Can Georgia's Department of Revenue share motor vehicle registration data with other state agencies (or with private third parties working with those agencies)?

Plain-English summary

The Commissioner of the Department of Revenue asked whether the Department could grant other state agencies access to GRATIS, the Georgia Registration and Title Information System database that holds motor vehicle registration and title records. Several agencies had asked for access for various purposes, including handing the data off to private third-party developers building consumer-facing computer systems.

The Attorney General's answer was narrow: access is permitted only for the purposes mandated by the federal Driver's Privacy Protection Act of 1994 (DPPA), 18 U.S.C. §§ 2721-2725, or to the specific state agencies designated in O.C.G.A. § 40-2-130(c) (registration records), § 40-3-23(d) (title records), and § 33-34-9 (insurer access). Everything else is off limits.

The opinion's core move is to read the three Georgia statutes against the backdrop of the DPPA's federal preemption. Both the state and federal regimes start from a default of confidentiality. Both list specific permitted disclosures. The AG concluded that the General Assembly intended to restrict disclosure to the listed users, period. State-agency convenience or third-party-developer arrangements do not create a new exception.

Currency note

This opinion was issued in 2008. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Common questions

Q: What is the DPPA?
A: The federal Driver's Privacy Protection Act of 1994, codified at 18 U.S.C. §§ 2721-2725, regulates disclosure of personal information held by state motor vehicle agencies. Congress enacted it after public concern about state DMVs selling personal information for marketing and after several stalking incidents tied to DMV data sales. The Supreme Court upheld it as a valid exercise of the Commerce Clause in Reno v. Condon, 528 U.S. 141 (2000), against a Tenth Amendment challenge brought by South Carolina.

Q: Are motor vehicle records public records under Georgia's Open Records Act?
A: No. They are statutorily exempt under O.C.G.A. § 40-2-130(c) and § 40-3-23(d). The default Open Records Act rule (in O.C.G.A. § 50-18-70(b)) gives citizens broad access, but the registration and title statutes carve motor vehicle records out of that default. The DPPA reinforces the carve-out at the federal level.

Q: Who can the Department of Revenue release the data to under Georgia law?
A: The opinion identifies four categories. Under § 40-2-130(c) for registration records: licensed dealers; tax collectors, tax receivers, and tax commissioners; the director of the Environmental Protection Division (or a designee); and private persons meeting § 40-2-25 requirements (only for the sole purpose of electronic registration renewal). Under § 40-3-23(d) for title records: licensed dealers and tax officials. And under § 33-34-9: insurers may be granted electronic access to individual motor vehicle records.

Q: What if a state agency wants to give the data to a private vendor that is building a consumer-facing app for the agency?
A: The opinion treats this as an indirect path that runs into the same prohibition. The Department's permitted disclosures are to the specific recipients listed in the three statutes, and using a state-agency conduit to forward data to a private developer falls outside that list unless the developer separately fits one of the categories (such as a § 40-2-25 electronic-renewal agent).

Q: What does "personal information" cover under DPPA?
A: 18 U.S.C. § 2725(3) defines it as information identifying an individual, including photograph, social security number, driver identification number, name, address (other than 5-digit zip), telephone number, and medical or disability information. Vehicular accidents, driving violations, and driver status are NOT personal information for DPPA purposes. The narrower category of "highly restricted personal information" in § 2725(4) covers photo or image, SSN, and medical or disability information, and gets even tighter protection.

Q: Does federal law preempt Georgia law on this?
A: Yes, and consistently with the federal floor. The opinion cites Oklahoma ex rel. Okla. Dep't of Pub. Safety v. United States (10th Cir. 1998) for the preemption point. The Georgia statutes track the DPPA's permitted-purposes framework, so the two regimes line up rather than conflict.

Q: Are there sub-purposes inside the DPPA that an agency could use?
A: Yes. 18 U.S.C. § 2721(b) lists fourteen specific permitted uses (motor vehicle safety, theft, emissions, recalls, performance monitoring, certain government functions, court use, insurance underwriting, anti-fraud, etc.). Some of those subsections require express consent of the individual when "highly restricted personal information" is involved. The opinion does not work through each one but flags them as the operative federal authority.

Background and statutory framework

GRATIS is the centralized state database the Department of Revenue maintains for motor vehicle registration and title information. Counties feed registration and title transactions into GRATIS, which gives the State a near-real-time consolidated view. Because that consolidated view contains personal information for nearly every Georgia driver, the disclosure rules are conservative.

The federal layer is the DPPA. In its 1994 form and its later amendments, the DPPA prohibits state DMVs from "knowingly disclosing or otherwise making available" personal information about any individual in connection with a motor vehicle record except for the listed permitted uses. The Supreme Court's Reno v. Condon decision settled the constitutional question in 2000, holding the DPPA does not violate the Tenth Amendment because it regulates the State as an owner of databases in interstate commerce, not as a sovereign.

The Georgia layer is the three statutes the AG cites. Each one starts by declaring registration or title records exempt from the Open Records Act, then enumerates the permitted recipients, and ties access back to the DPPA's permissible-use framework. The AG's reading harmonizes the three statutes under a presumption that the General Assembly knew about the DPPA when it wrote them.

The opinion does not address the procedural mechanics (who logs the access, how a recipient certifies a permitted purpose, how penalties for misuse are imposed). That is administrative regulation territory. The legal point is the disclosure rule itself.

Citations and references

Federal statutes:
- 18 U.S.C. § 2721(a), DPPA prohibition on disclosure
- 18 U.S.C. § 2721(b)(1)-(14), permitted uses
- 18 U.S.C. § 2725(3), (4): personal information and highly restricted personal information

Georgia statutes:
- O.C.G.A. § 40-2-130, registration records exemption and permitted recipients
- O.C.G.A. § 40-3-23, title records exemption and permitted recipients
- O.C.G.A. § 33-34-9, electronic insurer access
- O.C.G.A. § 40-2-25, private electronic-renewal agent requirements
- O.C.G.A. § 50-18-70(b): Open Records Act default

Cases:
- Reno v. Condon, 528 U.S. 141 (2000), DPPA upheld against Tenth Amendment challenge
- Oklahoma ex rel. Okla. Dep't of Pub. Safety v. United States, 161 F.3d 1266 (10th Cir. 1998), DPPA preempts contrary state law
- Poteat v. Butler, 231 Ga. 187 (1973), statutes are construed in harmony with existing law

Prior AG opinion:
- 1997 Op. Att'y Gen. 97-18: General Assembly is presumed to know existing law

Source

• Landing page: https://law.georgia.gov/opinions/2008-2
• Original PDF: not linked from landing page

Original opinion text

You have asked if the Department of Revenue (hereinafter the "Department") may provide State agencies with access to information contained in the Georgia Registration and Title Information System (hereinafter "GRATIS"). You have advised that GRATIS is a system that enables participating Georgia counties to provide the State with automated up-to-date motor vehicle registration and title processing information for its central database. The Department has received several inquiries regarding the propriety of providing access to GRATIS information to state agencies for the following reasons: State agency seeking the information for its internal use only in performance of its duties; or State agency seeking to assist a non-governmental third party who is developing a computer system for use by the general public that interacts with the agency and assists it with its duties; or State agency seeking to assist a non-governmental third party who is developing a computer system for use by the general public that does not interact with the agency per se, but furthers a related agency issue; or State agency interacting with a non-governmental third party to develop and operate a computer system on behalf of the agency in the furtherance of its duties. Pursuant to Georgia law, motor vehicle registration records and certificates of title are exempt from disclosure under Georgia's Open Records Act [1] unless disclosure is required under the Driver's Privacy Protection Act of 1994, 18 U.S.C. §§ 2721-2725 (hereinafter the "DPPA") [2], or by certain statutorily designated users. O.C.G.A. § 40-2-130(c); O.C.G.A. § 40-3-23(d); O.C.G.A. § 33-34-9. The DPPA provides that [a] State department of motor vehicles, and any officer, employee, or contractor thereof, shall not knowingly disclose or otherwise make available to any person or entity: (1) personal information, as defined in 18 U.S.C. 2725(3), about any individual obtained by the department in connection with a motor vehicle record, except as provided in subsection (b) . . . ; or (2) highly restricted personal information, as defined in 18 U.S.C. 2725(4), about any individual obtained by the department in connection with a motor vehicle record, without the express consent of the person to whom such information applies, except uses permitted in subsections (b)(1), (b)(4), (b)(6), and (b)(9) . . . . 18 U.S.C. § 2721(a). [3] Subsection (b) of 18 U.S.C. § 2721 requires a State department of motor vehicles (hereinafter "DMV") to disclose personal information for use in connection with matters of motor vehicle or driver safety and theft, motor vehicle emissions, motor vehicle product alterations, recalls, or advisories, performance monitoring of motor vehicles and dealers by motor vehicle manufacturers, and removal of non-owner records from the original owner records of motor vehicle manufacturers to carry out the purposes of titles I and IV of the Anti Car Theft Act of 1992, the Automobile Information Disclosure Act, the Clean Air Act, and chapters 301, 305, and 321-331 of title 49 . . . . 18 U.S.C. § 2721(a). [4] Furthermore, subsection (b) permits a DMV to disclose personal information for certain other purposes. [5] Pursuant to O.C.G.A. § 40-2-130, O.C.G.A. § 40-3-23, and O.C.G.A. § 33-34-9, the Department is authorized to disclose motor vehicle information only to the statutorily designated users. Specifically, O.C.G.A. § 40-2-130 provides that motor vehicle registration records may be disclosed for use as provided in the DPPA and by the following: Any licensed dealer of new or used motor vehicles; Any tax collector, tax receiver, or tax commissioner; The director of the Environmental Protection Division of the Department of Natural Resources or his or her designee; and Any private person who has met the requirements of Code Section 40-2-25, provided that the information shall be used for the sole purpose of effectuating the registration or renewal of motor vehicles by electronic or similar means . . . . O.C.G.A. § 40-2-130(c). Likewise, O.C.G.A. § 40-3-23 provides that certificate of title records may be disclosed for use as provided in the DPPA and by the following: Any licensed dealer of new or used motor vehicles; and Any tax collector, tax receiver, or tax commissioner. O.C.G.A. § 40-3-23(d). Furthermore, O.C.G.A. § 33-34-9 provides that "an insurer may be granted access via electronic means to individual motor vehicle records . . . ." Two basic tenets of statutory construction are that the General Assembly is presumed to enact legislation with full knowledge of the existing conditions of the law and that statutes are to be construed in connection and in harmony with existing law. 1997 Op. Att'y Gen. 97-18 (citing Poteat v. Butler, 231 Ga. 187, 188 (1973)). Applying these rules of statutory construction to O.C.G.A. § 40-2-130, O.C.G.A. § 40-3-23, and O.C.G.A. § 33-34-9, it appears that the General Assembly intended to restrict the disclosure of personal information from motor vehicle records only to the users designated in the statutes. Based on the foregoing, it is my official opinion that the Department of Revenue is authorized to provide access to the information contained in the Georgia Registration and Title Information System only for the purposes mandated by the Driver's Privacy Protection Act of 1994, or to those state agencies designated in O.C.G.A. § 40-2-130(c), O.C.G.A. § 40-3-23(d), and O.C.G.A. § 33-34-9. Prepared by: KEILANI KIMES-PARKER Assistant Attorney General [1] The Georgia Open Records Act states in pertinent part that "[a]ll public records of an agency … except those which by order of a court of this state or by law are prohibited or specifically exempted from being open to inspection by the general public, shall be open for a personal inspection by any citizen of this state at a reasonable time and place; and those in charge of such records shall not refuse this privilege to any citizen." O.C.G.A. § 50-18-70(b). [2] Congress enacted the DPPA in order to protect individuals against public sector use of driver's license data and the negative consequences arising from the widespread market availability of such data. Driver's Privacy Protection Act: Hearings on H.R. 3365 Before the Subcomm. on Civil and Const. Rights 103d Cong. (1994) (statement of Congressman James P. Moran), available in Fed. Doc. Clearing House, Feb. 4, 1994. 52 Stan. L. Rev. 1125, 1145. Accordingly, the DPPA regulates the disclosure of personal information contained in the records of state motor vehicle departments. See Reno v. Condon, 528 U.S. 141, 143 (2000). In regulating such information, the DPPA preempts contrary state law. See Oklahoma ex rel. Okla. Dep't of Pub. Safety v. United States, 161 F.3d 1266, 1272 (10th Cir. 1998); see also Reno, 528 U.S. at 143. [3] 18 U.S.C. § 2725(3) and (4) define "personal information" as information that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information, but does not include information on vehicular accidents, driving violations, and driver's status, and "highly restricted personal information" as an individual's photograph or image, social security number, medical or disability information, respectively. [4] Reno, 528 U.S. at 143; see also 18 U.S.C. § 2721(b). [5] Reno, 528 U.S. at 143; see also 18 U.S.C. § 2721(b)(1) through (14).