Can Oregon ODOT share driver and vehicle personal information with other state agencies, and what limits apply to redisclosure?

Plain-English summary

Congress passed the federal Driver's Privacy Protection Act (DPPA) in 1994 to restrict state DMVs from disclosing personal information from motor vehicle records. Oregon implemented its own version in 1997 (ORS 802.175 to 802.191). The DMV branch chief asked the AG three questions about how the new framework worked: could ODOT share information with other state agencies, what could those agencies do with the info, and did ODOT have to monitor what they did with it?

Deputy Attorney General David Schuman answered: yes, ODOT can share with state agencies for their governmental functions (state agencies are excluded from the statutory definition of "person" that triggers ORS 802.177's general prohibition, and the DPPA's government-function exception independently permits this). State agencies can use the information to carry out their own governmental functions without triggering the redisclosure restrictions in ORS 802.181, even if that use involves passing the information to non-agency third parties as part of the function. The redisclosure restrictions kick in when an agency reveals personal information for purposes unrelated to its own governmental function (for example, responding to a generic public records request for an accident report). ODOT has no statutory duty to monitor redisclosure by recipients, but it does have authority to inspect the recordkeeping logs that non-news-media recipients must maintain.

Currency note

This opinion was issued in 1998. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Common questions

Q: Are state agencies "persons" under the Oregon statute?
A: No. ORS 802.175(2) defines "person" as "an individual, an organization or an entity," but expressly excludes the State of Oregon and its agencies. So when ORS 802.177 bars disclosure to "any person," it doesn't automatically bar disclosure to state agencies. Both ORS 802.179(1) and 18 USC § 2721(b)(1) then expressly authorize disclosure to government agencies for their functions.

Q: A police dispatcher reads a driver's address on the radio. Does that violate the redisclosure rule?
A: No. The dispatch is part of the law enforcement function. Use of the information by the police agency, even if that use involves transmitting it via radio that can be picked up by scanners, is not "resale" or "redisclosure" under ORS 802.181(1). The information is being used to carry out the agency's traffic enforcement function, exactly what ORS 802.179(1) authorizes.

Q: But what if someone requests an accident report under the Public Records Law?
A: That's redisclosure. Responding to a generic public records request isn't part of the law enforcement function; it's a separate statutory duty under ORS 192.420. So the agency must redact personal information that came from the motor vehicle record before releasing the report, unless the requester is authorized under ORS 802.179 to receive that information for an authorized purpose.

Q: What recordkeeping is required?
A: ORS 802.181(6) requires non-news-media persons who resell or redisclose information to keep records of who got what, and why, and to make those records available to ODOT on request. That gives ODOT implied authority to audit, but no mandatory duty.

Q: Why aren't journalists subject to the recordkeeping requirement?
A: ORS 802.179(14) authorizes media access for "gathering or dissemination of information related to the operation of a motor vehicle or to public safety." ORS 802.181(6) requires "a person, other than a representative of the news media" who resells or rediscloses information to keep records, so by its terms the recordkeeping requirement does not reach the news media.

Background and statutory framework

The federal DPPA (18 USC § 2721 et seq.) was enacted in 1994 and effective September 13, 1997. It generally prohibits state DMVs from knowingly disclosing personal information from motor vehicle records to "any person or entity," with exceptions. The major exception (18 USC § 2721(b)(1)) permits disclosure to any government agency in carrying out its functions. ORS 802.175 to 802.191 (enacted as Oregon Laws 1997, ch. 678) is Oregon's implementing legislation.

The Oregon framework: ORS 802.177 prohibits ODOT disclosure to any "person." ORS 802.175(2) defines person to exclude state agencies, so state-agency sharing isn't barred. ORS 802.179 sets the disclosure exceptions, with subsection (1) requiring disclosure to government agencies for their governmental functions. ORS 802.181 restricts resale/redisclosure by recipients to persons authorized to receive under ORS 802.179 and for authorized purposes.

The key analytic distinction is between "use" of information (which is what ORS 802.179(1) authorizes) and "resale or redisclosure" (which is what ORS 802.181 restricts). The AG reads "use" broadly enough to include the operational handoffs needed to carry out the governmental function (radio dispatch, including info on a traffic citation copy filed with the court). Standalone information transfers outside the governmental function require the recipient and purpose authorization under ORS 802.179.

Federal law overrides any narrower Oregon reading. The DPPA preempts inconsistent state law (Gibbons v. Ogden). Where ORS 802.181 might seem to restrict government-to-government redisclosure that the DPPA itself authorizes, the federal authorization controls.

Citations and references

Statutes and rules:
- ORS 802.175 to 802.191, motor vehicle records disclosure
- ORS 802.175(2), definition of "person"
- ORS 802.177, prohibition on disclosure
- ORS 802.179, exceptions
- ORS 802.181, redisclosure restrictions
- 18 USC § 2721 (DPPA)
- OAR 257-015-0040(5), 257-015-0060(4), LEDS rules
- Oregon Laws 1997, chapter 678 (HB 2096)

Cases:
- PGE v. Bureau of Labor and Industries, 317 Or 606, 859 P2d 1143 (1993), interpretive method
- Gibbons v. Ogden, 22 US (9 Wheat) 1 (1824), federal supremacy
- State v. Bichsel, 101 Or App 257, 790 P2d 1142 (1990), police radio public accessibility

Source

• Landing page: https://www.doj.state.or.us/oregon-department-of-justice/office-of-the-attorney-general/attorney-general-opinions/
• Original PDF: https://www.doj.state.or.us/wp-content/uploads/1998/09/op8261.pdf

Original opinion text

September 18, 1998
No. 8261

This opinion is issued in response to questions from Jan Curry, Manager of the Driver and Motor Vehicle Services Branch
of the Oregon Department of Transportation (ODOT), about ORS 802.175 to 802.191, enacted as chapter 678, Oregon
Laws 1997 (House Bill 2096). These statutes govern the disclosure and redisclosure of personal information from motor
vehicle records.
FIRST QUESTION PRESENTED
Is ODOT prohibited by ORS 802.177 from disclosing personal information from motor vehicle records to
other agencies of the State of Oregon?
ANSWER GIVEN
ORS 802.177 does not prohibit ODOT from disclosing personal information from motor vehicle records to state agencies,
although unrestricted disclosure to state agencies would be prohibited by federal law. ODOT may disclose personal
information from motor vehicle records to state agencies as mandated by ORS 802.179(1) or as permitted by 18 USC
ß 2721(b).
SECOND QUESTION PRESENTED
To what extent does ORS 802.181(1) restrict a government agency's use of personal information obtained
from motor vehicle records under ORS 802.179(1)?
ANSWER GIVEN
ORS 802.181 does not restrict a government agency's use of personal information in carrying out that agency's
governmental functions. ORS 802.181 prohibits an agency's resale or redisclosure of personal information for purposes
other than those authorized by ORS 802.179.
THIRD QUESTION PRESENTED
Does ODOT have a duty to control, restrict or monitor the redisclosure of personal information it has
provided under ORS 802.179?
ANSWER GIVEN
No.
DISCUSSION
On September 13, 1994, Congress enacted the federal Driver's Privacy Protection Act (DPPA), Pub L No. 103-322, Title
XXX, ch 123, 108 Stat 2099 (1994). Subject to various exceptions, this law generally prohibits a state department of motor
vehicles from knowingly disclosing personal information about an individual obtained in connection with a motor vehicle
record to any person or entity. 18 USC ß 2721(a). Exceptions to the prohibition authorize disclosure of personal
information for various business or governmental uses, including use by a government agency in carrying out its functions.
18 USC ß 2721(b)(1). Those persons and entities authorized by the statute to obtain personal information are restricted in
their ability to resell or redisclose such information. 18 USC ß 2721(c). The DPPA became effective on September 13,
1997, three years from the date of its enactment, in order to give the states an opportunity to implement any law or
procedural changes necessary to comply with its provisions.
To implement the DPPA and to protect the privacy and safety of Oregon citizens, ORS 802.175 to 802.191 were enacted
effective September 13, 1997. Testimony of Representative Tim Josi, Senate Transportation Committee (HB 2096), May
19, 1997, tape 95, side A at 30.
Oregon's new statutes are substantially similar to the DPPA. ORS 802.177 prohibits ODOT from disclosing personal
information obtained in connection with a motor vehicle record to any person, while ORS 802.179 sets out the exceptions
to that general prohibition on disclosure. There are also restrictions on the resale or redisclosure of personal information by
a person or government agency authorized under ORS 802.179 to receive such information, and record-keeping
requirements for any authorized resale or redisclosure of the information. ORS 802.181.
The questions asked require us to interpret these new state statutes. In interpreting a statute, our goal is to discern the intent
of the legislature. ORS 174.020; PGE v. Bureau of Labor and Industries (PGE), 317 Or 606, 610, 859 P2d 1143 (1993).
We first look at the text and context of the statute, which includes other provisions of the same statute and related statutes.
In so doing, we consider statutory and judicially developed rules of construction that bear directly on how to read the text,
such as the rule that "words of common usage typically should be given their plain, natural, and ordinary meaning." Id. at
611. If the legislative intent is clear from the text and context, the search ends there. Only if the legislative intent is not
clear from the text and context of the statute will we look to the legislative history to attempt to discern that intent. Id. at
611-612. If, after considering text, context and legislative history, the intent of the legislature remains unclear, we may
resort to general maxims of statutory construction to resolve any remaining uncertainty as to the meaning of the statute. Id.
at 612.
I. Disclosure by ODOT to Agencies of the State of Oregon
We are first asked whether ORS 802.177 prohibits ODOT from disclosing personal information from motor vehicle
records to other agencies of the State of Oregon. ORS 802.177 states:
Except as otherwise provided in ORS 802.179, neither the Department of Transportation nor any officer,
employee or contractor of the department may knowingly disclose or otherwise make available to any
person personal information about an individual that is obtained by the department in connection with a
motor vehicle record.
(Emphasis added.) ORS 802.177 prohibits ODOT from disclosing personal information to any "person." A "person" is
defined as "an individual, an organization or an entity, but does not include the State of Oregon or any agency thereof."
ORS 802.175(2). Because state agencies are expressly excluded from the statutory definition of "person," it follows that
ORS 802.177 does not prohibit ODOT from disclosing personal information from a motor vehicle record to a state agency.
Although we conclude that ORS 802.177 does not prohibit ODOT from disclosing personal information from motor
vehicle records to state agencies, such disclosure must also be permitted by the DPPA to be lawful. The DPPA's provisions
override inconsistent provisions of state law. See US Const Art VI, cl 2 ("This Constitution, and the Laws of the United
States which shall be made in Pursuance thereof * * * shall be the supreme Law of the Land"); Gibbons v. Ogden, 22 US
(9 Wheat) 1, 210-211, 6 L Ed 23 (1824) (state law that is contrary to valid federal law must yield).
The DPPA prohibits a state department of motor vehicles, subject to certain exceptions, from disclosing personal
information to any "person or entity." 18 USC ß 2721(a). The term "entity" includes a state agency. Accordingly, we
review the exceptions to the DPPA's general prohibition of disclosure to determine whether, and for what purposes, they
permit ODOT's disclosure of personal information from motor vehicle records to other state agencies.
The DPPA expressly permits disclosure of personal information for use by "any government agency * * * in carrying out
its functions." 18 USC ß 2721(b)(1). This DPPA provision has its counterpart in ORS 802.179(1), which provides:
The Department of Transportation, upon request or as required by law, shall disclose personal information
from a motor vehicle record to a government agency for use in carrying out its governmental functions.
ORS 802.179(1).
The term "government agency" is not defined either in the DPPA or in ORS 802.175 to 802.191. In its common usage,
"governmental agency" includes a state agency. Its legal definition is "a subordinate creature of federal, state or local
government created to carry out a governmental function or to implement a statute or statutes." Black's Law Dictionary
696 (6th ed 1990). We conclude that, for purposes of both the DPPA and ORS 802.175 to 802.191, the term "government
agency" includes an agency of the State of Oregon and that ODOT must disclose personal information to such agencies for
use in carrying out their governmental functions. There is no conflict between the disclosure to state agencies that is
permitted by 18 USC ß 2721(b)(1) and the disclosure to state agencies mandated by ORS 802.179(1).
Several of the other exceptions to the federal prohibition on disclosure would also permit disclosure to state agencies. See,
e.g., 18 USC ß 2721(b)(5), (13). ORS 802.179 either does not contain similar provisions or restricts the authorized
disclosures to "persons." Nevertheless, because of our conclusion above that ORS 802.177 does not prohibit ODOT from
disclosing personal information to state agencies, the lack of express authorization in state law is irrelevant. Accordingly,
we conclude that ODOT may disclose personal information from motor vehicle records to state agencies as mandated by
ORS 802.179(1) or as permitted by 18 USC ß 2721(b).
II. Government Agency's Use of Personal Information
We are next asked to what extent ORS 802.181(1) restricts a government agency's use of personal information obtained
from motor vehicle records under ORS 802.179(1). ORS 802.181(1) provides that, with certain exceptions,
a person or government agency that is authorized under ORS 802.179 to receive personal information from
motor vehicle records may resell or redisclose the information only to a person authorized to receive it
under ORS 802.179 and only for purposes authorized under ORS 802.179.
ORS 802.181(1) thus establishes the conditions under which a person or government agency authorized to obtain personal
information from ODOT pursuant to ORS 802.179 may "resell" or "redisclose" such information to someone else. The
person to whom the information will be resold or redisclosed must be authorized to receive it and that person must intend
to use the information for an authorized purpose.
For example, under ORS 802.179(14), representatives of the news media may obtain personal information "for the
gathering or dissemination of information related to the operation of a motor vehicle or to public safety." See also 18 USC
ß 2721(b)(14). Consequently, a government agency may "resell" or "redisclose" personal information that it obtains from
motor vehicle records under ORS 802.179(1) to a representative of the news media for that representative to use in
gathering or disseminating information related to the operation of a motor vehicle or to public safety. In this case, both the
person who will receive the information and the intended use are authorized under ORS 802.179(14).
We understand that this question arises because government agencies, in carrying out their governmental functions, may
have a need to provide personal information obtained from motor vehicle records to persons who are not authorized under
ORS 802.179 to receive such information. Moreover, government agencies must frequently provide information to other
government agencies in order to carry out governmental functions. Yet, ORS 802.181(1) authorizes redisclosure only to a
"person," a term that does not include a state agency. ORS 802.175(2).
For example, upon request from a police officer conducting a traffic stop, a police dispatcher obtains personal information
from the ODOT motor vehicle records and transmits that information to the officer via police radio. Although intended for
use only by the police officer, information broadcast via police radio is accessible to the general public. Cf. State v.
Bichsel, 101 Or App 257, 790 P2d 1142 (1990). While in contact with the person stopped, the officer then uses the
information to verify the driver's identity, address and license number and to complete a traffic citation, a copy of which is
given to the court. If the dispatcher's broadcast of the information to the officer via radio or the officer's providing to the
court a copy of a traffic citation containing such information constitute "redisclosures" within the meaning of ORS
802.181(1), they would violate ORS 802.181(1) because neither "redisclosure" is to an authorized "person" for an
authorized purpose. In each of these situations, the use of the information is inherent in the governmental purpose for
which the information was obtained by the police dispatcher from ODOT. Thus, the question is whether a government
agency's use of personal information obtained under ORS 802.179(1) could constitute an unauthorized redisclosure of the
information under ORS 802.181(1).
Considering the text and context of ORS 802.179 and ORS 802.181, we believe there is a distinction between the "use" of
personal information as authorized by ORS 802.179(1) and the "resale" or "redisclosure" of such information under ORS
802.181(1). We find nothing in the text and context of these statutes to suggest that the legislature intended ORS
802.181(1) to restrict a government agency's ability to carry out its governmental functions. Nor do we find anything in the
legislative history that so suggests. We conclude that when a government agency uses personal information from a motor
vehicle record "in carrying out its governmental functions," that use is not a resale or redisclosure of the information
within the meaning of ORS 802.181 even if the use involves providing the information to someone who is not entitled
under ORS 802.181(1) to receive the information by "redisclosure."
The term "governmental function" is not defined in ORS 802.175 to 802.191. The common meaning of the term "function"
is the "action for which a person or thing is * * * responsible or for which a thing exists * * * role, duty, work". Webster's
Third New International Dictionary 920 (unabridged 1993.). Applying this definition, a government agency's functions
would be those responsibilities or duties for which the particular agency exists. Yet, the legislature did not merely refer to
the government agency's "functions" but rather its "governmental functions."

In the context of the constitutional separation of powers prohibiting a person in one branch of government from exercising
the functions of another branch, Or Const Art III, ß 1, we have stated that, in determining whether an action performed by
government officials constitutes a governmental function, the "principal inquiry must be whether the action in question is
integral to the movement of the government in an area where the sovereign has the power and authority to act." 43 Op Atty
Gen 205, 209 (1983). Thus, we found that the statutory duties of the Commission on Indian Services to compile
information and to develop and sponsor informational programs were not the acts of a sovereign and did not constitute the
exercise of governmental power. Id. at 209-10. In contrast, we found that the duties of the Capitol Planning Commission to
control the development of certain real properties and buildings that house and are the sites of the operation of government
were the exercise of a sovereign's governmental power. Id. at 210-11.
With respect to ORS 802.179(1), we believe that an agency is carrying out its "governmental functions" when it performs
those duties for which the agency exists that are integral to the movement of the government in an area where it has the
power and authority to act. In carrying out these functions, ORS 802.179(1) permits a government agency to use personal
information from motor vehicle records. Thus, in the example above, the police dispatcher "uses" the personal information
obtained from motor vehicle records by sending it via radio to the police officer to carry out that police agency's
governmental purpose, i.e., to enforce the traffic laws by assisting the officer in determining the identity of the driver so
that the correct individual may be cited. See ORS 181.040, 810.410, ORS ch 811. The enforcement of traffic laws is a
uniquely governmental function and one for which the police agency exists. Even though the dispatcher's broadcast might
be accessible to the general public, the dispatcher's purpose in making the broadcast was solely to carry out that
governmental function. Likewise, when the officer provides a copy of the traffic citation to the court, he or she is also
carrying out the next step in enforcing the traffic laws of this state. See ORS 153.515(4), 153.535(1)(b), 153.565. Because
the police agency is using the personal information obtained from ODOT motor vehicle records to carry out its
governmental functions as authorized by ORS 802.179(1), such use is not a "redisclosure" within the meaning of ORS
802.181(1).
The Oregon State Police Law Enforcement Data System (LEDS) has a statutory mission to maintain a criminal justice
information system for storage and retrieval of criminal justice information, including the collection and dissemination of
information relating to crime and criminals. ORS 181.730. In carrying out this mission, LEDS maintains computer links
with the ODOT Driver and Motor Vehicle Services Branch for the purpose of making available to the state's criminal
justice agencies information that will assist them in enforcing state criminal and traffic laws. OAR 257-015-0040(5).
Criminal justice agencies have access to motor vehicle records via LEDS for such criminal justice purposes; use of the
information for other than authorized purposes is prohibited. OAR 257-015-0060(4). Because the governmental function
of LEDS is specifically to gather and disseminate information to criminal justice agencies, its action in carrying out this
function is not a "redisclosure" of personal information obtained from motor vehicle records within the meaning of ORS
802.181(1).
A resale or redisclosure would occur for purposes of ORS 802.181(1), however, if a government agency reveals personal
information for a purpose not related to carrying out the agency's particular governmental function. For example, pursuant
to the Public Records Law, a person may request to inspect or copy an accident report in the custody of a police agency.
ORS 192.420. Although the police agency may be statutorily required to make the report available for inspection or
copying, complying with such a request is not related to the police agency's carrying out its law enforcement functions; the
agency does not exist for the purpose of providing public records. Therefore, it would be a "redisclosure" under ORS
802.181(1) to reveal in response to a public records request for an accident report any personal information obtained from
a motor vehicle record that may be contained in that report. The police agency must redact the personal information before
providing a copy of the report unless the requestor is authorized to receive such information under ORS 802.179 and
intends to use it for a purpose authorized under ORS 802.179. ORS 192.505, 802.181(1).
This question whether a government agency violates the "redisclosure" prohibition when it provides personal information
to another government agency as part of its own "use" of the information does not arise under the DPPA because that Act
permits, with limited exceptions not applicable here, an "authorized recipient" of personal information to resell or
redisclose the information "for a use permitted" under 18 USC ß 2721(b). 18 USC ß 2721(c). One of those permitted uses
is by any government agency in carrying out its functions. 18 USC ß 2721(b)(1). Thus, unlike ORS 802.181(1), which
permits redisclosure only to a "person" authorized to receive the information under ORS 802.179, the DPPA permits
"redisclosure" for any permitted use, which would include disclosure to other government agencies for use in carrying out
their functions.
To the extent a government agency's functions require that agency to provide information to someone other than a
government agency, we believe a court would conclude, for the reasons discussed above, that the agency's action was not a
"redisclosure" prohibited by 18 USC ß 2721(c). Rather, such an action should be a necessary element of carrying out that
agency's functions and therefore a permitted use under 18 USC ß 2721(b)(1).
III. Duty to Control, Restrict or Monitor Redisclosure of Personal Information
Finally, we are asked whether ODOT has a duty to control, restrict or monitor the resale or redisclosure of personal
information that it has provided under ORS 802.179. We have found no statutes that require or authorize ODOT to control
or restrict the resale or redisclosure of personal information once it has been disclosed by ODOT pursuant to ORS
802.179.
ORS 802.181(6) requires a person, other than a representative of the news media, who resells or rediscloses personal
information received from ODOT under ORS 802.179 to keep records identifying the person to whom the information is
provided and the purpose for which the information will be used. Those records must be made available to ODOT upon
request. ORS 802.181(6). We conclude that ORS 802.181(6) impliedly authorizes ODOT to review the records maintained
by persons under that provision and thus to monitor the resale and redisclosure of personal information. Nevertheless, we
do not find any mandate in the state or federal statutes that requires ODOT to monitor the resale or redisclosure of personal
information.
IV. Role of Attorney General
The Oregon Department of Justice does not act as legal counsel to government agencies other than those of the state. Other
government agencies are entitled to seek and rely upon advice from their own attorneys. The legal opinions stated herein
are given solely for your use and benefit.

DAVID SCHUMAN
Deputy Attorney General