Office of the Attorney General — State of Texas John Cornyn The Honorable Tony Goolsby Chair, Committee on House Administration Texas House of Representatives P.O. Box 2910 Austin, Texas 78768-2910
Re: Whether certain uses of driver's license information violate the Federal Driver's Privacy Protection Act of 1994, 18 U.S.C. § 2721-2725 (2000) (RQ-0464-JC)
Dear Representative Goolsby:
The Federal Driver's Privacy Protection Act of 1994 (the "DPPA") limits the release of personal information collected by the Texas Department of Public Safety (the "DPS") in connection with motor vehicle records. See 18 U.S.C. § 2721-2725 (2000) (ch. 123); see also Tex. Transp. Code Ann. §§ 730.001-.016 (Vernon 1999 Supp. 2002) (ch. 730 implementing 18 U.S.C. ch. 123). In addition, state law limits the kind of information that may be included in the magnetic strip on a driver's license and requires the DPS to "take necessary steps to ensure that the information is used only for law enforcement or governmental purposes." Tex. Transp. Code Ann. § 521.126(b) (Vernon Supp. 2002). However, section 109.61 of the Alcoholic Beverage Code permits use of information on the magnetic strip "for the purpose of complying with this code or a rule of the" Texas Alcoholic Beverage Commission (the "TABC").See Tex. Alco. Bev. Code Ann. § 109.61(a) (Vernon Supp. 2002). In Attorney General Opinion JC-0423, we concluded that Alcoholic Beverage Code, section 109.61 does not conflict with the DPPA. See Tex. Att'y Gen. Op. No. JC-0423 (2001). You now ask a number of questions as a follow-up to that opinion.1
You ask us, in essence, to revisit Attorney General Opinion JC-0423 and to apply the DPPA to a specific use of driver's license information by companies that generate membership information for private clubs that serve alcoholic beverages in this state under a special permit from the TABC. Specifically, you ask the following questions:
(1) Is the personal data of Texas residents of legal age that is collected by the Texas Department of Public Safety subject to any protection under the federal Driver's Privacy Protection Act, and if so, what are the restrictions placed on the collection, retention and use of that data?
(2) Does the State of Texas, by allowing capture and use of the personal data of Texas residents of legal age, by either reading the magnetic stripe on a Texas driver's license or by direct access of a purchased copy of the database of issued licenses from the Department of Public Safety, become liable under Section 2723(b) of the Driver's Privacy Protection Act?
(3) If an individual or legal entity doing business in the State of Texas uses the magnetic stripe on the Texas driver's license of a person of legal age to capture the driver license number of that person and then uses that number to access the personal data of that person from a purchased copy of the DPS database and then uses that data for the preparation of records required of private clubs operating under a permit issued by the Texas Alcoholic Beverage Commission, is that individual or legal entity in violation of the criminal sanctions of Section 2723(a) of the DPPA and subject to the civil action authorized by Section 2724, even though the TABC has an established rule or practice allowing the retention and use of that personal data?
Request Letter, supra note 1, at 1.
We first address your question about the application of the DPPA to information in the possession of the DPS. We note that chapter 730 of the Transportation Code, which was enacted to implement the federal law, contains similar provisions. See Tex. Transp. Code Ann. §§730.001-.016 (Vernon 1999 Supp. 2002) (ch. 730 implementing 18 U.S.C. ch. 123). As you ask about the DPPA, rather than Texas law, we focus on the federal provisions.
Personal information obtained by the DPS in connection with issuance of a Texas driver's license is protected under the federal statute. State law charges the DPS with issuing Texas driver's licenses and with collecting certain information about license applicants. See, e.g., id. §§ 521.141-.147 (chapter 521, subchapter G, driver's license application requirements). The DPPA protects personal information obtained by a state department of motor vehicles in connection with a motor vehicle record.See 18 U.S.C. § 2721(a) (2000). The term "motor vehicle record" as used in the federal law "means any record that pertains to a motor vehicle operator's permit, motor vehicle title, motor vehicle registration, or identification card issued by a department of motor vehicles." Id. § 2725(1). Thus, the DPPA applies to Texas driver's license information in the possession of the DPS.
Your first question also asks about the restrictions placed on the collection, retention, and use of personal information by the DPPA. We answer this question with a brief summary of the DPPA's complex provisions.
As a general matter, the federal statute provides in subsection (a) of18 U.S.C. § 2721 that a state department of motor vehicles, "and any officer, employee, or contractor thereof," shall not knowingly disclose or otherwise make available to any person or entity:
(1) personal information . . . about any individual obtained by the department in connection with a motor vehicle record, except as provided in subsection (b) of this section; or
(2) highly restricted personal information . . . about any individual obtained by the department in connection with a motor vehicle record, without the express consent of the person to whom such information applies, except uses permitted in subsections (b)(1), (b)(4), (b)(6), and (b)(9) . . . .
Id. § 2721(a). "Personal information" is defined as "information that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information, but does not include information on vehicular accidents, driving violations, and driver's status." Id. § 2725(3). "Highly restricted personal information" refers to a narrower set of information, namely "an individual's photograph or image, social security number, medical or disability information." Id. § 2725(4).
Subsection (b) of 18 U.S.C. § 2721 establishes a broad array of permissible uses for which a state department of motor vehicles must or may disclose personal information. First, a state department of motor vehicles must disclose personal information for certain limited purposes:
Personal information referred to in subsection (a) shall be disclosed for use in connection with matters of motor vehicle or driver safety and theft, motor vehicle emissions, motor vehicle product alterations, recalls, or advisories, performance monitoring of motor vehicles and dealers by motor vehicle manufacturers, and removal of non-owner records from the original owner records of motor vehicle manufacturers to carry out the purposes of titles I and IV of the Anti Car Theft Act of 1992, the Automobile Information Disclosure Act (15 U.S.C. § 1231 et seq.), the Clean Air Act (42 U.S.C. § 7401 et seq.), and chapters 301, 305, and 321-331 of title 49 . . . .
Id. § 2721(b) (emphasis added).
Second, subsection (b) permits, but does not require, a state department of motor vehicles to disclose personal information for a number of purposes. See id. ("information referred to in subsection (a) . . ., subject to subsection (a)(2), may be disclosed") (emphasis added). These purposes are as follows:
(1) For use by any government agency, including any court or law enforcement agency, in carrying out its functions, or any private person or entity acting on behalf of a Federal, State, or local agency in carrying out its functions.
(2) For use in connection with matters of motor vehicle or driver safety and theft; motor vehicle emissions; motor vehicle product alterations, recalls, or advisories; performance monitoring of motor vehicles, motor vehicle parts and dealers; motor vehicle market research activities, including survey research; and removal of non-owner records from the original owner records of motor vehicle manufacturers.
(3) For use in the normal course of business by a legitimate business or its agents, employees, or contractors, but only —
(A) to verify the accuracy of personal information submitted by the individual to the business or its agents, employees, or contractors; and
(B) if such information as so submitted is not correct or is no longer correct, to obtain the correct information, but only for the purposes of preventing fraud by, pursuing legal remedies against, or recovering on a debt or security interest against, the individual.
(4) For use in connection with any civil, criminal, administrative, or arbitral proceeding in any Federal, State, or local court or agency or before any self-regulatory body, including the service of process, investigation in anticipation of litigation, and the execution or enforcement of judgments and orders, or pursuant to an order of a Federal, State, or local court.
(5) For use in research activities, and for use in producing statistical reports, so long as the personal information is not published, redisclosed, or used to contact individuals.
(6) For use by any insurer or insurance support organization, or by a self-insured entity, or its agents, employees, or contractors, in connection with claims investigation activities, antifraud activities, rating or underwriting.
(7) For use in providing notice to the owners of towed or impounded vehicles.
(8) For use by any licensed private investigative agency or licensed security service for any purpose permitted under this subsection.
(9) For use by an employer or its agent or insurer to obtain or verify information relating to a holder of a commercial driver's license that is required under chapter 313 of title 49.
(10) For use in connection with the operation of private toll transportation facilities.
(11) For any other use in response to requests for individual motor vehicle records if the State has obtained the express consent of the person to whom such personal information pertains.
(12) For bulk distribution for surveys, marketing or solicitations if the State has obtained the express consent of the person to whom such personal information pertains.
(13) For use by any requester, if the requester demonstrates it has obtained the written consent of the individual to whom the information pertains.
(14) For any other use specifically authorized under the law of the State that holds the record, if such use is related to the operation of a motor vehicle or public safety.
Id. § 2721(b)(1)-(14).
Under section 2721, an individual's consent to release of information is required in some instances. Personal information may not be released except with the individual's express consent under subsections (b)(11), regarding requests for individual motor vehicle records, and (b)(12), providing for use for bulk distribution of surveys, marketing, or solicitations. In addition, highly restricted personal information about an individual may not be released without the person's express consent, except under subsection (b)(1), which provides for use by a governmental agency in carrying out a governmental function; subsection (b)(4), which provides for use in connection with litigation; subsection (b)(6), which provides for use by an insurer in connection with claims investigation, antifraud activities, rating or underwriting; and subsection (b)(9), which provides for use by an employer to verify information relating to a commercial driver's license. See id. § 2721(a)(2). The DPPA defines "express consent" as "consent in writing, including consent conveyed electronically that bears an electronic signature." Id. § 2725(5). Finally, personal information may be used by a requester "if the requester demonstrates it has obtained the written consent of the individual to whom the information pertains." Id. § 2721(b)(13).
In cases of requests for personal information that do not fall within one of the exceptions in subsection (b), a state motor vehicle department may establish and carry out procedures under which the department or its agents, upon receiving a request, may mail a copy of the request to the individual about whom the information was requested "informing such individual of the request, together with a statement to the effect that the information will not be released unless the individual waives such individual's right to privacy under this section." Id. § 2721(d).
The DPPA also limits resale and redisclosure of information released under subsection (b). The purpose for which information is resold or redisclosed may be limited, depending upon the purpose for which the information was released by the state department of motor vehicles:
An authorized recipient of personal information (except a recipient under subsection (b)(11) or (12)) may resell or redisclose the information only for a use permitted under subsection (b) (but not for uses under subsection (b)(11) or (12)). An authorized recipient under subsection (b)(11) may resell or redisclose personal information for any purpose. An authorized recipient under subsection (b)(12) may resell or redisclose personal information pursuant to subsection (b)(12). Any authorized recipient (except a recipient under subsection (b)(11)) that resells or rediscloses personal information covered by this chapter must keep for a period of 5 years records identifying each person or entity that receives information and the permitted purpose for which the information will be used and must make such records available to the motor vehicle department upon request.
Id. § 2721(c).
While section 2721 governs the conduct of state departments of motor vehicles, their officers, employees, and contractors, section 2722 governs the conduct of others, providing that "[i]t shall be unlawful forany person knowingly to obtain or disclose personal information, from a motor vehicle record, for any use not permitted under section 2721(b) of this title." Id. § 2722(a) (emphasis added). The term "person" "means an individual, organization or entity, but does not include a State oragency thereof." Id. § 2725(2) (emphasis added). In addition, section 2722 provides that "[i]t shall be unlawful for any person to make false representation to obtain any personal information from an individual's motor vehicle record." Id. § 2722(b).
Under the DPPA's enforcement provision, a state department of motor vehicles that has a policy or practice of substantial noncompliance with the DPPA "shall be subject to a civil penalty imposed by the [United States] Attorney General of not more than $5,000 a day for each day of substantial noncompliance." Id. § 2723(b). A person who knowingly violates the DPPA is subject to a fine. See id. § 2723(a). Again, the term "person," as defined in the DPPA, "does not include a State or agency thereof." Id. § 2725(2). The DPPA also provides for a private cause of action against "[a] person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted" under the statute by an individual to whom information pertains. See id. § 2724(a). The court may award actual damages, punitive damages (upon proof of willful or reckless disregard of the law), attorneys' fees and costs, and preliminary and equitable relief.See id. § 2724(b).
Your second question asks whether "the State of Texas, by allowing capture and use of the personal data of Texas residents of legal age, by either reading the magnetic stripe on a Texas driver's license or by direct access of a purchased copy of the database of issued licenses from the Department of Public Safety, become[s] liable under Section 2723(b) of the Driver's Privacy Protection Act?" Request Letter, supra note 1, at 1. As noted above, section 2723(b) of the DPPA provides that a state department of motor vehicles that has a policy or practice of substantial noncompliance with the Act "shall be subject to a civil penalty imposed by the [United States] Attorney General of not more than $5,000 a day for each day of substantial noncompliance." Id. § 2723(b).
As this office indicated in Attorney General Opinion JC-0423, the DPPA governs the release of information in the possession of a state department of motor vehicles by the state agency (and its subsequent use and redisclosure); it does not apply to situations in which an individual presents his or her driver's license to another person for purposes such as to verify the person's age or identity. See Tex. Att'y Gen. Op. No.JC-0423 (2001) at 4. The DPPA does govern the conduct of the DPS, however, when it sells and otherwise discloses databases containing personal information, and the DPS could be subject to a civil penalty under section 2723(b) if it were found to have a policy or practice of substantial noncompliance with the Act. Of course, any release of personal information by the DPS as authorized by section 2721(b) would comply with the DPPA.
Finally, you ask about certain uses of driver's license information by businesses that sell alcohol in this state under private club permits issued by the TABC, which requires permittees to obtain and retain certain information about its club members, such as their names and addresses. See Tex. Alco. Bev. Code Ann. §§ 32.01-.24 (Vernon 1995 Supp. 2002) (providing for private club registration permits); 16 Tex. Admin. Code §§ 41.49 (2002) (Private Clubs-Temporary Memberships), .52 (Private Clubs-General); Request Letter, supra note 1, at 1.
As we understand your question, a private club obtains the driver's license of a new member by swiping the magnetic strip of the new member's driver's license through a computer unit. A membership application is printed from the encoded data. The computer unit retains only the driver's license number. See Attachment to Request Letter, supra note 1, at 3 ("Analysis of Attorney General Opinion JC-0423"). The club has a contract with a private company that has purchased databases from the DPS. The company uses a club member's driver's license number "to access the personal data of that person from a purchased copy of the DPS database and then uses that data for the preparation of records required of private clubs operating under a permit issued by the Texas Alcoholic Beverage Commission." Request Letter, supra note 1, at 1.
The scenario you describe involves two kinds of access to driver's license information: (i) access to the magnetic strip on a driver's license by a private club when a potential club member presents his or her license to the club to become a member and (ii) the release of information by the DPS to a company that uses a database of driver's license information to generate and maintain club membership lists for private clubs. The first kind of access implicates state law governing the use of magnetic strips, while the second kind of access implicates the DPPA. You ask, in essence, whether this scenario as a whole complies with federal law. Before reaching federal law, however, we first consider whether the scenario you describe is authorized by state law.
As noted above, state law strictly limits access to and use of information encoded in the magnetic strip on a Texas driver's license. The Transportation Code limits the kind of information that may be included in the magnetic strip on a driver's license and requires the DPS to "take necessary steps to ensure that the information is used only for law enforcement or governmental purposes." Tex. Transp. Code Ann. §521.126(a) (Vernon Supp. 2002) (The DPS "may not include any information on a driver's license, commercial driver's license, or identification certificate in an electronically readable form other than the information printed on the license and a physical description of the licensee."), (b) (The DPS "shall take necessary steps to ensure that the information is used only for law enforcement or governmental purposes.").
Section 109.61 of the Alcoholic Beverage Code provides an exception to this general limitation, permitting access to information on the magnetic strip "for the purpose of complying with this code or a rule of the [TABC], including for the purpose of preventing the person from committing an offense under this code." Tex. Alco. Bev. Code Ann. §109.61(a) (Vernon Supp. 2002) ("A person may access electronically readable information on a driver's license, commercial driver's license, or identification certificate for the purpose of complying with this code or a rule of the commission, including for the purpose of preventing the person from committing an offense under this code."). As noted in Attorney General Opinion JC-0423, this provision authorizes the use of magnetic strip information to prevent underage drinking or other violations of the Alcoholic Beverage Code. See Tex. Att'y Gen. Op. No. JC-0423 (2001) at 2.
Section 109.61 also limits the retention of information obtained from a magnetic strip: "A person may not retain information accessed under this section unless the commission by rule requires the information to be retained. The person may not retain the information longer than the commission requires." Tex. Alco. Bev. Code Ann. § 109.61(b) (Vernon Supp. 2002). In addition, "[i]nformation accessed under this section may not be marketed in any manner." Id. § 109.61(c).
Consistent with this statutory scheme governing magnetic strips, the DPS has promulgated a rule providing that the information contained on the magnetic strip of a driver's license "includes only the information on the face of the license and the physical description of the licensee" and limiting access to magnetic strip information as follows:
Except for purposes of complying with the Texas Alcoholic Beverage Code or a rule adopted by the Texas Alcoholic Beverage Commission, which includes but is not limited to preventing the purchase of alcoholic beverages by minors and complying with TABC record keeping rules regarding private club membership, only law enforcement and governmental agency personnel acting in their official capacity can utilize the information provided in this format.
37 Tex. Admin. Code § 15.47(b) (2002).
The practice described in your query involves the scanning and retention of club members' driver's license numbers. We have not found any Alcoholic Beverage Code provision or TABC rule that requires a private club to obtain or retain the driver's license number of a club member. By rule, the TABC has required private clubs to obtain and retain club members' full names, initial membership numbers, current complete addresses, and dates of admission to the club and removal from the club.See 16 Tex. Admin. Code § 41.52(c)(1)(D) (2002). Private clubs must also maintain information showing information about temporary membership cards issued, namely "the date issued, the name of the person to whom the card was issued, and the serial number of the temporary membership card."Id. § 41.49(a)(3). Neither rule requires a club to obtain or retain members' drivers license numbers.
We conclude that state law prohibits private clubs from using the magnetic strips on driver's licenses to obtain access to driver's license numbers for purposes of creating and maintaining membership lists and from retaining this information. Section 109.61 of the Alcoholic Beverage Code provides an exception to the general prohibition against use of driver's license magnetic strips in the Transportation Code, see Tex. Transp. Code Ann. § 521.126 (Vernon Supp. 2002), permitting access to information on the magnetic strip for the purpose of complying with the Alcoholic Beverage Code or a rule of the TABC, see Tex. Alco. Bev. Code Ann. § 109.61(a) (Vernon Supp. 2002). Neither the Alcoholic Beverage Code nor the TABC's rules require a private club to obtain members' driver's license numbers for the purpose of creating and maintaining membership lists. This information is not necessary to comply with the TABC's record-keeping rules. See37 Tex. Admin. Code § 15.47 (2002) (permitting access to magnetic strip for purpose of "complying with TABC record keeping rules regarding private club membership"). Furthermore, although driver's license numbers may provide a convenient tool for compiling membership lists, section 109.61(b) prohibits the retention of driver's license numbers because no TABC rule requires the retention of that information. See Tex. Alco. Bev. Code Ann. § 109.61(b) (Vernon Supp. 2002) ("A person may not retain information accessed under this section unless the commission by rule requires the information to be retained.").
Your query also raises the issue whether the federal DPPA permits the disclosure by the DPS of a database containing personal information to a private company for the purpose of creating and maintaining private club membership lists for private clubs. That question raises difficult issues of first impression such as whether the use of personal information to create private membership lists is a use "in the normal course of business . . . to verify the accuracy of personal information submitted by the individual" permitted by 18 U.S.C. § 2721(b)(3), a "use in research activities, [or] in producing statistical reports" permitted by18 U.S.C. § 2721(b)(5), or a use "specifically authorized under [state law] related to the operation of a motor vehicle or public safety," permitted by 18 U.S.C. § 2721(b)(14). As we conclude that the practice you describe is not permitted under state law, we do not reach these complex and difficult questions of federal law.
Our conclusion here with respect to use of the magnetic strip to obtain driver's license numbers for the purpose of creating and maintaining private club membership lists does not affect our conclusion in Attorney General Opinion JC-0423 that section 109.61(a) of the Alcoholic Beverage Code authorizes the use of magnetic strip information to prevent underage drinking or other violations of the Alcoholic Beverage Code and that this use of the magnetic strip does not implicate the DPPA. See Tex. Att'y Gen. Op. No. JC-0423 (2001) at 2, 4.
SUMMARY The Federal Driver's Privacy Protection Act of 1994, 18 U.S.C. § 2721-2725 (2000) (the "DPPA"), applies to personal information collected by the Texas Department of Public Safety in connection with driver's licenses. The Department of Public Safety must comply with this federal law in releasing personal information subject to its protections.
State law does not permit a private club licensed to sell alcohol to its members by the Texas Alcoholic Beverage Commission to use the magnetic strip on driver's licenses to obtain members' driver's license numbers for the purpose of creating and maintaining membership lists nor does it permit clubs to retain driver's license numbers obtained from a magnetic strip for this purpose. See Tex. Transp. Code Ann. § 521.126 (Vernon Supp. 2002); Tex. Alco. Bev. Code Ann. § 109.61 (Vernon Supp. 2002); 16 Tex. Admin. Code §§ 41.49, .52 (2002).
The conclusion of Attorney General Opinion JC-0423 that section 109.61(a) of the Alcoholic Beverage Code authorizes the use of magnetic strip information to prevent underage drinking or other violations of the Alcoholic Beverage Code and that this use of the magnetic strip does not implicate the DPPA is affirmed. See Tex. Att'y Gen. Op. No. JC-0423 (2001) at 2, 4.
Yours very truly,
JOHN CORNYN Attorney General of Texas
HOWARD G. BALDWIN, JR. First Assistant Attorney General
NANCY FULLER Deputy Attorney General — General Counsel
SUSAN DENMON GUSKY Chair, Opinion Committee
Mary R. Crouter Assistant Attorney General, Opinion Committee
1 See Letter from Honorable Tony Goolsby, Chair, Committee on House Administration, to Honorable John Cornyn, Texas Attorney General (Nov. 6, 2001) (on file with Opinion Committee) [hereinafter Request Letter].