The Honorable John A. Riggs, IV State Senator P.O. Box 1399 Little Rock, AR 72203-1399

Dear Senator Riggs:

You have requested an official Attorney General opinion, pursuant to A.C.A. § 25-19-105(c)(3)(B), concerning the release of certain public records. Specifically, you have asked whether the home addresses of licensed drivers, which are required to be kept by the Director of the Office of Driver Services, are public records available to an insurer for rating or underwriting purposes.

RESPONSE

In my opinion, these records are presumptively available to an insurer for rating or underwriting purposes pursuant to the Driver's Privacy Protection Act (DPPA), 18 U.S.C. §§ 2721 through -2725. However, the constitutionality of the DDPA has been questioned: the Fourth and Eleventh Circuit Courts of Appeals have declared it unconstitutional, whereas the Seventh and Tenth Circuit Courts of Appeals have upheld it. The United States Supreme Court has granted certiorari to resolve this conflict among the circuits. In my opinion, if the Supreme Court declares the DPPA unconstitutional, state law would control and, by statute, only the home addresses of insureds or applicants of a particular insurer would be available to that insurer. In the meantime, I consider the DPPA presumptively constitutional and preemptive of state law. Under the DPPA, an insurer is entitled to the home addresses of any licensed drivers, not just its own insureds or applicants, so long as it restricts its use of this information to claims investigation, antifraud activities, rating or underwriting.

In your request, you inquire about the interplay between the DDPA and the Arkansas Freedom of Information Act (FOIA), A.C.A. § 25-19-101 through -107. As you note in your letter, the information at issue does not fall within any of the categories of public records deemed closed to public inspection under A.C.A. § 25-19-105(b). However, the general rule of disclosure under the FOIA is qualified by A.C.A. § 25-19-105(a), which provides for disclosure of all public records "[e]xcept as otherwise specifically provided by this section or by laws specifically enacted toprovide otherwise. . . ." (Emphasis added.) As Professor Watkins points out: "This language, which obviously includes state statutes, is broad enough to reach federal statutes as well." J. Watkins, The ArkansasFreedom of Information Act 160 (1998). The DDPA expressly dictates the rules of privacy to be observed by state departments of motor vehicles, regardless of what state disclosure requirements might be:

(a) In General. — Except as provided in subsection (b), a State department of motor vehicles, and any officer, employee, or contractor, thereof, shall not knowingly disclose or otherwise make available to any person or entity personal information about any individual obtained by the department in connection with a motor vehicle record.

18 U.S.C. § 2721(a). The statute defines the term "personal information" as follows:

(3) "personal information" means information that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information, but does not include information on vehicular accidents, driving violations, and driver's status.

(Emphasis added.) As a general rule, then, addresses maintained by a state department of motor vehicle are not subject to disclosure under the DPPA, although, as discussed below, subsection (b) creates an exception when the party seeking disclosure is an insurer. Specifically,18 U.S.C. § 2721(b)(6) authorizes the release of DMV records "[f]or use by any insurer or insurance support organization, or by a self-insured entity, or its agents, employees, or contractors, in connection with claims investigation activities, antifraud activities, rating or underwriting."

Congress' clear intention that the DPPA would preempt contrary state law is discussed in Condon v. Reno, 972 F. Supp. 977, 979-80 (D.S.C. 1997):

Congress enacted the DPPA in 1994 in an effort to remedy what it perceived to be a problem of national concern: i.e., the active commerce in, and consequent easy availability of, personal information contained in State motor vehicle records. Testimony before Congress established that as many as 34 States allowed easy access to personal information contained in motor vehicle records and that criminals had used such information to locate victims and commit crimes. Congress also found that many States sell or otherwise permit the use of information contained in motor vehicle records for direct marketing purposes.

(Footnote omitted.) See also discussion in Watkins, supra at 160. For purposes of this opinion, I will presume that Congress had the constitutional authority thus to preempt contrary state legislation, including the FOIA. Any Act of Congress "is to be presumed to be a constitutional exercise of legislative power until the contrary is clearly established." Close v. Glenwood Cemetery, 107 U.S. 475 (1883);accord I.N.S. v. Chadha, 462 U.S. 919, 944 (1983).¹

In my opinion, the preemptive effect of the DPPA further extends to state law that directly addresses disclosure of motor vehicle records. A.C.A. § 27-50-906(6) dictates the release of driving records to "[a]ny insurer licensed to do business in Arkansas or its agents, employees or contractors in connection with the driving record of an insured or applicant." This legislation is narrower in the disclosure it directs than is the corresponding federal law. Under the state statute, the insurer can obtain information only relating to its own insureds or applicants for insurance. By contrast, under the federal statute quoted earlier, an insurer can obtain information about any licensed driver, so long as the information is used for one of the authorized enumerated activities.

As previously noted, in my opinion the federal statute preempts the more restrictive state statute. I agree in all respects with the analysis of this issue offered by the Tenth Circuit Court of Appeals in Oklahoma:

In regulating states that choose to release motor vehicle information to the public, Congress simply exercised its power of preemption by requiring states to release such information into the stream of commerce in a manner Congress deemed appropriate. . . .

. . . [T]he DPPA does not commandeer the state legislative process by requiring states to enact legislation regulating the disclosure of personal information from motor vehicle records. Rather, the DPPA directly regulates the disclosure of such information and preempts contrary state law. . . . If states do not wish to comply with those regulations, they may stop disseminating information in their motor vehicle records to the public. . . .

In enacting the DPPA, Congress obviously curtailed states' prerogative to make choices respecting the release of motor vehicle information. No one claims that Congress exceeded the scope of its power under the Commerce Clause in so doing. Nor has the Supreme Court ever suggested that Congress impermissibly invades areas reserved to the states under the Tenth Amendment because it exercises its preemptive authority under the Commerce Clause in a manner that displaces state law and policy to some extent. The DPPA simply requires states to make a choice, i.e. stop releasing personal information from state motor vehicle records to the public, or release such information consistent with the dictates of the DPPA. See FERC v. Mississippi, 456 U.S. 742, 767-68 n. 30, 102 S. Ct. 2126, 72 L. Ed. 2d 532 (1982) (upholding federal legislation that gave States "a choice between regulating in conformity with federal requirements, or abandoning regulation in a given field").

161 F.3d at 1271-72.

In reviewing the DPPA, it is apparent that Congress intended not only to preclude impermissible uses of DMV information, but further to specify in detail what uses would be permitted. Following the general proscription against use set forth in 18 U.S.C. § 2721(a), the statute in subsection (b) details a series of detailed "permissible uses," including the use by insurers discussed above. In testifying before Congress on this bill, its primary sponsor, Congressman James P. Moran, observed that "[c]areful consideration was given to the common uses now made of this information and great efforts were made to ensure that those uses were allowed under this bill." 1994 WL 212698 (F.D.C.H.). Given this clear indication of legislative intent, as well as the highly detailed catalog of permissible uses, it is my opinion that Congress intended to preempt any state legislation defining permissible uses other than those set forth in the DPPA. More specifically, I feel it is impermissible for the state to release some motor vehicle records to insurers but not as many as the DPPA dictates. Based on my research, I understand that the Office of Driver Services currently conditions the release of information to insurers upon receipt of a quasi-contractual assurance that the information requested relates only to insureds or applicants for insurance. In my opinion, this requirement is more restrictive than warranted under the DPPA. I believe that, at most, the Office of Driver Services may exact from insurers some form of pledge that the information requested will be used only for claims investigation activities, antifraud activities, rating or underwriting, as specified in the statute. However, my conclusion would obviously be different if the Supreme Court were to declare the DPPA unconstitutional.

Assistant Attorney General Jack Druff prepared the foregoing opinion, which I hereby approve.

Sincerely,

MARK PRYOR Attorney General

MP:JHD/cyh

¹ As previously noted, two circuits have declared the DPPA unconstitutional on grounds that it violated the Tenth Amendment by directing the states to implement federal policy. Condon v. Reno,155 F.3d 453 (4^th Cir. 1998), affirming Condon v. Reno, 972 F. Supp. 977 (D.S.C. 1997), cert. granted Reno v. Condon, 119 S. Ct. 1753 (May 17, 1999); Pryor v. Reno, 171 F.3d 1281 (11^th Cir. 1999), reversing Pryorv. Reno, 998 F. Supp. 1317 (M.D. Alabama 1998). Two other circuits have expressly held the legislation to be a constitutionally permissible direct regulation of the states under the Commerce Clause and the Fourteenth Amendment. Travis v. Reno, 163 F.3d 1000 (7^th Cir. 1998), reversing Travis v. Reno, 12 F. Supp. 2d 921 (W.D. Wis. 1998); State ofOklahoma ex rel. Oklahoma Dept. of Public Safety v. U.S., 161 F.3d 1266 (10^th Cir. 1998), reversing State of Oklahoma ex rel. Oklahoma Dept. ofPublic Safety v. U.S., 994 F. Sup. 1358 (W.D. Ok. 1997). "Arguably," Professor Watkins observes, "Congress adopted the DPPA under its constitutional authority to regulate interstate commerce or its power under Section 5 of the Fourteenth Amendment to enforce its provisions by `appropriate legislation.'" Watkins, supra at 252 n. 519. Despite the pending constitutional challenges to the legislation, Watkins treats the DPPA as binding law and concludes that "it is a law `specifically enacted to provide otherwise' within the meaning of Section 25-19-105(a)," thus dictating preemption under the terms of the FOIA itself. Pending a judicial determination binding in this circuit, I concur in this conclusion and will not undertake an independent constitutional review of the legislation here. I will note in passing, however, that I am persuaded by the reasoning of those courts that classify the legislation as constitutionally permissible regulation of state information databases.