Security & Compliance / DPPA FAQ's

DPPA FAQ’s

FAQ Sheet for the Federal Driver Privacy Protection Act (18 U.S. Code § 2721)

What is the Federal Driver Privacy Protection Act (DPPA)?

The Federal Driver Privacy Protection Act (DPPA) is a United States federal law that protects the privacy of personal information found in motor vehicle records. Enacted in 1994, the DPPA restricts the disclosure of personal information by State Departments of Motor Vehicles (DMVs) and establishes penalties for the unauthorized release and use of this information.

What information is protected under the DPPA?

The DPPA protects personal information such as an individual's name, address, telephone number, Social Security number, driver identification number, photograph, and medical or disability information contained in motor vehicle records.

What are the permissible uses of personal information under the DPPA?

The DPPA allows the release of personal information for specific purposes, including:

a. Government agency functions
b. Motor vehicle safety and theft prevention
c. Insurance, toll, or motor vehicle-related transactions
d. Employment and licensing verification
e. Legal, research, or statistical purposes
f. Providing notice to owners of towed or impounded vehicles
g. Private investigation
h. Motor vehicle market research
i. Use in connection with court proceedings

Who can access personal information protected by the DPPA?

Access to personal information is generally restricted to authorized individuals and entities with a legitimate reason that falls under one of the permissible uses outlined in the DPPA.

What are the penalties for violating the DPPA?

Individuals or entities found guilty of violating the DPPA may be subject to civil and criminal penalties. Civil penalties can include actual and punitive damages, attorney fees, and other litigation costs. Criminal penalties can result in fines and/or imprisonment.

How can I protect my personal information under the DPPA?

You can protect your personal information by being cautious about the information you provide to DMVs and other organizations. Check your state's DMV website to see if they offer any additional privacy protections or options to restrict the release of your personal information.

How can I report a suspected violation of the DPPA?

If you suspect a violation of the DPPA, you may contact your state's DMV or the appropriate law enforcement agency to report the incident. Additionally, you may consult with an attorney to discuss your legal options.

What is the exact verbiage of the Federal Driver Privacy Protection Act?

§2721. Prohibition on release and use of certain personal information from State motor vehicle records

(a) In General.—A State department of motor vehicles, and any officer, employee, or contractor thereof, shall not knowingly disclose or otherwise make available to any person or entity:
(1) personal information, as defined in 18 U.S.C. 2725(3), about any individual obtained by the department in connection with a motor vehicle record, except as provided in subsection (b) of this section; or
(2) highly restricted personal information, as defined in 18 U.S.C. 2725(4), about any individual obtained by the department in connection with a motor vehicle record, without the express consent of the person to whom such information applies, except uses permitted in subsections (b)(1), (b)(4), (b)(6), and (b)(9): Provided, That subsection (a)(2) shall not in any way affect the use of organ donation information on an individual's driver's license or affect the administration of organ donation initiatives in the States.

(b) Permissible Uses.—Personal information referred to in subsection (a) shall be disclosed for use in connection with matters of motor vehicle or driver safety and theft, motor vehicle emissions, motor vehicle product alterations, recalls, or advisories, performance monitoring of motor vehicles and dealers by motor vehicle manufacturers, and removal of non-owner records from the original owner records of motor vehicle manufacturers to carry out the purposes of titles I and IV of the Anti Car Theft Act of 1992, the Automobile Information Disclosure Act (15 U.S.C. 1231 et seq.), the Clean Air Act (42 U.S.C. 7401 et seq.), and chapters 301, 305, and 321–331 of title 49, and, subject to subsection (a)(2), may be disclosed as follows:

(1) For use by any government agency, including any court or law enforcement agency, in carrying out its functions, or any private person or entity acting on behalf of a Federal, State, or local agency in carrying out its functions.

(2) For use in connection with matters of motor vehicle or driver safety and theft; motor vehicle emissions; motor vehicle product alterations, recalls, or advisories; performance monitoring of motor vehicles, motor vehicle parts and dealers; motor vehicle market research activities, including survey research; and removal of non-owner records from the original owner records of motor vehicle manufacturers.

(3) For use in the normal course of business by a legitimate business or its agents, employees, or contractors, but only—
(A) to verify the accuracy of personal information submitted by the individual to the business or its agents, employees, or contractors; and
(B) if such information as so submitted is not correct or is no longer correct, to obtain the correct information, but only for the purposes of preventing fraud by, pursuing legal remedies against, or recovering on a debt or security interest against, the individual.

(4) For use in connection with any civil, criminal, administrative, or arbitral proceeding in any Federal, State, or local court or agency or before any self-regulatory body, including the service of process, investigation in anticipation of litigation, and the execution or enforcement of judgments and orders, or pursuant to an order of a Federal, State, or local court.

(5) For use in research activities, and for use in producing statistical reports, so long as the personal information is not published, redisclosed, or used to contact individuals.

(6) For use by any insurer or insurance support organization, or by a self-insured entity, or its agents, employees, or contractors, in connection with claims investigation activities, antifraud activities, rating or underwriting.

(7) For use in providing notice to the owners of towed or impounded vehicles.
(8) For use by any licensed private investigative agency or licensed security service for any purpose permitted under this subsection.

(9) For use by an employer or its agent or insurer to obtain or verify information relating to a holder of a commercial driver's license that is required under chapter 313 of title 49.

(10) For use in connection with the operation of private toll transportation facilities.

(11) For any other use in response to requests for individual motor vehicle records if the State has obtained the express consent of the person to whom such personal information pertains.

(12) For bulk distribution for surveys, marketing or solicitations if the State has obtained the express consent of the person to whom such personal information pertains.

(13) For use by any requester, if the requester demonstrates it has obtained the written consent of the individual to whom the information pertains.

(14) For any other use specifically authorized under the law of the State that holds the record, if such use is related to the operation of a motor vehicle or public safety.

(c) Resale or Redisclosure.—An authorized recipient of personal information (except a recipient under subsection (b)(11) or (12)) may resell or redisclose the information only for a use permitted under subsection (b) (but not for uses under subsection (b)(11) or (12)). An authorized recipient under subsection (b)(11) may resell or redisclose personal information for any purpose. An authorized recipient under subsection (b)(12) may resell or redisclose personal information pursuant to subsection (b)(12). Any authorized recipient (except a recipient under subsection (b)(11)) that resells or rediscloses personal information covered by this chapter must keep for a period of 5 years records identifying each person or entity that receives information and the permitted purpose for which the information will be used and must make such records available to the motor vehicle department upon request.

(d) Waiver Procedures.—A State motor vehicle department may establish and carry out procedures under which the department or its agents, upon receiving a request for personal information that does not fall within one of the exceptions in subsection (b), may mail a copy of the request to the individual about whom the information was requested, informing such individual of the request, together with a statement to the effect that the information will not be released unless the individual waives such individual's right to privacy under this section.

(e) Prohibition on Conditions.—No State may condition or burden in any way the issuance of an individual's motor vehicle record as defined in 18 U.S.C. 2725(1) to obtain express consent. Nothing in this paragraph shall be construed to prohibit a State from charging an administrative fee for issuance of a motor vehicle record.

(Added Pub. L. 103–322, title XXX, §300002(a), Sept. 13, 1994, 108 Stat. 2099; amended Pub. L. 104–287, §1, Oct. 11, 1996, 110 Stat. 3388; Pub. L. 104–294, title VI, §604(b)(46), Oct. 11, 1996, 110 Stat. 3509; Pub. L. 106–69, title III, §350(c), (d), Oct. 9, 1999, 113 Stat. 1025; Pub. L. 106–346, §101(a) [title III, §309(c)–(e)], Oct. 23, 2000, 114 Stat. 1356, 1356A–24.)

Please note that this FAQ sheet is for informational purposes only and should not be considered legal advice. Consult with an attorney or relevant authority for guidance specific to your situation.