When the public asks the DMV or a local police department for a copy of a NC traffic accident report, what has to be redacted under the federal Drivers Privacy Protection Act, and what stays public?

Plain-English summary

DMV Commissioner George Tatum asked the AG to sort out how the federal Drivers Privacy Protection Act (DPPA) and the NC Public Records Act interact when someone requests an accident report. He also asked about vehicle registration data shared with local property tax authorities.

The DPPA was passed in 1994 after actress Rebecca Schaeffer was murdered by a stalker who got her home address from the California DMV. The federal law prohibits a state DMV from "knowingly disclosing" personal identifying information from motor vehicle records, with limited exceptions. The penalty for substantial noncompliance is up to $5,000 per day. The U.S. Supreme Court upheld the DPPA against a 10th Amendment challenge by NC and other states, so the DPPA preempts contrary state law.

The AG worked through three concrete scenarios:

Accident reports requested from DMV. The DPPA defines "personal information" to exclude "information on vehicular accidents, driving violations, and driver's status." So accident-narrative information itself is not protected. But an accident report typically includes both unprotected information and protected fields (driver names, addresses, license numbers, photographs, etc.). The AG's rule: the accident report is a public record, but DMV must redact DPPA-protected fields before releasing it.

Accident reports held by local law enforcement (TRACS system). NC officers prepare accident reports electronically and forward them to DMV through the TRACS system. Sometimes the local agency keeps no paper copy. The AG held that the report becomes a public record at the time the officer creates it, regardless of electronic form. Local law enforcement agencies are not DMVs, so the DPPA's restrictions do not bind them directly. They should release the report under the Public Records Act. DMV is separately subject to the DPPA when fulfilling a request to DMV.

Vehicle registration data shared with local tax authorities. DMV cooperates monthly with local property tax assessors, transferring vehicle registration data so counties can list, assess, and collect personal property taxes on vehicles. § 105-330.2(c) specifically authorizes this. NC's property tax statutes require local tax authorities to maintain public tax books, hold public review board hearings, and file records in publicly accessible locations. The AG read all of this together to conclude that the routine vehicle-registration data flowing from DMV to local tax authorities is still public under NC law. The DPPA exception in 18 U.S.C. § 2721(b)(1) (authorized release to government agencies for their functions) supports the cooperation. Once the data lives in the local tax authority's records, it is governed by the NC Public Records Act, not the DPPA.

The AG flagged that federal court interpretations of the DPPA could change the analysis, but at the time of the opinion the rule above was the working answer. The opinion is signed by Grayson G. Kelley, Chief Deputy AG.

Currency note

This opinion was issued in 2005. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

The DPPA itself has not been substantially amended, but federal court interpretations have continued to develop (most notably Maracich v. Spears, 570 U.S. 48 (2013), on the litigation-related disclosure exception). North Carolina law and DMV procedures have also evolved. Anyone applying this rule today should consult current law and any subsequent AG opinions.

Common questions

Q: Can I get a friend's accident report from DMV?
A: You can request it. DMV will release the report with DPPA-protected personal information redacted. You can typically see the narrative facts (when, where, what happened, vehicles involved by make/model/VIN), but not the protected personal identifiers.

Q: Can my insurance company get the unredacted report?
A: The DPPA contains exceptions for insurance claims processing and other permitted purposes. Insurance companies typically get more complete reports through statutory permitted-use channels.

Q: Why can the local police give me more information than the DMV?
A: The DPPA's restrictions apply specifically to state departments of motor vehicles. A local police department is not a DMV. NC's Public Records Act governs the local agency's release.

Q: Do I need to give a reason to get an accident report?
A: Not under the Public Records Act, which presumes public access. The DPPA has exceptions tied to use (litigation, insurance, research, etc.) that may unlock more data, but the basic redacted report is available to anyone.

Q: Are vehicle registration tax records public at the county level?
A: Yes. NC's property tax statutes require public tax books and public meetings of boards of equalization and review. The AG's opinion treats the routine data flow from DMV to local tax authorities as supporting public local tax records.

Q: What about social security numbers, photographs, and medical info?
A: These are "highly restricted personal information" under 18 U.S.C. § 2725(4) and require permitted-purpose access even where the DPPA's broader categories are unlocked.

Background and statutory framework

The DPPA was Congress's response to a privacy crisis that emerged once state DMVs began selling or freely releasing driver registration data in bulk. The statute fences off "personal information" by default and lists 14 permitted-use exceptions in 18 U.S.C. § 2721(b). North Carolina passed § 20-43.1 in 1997 to align state DMV practice with the federal law.

NC's Public Records Act starts from the opposite default: public records are public. The AG's job in this opinion is to thread the two regimes. The clean cuts are:

• Within DMV records: the DPPA controls, NC public records yields where there is a direct conflict.
• Outside DMV records (records created by local agencies, even if duplicative of DMV data): NC Public Records Act controls.
• Vehicle accident details (as distinct from driver identification fields): excluded from the DPPA's "personal information" definition, so still public.

The opinion is part of a broader pattern in NC AG advice during the early 2000s: read federal preemption narrowly, respect NC's strong public-records tradition where the federal law leaves room.

Citations

• 18 U.S.C. § 2721 et seq. (Drivers Privacy Protection Act)
• 18 U.S.C. § 2725 (DPPA definitions)
• 18 U.S.C. § 2723(b) (DPPA civil penalty)
• N.C.G.S. § 132-1 et seq. (Public Records Act)
• N.C.G.S. § 132-6.1(a) (electronic records access)
• N.C.G.S. § 20-43.1 (NC DMV compliance with DPPA)
• N.C.G.S. § 20-166.1(e) (accident reports, local forwarding)
• N.C.G.S. §§ 105-319, 105-321, 105-322, 105-330.2(c) (county tax records)
• Oklahoma ex rel. Oklahoma Dep't of Public Safety v. United States, 161 F.3d 1266 (10th Cir. 1998)

Source

• Landing page: https://ncdoj.gov/legal-services/archived-opinions/

Original opinion text

February 9, 2005

Mr. George Tatum
Commissioner, North Carolina Division of Motor Vehicles
3148 Mail Service Center
Raleigh, North Carolina 27699-3148

Re: Advisory Opinion: Drivers Privacy Protection Act (18 U.S.C. § 2721, et seq.)

Dear Commissioner Tatum:

You have requested an opinion concerning the application of the federal Drivers Privacy Protection Act ("DPPA"), 18 U.S.C. § 2721, et seq., to certain motor vehicle records in view of North Carolina's Public Records Act, N.C. GEN. STAT. § 132-1, et seq. Specifically, you have inquired as to the legal obligations of the Division of Motor Vehicles ("DMV") and local law enforcement agencies upon receiving a request for a copy of a motor vehicle accident report. You have also asked whether vehicle registration information obtained from DMV by local taxing authorities is subject to disclosure under the Public Records Act.

Prior to September 1997, all DMV records were subject to the Public Records Act and were publicly available upon request. The only information that could not be obtained by the public was confidential medical information, social security numbers, signatures, and photographs. See N.C. Gen. Stat. § 20-9(g)(4)(h)(1995); § 20-7(b1)(1995); § 20-43(a)(1997). In 1994, in direct response to the murder of actress Rebecca Shaeffer at the hands of a stalker who obtained her home address from the California DMV, Congress passed the DPPA as part of the 1994 Omnibus Crime Bill. The DPPA, effective 17 September 1997 (three years from the date it passed Congress), prohibits a state department of motor vehicles, or any officer, employee, or contractor thereof, from knowingly disclosing any personal identifying information contained in a state motor vehicle record. 18 U.S.C. § 2721(a). Failure to substantially comply with the DPPA may subject a state department of motor vehicles to a civil penalty of up to $5,000 per day. 18 U.S.C. § 2723(b). A "motor vehicle record" is defined as "any record that pertains to a motor vehicle operator's permit, motor vehicle title, motor vehicle registration, or identification card issued by a department of motor vehicles." 18 U.S.C. § 2725(1). (The DPPA does, however, contain a number of exceptions to the non-disclosure requirement. See 18 U.S.C. § 2721(b).) Because the DPPA conflicted, in some respects, with the North Carolina Public Records Act, the General Assembly in 1997 adopted N.C. GEN. STAT. § 20-43.1 to bring North Carolina into compliance with the federal requirements. This statute mandates that the Division shall only disclose personal information contained in motor vehicle records in accordance with the DPPA. G.S. § 20-43.1(a).

North Carolina was one of a number of states that challenged the constitutionality of the DPPA on grounds that the federal law violated the 10th Amendment of the United States Constitution. Although the federal district court declared the DPPA unconstitutional, the United States Supreme Court unanimously held that Congress had the power under the Commerce Clause to require the states to comply with the DPPA. Therefore, federal law controls, and the State's Public Records Act is preempted by the DPPA where there is a direct conflict. See Oklahoma ex rel. Oklahoma Dep't of Public Safety v. United States, 161 F.3d 1266, 1272 (10th Cir. 1998) ("the DPPA directly regulates the disclosure of [personal information from motor vehicle records] and preempts contrary state law"), cert. denied, 528 U.S. 1114, 120 S. Ct. 930, 145 L. Ed. 2d 810 (2000).

As to the applicability of the DPPA to the disclosure of motor vehicle accident reports, we are not aware of a court decision determining whether accident reports are included within the definition of "motor vehicle records." The DPPA does, however, specifically define "personal information" and "highly restricted personal information" within a motor vehicle record which a state department of motor vehicles is prohibited from disclosing except under certain circumstances. "Personal information" is defined as "information that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information but does not include information on vehicular accidents, driving violations, and driver's status." 18 U.S.C. § 2725(3). "Highly restricted personal information" is defined as "an individual's photograph or image, social security number [and] medical or disability information." 18 U.S.C. § 2725(4). Read in context, it is our view that the intent of Congress in enacting the DPPA was to restrict a state department of motor vehicles from releasing certain personal identifying information in records obtained and maintained in connection with the department's responsibility for the regulation of drivers and motor vehicles. Such personal identifying information may be contained within a variety of official motor vehicle records, including accident reports.

In responding to a request for information under North Carolina's Public Records law, the relevant inquiry for DMV must therefore be whether the document contains personal identifying information about a motor vehicle operator which cannot be disclosed under the DPPA. An accident report will likely include both information which is protected by the DPPA and information which is excepted from the DPPA. In fact, the DPPA's definition of protected personal information "excludes information on vehicular accidents, driving violations and driver's status." 18 U.S.C. § 2725(3). It is therefore our opinion that motor vehicle accident reports are public records, but should be released only after DMV has redacted personal identifying information in accordance with the DPPA.

Your opinion request also references issues that have been raised as a result of DMV's implementation of a new computerized accident reporting system referred to as TRACS. It is our understanding that the system allows an officer investigating a motor vehicle accident to prepare an electronic report at the scene and simultaneously forward it to DMV. In certain instances a local law enforcement agency has failed to maintain a copy of the report, relying instead on DMV's ability to provide a copy upon future request. The DPPA, however, also places disclosure restrictions on recipients of personal identifying information obtained from DMV. 18 U.S.C. § 2721(c). Your question is therefore whether a copy of an accident report transmitted from DMV back to a local law enforcement agency is subject to the DPPA's confidentiality requirements.

Pursuant to N.C. GEN. STAT. § 20-166.1(e) a local law enforcement officer investigating a reportable accident is required to prepare a written report and forward it to the appropriate local law enforcement agency within 24 hours. The local law enforcement agency receiving the report is required to forward it to DMV within ten days. An accident report prepared by a law enforcement officer is a public record under the Public Records Act at the time it is prepared. See N.C. GEN. STAT. § 132-1. Creation of an accident report in electronic form does not alter the status of the report as a public record. Public agencies are, in fact, precluded from acquiring electronic systems which impede public access to records. N.C. GEN. STAT. § 132-6.1(a).

Inasmuch as the DPPA's restrictions generally apply only to a state department of motor vehicles, local law enforcement agencies should fully comply with the Public Records Act in responding to an accident report request. In our opinion, a public record is created at the time an electronic accident report is prepared by an officer. Transmittal of the report to DMV through the TRACS system neither subjects the report to the DPPA nor affects its status as a public record from the standpoint of the local law enforcement agency. DMV's implementation of the TRACS system should therefore have no impact on the ability of local law enforcement agencies to comply with the Public Records Act. As previously stated, however, DPPA requirements do apply to DMV and requests for accident reports to DMV must be responded to accordingly.

You have also asked whether vehicle registration information provided to local taxing authorities is subject to the confidentiality restrictions of the DPPA. Pursuant to the requirements of N.C. GEN. STAT. § 105-330.2(c) DMV cooperates with the Department of Revenue, Property Tax Division, to provide monthly vehicle registration information to local governments for property tax assessment purposes. The procedures and requirements for local governments to compile, publish and publicly file tax records are set out in Article 20 of Chapter 105. In general, North Carolina's system of personal property taxation involves a comprehensive scheme of listing, assessment and collection. Records documenting this process are generally on file and open for public inspection.

At least one county has declined a request for vehicle property tax information based upon a belief that registration information obtained from DMV is subject to the DPPA and therefore confidential. Although we acknowledge that a literal reading of the DPPA's definition of "personal information," without context to the overall statutory scheme, can be interpreted to preclude the release of information connecting a particular vehicle to an individual name and address. We believe the better interpretation, however, allows a local taxing authority to release vehicle tax information in accordance with North Carolina's Public Records Act.

DMV is clearly authorized to provide vehicle registration information to local governments as necessary for the carrying out of their functions. 18 U.S.C. § 2721(b)(1). As previously noted, the statutory process through which local taxing authorities list, appraise, assess and collect property taxes requires the publication and distribution of individual tax information at various points in the process. For example, each local taxing authority is required to prepare annually a tax book which shows individual taxpayer information, including personal property valuation and taxation. N.C. GEN. STAT. § 105-319. County tax records are required to be filed in the office of the county tax assessor or some other public county office. N.C. GEN. STAT. § 105-321(a). A county board of equalization and review has a duty to hold public meetings for the purpose of reviewing county tax lists, hearing appeals and making such corrections to the tax records as it may determine appropriate. N.C. GEN. STAT. § 105-322. This well-established statutory process would be substantially impeded if motor vehicle registration information obtained from DMV was required to be kept confidential.

The majority of the vehicle information provided by DMV to local taxing authorities, such as vehicle make and model, VIN number, odometer reading, inspection dates, purchase price, insurance and whether the vehicle has been branded as a flood or salvage vehicle, clearly does not involve personal identifying information covered by the DPPA. Furthermore, most information obtained monthly from DMV is duplicative of information already in the possession of local taxing authorities and available to the public. Vehicle registration renewal information, for example, essentially reaffirms on an annual basis that the vehicle is still possessed by the same individual and subject to taxation by the local taxing authority. The only information obtained from DMV by a local taxing authority which may arguably fall within the DPPA's definition of personal information is therefore the name and address of an individual who has purchased a particular vehicle within the previous twelve months. We do not believe it was the intent of Congress in enacting the DPPA to prohibit local taxing authorities from releasing such generic information when required by state tax laws. Likewise, it is our opinion that such tax information is a public record under the Public Records Act.

We recognize that the courts may eventually provide clarification of the DPPA's requirements which conflicts with the advice offered in this opinion. Federal officials may also, at some point, choose to advise North Carolina of their interpretation of the DPPA's confidentiality requirements. Until such time, however, it is our opinion that DMV is required by the DPPA to redact "personal information" and "highly restricted personal information" from documents, such as accident reports, provided to the public. Otherwise, the requirements of the Public Records Act should be complied with by DMV and local law enforcement agencies. Motor vehicle registration information provided by DMV to local taxing authorities should also be provided upon request in accordance with the Public Records Act.

Very truly yours,

Grayson G. Kelley
Chief Deputy Attorney General