More than three decades after its enactment, the Driver’s Privacy Protection Act (DPPA) remains the principal federal statute shielding American motorists from the misuse of their personal information held by state departments of motor vehicles. The law, born from a grim calculus of stalking, harassment, and murder in the early 1990s, restricts the disclosure of driver data without the individual’s express consent. Its passage marked a rare instance where Congress intervened directly in the relationship between states and the personal records they collect, a move later tested and upheld by the U.S. Supreme Court.
A Deadly Catalyst and a Legislative Response
The origins of the DPPA trace back to two distinct but equally alarming threats. In 1989, actress Rebecca Schaeffer was murdered at her home by Robert John Bardo, who had obtained her address through a private detective agency that accessed Department of Motor Vehicles records. Around the same time, opponents of abortion were using publicly available driving license databases to track down and harass physicians and patients.
Dr. Susan Wicklund, an abortion provider, found her house picketed for an entire month after her information was obtained through such means. Representative Jim Moran, a Democrat from Virginia, introduced the bill in 1992 in response to these abuses.
The measure was eventually folded into the Violent Crime Control and Law Enforcement Act, which President Bill Clinton signed into law on September 13, 1994. The statute, codified at Chapter 123 of Title 18 of the United States Code, defines personal information under 18 U.S.C. § 2725 and prohibits its disclosure without the driver’s express consent.
Balancing Privacy with Legitimate Needs
While the DPPA establishes a default of privacy, it also enumerates precise exceptions that allow access for specific purposes. These include government functions; motor vehicle safety and theft matters; court proceedings; statistical research; insurance companies; licensed private investigators; employers verifying commercial driver information; private toll facilities; and bulk distribution of surveys or marketing materials—provided the recipient obtains opt-in consent from individuals.
The law also creates criminal fines for noncompliance and provides a civil cause of action for drivers whose information is unlawfully obtained or used. It further prohibits obtaining driver data through false representations or for unlawful purposes. In 2000, the U.S. Supreme Court upheld the DPPA’s constitutionality in Reno v. Condon, rejecting a Tenth Amendment challenge that argued the law infringed on state sovereignty.
The Court ruled that Congress may regulate how states handle personal data they collect, even without directly commanding states to implement federal policy. That decision reinforced a central feature of American federalism: the national government and individual states share power, but the federal government can impose rules on how states manage the information they gather from citizens.
This balance between federal authority and state sovereignty continues to shape privacy protections across jurisdictions.
Pressures from a Data-Driven Era
The DPPA’s framework was built in an age of paper records and fax machines, a time when large-scale data aggregation was a distant concern. Today, as technology permits the rapid collection, analysis, and sharing of personal data, the law’s carefully drawn exceptions face novel strains.
Governments, commercial entities, and private investigators operate in an environment where the boundaries of legitimate use are increasingly tested. The statute’s prohibition on obtaining driver information for unlawful purposes or through false representations remains a key safeguard, but questions persist about how well it covers emerging practices. Lawmakers and courts will likely need to reexamine the scope of the exceptions as data aggregation grows more sophisticated. The past three decades have shown that the DPPA’s protections are not static; they evolve through judicial interpretation and, potentially, legislative revision.
The question is not whether the law will be tested again, but which new challenge—a novel data broker, a new surveillance technique, or an unintended consequence of the exceptions—will force the next judicial or legislative move.
