A Decade After Adoption of Federal DPPA, Treatment of Personal Information Remains Unclear
Ten years after the adoption of the federal Drivers Privacy Protection Act (“DPPA”) treatment of personal information remains unclear
Despite the passage of a decade and a trio of court rulings, a local government’s obligation to disclose certain records containing “personal information” in compliance with the federal Drivers Privacy Protection Act (“DPPA”) and Wisconsin’s public records law remains somewhat unclear.
Adopted in response to concerns that the release of personal information held by state departments of motor vehicles – and agencies with access to those records – might be used for mass marketing purposes or to commit identity theft or other crimes, the DPPA places severe restrictions on the release of such information and imposes up to a $2,500 fine per violation. Although the law was drafted broadly to apply to municipal governments, the DPPA contains an exception that permits the disclosure of personal information “for use in connection with any civil, criminal, administrative or arbitral proceeding,” including “investigation in anticipation of litigation.”[1] (Emphasis added.)
Local Government Tip #1: Understand the Permissible and Impermissible Uses of Personal Information Under the DPPA to Ensure Compliance
The DPPA defines “personal information” as information that identifies an individual, including an individual’s photograph, social security number, driver identification number, name, address (but not the five-digit zip code), telephone number, and medical or disability information, but does not include information on vehicular accidents, driving violations, and driver’s status. A small number of exceptions permit disclosure of this information for authorized for use by a law enforcement agency in carrying out its functions.
Certain data, referred to as highly restricted personal information and includes an individual’s social security number, photograph and medical or disability information, may be accessed only in certain restrictive instances such as a government’s legitimate need for the information. However, it does not provide unlimited authority for law enforcement to access or disclose the information.
In August 2012, the 7th Circuit Court of Appeals held that the inclusion of personal information on a parking citation constituted the disclosure of personal information in violation of the DPPA.[2] The infringing information consisted of the driver’s full name, address, drivers license number, date of birth, sex, height and weight.[3]
Subsequent to the 7th Circuit’s decision in Senne, the United States Supreme Court held in a 5-4 decision that exceptions to the prohibition of the release of personal information under the DPPA must be narrowly construed and that the “’in connection with’ language in [the] (b)(4) [exception] must have a limit.”[4] Although the Spears case dealt with the release of personal information to attorneys soliciting prospective clients, not records custodians’ responses to public records requests, the Court seemed to affirm the 7th Circuit’s narrow interpretation of the boundaries of the exceptions to the prohibition of disclosure of personal information under the DPPA.
Local Government Tip #2: It May Not be Appropriate to Redact ALL Personal Information Under the DPPA and Wisconsin’s Public Records Law
In response to the Senne and Spears cases, various trade associations recommended that municipalities carefully evaluate their use of personal information under the DPPA. Some Wisconsin municipalities became very cautious, and began redacting all personal information obtained through the state Department of Motor Vehicles (“DMV”) database.[5].
Media organizations, including the Wisconsin Newspaper Association and the Wisconsin Broadcasters Association, objected to the blanket redaction policies adopted by some municipalities and law enforcement agencies. Arguing that such actions restricted the public’s right of access to law enforcement records under Wisconsin’s public records law, the New Richmond News filed an action in St. Croix County Circuit Court against the City of New Richmond seeking disclosure of redacted personal information provided in response to the newspaper’s public records request.
In July 2014 the St. Croix County Circuit Court found that the DPPA did not require the City of New Richmond to redact the records under the DPPA and, therefore, that the City had violated Wisconsin’s public records law when it withheld from the New Richmond News personal information included in its police reports.[6] As justification for its decision, the Court cited Wis. Stat. § 19.31, which requires the disclosure of records relating to the affairs of government, including the official actions of police officers in responding to accidents or other incidents. The City of New Richmond has signaled its intent to appeal the decision.
Local Government Tip #3: “Form for Release of DPPA-Related Information” May Provide Temporary Solution
Last week stakeholders, including the League of Wisconsin Municipalities and the Wisconsin Newspaper Association, brokered a temporary solution to the redaction debate in anticipation of an appeals court decision in Senne. The form allows a requester seeking disclosure of personal information under the public records law to certify that their request is allowed under the exemptions included in the DPPA. This certification is intended to reassure records custodians that the information will not be used in violation of the DPPA and balances the public’s right to information with a local government’s responsibility to protect personal information. A copy of the form can be found here.
Local Government Tip #4: To Ensure Compliance with the DPPA and Wisconsin’s Public Records Law, Contact your Stafford Rosenbaum Government Law Attorney
Overly broad or overly lax policies pertaining to the release of personal information may violate the DPPA, the public records law, or both. Determining whether personal information can be released in response to a public records request can be intensely fact-specific and may vary depending on the type and purpose of the request. Although the form described above provides useful guidance on the release of unredacted personal information in lieu of settled law, municipalities must still consider whether the release of such information is precluded by state statute or the DPPA.
To ensure compliance with state and federal law or for more information on the cases cited in this article, contact your Stafford Rosenbaum attorney.
[1] 18 U.S.C. § 2721(b)(4).
[2] Senne v. Vill. of Palatine, 695 F.3d 597 (7th Cir. 2012).
[3] Id.
[4] Maracich v. Spears, 570 U.S. ___, 133 S.Ct. 2191, 186 L.Ed.2d 275 (2013).
[5] This response contrasted with the reactions of municipalities in other states in the 7th Circuit where the case went largely unnoticed.
[6] New Richmond News v. City of New Richmond, Case No. 13 CV 163.