REQUESTED BY: Senator Carol Hudkins OPINION REQUEST:
You have requested an opinion from this office regarding proposed legislation which would exempt insurance providers from the conditions for disclosure requirements prescribed by Neb. Rev. Stat. § 60-2909. Our response to your inquiry is set forth below.
I. ISSUE TO BE ADDRESSED BY PROPOSED LEGISLATION The proposed legislation was drafted in response to concerns from the insurance industry regarding increased cost and decreased availability of motor vehicle records for underwriting purposes. Historically, insurance providers were able to get relevant personal information from motor vehicle records for underwriting purposes from the Department of Motor Vehicles over the telephone. This information was provided in a timely manner and free of charge. Due to the enactment of the Driver's Privacy Protection Act and its amendments, Nebraska law was recently changed to require strict regulation of the release of such information. Now insurance providers must either submit a written request for such information or pay a fee to access this information on the Internet. This has imposed a hardship upon the insurance industry by increasing the time and cost involved in obtaining such information for their customers. Therefore, the proposed legislation was drafted to allow insurance providers access to personal information from motor vehicle records in a more timely and cost efficient manner.
II. PROPOSED LEGISLATION The proposed legislation would amend the Uniform Motor Vehicle Records Disclosure Act as follows:
60-2909 Conditions for Disclosure. In addition to provisions for payment of applicable fees, the department may, prior to the disclosure of personal information as permitted under section 60-2906 or 60-2907, require the meeting of conditions by the requester for the purposes of obtaining reasonable assurance concerning the identity of the requester and, to the extent required, that the information will only be used as authorized or that the consent of the person who is the subject of the information has been obtained. Except for requests made pursuant to section 60-2907(6), Ssuch conditions shall include, but need not be limited to, the making and filing of a form containing such information and verification as the department may prescribe.
III. THE DRIVER'S PRIVACY PROTECTION ACT The Driver's Privacy Protection Act of 1994 ("DPPA") established a regulatory scheme that restricts a state's ability to disclose personal information about any individual obtained in connection with a motor vehicle record without the individual's consent.1 The DPPA originally provided that a state could obtain an individual's consent on a case-by-case basis, or it could imply consent if the state provided drivers with an opportunity to block disclosure of personal information when they received or renewed their licenses and drivers failed to avail themselves of that opportunity. 18 U.S.C. § 2721 (b)(11), (13), and (d) (1996). However, Congress amended the DPPA in 1999 to eliminate this "opt-out" alternative. Therefore, except for the permissible uses detailed in 18 U.S.C. § 2721(b), states are now required to obtain an individual's affirmative consent prior to disclosing their personal information from motor vehicle records.
The impetus for the DPPA and its subsequent amendments was to protect citizens from the unauthorized disclosure of their personal information, which they must necessarily provide to the Department of Motor Vehicles in order to obtain various driving privileges. Prior to the DPPA, it was common practice for states to disclose personal information from motor vehicle records without an individual's consent or knowledge, often for a profit. Such unauthorized disclosure had contributed to instances of criminal behavior, such as stalking and even murder. Therefore, the DPPA was adopted to combat the dangers of the unauthorized disclosure of an individual's personal information from motor vehicle records.
The United States Supreme Court has found the DPPA to be a proper exercise of Congress' authority to regulate interstate commerce.Reno v. Condon, 528 U.S. 141, 120 S.Ct. 666 (2000). The Court stated that the DPPA "does not require [states] to enact any laws or regulations, and it does not require state officials to assist in the enforcement of federal statutes regulating private individuals." Id. Instead, the DPPA merely requires that states wishing to engage in certain activity regulated by the DPPA take administrative or legislative action to comply with the federal standards regulating such activity. Id. Therefore, it is clear that the State of Nebraska must comply with the DPPA if it wishes to engage in any activities involving the release of personal information from motor vehicle records.
The supremacy clause of the United States Constitution mandates that federal law preempts any state regulation where there is an actual conflict between the two sets of legislation such that both cannot stand. U.S. Const. Art. VI, cl.2. FFederal law supersedes state law to the extent that it would cause major damage to significant federal interests. Kramer v. Kramer, 252 Neb. 526,540, 567 N.W.2d 100, 110 (1997) (citing In re Application ofBurlington Northern RR. Co., 249 Neb. 821, 545 N.W.2d 749 (1996);Dowd v. First Omaha Sec. Corp., 242 Neb. 347, 495 N.W.2d 36 (1993)). When possible, a Nebraska statute will be construed to achieve the statute's purpose and preserve its validity. Callan v.Balka, 248 Neb. 469, 481, 536 N.W.2d 47, 54 (1995). Therefore, in order to be valid, Nebraska statutes regulating the release of personal information from motor vehicle records must be capable of being construed in conformity with the DPPA.
IV. UNIFORM MOTOR VEHICLE RECORDS DISCLOSURE ACT The Nebraska Legislature has codified the Uniform Motor Vehicle Records Disclosure Act at Nebraska Revised Statutes, §§ 60-2901 to60-2912 (1998, Cum. Supp. 2000). This act prohibits the disclosure of personal information from Nebraska's motor vehicle records, subject to permissible exceptions, in conformance with the DPPA.See Neb. Rev. Stat. §§ 60-2905, 60-2907, 60-2909.01. The act provides for "the verification of identity and purpose of a requester" in § 60-2907 and § 60-2909.01 prior to disclosing information allegedly subject to a permissible exception. Furthermore, § 60-2909 states that conditions for disclosure may be required "for the purposes of obtaining reasonable assurance concerning the identity of the requester and, to the extent required, that the information will only be used as authorized or that the consent of the person who is the subject of the information has been obtained."
Pursuant to Neb. Rev. Stat. § 60-2911 the Nebraska Department of Motor Vehicles has adopted rules and regulations to carry out the Uniform Motor Vehicle Records Disclosure Act. These rules and regulations are found in Title 250, Nebraska Administrative Code, Chapter 2, and provide procedures for verifying the identity and purpose of a requestor. These procedures include the use of standardized forms and the payment of fees pursuant to Neb. Rev. Stat. § 60-2908.
V. THE VERIFICATION REQUIREMENT The DPPA does not expressly require verification of the identity and purpose of a requester, but this requirement is necessarily implied by the stated standard for disclosure provided therein. The DPPA prohibits states from "knowingly" disclosing information obtained from motor vehicle records except for certain permissible uses. Whereas the original version of the DPPA allowed for a presumption that all personal information was publicly available unless otherwise requested, the 1999 amendment clarifies that all personal information is presumed to be confidential. Although the DPPA does not address liability for accidental or negligent disclosure, it clearly places the burden on the State to determine whether a request qualifies under an exception prior to disclosure. This burden is met by Nebraska's statutory requirement for verification of the identity and purpose of a requester.
VI. THE PROPOSED LEGISLATION'S COMPLIANCE WITH THE DPPA The proposed legislation would exempt insurance providers from the conditions for disclosure requirements prescribed by Neb. Rev. Stat. § 60-2909. However, the proposed legislation does not purport to provide an alternative method for verification of the identity and purpose of a requester as required by Neb. Rev. Stat. §§ 60-2907 and 60-2909.01. Nor does the proposed legislation address the payment of fees provided for in Neb. Rev. Stat. §60-2908.
On its face, the proposed legislation does not violate the DPPA. When possible, a statute will be construed to achieve the statute's purpose and preserve its validity. Callan,248 Neb. at 481, 536 N.W.2d at 54 (1995). The DPPA merely prohibits states from disclosing an individual's personal information from motor vehicle records. The DPPA does not dictate any particular method for ensuring that information is not disclosed, but instead leaves that to the discretion of the individual states. A reasonable interpretation of the proposed legislation merely precludes the department from requiring insurance providers to complete a universal standardized form. The proposed legislation does not purport to affect Neb. Rev. Stat. §§ 60-2907 and 60-2909.01 or the first sentence of Neb. Rev. Stat. § 60-2909, all which require verification of the identity and purpose of the requester. Therefore, on its face, the proposed legislation does not violate the DPPA by allowing unauthorized disclosure of prohibited information, but instead merely limits the methods in which the department may verify the validity of a requester's purported authority to receive such information.
If the intent of the proposed legislation is to revert back to the historical practice of allowing insurance providers to obtain personal information from motor vehicle records over the telephone without any objective verification, then it would clearly violate the DPPA. This procedure, absent verification of the identity and purpose of the requester, provides no assurance that the disclosure is within an authorized exception. Such disregard for the validity of allegedly authorized disclosure would result in substantial noncompliance with the DPPA.
If enacted, the proposed legislation will require the development of an alternative verification procedure to fulfill its stated purpose of providing the insurance industry a less expensive and timely method of obtaining information from motor vehicle records. The proposed legislation exempts insurance providers from utilizing the standardized form currently prescribed for verification purposes. Therefore, an alternative method for verifying the identity and purpose of a requester must be developed to ensure continued access to motor vehicle records for insurance providers.2 However, many options for streamlining the verification process would likely involve some type of standardized form, which would be prohibited by the proposed legislation.3 Therefore, it may be provident to amend the proposed legislation to address an alternative method for verification and its related implementation requirements.
Sincerely Yours,
DON STENBERG Attorney General
Jodi M. Fenner Assistant Attorney General
1 A state that maintains a "policy or practice of substantial noncompliance" with the DPPA may be subject to a civil penalty by the United States Attorney General of $5,000 per day. 18 U.S.C. § 2723 (b). The DPPA's 1999 amendment complicated the penalty issue, because the amendment was passed as part of an appropriations bill that appeared to condition receipt of federal highway funds upon compliance with the DPPA. However, Congress recently further amended the DPPA, again as a part of an appropriations bill, which clarifies that such federal highway funds will not be withheld due to noncompliance. See Public Law No. 106-346 (October 23, 2000). Therefore, the sole federal penalty for a state's noncompliance with the DPPA is the $5,000 per day civil penalty provided for in18 U.S.C. § 2723(b).
2 Independent pre-verification procedures for insurance providers may be a feasible option which allows for timely telephone or fax requests.
3 Furthermore, creating and implementing a new system for verification may involve an increased cost to the department, but the proposed legislation does not address any such funding source, nor does it exempt insurance providers from the fees provided for in Neb. Rev. Stat. § 60-2908.