Must NC DMV redact personal information from accident reports under the federal Drivers Privacy Protection Act, and what about local law enforcement copies and tax records?

Plain-English summary

DMV Commissioner George Tatum asked the AG how the federal Drivers Privacy Protection Act ("DPPA") interacted with North Carolina's Public Records Act. Specifically, how should DMV and local police handle accident report requests, and could local tax authorities use DMV registration data in tax records they made public.

The AG worked through the layered federal-state framework.

Background on DPPA. Before September 1997, NC DMV records were public except for a narrow list (medical info, SSN, signatures, photographs). Congress passed the DPPA in 1994 in response to the murder of actress Rebecca Schaeffer (a stalker had obtained her home address from the California DMV). The DPPA, effective in 1997, prohibits state DMVs from disclosing personal identifying information from motor vehicle records, with penalties up to $5,000 per day for non-compliance. NC enacted § 20-43.1 in 1997 to bring DMV in line. The US Supreme Court unanimously upheld DPPA against a 10th Amendment challenge, so federal law preempts contrary state public records law where there is a direct conflict.

DMV's obligation on accident reports. No federal court had decided whether accident reports were "motor vehicle records" under DPPA. The AG read the statute purposively. DPPA defines "personal information" to mean information identifying an individual (photograph, SSN, driver ID, name, address, phone, medical/disability info) and excludes information on vehicular accidents, driving violations, and driver status. The DPPA's intent was to prevent state DMVs from releasing identifying information that came in connection with regulating drivers and vehicles. That intent reached identifying information that happened to appear in accident reports too. So DMV must redact personal information before releasing accident reports to the public.

Local law enforcement copies. Different answer. Under N.C.G.S. § 20-166.1(e), a local officer prepares an accident report and forwards it to the local agency within 24 hours; the agency then forwards to DMV within 10 days. The AG concluded the report became a public record under § 132-1 when the officer prepared it. Electronic preparation through the new TRACS system did not change that. DMV's electronic re-transmission back to the local agency did not subject the local copy to DPPA, because DPPA's restrictions generally apply to state DMVs, not local police. Local agencies thus complied with the NC Public Records Act on their own copies.

Local property tax authorities. N.C.G.S. § 105-330.2(c) requires DMV to share monthly vehicle registration data with local taxing authorities for property-tax assessment. Some counties had refused to release that data, thinking DPPA confidentiality flowed through. The AG concluded the better reading allowed local tax authorities to release tax information per the Public Records Act. DPPA's § 2721(b)(1) expressly authorizes DMV to provide registration data to government functions, and the NC property tax statutory scheme (§§ 105-319, 105-321(a), 105-322) requires that tax books and review board records be public. Most of the data (make, model, VIN, odometer, inspection dates, purchase price) was not DPPA-personal anyway, and the only potentially-personal piece (name and address of a recent vehicle purchaser) fell within the tax-administration carve-out the AG inferred from the statutory scheme.

Currency note

This opinion was issued in 2005. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

The DPPA was amended in 2000 to broaden opt-in/opt-out rules, and NC has changed accident-reporting and DMV-data statutes since 2005. The Supreme Court's later decision in Maracich v. Spears, 570 U.S. 48 (2013), tightened the litigation-related permissible-use exception in ways that could affect downstream uses. Anyone with a current question should pull the current DPPA regulations and NC statutes.

Common questions

Q: At the time of the opinion, could the public still get an accident report from DMV?
A: Yes, but with personal identifying information redacted. The accident facts themselves (vehicles involved, location, time, what happened) were not DPPA-personal and remained available.

Q: Could you get the same report unredacted from the local police department?
A: Generally yes. The local agency's copy was governed by NC's Public Records Act, not DPPA, and the AG saw no statutory bar on releasing it. That said, local agencies still had to respect any state confidentiality laws independent of DPPA.

Q: Could a county tax office tell a member of the public what cars you owned?
A: Yes. Vehicle property-tax records were public under NC law, and the AG concluded that did not violate DPPA because the tax-administration use of DMV data was a permissible federal use.

Q: What was the TRACS system?
A: A new electronic accident-reporting system that let officers prepare reports at the scene and transmit them to DMV. Some agencies relied on DMV to keep the only copy. The AG concluded that electronic preparation did not strip the report of its public-record status at the local level.

Background and statutory framework

The federal layer:

• 18 U.S.C. § 2721(a). Prohibits state DMVs from disclosing personal identifying information.
• 18 U.S.C. § 2721(b). Lists permissible uses (including government functions, law enforcement, tax administration).
• 18 U.S.C. § 2721(c). Redistribution restrictions on recipients of DMV personal information.
• 18 U.S.C. § 2723(b). Civil penalties up to $5,000 per day for non-compliance.
• 18 U.S.C. § 2725. Defines "motor vehicle record," "personal information," and "highly restricted personal information."

The NC layer:

• N.C. Gen. Stat. § 20-43.1. Brings DMV into compliance with DPPA.
• N.C. Gen. Stat. § 20-166.1(e). Accident-report preparation and transmittal.
• N.C. Gen. Stat. § 132-1. General Public Records Act.
• N.C. Gen. Stat. § 132-6.1(a). Prohibits acquiring electronic systems that impede public access.
• N.C. Gen. Stat. §§ 105-319, 105-321(a), 105-322, 105-330.2(c). Property-tax records and DMV data-sharing.

The framework the AG built: DMV is bound by DPPA directly and must redact. Local agencies hold their own original copies under state public records law. Local taxing authorities can use DMV data for tax-records purposes that the federal statute itself authorizes.

The AG flagged caution at the end. Courts (and federal officials) might later interpret DPPA differently. Until then, the AG's reading governed NC practice.

The opinion was signed by Chief Deputy Attorney General Grayson G. Kelley.

Citations

• 18 U.S.C. § 2721 (DPPA)
• 18 U.S.C. § 2725 (DPPA definitions)
• N.C. Gen. Stat. § 20-43.1 (NC DMV/DPPA compliance)
• N.C. Gen. Stat. § 20-166.1(e) (accident-report procedure)
• N.C. Gen. Stat. § 132-1 (Public Records Act)
• N.C. Gen. Stat. § 132-6.1(a) (electronic-systems access)
• N.C. Gen. Stat. §§ 105-319, 105-321(a), 105-322 (property-tax records)
• N.C. Gen. Stat. § 105-330.2(c) (DMV-tax data sharing)
• Oklahoma ex rel. Oklahoma Dep't of Public Safety v. United States, 161 F.3d 1266 (10th Cir. 1998), cert. denied, 528 U.S. 1114 (2000)

Source

• Landing page: https://ncdoj.gov/opinions/drivers-privacy-protection-act/

Original opinion text

February 9, 2005

Mr. George Tatum
Commissioner, North Carolina Division of Motor Vehicles
3148 Mail Service Center
Raleigh, North Carolina 27699-3148

Re: Advisory Opinion: Drivers Privacy Protection Act (18 U.S.C. § 2721, et seq.)

Dear Commissioner Tatum:

You have requested an opinion concerning the application of the federal Drivers Privacy Protection Act ("DPPA"), 18 U.S.C. § 2721, et seq., to certain motor vehicle records in view of North Carolina's Public Records Act, N.C. GEN. STAT. § 132-1, et seq. Specifically, you have inquired as to the legal obligations of the Division of Motor Vehicles ("DMV") and local law enforcement agencies upon receiving a request for a copy of a motor vehicle accident report. You have also asked whether vehicle registration information obtained from DMV by local taxing authorities is subject to disclosure under the Public Records Act.

Prior to September 1997, all DMV records were subject to the Public Records Act and were publicly available upon request. The only information that could not be obtained by the public was confidential medical information, social security numbers, signatures, and photographs. See N.C. Gen. Stat. § 20-9(g)(4)(h)(1995); § 20-7(b1)(1995); § 20-43(a)(1997). In 1994, in direct response to the murder of actress Rebecca Shaeffer at the hands of a stalker who obtained her home address from the California DMV, Congress passed the DPPA as part of the 1994 Omnibus Crime Bill. The DPPA, effective 17 September 1997 (three years from the date it passed Congress), prohibits a state department of motor vehicles, or any officer, employee, or contractor thereof, from knowingly disclosing any personal identifying information contained in a state motor vehicle record. 18 U.S.C. § 2721(a). Failure to substantially comply with the DPPA may subject a state department of motor vehicles to a civil penalty of up to $5,000 per day. 18 U.S.C. § 2723(b). A "motor vehicle record" is defined as "any record that pertains to a motor vehicle operator's permit, motor vehicle title, motor vehicle registration, or identification card issued by a department of motor vehicles." 18 U.S.C. § 2725(1). (The DPPA does, however, contain a number of exceptions to the non-disclosure requirement. See 18 U.S.C. § 2721(b).) Because the DPPA conflicted, in some respects, with the North Carolina Public Records Act, the General Assembly in 1997 adopted N.C. GEN. STAT. § 20-43.1 to bring North Carolina into compliance with the federal requirements. This statute mandates that the Division shall only disclose personal information contained in motor vehicle records in accordance with the DPPA. G.S. § 20-43.1(a).

North Carolina was one of a number of states that challenged the constitutionality of the DPPA on grounds that the federal law violated the 10th Amendment of the United States Constitution. Although the federal district court declared the DPPA unconstitutional, the United States Supreme Court unanimously held that Congress had the power under the Commerce Clause to require the states to comply with the DPPA. Therefore, federal law controls, and the State's Public Records Act is preempted by the DPPA where there is a direct conflict. See Oklahoma ex rel. Oklahoma Dep't of Public Safety v. United States, 161 F.3d 1266, 1272 (10th Cir. 1998) ("the DPPA directly regulates the disclosure of [personal information from motor vehicle records] and preempts contrary state law"), cert. denied, 528 U.S. 1114, 120 S. Ct. 930, 145 L. Ed. 2d 810 (2000).

As to the applicability of the DPPA to the disclosure of motor vehicle accident reports, we are not aware of a court decision determining whether accident reports are included within the definition of "motor vehicle records." The DPPA does, however, specifically define "personal information" and "highly restricted personal information" within a motor vehicle record which a state department of motor vehicles is prohibited from disclosing except under certain circumstances. "Personal information" is defined as "information that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information but does not include information on vehicular accidents, driving violations, and driver's status." 18 U.S.C. § 2725(3). "Highly restricted personal information" is defined as "an individual's photograph or image, social security number [and] medical or disability information." 18 U.S.C. 2725(4). Read in context, it is our view that the intent of Congress in enacting the DPPA was to restrict a state department of motor vehicles from releasing certain personal identifying information in records obtained and maintained in connection with the department's responsibility for the regulation of drivers and motor vehicles. Such personal identifying information may be contained within a variety of official motor vehicle records, including accident reports.

In responding to a request for information under North Carolina's Public Records law, the relevant inquiry for DMV must therefore be whether the document contains personal identifying information about a motor vehicle operator which cannot be disclosed under the DPPA. An accident report will likely include both information which is protected by the DPPA and information which is excepted from the DPPA. In fact, the DPPA's definition of protected personal information "excludes information on vehicular accidents, driving violations and driver's status." 18 U.S.C. § 2725(3). It is therefore our opinion that motor vehicle accident reports are public records, but should be released only after DMV has redacted personal identifying information in accordance with the DPPA.

Your opinion request also references issues that have been raised as a result of DMV's implementation of a new computerized accident reporting system referred to as TRACS. It is our understanding that the system allows an officer investigating a motor vehicle accident to prepare an electronic report at the scene and simultaneously forward it to DMV. In certain instances a local law enforcement agency has failed to maintain a copy of the report, relying instead on DMV's ability to provide a copy upon future request. The DPPA, however, also places disclosure restrictions on recipients of personal identifying information obtained from DMV. 18 U.S.C. § 2721(c). Your question is therefore whether a copy of an accident report transmitted from DMV back to a local law enforcement agency is subject to the DPPA's confidentiality requirements.

Pursuant to N.C. GEN. STAT. § 20-166.1(e) a local law enforcement officer investigating a reportable accident is required to prepare a written report and forward it to the appropriate local law enforcement agency within 24 hours. The local law enforcement agency receiving the report is required to forward it to DMV within ten days. An accident report prepared by a law enforcement officer is a public record under the Public Records Act at the time it is prepared. See N.C. GEN. STAT. § 132-1. Creation of an accident report in electronic form does not alter the status of the report as a public record. Public agencies are, in fact, precluded from acquiring electronic systems which impede public access to records. N.C. GEN. STAT. § 132-6.1(a).

Inasmuch as the DPPA's restrictions generally apply only to a state department of motor vehicles, local law enforcement agencies should fully comply with the Public Records Act in responding to an accident report request. In our opinion, a public record is created at the time an electronic accident report is prepared by an officer. Transmittal of the report to DMV through the TRACS system neither subjects the report to the DPPA nor affects its status as a public record from the standpoint of the local law enforcement agency. DMV's implementation of the TRACS system should therefore have no impact on the ability of local law enforcement agencies to comply with the Public Records Act. As previously stated, however, DPPA requirements do apply to DMV and requests for accident reports to DMV must be responded to accordingly.

You have also asked whether vehicle registration information provided to local taxing authorities is subject to the confidentiality restrictions of the DPPA. Pursuant to the requirements of N.C. GEN. STAT. § 105-330.2(c) DMV cooperates with the Department of Revenue, Property Tax Division, to provide monthly vehicle registration information to local governments for property tax assessment purposes. The procedures and requirements for local governments to compile, publish and publicly file tax records are set out in Article 20 of Chapter 105. In general, North Carolina's system of personal property taxation involves a comprehensive scheme of listing, assessment and collection. Records documenting this process are generally on file and open for public inspection.

At least one county has declined a request for vehicle property tax information based upon a belief that registration information obtained from DMV is subject to the DPPA and therefore confidential. Although we acknowledge that a literal reading of the DPPA's definition of "personal information," without context to the overall statutory scheme, can be interpreted to preclude the release of information connecting a particular vehicle to an individual name and address. We believe the better interpretation, however, allows a local taxing authority to release vehicle tax information in accordance with North Carolina's Public Records Act.

DMV is clearly authorized to provide vehicle registration information to local governments as necessary for the carrying out of their functions. 18 U.S.C. § 2721(b)(1). As previously noted, the statutory process through which local taxing authorities list, appraise, assess and collect property taxes requires the publication and distribution of individual tax information at various points in the process. For example, each local taxing authority is required to prepare annually a tax book which shows individual taxpayer information, including personal property valuation and taxation. N.C. GEN. STAT. § 105-319. County tax records are required to be filed in the office of the county tax assessor or some other public county office. N.C. GEN. STAT. § 105-321(a). A county board of equalization and review has a duty to hold public meetings for the purpose of reviewing county tax lists, hearing appeals and making such corrections to the tax records as it may determine appropriate. N.C. GEN. STAT. § 105-322. This well-established statutory process would be substantially impeded if motor vehicle registration information obtained from DMV was required to be kept confidential.

The majority of the vehicle information provided by DMV to local taxing authorities, such as vehicle make and model, VIN number, odometer reading, inspection dates, purchase price, insurance and whether the vehicle has been branded as a flood or salvage vehicle, clearly does not involve personal identifying information covered by the DPPA. Furthermore, most information obtained monthly from DMV is duplicative of information already in the possession of local taxing authorities and available to the public. Vehicle registration renewal information, for example, essentially reaffirms on an annual basis that the vehicle is still possessed by the same individual and subject to taxation by the local taxing authority. The only information obtained from DMV by a local taxing authority which may arguably fall within the DPPA's definition of personal information is therefore the name and address of an individual who has purchased a particular vehicle within the previous twelve months. We do not believe it was the intent of Congress in enacting the DPPA to prohibit local taxing authorities from releasing such generic information when required by state tax laws. Likewise, it is our opinion that such tax information is a public record under the Public Records Act.

We recognize that the courts may eventually provide clarification of the DPPA's requirements which conflicts with the advice offered in this opinion. Federal officials may also, at some point, choose to advise North Carolina of their interpretation of the DPPA's confidentiality requirements. Until such time, however, it is our opinion that DMV is required by the DPPA to redact "personal information" and "highly restricted personal information" from documents, such as accident reports, provided to the public. Otherwise, the requirements of the Public Records Act should be complied with by DMV and local law enforcement agencies. Motor vehicle registration information provided by DMV to local taxing authorities should also be provided upon request in accordance with the Public Records Act.

Very truly yours,

Grayson G. Kelley
Chief Deputy Attorney General