs the requestor the information does not match, but will not give the DMV address.
• The form requires the requestor to identify under which of the permitted purposes he or she is seeking access to the records being requested, by selecting a code. The requestor must certify by his or her signature the information obtained will only be used for a permissible purpose.
• If a person requesting information comes in person to DMV and presents a completed form, DMV staff will ask to see two forms of identification, one of which must be a photo I.D (and there must be a signature against which to compare the signature on the form.) The identity check does not confirm the validity of the permissible purpose for which the requestor says he or she is seeking information.
• If the request comes to DMV by mail, there is no identification check.

¹ Digest of Annual Reports, 2000

² The U.S. Supreme Court upheld the law in 1999 as within the commerce clause of the Constitution. Also effective in 1999 were amendments to the DPPA that include a new category of "sensitive personal information" and make other changes to certain uses.

³ A motor vehicle record means any record that pertains to an operator's license, learner's permit, identity card, registration, certificate of title or any other document issued by DMV.

⁴ See Davis v. FOIC, (CV 000502561) April 30, 2001, where a Superior Court judge held statutory prohibition against disclosure of motor vehicle records only applies to DMV and not to the municipal tax assessors to whom DMV sends registration information; the statutory right of taxpayers to access to grand list outweighs need for motor vehicle confidentiality.

⁵ A driver history file shows name, residential address, birthdate, operator's license number and expiration date, number of points and any traffic violations in the last two years, and the status of those violations. A registration file shows name and address of the person to whom the car is registered, birthdate, marker plate number, vehicle identification number, description of car, and the registration expiration date.

Return to Year 2001 studies

Return to Table of Contents