The Indiana State Police has requested of the Indiana Attorney General an opinion concerning the risk of public disclosure of "personal information," as defined by federal laws created to shield motorists' private information when they find themselves exposed in the pages of crash reports. Balancing the interests of law enforcement in preserving accurate records of vehicle crashes against the perceived need, protected by federal laws designed to safeguard privacy for the travelling public, is no easy task. To do the legal analysis correctly, one must navigate a serpentine course, zigzagging through a succession of alternating state and federal provisions, arriving at last at the proper formula for balancing these important interests.

As specifically stated in your letter requesting the opinion of the Attorney General:

Can crash data that include personally identifiable information be disclosed through an Access to Public Records Act (APRA) request where to do so may result in a violation of the federal Driver's Privacy Protection Act, 18 U.S.C. §2721 et seq.? If not, would non-disclosure violate the APRA?

Because the federal Driver's Privacy Protection Act ("DPPA") declares "personal information" from a motor vehicle record to be non-disclosable, such information remains confidential under APRA unless a DPPA exception applies. This conclusion applies whether the information at issue derives from a crash report extracted from a law enforcement database or from a driver's license.

Law enforcement officers are statutorily required to investigate and create an accident report for any motor vehicle accident that results in injury or death of a person or property damage of at least one thousand dollars ($1,000.00). Ind. Code §§ 9-26-2-1, 9-26-2-2. That report "must contain" the name and address of each operator and witness, along with other information. I.C. § 9-26-2-2. Accident reports are statutorily deemed "not a confidential record" and "shall be" disclosable under Indiana Code § 5-14-3 et seq. ("APRA"). Thus, accident reports and the relevant electronic data are public records, whether held by Indiana State Police (ISP) or a vendor contracted to compile and store such information. See Carfax, Inc. v. Indiana State Police, 17-FC-202 (Advisory Opinion of the Indiana Public Access Counselor).¹

Excepted from disclosure under APRA, however, are public records "required to be kept confidential by federal law." I.C. § 5-14-3-4(a)(3). The Driver's Privacy Protection Act of 1994 (the "DPPA"), 18 U.S.C. §2721 et seq., "regulates the disclosure of personal information contained in the records of state motor vehicle departments." Reno v. Condon, 528 U.S. 141, 142 (2000). The purpose of the DPPA is to prevent all but a limited range of authorized disclosures of information contained in individual motor vehicle records. Senne v. Village of Palatine, Illinois, 695 F.3d 597, 605 (7th Cir. 2012).

There are two underlying purposes of the statute: 1) it is a public safety measure to prevent stalkers and criminals from utilizing motor vehicle records to acquire information about their victims; and 2) it protects against "the State's common practice of selling personal information to businesses engaged in direct marketing and solicitation." Dahlstrom v. Sun-Times Media, LLC, 777 F.3d 937, 944 (7th Cir. 2015).

To achieve the first purpose, the DPPA makes it unlawful for any person to knowingly "obtain or disclose" personal information from a motor vehicle record for any use not permitted; civil liability is imposed against a person who knowingly obtains, discloses, or uses personal information from a motor vehicle record for any use not permitted. 18 U.S.C. § 2722, §2724 (emphasis added).

To achieve the second purpose, the DPPA generally prohibits any State Bureau of Motor Vehicles (BMV), or officer, employee, or contractor thereof, from "knowingly disclos[ing] or otherwise mak[ing] available to any person or entity personal information about any individual obtained by the department in connection with a motor vehicle record." 18 U.S.C. § 2721(a); see Condon, 528 U.S. at 144.

The DPPA defines "personal information" as any information "that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information," but not including "information on vehicular accidents, driving violations, and driver's status." 18 U.S.C. § 2725(3). A "motor vehicle record" is defined as "any record that pertains to a motor vehicle operator's permit, motor vehicle title, motor vehicle registration, or identification card issued by a department of motor vehicles." 18 U.S.C. § 2725(1).

Accident reports are not motor vehicle records, as the reports are generated by law enforcement and not by a state bureau or department of motor vehicles. Arkansas State Police v. Wren, 491 S.W.3d 124, 128 (Ark. 2016); Pavone v. Law Offices of Anthony Mancini, Ltd., 205 F.Supp.3d 961, 964 (N.D. Ill. 2016). The accident report itself, then, does not fall under the scope of the DPPA.

What does fall under the DPPA is the personal information contained in an accident report that comes "from" a motor vehicle record. Senne, 695 F.3d at 602 (holding that personal information printed on a parking ticket that was obtained in connection with a motor vehicle record falls under the scope of the DPPA); see also Pavone v. Meyerkord & Meyerkord, LLC, 118 F.Supp.3d 1046, 1006 (N.D. Ill 2015) (stating that U.S. Seventh Circuit Court of Appeals' precedent supports the conclusion that the DPPA protects personal information listed in accident reports). Also see Wren, 491 S.W.3d at 133 (Baker, J., dissenting) (stating that the personal information, not the document, is the focus under the DPPA).

If the original source of the other government agency's information is the state department of motor vehicles, the DPPA protects the information throughout its travels.

Whitaker v. Appriss, Inc., 266 F.Supp.3d 1103, 1107 (N.D. Ind. 2017). Thus, if the source of the personal information on the accident report is from the state BMV, then the information falls under the scope of the DPPA.² Id. at 1108. The personal information is then disclosable only if one (or more) of the fourteen enumerated exceptions to non-disclosure under the DPPA applies; these exceptions relate generally to the operation of motor vehicles, insurance, government or security entities, legal proceedings, research, and with a person's consent. 18 U.S.C. § 2721(b)(1)-(14). See New Richmond News v. City of New Richmond, 881 N.W.2d 339, 352 (Wisc. Ct. App. 2016) (finding the "state law" exception under 18 U.S.C. § 2721(b)(14) applicable to the disclosure of accident reports). These fourteen exceptions are limited circumstances in which Congress deemed the public safety risk to be minimal. Dahlstrom, 777 F.3d at 950.

If a DPPA exception does not apply, the question then is whether a driver's license is a motor vehicle record such that information obtained from a driver's license and recorded on an accident report by a responding officer falls under the scope of the DPPA.

Information obtained from a driver's license is information obtained from a motor vehicle record. Pavone, 205 F.Supp.3d at 966. The DPPA defines the term "motor vehicle record" to include "any record that pertains to a motor vehicle operator's permit," which means that "any record that pertains to a driver's license is a motor vehicle record." Id. (emphasis original); see also 18 U.S.C. § 2725(1). The Seventh Circuit has defined "pertains to" in the DPPA as "to belong as a part, member, accessory, or product." Lake v. Neal, 585 F.3d 1059, 1060 (7th Cir. 2009). "A driver's license is created by the Department of Motor Vehicles and it is a record of the information on the license," and "the idea that a driver's license is not a 'motor vehicle record' defies common sense." Eggen v. WESTconsin Credit Union, 2016 WL 4382773 at *3 (W.D. Wisc. 2016). Moreover, "the statutory language offers no basis to limit liability to those who obtain driver's license information from the state department of motor vehicles but absolve those who knowingly get it from the driver's license itself." Pavone, 205 F.Supp.3d at 966.

Thus, when a responding officer accesses personal information from a driver's license to complete the accident report, he is accessing a motor vehicle record. Any subsequent release of that report that includes the personal information and which does not fall under a DPPA exception violates the DPPA. Not only does the plain language of the statute support this conclusion, as the statutory definition of "motor vehicle record" expressly includes a driver's license, but a driver's license can only be produced by a state department of motor vehicles: it is an official record of that agency.³ This position fulfills the purpose and intent of the DPPA, which is to prohibit the disclosure–by a State BMV or any person–of personal information from a motor vehicle record (unless one of the fourteen exceptions are met).

The notion that a driver's license is not a motor vehicle record under the DPPA is erroneous.⁴ Under the reasoning in Whitaker, the DPPA only prohibits disclosure directly from a database but not from a person handing an officer a driver's license. 226 F.Supp.3d at 1110. This reasoning has two fatal flaws: 1) it excludes from the definition of motor vehicle record any document that is an actual motor vehicle record (registration, license, title), which is contrary to the statutory definition; and 2) it focuses only on information from a database. The DPPA prohibits any person from obtaining or disclosing information from motor vehicle records, not just specifically the databases maintained by the state BMV. If Congress had intended to only prevent the disclosure of personal information from a state BMV database, then it would have used that specific language and not have broadly defined "motor vehicle record" as the prohibited source.

The intent of the DPPA is straightforward: "to protect the personal privacy and safety of all American licensed drivers." Dahlstrom, 777 F.3d at 944. The illegality of the disclosure is a combination of source (a motor vehicle record) and subject matter (personal information). A driver's license falls within the definition of "motor vehicle record" and thus within the scope of the DPPA. A person who obtains personal information from a driver's license is not lawfully permitted to further use or disclose that information unless for a permissible purpose under the federal statute.

It matters not whether a responding officer obtains personal information for an accident report from the BMV database or a driver's license; both sources constitute motor vehicle records, and the DPPA therefore prohibits disclosure. It would be a violation both of APRA and of the DPPA to disclose personal information from accident reports obtained from these two sources unless the requestor is currently asserting the applicability of a DPPA exception applies.

SUBMITTED, and

ENDORSED FOR PUBLICATION:

Curtis T. Hill, Jr.

Attorney General

Scott C. Newman, Chief Counsel

Kevin C. McDowell, Assistant Chief Counsel

Jodi Kathryn Stein, Deputy Attorney General

DIN: 20180620-IR-010180252AOA

Composed: Apr 28,2024 9:29:33PM EDT

A PDF version of this document.