-* OFFICE OF THE ATTORNEY GENERAL . STATE OF TEXAS
JOHN CORNYN
May 6,2002
The Honorable Tony Goolsby Opinion No. JC-0499
Chair, Committee on House Administration
Texas House of Representatives Re: Whether certain uses of driver’s license
P. 0. Box 2910 information violate the Federal Driver’s
Austin, Texas 78768-2910 Privacy Protection Act of 1994, 18 U.S.C.
$5 2721-2725 (2000) (RQ-0464-JC)
Dear Representative Goolsby:
The Federal Driver’s Privacy Protection Act of 1994 (the “DPPA”) limits the release of
personal information collected by the Texas Department of Public Safety (the “DPS”) in connection
with motor vehicle records. See 18 U.S.C. $9 2721-2725 (2000) (ch. 123); see also TEX. TRANSP.
CODE ANN. $5 730.001-.016 (Vernon 1999 & Supp. 2002) (ch. 730 implementing 18 U.S.C. ch.
123). In addition, state law limits the kind of information that may be included in the magnetic strip
on a driver’s license and requires the DPS to “take necessary steps to ensure that the information is
used only for law enforcement or governmental purposes.” TEX. TRANSP. CODE ANN. fj 521.126(b)
(Vernon Supp. 2002). However, section 109.61 of the Alcoholic Beverage Code permits use of
information on the magnetic strip “for the purpose of complying with this code or a rule of the”
Texas Alcoholic Beverage Commission (the “TABC”). See TEX. ALCO. BEV. CODE ANN. 5 109.61(a)
(Vernon Supp. 2002). In Attorney General Opinion JC-0423, we concluded that Alcoholic Beverage
Code, section 109.61 does not conflict with the DPPA. See Tex. Att’y Gen. Op. No. JC-0423
(2001). You now ask a number of questions as a follow-up to that opinion.’
You ask us, in essence, to revisit Attorney General Opinion JC-0423 and to apply the DPPA
to a specific use of driver’s license information by companies that generate membership information
for private clubs that serve alcoholic beverages in this state under a special permit from the TABC.
Specifically, you ask the following questions:
(1) Is the personal data of Texas residents of legal age that is
collected by the Texas Department of Public Safety subject to any
protection under the federal Driver’s Privacy Protection Act, and if
so, what are the restrictions placed on the collection, retention and use
of that data?
‘See Letter from Honorable Tony Goolsby, Chair, Committee on House Administration, to Honorable John
Comyn, Texas Attorney General (Nov. 6,200l) (on file with Opinion Committee) [hereinafter Request Letter].
The Honorable Tony Goolsby - Page 2 (JC-0499)
(2) Does the State of Texas, by allowing capture and use of the
personal data of Texas residents of legal age, by either reading the
magnetic stripe on a Texas driver’s license or by direct access of a
purchased copy of the database of issued licenses from the
Department of Public Safety, become liable under Section 2723(b) of
the Driver’s Privacy Protection Act?
(3) If an individual or legal entity doing business in the State of
Texas uses the magnetic stripe on the Texas driver’s license of a
person of legal age to capture the driver license number of that person
and then uses that number to access the personal data of that person
from a purchased copy of the DPS database and then uses that data
for the preparation of records required of private clubs operating
under a permit issued by the Texas Alcoholic Beverage Commission,
is that individual or legal entity in violation of the criminal sanctions
of Section 2723(a) of the DPPA and subject to the civil action
authorized by Section 2724, even though the TABC has an
established rule or practice allowing the retention and use of that
personal data?
Request Letter, supra note 1, at 1.
We first address your question about the application of the DPPA to information in the
possession of the DPS. We note that chapter 730 of the Transportation Code, which was enacted
to implement the federal law, contains similar provisions. See TEX. TRANSP. CODE ANN. $8 730.001-
.016 (Vernon 1999 & Supp. 2002) (ch. 730 implementing 18 U.S.C. ch. 123). As you ask about the
DPPA, rather than Texas law, we focus on the federal provisions.
Personal information obtained by the DPS in connection with issuance of a Texas driver’s
license is protected under the federal statute. State law charges the DPS with issuing Texas driver’s
licenses and with collecting certain information about license applicants. See, e.g., id. $5 52 1.141-
.147 (chapter 521, subchapter G, driver’s license application requirements). The DPPA protects
personal information obtained by a state department of motor vehicles in connection with a motor
vehicle record. See 18 U.S.C. 8 2721 (a) (2000). The term “motor vehicle record” as used in the
federal law “means any record that pertains to a motor vehicle operator’s permit, motor vehicle title,
motor vehicle registration, or identification card issued by a department of motor vehicles.” Id.
8 2725( 1). Thus, the DPPA applies to Texas driver’s license information in the possession of the
DPS.
Your first question also asks about the restrictions placed on the collection, retention, and
use of personal information by the DPPA. We answer this question with a brief summary of the
DPPA’s complex provisions.
The Honorable Tony Goolsby - Page 3 (JC-0499)
As a general matter, the federal statute provides in subsection (a) of 18 U.S.C. 5 2721 that
a state department of motor vehicles, “and any officer, employee, or contractor thereof,” shall not
knowingly disclose or otherwise make available to any person or entity:
(1) personal information. . . about any individual obtained by the
department in connection with a motor vehicle record, except as
provided in subsection (b) of this section; or
(2) highly restricted personal information . . . about any
individual obtained by the department in connection with a motor
vehicle record, without the express consent of the person to whom
such information applies, except uses permitted in subsections (b)(l),
(b)(4), @X6)9 and 09(9) - - - -
Id. 8 2721(a). “Personal information” is defined as “information that identifies an individual,
including an individual’s photograph, social security number, driver identification number, name,
address (but not the 5-digit zip code), telephone number, and medical or disability information, but
does not include information on vehicular accidents, driving violations, and driver’s status.” Id.
8 2725(3). “Highly restricted personal information” refers to a narrower set of information, namely
“an individual’s photograph or image, social security number, medical or disability information.”
Id. fj 2725(4).
Subsection (b) of 18 U.S.C. 0 2721 establishes a broad array of permissible uses for which
a state department of motor vehicles must or may disclose personal information. First, a state
department of motor vehicles must disclose personal information for certain limited purposes:
Personal information referred to in subsection (a) shall be disclosed
for use in connection with matters of motor vehicle or driver safety
and theft, motor vehicle emissions, motor vehicle product alterations,
recalls, or advisories, performance monitoring of motor vehicles and
dealers by motor vehicle manufacturers, and removal of non-owner
records from the original owner records of motor vehicle
manufacturers to carry out the purposes of titles I and IV of the Anti
Car Theft Act of 1992, the Automobile Information Disclosure Act
(15 U.S.C. 1231 et seq.), the Clean Air Act (42 U.S.C. 7401 et seq.),
and chapters 301,305, and 321-331 oftitle 49 . . . .
Id. 0 2721(b) (emphasis added).
Second, subsection (b) permits, but does not require, a state department of motor vehicles
to disclose personal information for a number of purposes. See id. (“information referred to in
subsection (a) . . . , subject to subsection (a)(2), may be disclosed”) (emphasis added). These
purposes are as follows:
The Honorable Tony Goolsby - Page 4 (JC-0499)
(1) For use by any government agency, including any court or law
enforcement agency, in carrying out its functions, or any private
person or entity acting on behalf of a Federal, State, or local agency
in carrying out its functions.
(2) For use in connection with matters of motor vehicle or driver
safety and theft; motor vehicle emissions; motor vehicle product
alterations, recalls, or advisories; performance monitoring of motor
vehicles, motor vehicle parts and dealers; motor vehicle market
research activities, including survey research; and removal of
non-owner records from the original owner records of motor vehicle
manufacturers.
(3) For use in the normal course of business by a legitimate
business or its agents, employees, or contractors, but only-
(A) to verify the accuracy of personal information submitted
by the individual to the business or its agents, employees, or
contractors; and
(B) if such information as so submitted is not correct or is no
longer correct, to obtain the correct information, but only for the
purposes of preventing fraud by, pursuing legal remedies against, or
recovering on a debt or security interest against, the individual.
(4) For use in connection with any civil, criminal, administrative,
or arbitral proceeding in any Federal, State, or local court or agency
or before any self-regulatory body, including the service of process,
investigation in anticipation of litigation, and the execution or
enforcement of judgments and orders, or pursuant to an order of a
Federal, State, or local court.
(5) For use in research activities, and for use in producing
statistical reports, so long as the personal information is not
published, redisclosed, or used to contact individuals.
(6) For use by any insurer or insurance support organization, or
by a self-insured entity, or its agents, employees, or contractors, in
connection with claims investigation activities, antifraud activities,
rating or underwriting.
(7) For use in providing notice to the owners of towed or
impounded vehicles.
The Honorable Tony Goolsby - Page 5 (JC-0499)
(8) For use by any licensed private investigative agency or
licensed security service for any purpose permitted under this
subsection.
(9) For use by an employer or its agent or insurer to obtain or
verify information relating to a holder of a commercial driver’s
license that is required under chapter 3 13 of title 49.
(10) For use in connection with the operation of private toll
transportation facilities.
(11) For any other use in response to requests for individual
motor vehicle records if the State has obtained the express consent of
the person to whom such personal information pertains.
(12) For bulk distribution for surveys, marketing or solicitations
if the State has obtained the express consent of the person to whom
such personal information pertains.
(13) For use by any requester, if the requester demonstrates it has
obtained the written consent of the individual to whom the
information pertains.
(14) For any other use specifically authorized under the law of
the State that holds the record, if such use is related to the operation
of a motor vehicle or public safety.
Id. 8 2721(b)(l)-(14).
Under section 2721, an individual’s consent to release of information is required in some
instances. Personal information may not be released except with the individual’s express consent
under subsections (b)( 1 l), regarding requests for individual motor vehicle records, and (b)( 12)
providing for use for bulk distribution of surveys, marketing, or solicitations. In addition, highly
restricted personal information about an individual may not be released without the person’s express
consent, except under subsection (b)(l), which provides for use by a governmental agency in
carrying out a governmental function; subsection (b)(4), which provides for use in connection with
litigation; subsection (b)(6), which provides for use by an insurer in connection with claims
investigation, antifraud activities, rating or underwriting; and subsection (b)(9), which provides for
use by an employer to verify information relating to a commercial driver’s license. See id. 8
2721(a)(2). The DPPA defines “express consent” as “consent in writing, including consent
conveyed electronically that bears an electronic signature.” Id. 6 2725(5). Finally, personal
information may be used by a requester “if the requester demonstrates it has obtained the written
consent of the individual to whom the information pertains.” Id. tj 272 1(b)( 13).
The Honorable Tony Goolsby - Page 6 (JC-0499)
In cases of requests for personal information that do not fall within one of the exceptions in
subsection (b), a state motor vehicle department may establish and carry out procedures under which
the department or its agents, upon receiving a request, may mail a copy of the request to the
individual about whom the information was requested “informing such individual of the request,
together with a statement to the effect that the information will not be released unless the individual
waives such individual’s right to privacy under this section.” Id. 6 2721(d).
The DPPA also limits resale and redisclosure of information released under subsection (b).
The purpose for which information is resold or redisclosed may be limited, depending upon the
purpose for which the information was released by the state department of motor vehicles:
An authorized recipient of personal information (except a
recipient under subsection (b)( 11) or (12)) may resell or redisclose the
information only for a use permitted under subsection (b) (but not for
uses under subsection (b)( 11) or (12)). An authorized recipient under
subsection (b)( 11) may resell or redisclose personal information
for any purpose. An authorized recipient under subsection (b)( 12)
may resell or redisclose personal information pursuant to subsection
(b)( 12). Any authorized recipient (except a recipient under sub-
section (b)( 11)) that resells or rediscloses personal information
covered by this chapter must keep for a period of 5 years records
identifying each person or entity that receives information and the
permitted purpose for which the information will be used and must
make such records available to the motor vehicle department upon
request.
Id. 6 2721(c).
While section 272 1 governs the conduct of state departments of motor vehicles, their officers,
employees, and contractors, section 2722 governs the conduct of others, providing that “[i]t shall be
unlawful for anyperson knowingly to obtain or disclose personal information, from a motor vehicle
record, for any use not permitted under section 2721 (b) of this title.” Id. 8 2722(a) (emphasis
added). The term “person” “means an individual, organization or entity, but does not include a State
or agency thereoJ” Id. 8 2725(2) (emphasis added). In addition, section 2722 provides that “[i]t
shall be unlawful for any person to make false representation to obtain any personal information
from an individual’s motor vehicle record.” Id. 9 2722(b).
Under the DPPA’s enforcement provision, a state department of motor vehicles that has a
policy or practice of substantial noncompliance with the DPPA “shall be subject to a civil penalty
imposed by the [United States] Attorney General of not more than $5,000 a day for each day of
substantial noncompliance.” Id. 9 2723(b). A person who knowingly violates the DPPA is subject
to a fine. See id. 4 2723(a). Again, the term “person,” as defined in the DPPA, “does not include
a State or agency thereof.” Id. 8 2725(2). The DPPA also provides for a private cause of action
The Honorable Tony Goolsby - Page 7 (JC-0499)
against “[a] person who knowingly obtains, discloses or uses personal information, from a motor
vehicle record, for a purpose not permitted” under the statute by an individual to whom information
pertains. See id. 5 2724(a). The court may award actual damages, punitive damages (upon proof
of willful or reckless disregard of the law), attorneys’ fees and costs, and preliminary and equitable
relief. See id. tj 2724(b).
Your second question asks whether “the State of Texas, by allowing capture and use of the
personal data of Texas residents of legal age, by either reading the magnetic stripe on a Texas
driver’s license or by direct access of a purchased copy of the database of issued licenses from the
Department of Public Safety, become[s] liable under Section 2723(b) of the Driver’s Privacy
Protection Act?” Request Letter, supra note 1, at 1. As noted above, section 2723(b) of the DPPA
provides that a state department of motor vehicles that has a policy or practice of substantial
noncompliance with the Act “shall be subject to a civil penalty imposed by the [United States]
Attorney General of not more than $5,000 a day for each day of substantial noncompliance.” Id.
tj 2723(b).
As this office indicated in Attorney General Opinion JC-0423, the DPPA governs the release
of information in the possession of a state department of motor vehicles by the state agency (and its
subsequent use and redisclosure); it does not apply to situations in which an individual presents his
or her driver’s license to another person for purposes such as to verify the person’s age or identity.
See Tex. Att’y Gen. Op. No. JC-0423 (2001) at 4. The DPPA does govern the conduct of the DPS,
however, when it sells and otherwise discloses databases containing personal information, and the
DPS could be subject to a civil penalty under section 2723(b) if it were found to have a policy or
practice of substantial noncompliance with the Act. Of course, any release of personal information
by the DPS as authorized by section 2721(b) would comply with the DPPA.
Finally, you ask about certain uses of driver’s license information by businesses that sell
alcohol in this state under private club permits issued by the TABC, which requires permittees to
obtain and retain certain information about its club members, such as their names and addresses. See
TEX. ALCO. BEV. CODEANN. $0 32.01-.24 (Vernon 1995 & Supp. 2002) (providing for private club
registration permits); 16 TEX. ADMIN. CODE $0 41.49 (2002) (Private Clubs-Temporary
Memberships), .52 (Private Clubs-General); Request Letter, supra note 1, at 1.
As we understand your question, a private club obtains the driver’s license of a new member
by swiping the magnetic strip of the new member’s driver’s license through a computer unit. A
membership application is printed from the encoded data. The computer unit retains only the
driver’s license number. See Attachment to Request Letter, supra note 1, at 3 (“Analysis ofAttorney
General Opinion JC-0423”). The club has a contract with a private company that has purchased
databases from the DPS. The company uses a club member’s driver’s license number “to access the
personal data of that person from a purchased copy of the DPS database and then uses that data for
the preparation of records required of private clubs operating under a permit issued by the Texas
Alcoholic Beverage Commission.” Request Letter, supra note 1, at 1.
The Honorable Tony Goolsby - Page 8 (JC-0499)
The scenario you describe involves two kinds of access to driver’s license information: (i)
access to the magnetic strip on a driver’s license by a private club when a potential club member
presents his or her license to the club to become a member and (ii) the release of information by the
DPS to a company that uses a database of driver’s license information to generate and maintain club
membership lists for private clubs. The first kind of access implicates state law governing the use
of magnetic strips, while the second kind of access implicates the DPPA. You ask, in essence,
whether this scenario as a whole complies with federal law. Before reaching federal law, however,
we first consider whether the scenario you describe is authorized by state law.
As noted above, state law strictly limits access to and use of information encoded in the
magnetic strip on a Texas driver’s license. The Transportation Code limits the kind of information
that may be included in the magnetic strip on a driver’s license and requires the DPS to “take
necessary steps to ensure that the information is used only for law enforcement or governmental
purposes.” TEX.TRANSP.CODEANN. 8 521.126(a) (Vernon Supp. 2002) (The DPS “maynot include
any information on a driver’s license, commercial driver’s license, or identification certificate in an
electronically readable fort-n other than the information printed on the license and a physical
description of the licensee.“), (b) (The DPS “shall take necessary steps to ensure that the information
is used only for law enforcement or governmental purposes.“).
Section 109.61 of the Alcoholic Beverage Code provides an exception to this general
limitation, permitting access to information on the magnetic strip “for the purpose of complying with
this code or a rule of the [TABC], including for the purpose of preventing the person from
committing an offense under this code.” TEX. ALCO. BEV. CODEANN. 9 109.61(a) (Vernon Supp.
2002) (“A person may access electronically readable information on a driver’s license, commercial
driver’s license, or identification certificate for the purpose of complying with this code or a rule of
the commission, including for the purpose of preventing the person from committing an offense
under this code.“). As noted in Attorney General Opinion JC-0423, this provision authorizes the use
of magnetic strip information to prevent underage drinking or other violations of the Alcoholic
Beverage Code. See Tex. Att’y Gen. Op. No. JC-0423 (2001) at 2.
Section 109.61 also limits the retention of information obtained from a magnetic strip: “A
person may not retain information accessed under this section unless the commission by rule requires
the information to be retained. The person may not retain the information longer than the
commission requires.” TEX. ALCO.BEV. CODEANN. 9 109.61 (b) (Vernon Supp. 2002). In addition,
“[iInformation accessed under this section may not be marketed in any manner.” Id. fj 109.6 1(c).
Consistent with this statutory scheme governing magnetic strips, the DPS has promulgated
a rule providing that the information contained on the magnetic strip of a driver’s license “includes
only the information on the face of the license and the physical description of the licensee” and
limiting access to magnetic strip information as follows:
Except for purposes of complying with the Texas Alcoholic
Beverage Code or a rule adopted by the Texas Alcoholic Beverage
The Honorable Tony Goolsby - Page 9 (JC-0499)
Commission, which includes but is not limited to preventing the
purchase of alcoholic beverages by minors and complying with
TABC record keeping rules regarding private club membership, only
law enforcement and governmental agency personnel acting in their
official capacity can utilize the information provided in this format.
37 TEX. ADMIN. CODE 8 15.47(b) (2002).
The practice described in your query involves the scanning and retention of club members’
driver’s license numbers. We have not found any Alcoholic Beverage Code provision or TABC rule
that requires a private club to obtain or retain the driver’s license number of a club member. By rule,
the TABC has required private clubs to obtain and retain club members’ full names, initial
membership numbers, current complete addresses, and dates of admission to the club and removal
from the club. See 16 TEX. ADMIN.CODE9 41.52(c)(l)(D) (2002). P rivate clubs must also maintain
information showing information about temporary membership cards issued, namely “the date
issued, the name of the person to whom the card was issued, and the serial number of the temporary
membership card.” Id. 8 41.49(a)(3). Neither rule requires a club to obtain or retain members’
drivers license numbers.
We conclude that state law prohibits private clubs from using the magnetic strips on driver’s
licenses to obtain access to driver’s license numbers for purposes of creating and maintaining
membership lists and from retaining this information. Section 109.61 of the Alcoholic Beverage
Code provides an exception to the general prohibition against use of driver’s license magnetic strips
in the Transportation Code, see TEX. TRANSP.CODE ANN. 3 521.126 (Vernon Supp. 2002)’
permitting access to information on the magnetic strip for the purpose of complying with the
Alcoholic Beverage Code or a rule of the TABC, see TEX. &CO. BEV. CODEANN. 5 109.61(a)
(Vernon Supp. 2002). Neither the Alcoholic Beverage Code nor the TABC’s rules require a private
club to obtain members’ driver’s license numbers for the purpose of creating and maintaining
membership lists. This information is not necessary to comply with the TABC’s record-keeping
rules. See 37 TEX. ADMIN. CODE fj 15.47 (2002) (p ermitting access to magnetic strip for purpose
of “complying with TABC record keeping rules regarding private club membership”). Furthermore,
although driver’s license numbers may provide a convenient tool for compiling membership lists,
section 109.61 (b) prohibits the retention of driver’s license numbers because no TABC rule requires
the retention of that information. See TEX.ALco. BEV. CODEANN. 5 109.61 (b) (Vernon Supp. 2002)
(“A person may not retain information accessed under this section unless the commission by rule
requires the information to be retained.“).
Your query also raises the issue whether the federal DPPA permits the disclosure by the DPS
of a database containing personal information to a private company for the purpose of creating and
maintaining private club membership lists for private clubs. That question raises difficult issues of
first impression such as whether the use of personal information to create private membership lists
is a use “in the normal course of business . . . to verify the accuracy of personal information
submitted by the individual” permitted by 18 U.S.C. 8 2721 (b)(3) , a “use in research activities, [or]
The Honorable Tony Goolsby - Page 10 (JC-0499)
in producing statistical reports” permitted by 18 U.S.C. 8 2721(b)(5), or a use “specifically
authorized under [state law] related to the operation of a motor vehicle or public safety,” permitted
by 18 U.S.C. 5 2721(b)(14). As we conclude that the practice you describe is not permitted under
state law, we do not reach these complex and difficult questions of federal law.
Our conclusion here with respect to use of the magnetic strip to obtain driver’s license
numbers for the purpose of creating and maintaining private club membership lists does not affect
our conclusion in Attorney General Opinion JC-0423 that section 109.61(a) of the Alcoholic
Beverage Code authorizes the use of magnetic strip information to prevent underage drinking or
other violations of the Alcoholic Beverage Code and that this use of the magnetic strip does not
implicate the DPPA. See Tex. Att’y Gen. Op. No. JC-0423 (2001) at 2,4.
The Honorable Tony Goolsby - Page 11 (JC-0499)
SUMMARY
The Federal Driver’s Privacy Protection Act of 1994, 18
U.S.C. $8 2721-2725 (2000) (the “DPPA”), applies to personal
information collected by the Texas Department of Public Safety in
connection with driver’s licenses. The Department of Public Safety
must comply with this federal law in releasing personal information
subject to its protections.
State law does not permit a private club licensed to sell
alcohol to its members by the Texas Alcoholic Beverage Commission
to use the magnetic strip on driver’s licenses to obtain members’
driver’s license numbers for the purpose of creating and maintaining
membership lists nor does it permit clubs to retain driver’s license
numbers obtained from a magnetic strip for this purpose. See TEX.
TFUNSP.CODEANN. 8 521.126 (Vernon Supp. 2002); TEX. ALCO.
BEV. CODE ANN. 8 109.61 (Vernon Supp. 2002); 16 TEX. ADMIN.
CODE 88 41.49, .52 (2002).
The conclusion of Attorney General Opinion JC-0423 that
section 109.61 (a) of the Alcoholic Beverage Code authorizes the use
of magnetic strip information to prevent underage drinking or other
violations of the Alcoholic Beverage Code and that this use of the
magnetic strip does not implicate the DPPA is affirmed. See Tex.
Att’y Gen. Op. No. JC-0423 (2001) at 2’4.
Attorney General of Texas
HOWARD G. BALDWIN, JR.
First Assistant Attorney General
NANCY FULLER
Deputy Attorney General - General Counsel
SUSAN DENMON GUSKY
Chair, Opinion Committee
Mary R. Crouter
Assistant Attorney General, Opinion Committee