Background: The Driver Privacy Protection Act (DPPA), enacted by Congress in 1994, regulates state governments' release of personal information contained in an individual's motor vehicle record. DPPA defines personal information as information that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address – but not zip code, telephone number, and medical or disability information. There are 14 specified allowable uses of personal information by different entities listed in the DPPA.

Regarding the disclosure of lists of registered motored vehicle owners, current Washington State law is more restrictive than DPPA in that there are less permissible uses and entities identified. The Department of Licensing (DOL) may furnish lists of registered and legal owners of motor vehicles to the following entities for the specified purposes: (1) motor vehicle manufacturers, for safety recalls; (2) U.S. and Canadian governmental agencies, for use in enforcement of vehicle or traffic laws; (3) commercial parking companies, to notify owners of outstanding parking violations; (4) DOL agents, to provide certain information to motor vehicle dealers; (5) businesses making loans for the purchase of motor vehicles, to assist in determining whether to provide financing; and (6) the operator of a toll facility, to identify toll violators.

The following activities related to obtaining or the use of information contained in a vehicle record constitute a gross misdemeanor: unauthorized disclosure of information from a vehicle record; use of false representation to obtain information from a vehicle record; the use of information for a purpose other than what is stated in the request for information or disclosure agreement; or, the sale or other distribution of any vehicle owner name or address to another person not disclosed in the request or disclosure agreement.

Summary of Bill (Proposed Substitute): The purposes for which DOL must provide a list of registered motor vehicle owners to the manufacturer of motor vehicles or their agents is broadened to reflect all of the disclosures required under the federal Driver Privacy Protection Act.

The purposes for which DOL may furnish lists of registered owners of motor vehicles to specified entities are expanded to include the following:

vehicle manufacturers, legitimate businesses, or their agents for use in research activities and in producing statistical reports, as long as the personal information is not published, redisclosed, or used to contact individuals;
a legitimate business or its agents for use in the normal course of business to verify the accuracy of personal information submitted by the individual to the business; and if such information is not correct, then to obtain the correct information, but only for the purposes of preventing fraud by pursuing legal remedies against, or recovering on a debt or security interest from the individual;
an insurer or insurance support organization or their agent for use in connection with claims investigation, antifraud, rating, or underwriting activities;
local government entities or their agents for use in providing notice to owners of towed and impounded vehicles; and
government agencies or their agents requiring the names and addresses of registered owners to notify them of outstanding parking violations.

Prior to the release of any information, DOL must enter into a contract with an authorized entity. The contract must contain provisions requiring DOL or its agent to conduct regular permissible use and data security audits.

DOL must collect a fee of $15 per 1000 vehicle owner records released to a private entity. If less than 1000 records are released, DOL must prorate the fee. However, if the request requires a weekly, monthly, or regular update of vehicle records that have changed, DOL must charge a fee of $0.05 per record. DOL must deposit the fee revenue into the newly created DOL technology improvement and data management account. The monies in the account may only be appropriated for investments in technology and data management.

Personal information received by an authorized entity may not be released for direct marketing purposes.

Staff Summary of Public Testimony on Original Bill:

Testimony From 2013 Regular Session.

PRO: R.L. Polk has had a long relationship with DOL. In order to maintain the services that we provide to universities and manufacturers we worked with you to obtain a budget proviso last year and are now requesting that you amend the statute to address this use permanently. In regard to why the bill contains more than just the authorization we specifically need, we thought that state laws might get interpreted narrowly again regarding other recipients and purposes and wanted to align state law with permissible releases of information under the DPPA. Experian Automotive acts as an agent on behalf of vehicle manufacturers. The federal law is much more comprehensive and detailed about the kinds of information that may be released. We worked to lift verbatim from the federal law and drop it into state statute. Experian Automotive receives motor vehicle records from all states in the nation. Regarding safety recalls, Experian and R.L. Polk are really the only two providers of vehicle owner information to vehicle manufacturers in safety recall situations. We also provide statistical products, where we strip personal information from the records, that are very useful. The DPPA prohibits use of this information for direct marketing. Experian and R.L. Polk have not been part of any disciplinary actions related to misuse of this information.

CON: We believe any legislation on this topic must strike a balance between privacy interests and business interests in obtaining this data. This bill does not strike that balance. We have experience in this area in the Consumer Protection Unit at the AG's office. We opened five investigations and found some of the gaps in state and federal law. We are not pointing a finger at R.L. Polk or Experian; rather, it was further down the stream when data was redisclosed. The legal remedies are very limited. DOL can deny access to the primary recipient, but there is no other disincentive that would allow us to go after someone who disclosed this data. We have no authority to enforce as a 3rd party in a privacy breach. Section 3 expands who can have access to the database to verify accuracy of information, which includes a very broad group of people. The DPPA does not require states to release this information. It is a floor, and state law may be more restrictive or protective of this information. This bill dramatically expands the scope of who can have access to this information. This bill is too broad. Dealers are very concerned about the release of some of this information. The challenge for the dealers is that we are scored on our customer satisfaction. If customers believe that dealers are selling or disclosing their information it can negatively impact dealers' ability to keep their franchise. DOL and the Attorney General are already having a very difficult time policing the current version of the law; it does not need to be broadened to the extent provided under this bill. We have been in discussions with the sponsors of this bill and some folks in the House to provide a much more narrow bill with enforcement mechanisms and would ask that you hold this bill and wait for the House version.

Staff Summary of Public Testimony on Substitute: CON: Dealers collect info from the public and give it to DOL. Largely dealers don’t otherwise disseminate information they collect. The challenge dealers have is when we have customers who buy a car and receive a fake new warranty advertisement card in the mail and mistakenly think we released the information. It affects our business and our customers. We have worked to identify our concerns. We have worked toward two main goals: personal information is not disclosed and that there be an audit process. Section 1(2)(d) allows release of information to any business to verify accuracy of information to prevent fraud. This new permissible use is too difficult to audit as it would require the data provider to audit their customers and ensure that the customer was actually trying to prevent fraud. We ask that you remove this provision from the bill.

OTHER: RJ Polk and Experian are largely in support of this bill, we just have a couple of outstanding issues. There are two areas we have concerns with which are the audits requirements and the level of the fee. Both of our companies work with every US and Canadian jurisdiction. Anything we do in one jurisdiction we must open up to another, so you can see where it could be a problem. We could not support the workload that would be required should all 50 states and all the Canadian provinces submit us to different audits. We currently conduct our audits to the highest standards. We would like to use the audits we already conduct but allow DOL to work with us to add something if DOL felt that our current audits were lacking. The second issue is the level of the fee. We currently pay the cost of DOL to produce the file. There are other states that only require cost recovery as well. We are asking to continue a conversation on what the fee should be. The fee level of $.05 per record is nearly $600,000 per year, which is not sustainable for our companies.

We are trusted custodians of public records and have never had a data breach. We use this information in a number of different ways. Most products we provide are a statistical report type. We would like to broaden the permissible uses in Washington.

DOL's priority is that the data is being used for permissible purposes as required by state and federal law. We strongly believe that DOL should be able to choose the permissible use auditor. We would like to continue to work with everyone on this issue.