February 9, 2005
Mr. George Tatum
Commissioner, North Carolina Division of Motor Vehicles
3148 Mail Service Center
Raleigh, North Carolina 27699-3148
Re: Advisory Opinion: Drivers Privacy Protection Act (18 U.S.C. § 2721, et seq.)
Dear Commissioner Tatum:
You have requested an opinion concerning the application of the federal Drivers Privacy Protection Act (“DPPA”), 18 U.S.C. § 2721, et seq., to certain motor vehicle records in view of North Carolina’s Public Records Act, N.C. GEN.STAT. § 132-1, et seq. Specifically, you have inquired as to the legal obligations of the Division of Motor Vehicles (“DMV”) and local law enforcement agencies upon receiving a request for a copy of a motor vehicle accident report. You have also asked whether vehicle registration information obtained from DMV by local taxing authorities is subject to disclosure under the Public Records Act.
Prior to September 1997, all DMV records were subject to the Public Records Act and were publicly available upon request. The only information that could not be obtained by the public was confidential medical information, social security numbers, signatures, and photographs. See N.C. Gen. Stat. § 20-9(g)(4)(h)(1995); § 20-7(b1)(1995); § 2043(a)(1997). In 1994, in direct response to the murder of actress Rebecca Shaeffer at the hands of a stalker who obtained her home address from the California DMV, Congress passed the DPPA as part of the 1994 Omnibus Crime Bill. The DPPA, effective 17 September 1997 (three years from the date it passed Congress), prohibits a state department of motor vehicles, or any officer, employee, or contractor thereof, from knowingly disclosing any personal identifying information contained in a state motor vehicle record. 18 U.S.C. § 2721(a). Failure to substantially comply with the DPPA may subject a state department of motor vehicles to a civil penalty of up to $5,000 per day. 18 U.S.C. § 2723(b). A “motor vehicle record” is defined as “any record that pertains to a motor vehicle operator’s permit, motor vehicle title, motor vehicle registration, or identification card issued by a department of motor vehicles.” 18 U.S.C. § 2725(1). (The DPPA does, however, contain a number of exceptions to the non-disclosure requirement. See 18 U.S.C. § 2721(b).) Because the DPPA conflicted, in some respects, with the North Carolina Public Records Act, the General Assembly in 1997 adopted N.C. GEN. STAT. § 20-43.1 to bring North Carolina into compliance with the federal requirements. This statute mandates that the Division shall only disclose personal information contained in motor vehicle records in accordance with the DPPA. G.S. § 20-43.1(a).
North Carolina was one of a number of states that challenged the constitutionality of the DPPA on grounds that the federal law violated the 10th Amendment of the United States Constitution. Although the federal district court declared the DPPA unconstitutional, the United States Supreme Court unanimously held that Congress had the power under the Commerce Clause to require the states to comply with the DPPA. Therefore, federal law controls, and the State’s Public Records Act is preempted by the DPPA where there is a direct conflict. See Oklahoma ex rel. Oklahoma Dep’t of Public Safety v. United States, 161 F.3d 1266, 1272 (10th Cir. 1998) (“the DPPA directly regulates the disclosure of [personal information from motor vehicle records] and preempts contrary state law”), cert. denied, 528 U.S. 1114, 120 S. Ct. 930, 145 L. Ed. 2d 810 (2000).
As to the applicability of the DPPA to the disclosure of motor vehicle accident reports, we are not aware of a court decision determining whether accident reports are included within the definition of “motor vehicle records.” The DPPA does, however, specifically define “personal information” and “highly restricted personal information” within a motor vehicle record which a state department of motor vehicles is prohibited from disclosing except under certain circumstances. “Personal information” is defined as “information that identifies an individual, including an individual’s photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information but does not include information on vehicular accidents, driving violations, and driver’s status.” 18 U.S.C. § 2725(3). “Highly restricted personal information” is defined as “an individual’s photograph or image, social security number [and] medical or disability information. 18 U.S.C. 2725(4). Read in context, it is our view that the intent of Congress in enacting the DPPA was to restrict a state department of motor vehicles from releasing certain personal identifying information in records obtained and maintained in connection with the department’s responsibility for the regulation of drivers and motor vehicles. Such personal identifying information may be contained within a variety of official motor vehicle records, including accident reports.
In responding to a request for information under North Carolina’s Public Records law, the relevant inquiry for DMV must therefore be whether the document contains personal identifying information about a motor vehicle operator which cannot be disclosed under the DPPA. An accident report will likely include both information which is protected by the DPPA and information which is excepted from the DPPA. In fact, the DPPA’s definition of protected personal information “excludes information on vehicular accidents, driving violations and driver’s status.” 18 U.S.C. § 2725(3). It is therefore our opinion that motor vehicle accident reports are public records, but should be released only after DMV has redacted personal identifying information in accordance with the DPPA.
Your opinion request also references issues that have been raised as a result of DMV’s implementation of a new computerized accident reporting system referred to as TRACS. It is our understanding that the system allows an officer investigating a motor vehicle accident to prepare an electronic report at the scene and simultaneously forward it to DMV. In certain instances a local law enforcement agency has failed to maintain a copy of the report, relying instead on DMV’s ability to provide a copy upon future request. The DPPA, however, also places disclosure restrictions on recipients of personal identifying information obtained from DMV. 18 U.S.C. § 2721(c). Your question is therefore whether a copy of an accident report transmitted from DMV back to a local law enforcement agency is subject to the DPPA’s confidentiality requirements.
Pursuant to N.C. GEN. STAT. § 20-166.1(e) a local law enforcement officer investigating a reportable accident is required to prepare a written report and forward it to the appropriate local law enforcement agency within 24 hours. The local law enforcement agency receiving the report is required to forward it to DMV within ten days. An accident report prepared by a law enforcement officer is a public record under the Public Records Act at the time it is prepared. See N.C. GEN. STAT. § 132-1. Creation of an accident report in electronic form does not alter the status of the report as a public record. Public agencies are, in fact, precluded from acquiring electronic systems which impede public access to records. N.C. GEN. STAT. § 132-6.1(a).
Inasmuch as the DPPA’s restrictions generally apply only to a state department of motor vehicles, local law enforcement agencies should fully comply with the Public Records Act in responding to an accident report request. In our opinion, a public record is created at the time an electronic accident report is prepared by an officer. Transmittal of the report to DMV through the TRACS system neither subjects the report to the DPPA nor affects its status as a public record from the standpoint of the local law enforcement agency. DMV’s implementation of the TRACS system should therefore have no impact on the ability of local law enforcement agencies to comply with the Public Records Act. As previously stated, however, DPPA requirements do apply to DMV and requests for accident reports to DMV must be responded to accordingly.
You have also asked whether vehicle registration information provided to local taxing authorities is subject to the confidentiality restrictions of the DPPA. Pursuant to the requirements of N.C. GEN. STAT. § 105-330.2(c) DMV cooperates with the Department of Revenue, Property Tax Division, to provide monthly vehicle registration information to local governments for property tax assessment purposes. The procedures and requirements for local governments to compile, publish and publicly file tax records are set out in Article 20 of Chapter 105. In general, North Carolina’s system of personal property taxation involves a comprehensive scheme of listing, assessment and collection. Records documenting this process are generally on file and open for public inspection.
At least one county has declined a request for vehicle property tax information based upon a belief that registration information obtained from DMV is subject to the DPPA and therefore confidential. Although we acknowledge that a literal reading of the DPPA’s definition of “personal information,” without context to the overall statutory scheme, can be interpreted to preclude the release of information connecting a particular vehicle to a individual name and address. We believe the better interpretation, however, allows a local taxing authority to release vehicle tax information in accordance with North Carolina’s Public Records Act.
DMV is clearly authorized to provide vehicle registration information to local governments as necessary for the carrying out of their functions. 18 U.S.C. § 2721(b)(l). As previously noted, the statutory process through which local taxing authorities list, appraise, assess and collect property taxes requires the publication and distribution of individual tax information at various points in the process. For example, each local taxing authority is required to prepare annually a tax book which shows individual taxpayer information, including personal property valuation and taxation. N.C. GEN. STAT. § 105-319. County tax records are required to be filed in the office of the county tax assessor or some other public county office. N.C. GEN. STAT. § 105-321(a). A county board of equalization and review has a duty to hold public meetings for the purpose of reviewing county tax lists, hearing appeals and making such corrections to the tax records as it may determine appropriate. N.C. GEN. STAT. § 105-322. This well-established statutory process would be substantially impeded if motor vehicle registration information obtained from DMV was required to be kept confidential.
The majority of the vehicle information provided by DMV to local taxing authorities, such as vehicle make and model, VIN number, odometer reading, inspection dates, purchase price, insurance and whether the vehicle has been branded as a flood or salvage vehicle, clearly does not involve personal identifying information covered by the DPPA. Furthermore, most information obtained monthly from DMV is duplicative of information already in the possession of local taxing authorities and available to the public. Vehicle registration renewal information, for example, essentially reaffirms on an annual basis that the vehicle is still possessed by the same individual and subject to taxation by the local taxing authority. The only information obtained from DMV by a local taxing authority which may arguably fall within the DPPA’s definition of personal information is therefore the name and address of an individual who has purchased a particular vehicle within the previous twelve months. We do not believe it was the intent of Congress in enacting the DPPA to prohibit local taxing authorities from releasing such generic information when required by state tax laws. Likewise, it is our opinion that such tax information is a public record under the Public Records Act.
We recognize that the courts may eventually provide clarification of the DPPA’s requirements which conflicts with the advice offered in this opinion. Federal officials may also, at some point, choose to advise North Carolina of their interpretation of the DPPA’s confidentiality requirements. Until such time, however, it is our opinion that DMV is required by the DPPA to redact “personal information” and “highly restricted personal information” from documents, such as accident reports, provided to the public. Otherwise, the requirements of the Public Records Act should be complied with by DMV and local law enforcement agencies. Motor vehicle registration information provided by DMV to local taxing authorities should also be provided upon request in accordance with the Public Records Act.
Very truly yours,
Grayson G. Kelley
Chief Deputy Attorney General