Office of the Attorney General — State of Texas John Cornyn The Honorable Tony Goolsby Chair, Committee on House Administration Texas House of Representatives P. O. Box 2910 Austin, Texas 78768-2910
Re: Limitation on disclosure of driver's license information imposed by the Federal Driver's Privacy Protection Act (RQ-0381-JC)
Dear Representative Goolsby:
House Bill 3016, adopted by the 77th Texas Legislature, "permits the use of information accessed by using the magnetic strip on a . . . driver's license by persons other than law enforcement officials when used to prevent the purchase of alcoholic beverages by minors and to comply with Texas Alcoholic Beverage Commission record keeping rules regarding private club memberships." House Comm. on Licensing Administrative Procedures, Bill Analysis, Tex. H.B. 3016, 77th Leg., R.S. (2001). You ask whether this legislation falls afoul of the Federal Driver's Privacy Protection Act, 18 U.S.C. § 2721. In our view, it does not.
House Bill 3016 amends the Alcoholic Beverage Code by adding section 109.61, which provides:
(a) A person may access electronically readable information on a driver's license, commercial driver's license, or identification certificate for the purpose of complying with this code or a rule of the commission, including for the purpose of preventing the person from committing an offense under this code.
(b) A person may not retain information accessed under this section unless the commission by rule requires the information to be retained. The person may not retain the information longer than the commission requires.
(c) Information accessed under this section may not be marketed in any manner.
(d) A person who violates this section commits an offense. An offense under this section is a Class A misdemeanor.
Act of May 27, 2001, 77th Leg., R.S., ch. 1163, 2001 Tex. Sess. Law Serv. 2486 (to be codified at Tex. Alco. Bev. Code Ann. §109.61).
As the bill analysis indicates, House Bill 3016 was drafted in response to an opinion of this office, Attorney General OpinionJC-0337 (2001). That opinion considered whether the Department of Public Safety (the "DPS"), in adopting rules under section521.126 of the Transportation Code to insure that magnetic stripe information "is used only for law enforcement or governmental purposes," Tex. Transp. Code Ann. § 521.126 (Vernon Supp. 2001), could restrict usage of the information provided on the magnetic stripe to law enforcement and government agency personnel acting in their official capacity. See Tex. Att'y Gen. Op. No. JC-0337 (2001). The opinion concluded, based on the language and legislative history of the Transportation Code section, that the proposed DPS rule "correctly interpreted the legislature's intent . . . [and] that magnetic stripe information contained on a driver's license or identification card issued by the Department of Public Safety may be utilized only by law enforcement and other governmental agency personnel acting in their official capacities." Id. at 5.
The opinion specifically rejected the view that "an alcoholic beverage retailer's use of the magnetic stripe information serves a law enforcement purpose because it enables such a retailer to more easily identify, and thus refuse to serve minors, and to determine beyond doubt that a particular driver's license or identification card is fraudulent." Id. at 3. While acknowledging the argument, the opinion took the view "that the DPS has the initial discretion to determine what [law enforcement or governmental] purposes are," and had done so in the proposed rule in question. Id. House Bill 3016, however, permits the use of magnetic stripe information by private parties to prevent under-age drinking or other violations of the Alcoholic Beverage Code.
You express concern about the relation of House Bill 3016 to the Federal Driver's Privacy Protection Act, 18 U.S.C. § 2721, which provides in relevant part:
(a) In General. — A State department of motor vehicles, and any officer, employee, or contractor thereof, shall not knowingly disclose or otherwise make available to any person or entity:
(1) personal information, as defined in 18 U.S.C. § 2725(3), about any individual obtained by the department in connection with a motor vehicle record, except as provided in subsection (b) of this section;
. . . .
(b) Permissible Uses. — Personal information referred to in subsection (a) . . . may be disclosed as follows:
(1) For use by any government agency, including any court or law enforcement agency, in carrying out its functions, or any private person or entity acting on behalf of a Federal, State, or local agency in carrying out its functions.
. . . .
(3) For use in the normal course of business by a legitimate business or its agents, employees, or contractors, but only —
(A) to verify the accuracy of personal information submitted by the individual to the business or its agents, employees, or contractors; and
(B) if such information as so submitted is not correct or is no longer correct, to obtain the correct information, but only for the purposes of preventing fraud by, pursuing legal remedies against, or recovering on a debt or security interest against, the individual.
. . . .
(14) For any other use specifically authorized under the law of the State that holds the record, if such use is related to the operation of a motor vehicle or public safety.
Driver's Privacy Protection Act of 1994, 18 U.S.C. § 2721(a), (b) (1994 Supp. V 1999), amended by Pub.L. No. 106-346.114 Stat. 1356 (2000) (amendment to be codified at 18 U.S.C. § 2721(a)).
The purpose of the Driver's Privacy Protection Act (the "DPPA"), as the Supreme Court noted in Reno v. Condon, 528 U.S. 141, 144 (2000), is to establish "a regulatory scheme that restricts the States' ability to disclose a driver's personal information without the driver's consent." Representative James Moran, who introduced the legislation in the United States House of Representatives, described the problem the statute seeks to correct thus:
In 34 states across the country, there are virtually no restrictions on who has access to the name and address of licensees. In fact, very few Americans realize that by registering their car or obtaining a driver's license through the DMV, they are surrendering their personal and private information to anyone who wants to obtain it.
139 Cong. Rec. E2747-02 (1993) (statement of Rep. James P. Moran). Accordingly, Representative Moran described the DPPA as "safeguard[ing] the privacy of drivers and vehicle owners by prohibiting the release of personal information — including a person's name and address — to anyone without a specific business-related reason for obtaining the information." Id.
As the statutory language, legislative history, and case law recited above all make clear, it is the dissemination of private information by state departments of motor vehicles such as the Texas Department of Public Safety that the DPPA seeks to regulate. But the transactions at issue in House Bill 3016 do not directly involve the DPS. The person accessing information from the magnetic stripe has presumably obtained possession of the license from the licensee, rather than from the DPS. Accordingly, it does not appear to be the case that in this situation the DPS has, in the terms of the DPPA, "knowingly disclose[d] or otherwise [made] available" any information. (We note as an aside that, given that the magnetic stripe information is "the information printed on the license and a physical description of the licensee," Tex. Transp. Code Ann. § 521.126(a) (Vernon Supp. 2001), a transaction permitted by House Bill 3016 would not seem to implicate the DPPA any more than would any other instance in which a driver's license was used as proof of age for a commercial transaction.)
Assuming for the sake of argument, however, that a court were to take the view that allowing the use of magnetic stripe information by persons who sell alcoholic beverages to check for under-age drinkers did constitute the making available of information protected under the DPPA, we believe a case could be made that transactions permitted under House Bill 3016 are permissible under at least two separate exceptions permitted by the federal statute — the exceptions for use in the normal course of business to verify the accuracy of personal information submitted, see 18 U.S.C. § 2721(b)(3) (1994 Supp. V 1999), and for "any other use specifically authorized [by state law] . . . related to . . . public safety." Id. § 2721(b)(14).
While there is little case law interpreting the DPPA, and accordingly little guidance concerning the breadth of the statutory exceptions, we note that subsection (b)(3)'s exception of "use in the normal course of business by a legitimate business . . . to verify the accuracy of personal information submitted by the individual" appears to us precisely to describe the activity popularly known as "carding" by those who sell alcoholic beverages. That is, a person attempting to purchase such a beverage is asked to provide verification for the claim that he or she is twenty-one years of age. What House Bill 3016 provides is a method by which that claim may be verified. When the license is provided, its electronic reading assures that the information on the face of the license has not been tampered with. Such a use as this is exactly the sort excepted by the language of18 U.S.C. § 2721(b)(3).
Further, subsection (b)(14), the DPPA's "catch-all" provision, excepts from its coverage "any other use specifically authorized under the law of the State that holds the record, if such use is related to the operation of a motor vehicle or public safety."18 U.S.C. § 2721(b)(14) (1994). The laws related to the possession of alcohol by minors are to be found in chapter 106 of the Alcoholic Beverage Code. The public policy which that Code articulates, and in light of which it is to be construed, is stated in section 1.03 of the Code:
This code is an exercise of the police power of the state for the protection of the welfare, health, peace, temperance, and safety of the people of the state. It shall be liberally construed to accomplish this purpose.
Tex. Alco. Bev. Code Ann. § 1.03 (Vernon 1995).
In light of the fact that preventing minors from acquiring alcoholic beverages is therefore a matter related to the public safety, and the use of magnetic stripe information is specifically authorized by House Bill 3016 for that purpose, as well as for the other reasons articulated above, we conclude that House Bill 3016 does not fall afoul of the Federal Driver's Privacy Protection Act.
SUMMARY House Bill 3016, which permits the use of magnetic stripe information on drivers' licenses and identification cards issued by the Texas Department of Public Safety for the purpose of compliance with the Alcoholic Beverage Code and rules promulgated by the Alcoholic Beverage Commission, does not violate or conflict with the Federal Driver's Privacy Protection Act,18 U.S.C. § 2721.
Yours very truly,
JOHN CORNYN Attorney General of Texas
Howard G. Baldwin, Jr. First Assistant Attorney General
Nancy Fuller Deputy Attorney General — General Counsel
Susan D. Gusky Chair, Opinion Committee
James E. Tourtelott Assistant Attorney General, Opinion Committee