The Drivers Privacy Protection Act - Why A 1989 Hollywood Murder Affects How Municipalities And Corporations Handle Your Data Today

In 1989, an obsessed fan fatally shot actress Rebecca Schaeffer in the doorway of her West Hollywood home. He had obtained her address from the California Department of Motor Vehicles. The murder prompted Congress to pass the Drivers Privacy Protection Act (DPPA).

DPPA prohibits state DMVs from releasing drivers' personal information without the express authorization of the driver. It applies to DMVs and individuals authorized to receive personal information and imposes record-keeping requirements. The penalty for noncompliance is a civil penalty of up to $5,000 a day for each day of substantial noncompliance. This is in addition to criminal fines and potential liability in private actions by the drivers, including liquidated damages of at least $2,500 for each violation. The Supreme Court held DPPA constitutional in Reno v. Condon.

DPPA carves out exceptions for permissible uses. These include:

Government agencies carrying out their functions Insurance companies underwriting policies Statistical research Employers who need to verify their employees' commercial driver's license information In court and litigation proceedings. The litigation exception had been read expansively until the 2013 Supreme Court decision in Maracich v. Spears. Maracich held that an attorney's solicitation of prospective clients constituted an impermissible purpose for disclosure under the DPPA.

The Maracich decision has underscored the potential risk for businesses and municipalities relying on such data. For instance, companies selling extended car warranties, who may identify prospective clients based on data partially derived from DMV records may breach DPPA. Likewise, many attorneys have long relied on DMV records to identify prospective clients involved in recent auto accidents or who have recently received speeding tickets, and Maracich would seem to be the death knell for those kinds of solicitations.

In another example, drivers sued a town, contending that its placement of parking tickets containing drivers' information under windshield wipers constituted an impermissible disclosure of information under DPPA (Senne v. Village of Palatine). Two unions were accused of violating DPPA by obtaining worker's addresses by tracing the registrations of vehicles parked outside the employer's facility during an organizing drive in Pichler v. UNITE. A class action lawsuit alleged that certain parties violated DPPA when they purchased DMV records in bulk (Taylor v...