LOCATE.PLUS.COM, INC. d/b/a Worldwide Information, Inc., Appellant,
v.
IOWA DEPARTMENT OF TRANSPORTATION, Appellee.
No. 01-1411.
Supreme Court of Iowa.
September 5, 2002.*611 Brian L. Wirt of Davis, Brown, Koehn, Shors & Roberts, P.C., Des Moines, for appellant.
Thomas J. Miller, Attorney General, David A. Ferree, Special Assistant Attorney General, and Carolyn J. Olson, Assistant Attorney General, for appellee.
CADY, Justice.
The primary issue we confront in this appeal is whether Iowa Code section 321.11 (2001) and 18 U.S.C. § 2721(b) (2001) permit the Iowa Department of Transportation to disclose personal information pertaining to motor vehicle drivers to a private business that reformats the information onto computer disks for sale. The Department denied access to the information, and the district court affirmed the decision in its review. On our review, we affirm.
I. Background Facts and Proceedings.
Locate.Plus.Com, Inc. is a private corporation that does business throughout the United States as Worldwide Information, Inc. It is also licensed as a private investigation agency in Massachusetts, where its principal place of business is located. The Department of Transportation maintains records on all motor vehicles and drivers in Iowa, including the personal information disclosed by drivers in the process of obtaining a driver's license and registering a motor vehicle.
Worldwide sells motor vehicle and driver's license information to law enforcement agencies and other entities and persons who utilize the information in the course of their work. Worldwide obtains the data and information from state motor vehicle records and formats it onto computer disks in such a manner that the information pertaining to a particular vehicle or driver can be quickly and conveniently searched and retrieved by such means as name, address, date of birth, license plate number, partial license identification number, or color, model, or year of vehicle. The disks are used by many state and local law enforcement agencies around Iowa and the rest of the country. They are recognized to be a valuable law enforcement tool.
Worldwide purportedly limits the sale of the disks to users who are authorized by state and federal law to have access to the information. Furthermore, the disks are encoded with various levels of security to prevent use by unauthorized users. Worldwide also requires each customer to designate Worldwide as its agent and maintains records of each purchaser.
Prior to 1999, Worldwide requested and received limited motor vehicle information from the Iowa Department of Transportation, which it formatted onto disks. In 1999, Worldwide requested additional personal driver's records to improve the utility of the disks for the users. The Department refused to provide the personal driver and vehicle records to Worldwide. The Department maintained Worldwide was not entitled to records containing personal driver information under state and federal law.
Worldwide sought judicial review of the decision by the Department to deny access to the personal information. The district court affirmed the decision of the Department, and Worldwide appealed.
*612 On appeal Worldwide argues it is entitled to the personal information for two reasons. It claims it is entitled to disclosure of the information as an agent of the authorized users of the information and in its own right as an authorized user under the statute governing disclosure.
II. Scope of Review.
Our review of agency action is for errors at law. Bernau v. Iowa Dep't of Transp., 580 N.W.2d 757, 763 (Iowa 1998). We review the district court decision by applying the standards of the Administrative Procedure Act to the agency action to determine if our conclusions are the same reached by the district court. See Heartland Express, Inc. v. Terry, 631 N.W.2d 260, 265 (Iowa 2001).
Worldwide initially argues the district court erred in its review of the decision by the Department by refusing to apply the 1999 amendments to the Administrative Procedure Act. The district court determined the amendments did not apply because they became effective after the agency action was taken. See Iowa Code § 17A.19(8)(b).
Our legislature amended section 17A.19 to describe specific standards and rules of judicial review of agency action. See Arthur Earl Bonfield, Amendments to Iowa Administrative Procedure Act, Report on Selected Provisions to Iowa State Bar Association and Iowa State Government, at 59 (1998) [hereinafter Bonfield]. One of the standards now articulated under the statute requires a reviewing court to reverse, modify, or correct agency action if it was based on "an erroneous interpretation of a provision of law whose interpretation has not clearly been vested by a provision of law in the discretion of the agency." Iowa Code § 17A.19(10)(c). The amendments were effective for agency action commenced after July 1, 1999. Worldwide argues the agency action in this case was commenced after that date, and the district court erred in refusing to apply section 17A.19(10)(c).
Although the record reveals that the decision made by the Department to deny access to the personal information was made after the effective date of section 17A.19(10)(c), there is no indication the district court failed to apply the proper standard of review. See id. § 17A.2(2) (defining "agency action"). The district court applied the standards governing its role in the interpretation of statutes that we have articulated in our cases, and we believe those standards are substantially the same as the standards now framed by our legislature.
Our legislature did not amend the judicial review provisions of the Administrative Procedure Act to increase the intensity of judicial review beyond that originally contemplated by the act, but to ensure that courts actually follow the level of review consistent with the act. Bonfield at 59. Thus, the amendments did not actually change the existing principles of law applicable to judicial review, but were enacted to provide greater specificity. Id. at 60. Generally, the amendments achieve this goal by
Stating explicitly the exact circumstances in which the District Court is or is not required to give deference to an agency's view of a matter, and by filling in with express language some of the legal principles applicable to the scope of review that are not dealt with by the language of the current IAPA.
Id.
The specific standards for courts to follow in reviewing agency actions are now contained in section 17A.19(8)-(12). The fourteen lettered paragraphs of section 17A.19(10) detail the specific reviewing *613 standards for courts to follow under the Act and describe each ground under which the court may grant relief in agency action. Id. at 61. Paragraph (c) of subsection 10 addresses the standard governing the interpretation of a statute that Worldwide claims the district court failed to apply.
Although section 17A.19(10)(c) is not substantially different from our existing judicial principles concerning statutory interpretation in judicial review proceedings, the new legislative standard appears to combine two approaches that have emerged from our cases addressing the interpretation of statutes. Id. at 61-62. We have repeatedly held that the interpretation of statutes is a legal question for courts, not for agencies. Uni-United Faculty v. Iowa PERB, 545 N.W.2d 274, 277 (Iowa 1996) (quoting Norland v. Iowa Dep't of Job Serv., 412 N.W.2d 904, 908 (Iowa 1987)). Consequently, we give only limited deference to the interpretation by an agency. Id. On the other hand, we have, at times, given greater deference to some agency interpretations. See PanDa Eng'g v. Eng'g & Land Surveying Examining Bd., 621 N.W.2d 196, 198 (Iowa 2001) (courts give careful consideration to agency determination of question of law in an area of the agency's expertise); Barker, II v. Iowa Dep't of Transp., 431 N.W.2d 348, 349 (Iowa 1988) (courts recognize the expertise of an agency in reviewing an agency rule and grants a reasonable range of informed discretion); Bonfield at 62 (noting our cases have given deference to agency interpretation of broad vague statutory terms). The new legislative standard is "meant to explain the difference between those two coexisting approaches to the judicial review of agency statutory interpretation found in Iowa cases." Bonfield at 62.
The new standard for interpreting statutes merely confirms and clarifies that interpretation is normally a judicial function, except when the legislature has delegated the discretionary authority to the agency. Iowa Code § 17A.19(10)(c); Bonfield at 62. Thus, courts normally review an issue of statutory interpretation independent of an agency's interpretation. Bonfield at 62. However, when the legislature has "clearly" delegated the authority to interpret a statute to an agency, courts may reverse that interpretation only if it is arbitrary, capricious, unreasonable, or an abuse of discretion. Id.[1]
There is no argument made by Worldwide that our legislature granted the Department discretion to interpret any statute relevant to this case. Clearly, it is for the courts, not the Department, to interpret section 321.11 and, in turn, 18 U.S.C. § 2721. This was the standard applied by the district court. Thus, the district court did not apply the incorrect reviewing standard. Moreover, our own review of the district court decision is to consider whether the conclusions reached *614 by the district court are the same conclusions we reach, and we apply all the relevant statutory standards to the agency action to make this determination. Accordingly, any review by the district court that failed to recognize the specific standards under section 17A.19 did not create error for the purposes of our review.
III. Access to Personal Information.
A. Overview.
Many state and federal statutes limit or prohibit access to records maintained by government. See generally 76 C.J.S. Records § 74, at 149-151 (1994). Congress added to this growing list of statutes in 1994 by enacting the Driver's Privacy Protection Act (DPPA). 18 U.S.C. §§ 2721-2725 (1994 & Supp.2001). This Act generally regulates the authority of state motor vehicle departments to disclose personal information maintained in their records. DeVere v. Attorney Gen., 146 N.H. 762, 781 A.2d 24, 26 (2001).
Congress enacted the Act largely in response to the mounting public safety concerns over the easy access by stalkers and other criminals of personal information maintained by state motor vehicle departments.[2] Congress also sought to curb the common practice by many states of selling information in motor vehicle records to businesses, marketers, and individuals. Reno v. Condon, 528 U.S. 141, 143-44, 120 S. Ct. 666, 668, 145 L. Ed. 2d 587, 591 (2000).
The federal act generally restricts states from disclosing personal information in a driver's motor vehicle record to any person or entity without the driver's affirmative consent. Id. at 144-45, 120 S. Ct. at 669, 145 L.Ed.2d at 592 (citing 18 U.S.C. § 2721, as amended). Thus, the general ban imposed on the disclosure of personal information does not apply if a driver consents to the release of the data. Id. The Act defines the restricted personal information two ways. First, it defines personal information to mean "information that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information...." See 18 U.S.C. § 2725(3). It then defines "highly restricted personal information," to mean an individual's photograph, social security number, or medical or disability information. See id. § 2725(4).
Despite the general prohibition against disclosure of personal information contained in motor vehicle records, Congress understood that there are legitimate reasons for the dissemination of such information. Thus, the Act carves out exceptions for both mandatory and permissive disclosure. First, states must disclose personal *615 information for use in carrying out the provisions of certain federal statutes. See id. § 2721(b). Second, states are given discretionary authority to disclose personal information for a number of purposes.
The DPPA lists eleven categories of reasons or purposes for the nonconsensual discretionary disclosure of information. Id. § 2721(b)(1)-(10), (14); see also Maginnis, 51 S.C. L.Rev. at 809. These categories are: For use "by any government agency" or by "any private person or entity acting on behalf of a Federal, State, or local agency in carrying out its functions," § 2721(b)(1); for use in connection with car safety, car theft, and promotion of driver's safety, § 2721(b)(2); for use by a business to verify personal information submitted to it and to prevent fraud or to pursue legal remedies if the information submitted to the business is inaccurate, § 2721(b)(3); in connection with court, agency, or self-regulatory proceedings, § 2721(b)(4); for research purposes so long as the information is not further disclosed, § 2721(b)(5); for use by insurers, § 2721(b)(6); to notify motor vehicle owners that their vehicle has been towed or impounded, § 2721(b)(7); for use by licensed private investigators for the purposes permitted under the DPPA, § 2721(b)(8); for use by an employer to obtain or verify information, § 2721(b)(9); in connection with private toll transportation services, § 2721(b)(10); and for any state authorized purpose relating to the operation of a motor vehicle or public safety, § 2721(b)(14). The Act also lists three categories or reasons for disclosure based on expressed consent of the person to whom the information pertains. 18 U.S.C. § 2721(b)(11)-(13). States may disclose personal information if the use falls within one of the fourteen categories, and may disclose "highly restricted personal information" only for uses permitted in 18 U.S.C. § 2721(b)(1), (b)(4), (b)(6), and (b)(9). Id. § 2721(a)(1).
The DPPA also permits the limited resale or redisclosure of personal information. Id. § 2721(c). Thus, the disclosure restrictions of the Act apply not only to state government, but also apply to persons or entities who have obtained the information from motor vehicle departments. See Reno, 528 U.S. at 146, 120 S.Ct. at 669, 145 L. Ed. 2d at 592-93. Generally, an "authorized recipient" of a driver's personal information may "resell or redisclose" the information only for a permissible purpose. 18 U.S.C. § 2721(c). There are substantial fines and penalties imposed for state agencies or private persons who violate the provisions of the Act, in addition to liability in civil proceedings. See id. § 2723.
Following in the footsteps of the DPPA, our legislature amended section 321.11 to provide that records of the Department of Transportation are open to public inspection except "those made confidential and not permitted to be open" under the DPPA. Iowa Code § 321.11(1) (as amended). The statute declares that "personal information shall not be disclosed to a requestor, except as provided in 18 U.S.C. § 2721, unless the person whose personal information is requested" has expressly consented. Iowa Code § 321.11(2). Personal information is defined under section 321.11(2) to mean:
[I]nformation that identifies a person, including a person's photograph, social security number, driver's license number, name, address, telephone number, and medical or disability information, but does not include information on vehicular accidents, driving violations, and driver's status or a person's zip code.
This definition is nearly identical to the definition under the DPPA. Yet, unlike the DPPA, the statute does not distinguish *616 between personal information and highly restricted personal information. It does, however, limit the disclosure of a person's photograph to specific persons or agencies. Id. § 321.11(4). The statute further prohibits the release of personal information, with limited exceptions, when disclosure of the information is requested by the presentation of a registration plate number. Id. § 321.11(3).
B. Disclosure as an Authorized Use.
Worldwide centers on the manner the DPPA permits disclosure of personal information to support its claim to access of the information. Under each category, disclosure is ultimately permitted based on the use of the information. Thus, Worldwide argues that its use falls within the various categories because the reformatting of the information onto disks facilitates the usefulness of the information, and it only sells its computer disk to those who would be permissible users of the information under one of the authorized categories of use. Worldwide asserts this satisfies the purposes behind the DPPA because its use of the information not only assists those who are properly authorized to utilize the information, but the restrictions on its consumer base also protects the privacy interest sought to be maintained by Congress.[3]
Before we turn to examine Worldwide's claims in light of the relevant statutes, it is important to recognize that our goal in construing statutes is to ascertain the legislative intent. Perkins v. Madison County Livestock & Fair Ass'n, 613 N.W.2d 264, 269 (Iowa 2000). This is done by first focusing on the language used by the legislature. Id. In doing so, we consider the statute in its entirety and interpret its provisions in relationship to the whole. State v. Carpenter, 616 N.W.2d 540, 542 (Iowa 2000). This provides us the best opportunity to discern the interpretation and construction that best effects the purpose of the statute. See State v. Iowa Dist. Ct., 620 N.W.2d 271, 273 (Iowa 2000).
The language of the DPPA as a whole makes it plain that Congress and, in turn, our legislature, sought to limit access to personal information in state motor vehicle records by both protecting citizens from the improper use of such information, while allowing access for legitimate purposes or uses. At the same time, it imposed a gatekeeping function on the state departments of motor vehicles to exercise discretion to disclose personal information when used for the purposes described in subsection (b). Thus, disclosure essentially depends on the use sought for the information, and the states are charged with the responsibility to ensure that disclosure is limited to those circumstances where Congress determined that the use for the information trumps the competing privacy interest. Yet, we do not read the statute to permit disclosure in the manner asserted by Worldwide.
Our review of the disclosure requirements of 18 U.S.C. § 2721(b) reveals some of the categories of permissible uses identify a specific user. See § 2721(b)(1) (use by government agency or private person); § 2721(b)(3) (use by legitimate business); § 2721(b)(6) (use by insurer); § 2721(b)(8) *617 (use by private investigative agency); § 2721(b)(9) (use by employer); § 2721(b)(13) (use by any requester with written consent). Other categories solely consider the manner of use. See § 2721(b)(2) (use in connection with motor vehicle safety, prevention of motor vehicle theft, and promotion of driver's safety); § 2721(b)(4) (use in connection with court and agency proceedings); § 2721(b)(5) (use in research activities); § 2721(b)(7) (use in providing notice to owners that their vehicle has been towed or impounded); § 2721(b)(10) (use in connection with private toll transportation services); § 2721(b)(11) (for any use when consent is obtained); § 2721(b)(12) (for bulk distribution of surveys, marketing or solicitations when consent obtained); and § 2721(b)(14) (any state authorized purpose pertaining to the operation of a motor vehicle or public safety). Yet, even the permissible users of nonconsensual information are limited in the manner the information may be used. See § 2721(b)(1) (for use by a government agency in carrying out its functions); § 2721(b)(3) (use by business to verify or to obtain information); § 2721(b)(6) (use by insurer in connection with claims investigation); § 2721(b)(8) (use by private investigator for any permitted purpose); § 2721(b)(9) (use by employer to obtain or verify information); § 2721(b)(13) (use by requester if based on written consent). Thus, for example, a government agency could not receive personal information under § 2721(b)(1) if the information was being used for a private purpose. See DeVere, 781 A.2d at 29. Similarly, a private entity could not obtain personal information if used for a private purpose or if the entity was otherwise not acting on behalf of a government agency in carrying out its functions. See 18 U.S.C. § 2721(b)(1). Additionally, a licensed private investigator could not receive personal information under § 2721(b)(8) if the information was not being used for one of the permitted purposes. Id. § 2721(b)(8). In fact, a user is permitted access to information only when the information will be used for the permitted purpose, subject only to two exceptions. The Act imposes no restrictions on the type of use when the "requester" of the information has obtained consent of the individual to whom the information pertains. Id. § 2721(b)(13). Likewise, any type of use will support disclosure when "in response to requests" the State previously had "obtained the express consent of the person" to whom the information pertains. Id. § 2721(b)(11).
We think this approach taken by Congress to the dissemination of personal information in motor vehicle records contemplates that the person or entity requesting disclosure of the personal information also be the person or entity that will use the information for the statutory purpose. Thus, nonconsensual disclosure of information is permitted only for approved uses, and disclosure is not permitted if the requester is not seeking to use the information for the statutory purpose. The statute does not permit disclosure to a nonuser, who only seeks information to redisclose it for use under a permitted purpose. Redisclosure of the information is allowed only for a permitted purpose and can only occur if the information was initially disclosed by the state to "an authorized recipient." Id. § 2721(c). Clearly, any other interpretation would render the statute impractical, and essentially render the state incapable of performing its gatekeeping function under the statute. The important task of protecting individual privacy interests recognized by Congress would be undermined by permitting a requester to determine the eligibility to receive the information. Thus, the claimed restrictions on Worldwide's customer base *618 do not justify disclosure under the Act. Worldwide must itself be an authorized user.
Worldwide argues that its process of placing the information onto disks for authorized users to use is itself a use of the information for a statutory purpose. Worldwide emphasizes that its disks benefit authorized users, such as law enforcement agencies, by allowing them to quickly and efficiently utilize the information.
We understand how the computerization of records benefits legitimate users of the information, but we think Congress would have specifically identified reformatting information as an authorized use if it intended to permit disclosure of the information for that purpose. Congress provided a long list of uses but failed to include the use engaged in by Worldwide. Generally, the express mention of one thing in a statute implies the exclusion of others. Callender v. Skiles, 591 N.W.2d 182, 186 (Iowa 1999). Thus, when a legislative body delineates exceptions, it is presumed that no others were created or intended. Elliott v. Iowa Dep't of Pub. Safety, 374 N.W.2d 670, 672 (Iowa 1985). Clearly, Congress did not provide a specific category of use for businesses like Worldwide. Instead, we think Congress envisioned that the categories of use relate to the actual use of the information that directly serves the permitted purpose and involve those entities that carry out such purposes.
We recognize, as well, that the disks marketed by Worldwide do not serve any of the categories of purposes in any manner until the disks are actually sold. Thus, the actual and specific use of the information by Worldwide does not fit into any permitted purpose under the statute until resale. Yet, resale or redisclosure to authorized users is not the test for disclosure by the state, and redisclosure to an authorized recipient alone does not satisfy the test of disclosure. See 18 U.S.C. § 2721(c). Worldwide cannot utilize the use of another person or entity to support disclosure.
Notwithstanding, Worldwide argues that it, at least, is entitled to personal information for distribution to government agencies under § 2721(b)(1) and for distribution to private investigators under § 2721(b)(8). Subsection (b)(1) permits disclosure:
For use by any government agency, including any court or law enforcement agency, in carrying out its functions, or any private person or entity acting on behalf of a Federal, State, or local agency in carrying out its functions.
Worldwide asserts that it is "acting on behalf of a Federal, State, or local agency in carrying out its functions" by reformatting the information onto disks for use by various government agencies.
A review of the evidence in this case reveals Worldwide is not acting on behalf of any government agency in carrying out its functions by reformatting the information onto disks. Worldwide is a private business that computerizes information that can relate to a government function in a general way, but it does not act as a government agency and does not act for a government agency. It sells and markets its disks to a vast array of entities, including lawyers, private investigators, insurance companies, and others. Clearly, it acts for itself and does not carry out a function of government. A private entity does not act for government, and carry out government functions, by manufacturing a product used by government. Thus, Worldwide qualifies as a private entity under the language of § 2721(b)(1), but does not use the information for the permitted purpose that would enable the Department *619 to exercise its discretion to disclose the information.
For the same reason, Worldwide does not fall within the discretionary disclosure category for private investigators. Although Worldwide is a licensed private investigator, its use of the information does not fit within any permitted purpose as required under 18 U.S.C. § 2721(b)(8).
We conclude the use of the information by Worldwide does not support disclosure. The purpose for which Worldwide seeks the information does not fall within any purpose delineated in 18 U.S.C. § 2721(b).
C. Disclosure as an Agent.
Worldwide next asserts that it is an agent of its customers and if the customer is authorized to receive the information under the statute, it is authorized to receive the information as an agent of the customer.
It is not necessary for us to determine if Congress or our legislature intended the information to be disclosed under an agency theory. Clearly, the relationship between Worldwide and its customers falls far short of an agency relationship. An agency relationship results only when there is an understanding between the parties that creates a fiduciary relationship under which the fiduciary is subject to the directions of the principal and acts on account of the principal. Benson v. Webster, 593 N.W.2d 126, 130 (Iowa 1999). Worldwide is not subject to control of its customers and does not act on account of its customers. The relationship, plain and simple, is one of seller and buyer, and Worldwide cannot artificially create an agency relationship by designating the relationship as an agency in its request forms. See Ward v. Mgmt. Analysis Co. Employee Disability Benefit Plan, 135 F.3d 1276, 1284 (9th Cir.1998) (existence of agency relationship is not governed by a party's stipulation).
IV. Conclusion.
We conclude section 321.11 and 18 U.S.C. § 2721(b) do not permit disclosure of personal information to Worldwide. We affirm the decision of the district court.
AFFIRMED.
NOTES
[1] Worldwide also argued the district court failed to apply the statutory standards of review under sections 17A.19(11)(a) and (b). This subsection was "intended to further clarify the appropriate application by the courts, when they review the lawfulness of agency action, of the more discreet standards of review contained in subsection (10)." Bonfield at 70. Subparagraph (a) makes it clear that the question whether an agency has discretion over a matter is a legal issue, so that courts must decide whether an agency has been delegated such discretion without giving deference to the position of the agency. Id. at 71. Subparagraph (b) provides that courts "should not give any deference" to an agency's position on matters the court has determined have not been vested to the agency by the legislature. Id. Like section 17A.19(10)(c), these standards reflect the standards in our cases.
[2] The watershed event behind the enactment of the DPPA was the 1989 murder of actress Rebecca Schaeffer, who starred in the television series "My Sister Sam." See Maureen Maginnis, Maintaining the Privacy of Personal Information: The DPPA and the Right of Privacy, 51 S.C. L.Rev. 807, 809 (2000) [hereinafter Maginnis]; see also 138 Cong. Rec. H1785-01 (1992); 139 Cong. Rec. E2742-02 (1993). She was shot and killed outside her apartment by a stalker who obtained her unlisted address from the California Department of Motor Vehicles. Maginnis, 51 S.C. L.Rev. at 809. The easy access of personal information by stalkers, domestic abusers, and other criminals was also a major impetus for the enactment of similar state laws. See DeVere v. Attorney Gen., 781 A.2d at 26. Prior to the DPPA, most states granted almost total public access to personal information in motor vehicle records. Maginnis, 51 S.C. L.Rev. at 809. For example, prior to 1996, Iowa Code section 321.11 provided that "[a]ll records of the department [of transportation], other than those declared by law to be confidential for use of the department, shall be open to public inspection...." Iowa Code § 321.11 (1995).
[3] The Department is given discretion to disclose personal information when the use of the information falls within one of the categories of uses delineated by Congress in § 2721(b). Worldwide does not claim on appeal that the Department abused its discretionary function in refusing to disclose the requested information, but claims the Department erred by interpreting the statute to exclude its use of the information as a use permitted under the statute. We do not address the discretionary function of the Department once a use falls within a statutory category.