Privacy & Information Security Law Blog

On September 28, 2011, a federal court in Illinois held that West Publishing Company (“West”) had not violated the Driver’s Privacy Protection Act (“DPPA”) by reselling driver’s license information obtained from state DMVs.  The court held that (1) the DPPA creates a federal private right of action permitting individuals like the plaintiffs to bring their class action suit, but (2) the lower court’s dismissal for failure to state a claim was proper.

The plaintiffs had argued that because “resale” is not included in the DPPA’s list of permissible uses for which driver’s license information may be disclosed by state DMVs, such information may be resold only by “authorized recipients” in accordance with section 2721(c) of the Act.  Plaintiffs contended that West is not an “authorized recipient” of the records because it does not use the information for one of the enumerated permissible purposes. Although the DPPA does not define the term “authorized recipient,” the court stated that the DPPA as a whole “is concerned with the ultimate use or uses” of the information, and plaintiffs had not alleged that West sold the information to persons who did not have a permissible use. Accordingly, the court held that “the DPPA does not prohibit West Publishing from reselling the plaintiffs’ personal information to those with permissible uses under the Act” even if West itself does not use the information for one of the 14 permissible purposes.