Can Texas let alcohol sellers scan a driver's license stripe to check age without breaking federal privacy law?

Plain-English summary

A House committee chair asked whether House Bill 3016, passed by the 77th Texas Legislature, conflicted with the Federal Driver's Privacy Protection Act. The bill let people other than law enforcement read the electronically stored information on a driver's license, commercial driver's license, or identification certificate to prevent underage alcohol purchases and to comply with Alcoholic Beverage Commission recordkeeping rules. The Attorney General concluded the bill did not run afoul of the federal Act.

House Bill 3016 added section 109.61 to the Alcoholic Beverage Code. It let a person access the electronically readable information on a license to comply with the code or a Commission rule, including to prevent an offense; barred retaining that information unless a Commission rule required it; prohibited marketing the information; and made a violation a Class A misdemeanor. The bill was a response to an earlier opinion, JC-0337, which had read the Transportation Code to limit use of magnetic-stripe information to law enforcement and government personnel acting in their official capacities. House Bill 3016 then expressly permitted private parties to use the information to stop underage drinking.

The opinion explained that the Driver's Privacy Protection Act regulates dissemination of personal information by state motor-vehicle departments, such as the Department of Public Safety. The transactions allowed by House Bill 3016 do not directly involve the Department: the person reading the stripe has obtained the license from the licensee, not from the Department, so the Department has not "knowingly disclosed or otherwise made available" the information. The opinion added that even if a court viewed this as making protected information available, two exceptions in the federal Act would likely cover it. First, the exception for use in the normal course of business by a legitimate business to verify the accuracy of personal information the individual submitted describes exactly what "carding" a buyer does. Second, the catch-all exception covers any other use specifically authorized by state law if it relates to motor-vehicle operation or public safety, and preventing minors from getting alcohol is a public-safety matter under the Alcoholic Beverage Code. On those grounds the opinion concluded the bill does not violate the Act.

Currency note

This opinion was issued in 2001. Subsequent statutory amendments, court decisions, or later Attorney General opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here. Both the Alcoholic Beverage Code provision and the federal Driver's Privacy Protection Act may have been amended since 2001.

What the opinion meant for those who asked

The Legislature and the Alcoholic Beverage Commission (what the opinion held): The opinion concluded House Bill 3016's authorization for private parties to read license stripe data to prevent underage sales did not conflict with the federal Act, both because the Department of Public Safety was not the one disclosing the data and because the use fit the Act's business-verification and public-safety exceptions.

Sellers of alcoholic beverages (what the opinion held for them): The opinion treated electronic age verification at the point of sale, "carding," as the kind of normal-course-of-business verification the federal Act allows. It also noted the bill barred retaining the data unless a Commission rule required it and barred marketing it.

Common questions

Did House Bill 3016 violate the federal Driver's Privacy Protection Act?
The opinion concluded it did not.

Why doesn't reading a license's magnetic stripe trigger the federal Act?
The opinion explained the Act regulates disclosures by state motor-vehicle departments, and in these transactions the person reads the license obtained from the cardholder, not from the Department of Public Safety.

What if a court decided the Act did apply?
The opinion said the use would still likely fit two exceptions: verifying the accuracy of submitted information in the normal course of business, and a state-authorized use related to public safety.

What did the bill require sellers to do with the scanned data?
The opinion noted section 109.61 barred retaining the information unless a Commission rule required it, prohibited marketing it, and made a violation a Class A misdemeanor.

Background and statutory framework

House Bill 3016 added section 109.61 to the Alcoholic Beverage Code, allowing a person to access electronically readable license information to comply with the code or a Commission rule, barring retention except as the Commission requires, prohibiting marketing of the information, and making a violation a Class A misdemeanor. Act of May 27, 2001, 77th Leg., R.S., ch. 1163, 2001 Tex. Sess. Law Serv. 2486. The bill responded to an earlier reading of the Transportation Code limiting magnetic-stripe use to law enforcement and government personnel. Tex. Transp. Code Ann. § 521.126 (Vernon Supp. 2001); id. § 521.126(a) (defining the stripe information as the information printed on the license and a physical description of the licensee). The Driver's Privacy Protection Act bars a state department of motor vehicles, and its officers, employees, or contractors, from knowingly disclosing personal information from a motor-vehicle record, subject to permissible uses. 18 U.S.C. § 2721(a), (b) (1994 & Supp. V 1999); id. § 2725(3); Pub. L. No. 106-346, 114 Stat. 1356 (2000). Its purpose is to restrict states' ability to disclose a driver's personal information without consent. Reno v. Condon, 528 U.S. 141, 144 (2000). Permissible uses include use in the normal course of business to verify the accuracy of submitted information, id. § 2721(b)(3), and any other state-authorized use related to motor-vehicle operation or public safety, id. § 2721(b)(14). The Alcoholic Beverage Code is an exercise of the state's police power for the protection of the welfare, health, peace, temperance, and safety of the people and is liberally construed to that end. Tex. Alco. Bev. Code Ann. § 1.03 (Vernon 1995).

Citations

Statutory provisions:

• Driver's Privacy Protection Act of 1994, 18 U.S.C. § 2721(a), (b) (1994 & Supp. V 1999)
• 18 U.S.C. § 2721(b)(3)
• 18 U.S.C. § 2721(b)(14)
• 18 U.S.C. § 2725(3)
• Act of May 27, 2001, 77th Leg., R.S., ch. 1163, 2001 Tex. Sess. Law Serv. 2486
• Tex. Transp. Code Ann. § 521.126 (Vernon Supp. 2001)
• Tex. Transp. Code Ann. § 521.126(a) (Vernon Supp. 2001)
• Tex. Alco. Bev. Code Ann. § 1.03 (Vernon 1995)
• Pub. L. No. 106-346, 114 Stat. 1356 (2000)

Cases:

• Reno v. Condon, 528 U.S. 141 (2000)

Source

• Landing page: https://www.texasattorneygeneral.gov/opinions/john-cornyn/jc-0423
• Original PDF: https://www.texasattorneygeneral.gov/sites/default/files/opinion-files/opinion/2001/jc0423.pdf

Original opinion text

Best-effort transcription from the official scanned PDF. Minor character-level errors from the source OCR have been corrected; the linked PDF is authoritative.

OFFICE OF THE ATTORNEY GENERAL - STATE OF TEXAS

JOHN CORNYN

October 19, 2001

The Honorable Tony Goolsby
Chair, Committee on House Administration
Texas House of Representatives
P.O. Box 2910
Austin, Texas 78768-2910

Opinion No. JC-0423

Re: Limitation on disclosure of driver's license information imposed by the Federal Driver's Privacy Protection Act (RQ-0381-JC)

Dear Representative Goolsby:

House Bill 3016, adopted by the 77th Texas Legislature, "permits the use of information accessed by using the magnetic strip on a . . . driver's license by persons other than law enforcement officials when used to prevent the purchase of alcoholic beverages by minors and to comply with Texas Alcoholic Beverage Commission record keeping rules regarding private club memberships." HOUSE COMM. ON LICENSING & ADMINISTRATIVE PROCEDURES, BILL ANALYSIS, Tex. H.B. 3016, 77th Leg., R.S. (2001). You ask whether this legislation falls afoul of the Federal Driver's Privacy Protection Act, 18 U.S.C. § 2721. In our view, it does not.

House Bill 3016 amends the Alcoholic Beverage Code by adding section 109.61, which provides:

            (a) A person may access electronically readable information on a driver's license, commercial driver's license, or identification certificate for the purpose of complying with this code or a rule of the commission, including for the purpose of preventing the person from committing an offense under this code.

            (b) A person may not retain information accessed under this section unless the commission by rule requires the information to be retained. The person may not retain the information longer than the commission requires.

            (c) Information accessed under this section may not be marketed in any manner.

            (d) A person who violates this section commits an offense. An offense under this section is a Class A misdemeanor.

Act of May 27, 2001, 77th Leg., R.S., ch. 1163, 2001 Tex. Sess. Law Serv. 2486 (to be codified at TEX. ALCO. BEV. CODE ANN. § 109.61).

As the bill analysis indicates, House Bill 3016 was drafted in response to an opinion of this office, Attorney General Opinion JC-0337 (2001). That opinion considered whether the Department of Public Safety (the "DPS"), in adopting rules under section 521.126 of the Transportation Code to insure that magnetic stripe information "is used only for law enforcement or governmental purposes," TEX. TRANSP. CODE ANN. § 521.126 (Vernon Supp. 2001), could restrict usage of the information provided on the magnetic stripe to law enforcement and government agency personnel acting in their official capacity. See Tex. Att'y Gen. Op. No. JC-0337 (2001). The opinion concluded, based on the language and legislative history of the Transportation Code section, that the proposed DPS rule "correctly interpreted the legislature's intent . . . [and] that magnetic stripe information contained on a driver's license or identification card issued by the Department of Public Safety may be utilized only by law enforcement and other governmental agency personnel acting in their official capacities." Id. at 5.

The opinion specifically rejected the view that "an alcoholic beverage retailer's use of the magnetic stripe information serves a law enforcement purpose because it enables such a retailer to more easily identify, and thus refuse to serve minors, and to determine beyond doubt that a particular driver's license or identification card is fraudulent." Id. at 3. While acknowledging the argument, the opinion took the view "that the DPS has the initial discretion to determine what [law enforcement or governmental] purposes are," and had done so in the proposed rule in question. Id. House Bill 3016, however, permits the use of magnetic stripe information by private parties to prevent under-age drinking or other violations of the Alcoholic Beverage Code.

You express concern about the relation of House Bill 3016 to the Federal Driver's Privacy Protection Act, 18 U.S.C. § 2721, which provides in relevant part:

            (a) IN GENERAL.- A State department of motor vehicles, and any officer, employee, or contractor thereof, shall not knowingly disclose or otherwise make available to any person or entity:

                (1) personal information, as defined in 18 U.S.C. 2725(3), about any individual obtained by the department in connection with a motor vehicle record, except as provided in subsection (b) of this section;

            (b) PERMISSIBLE USES. - Personal information referred to in subsection (a) . . . may be disclosed as follows:

                (1) For use by any government agency, including any court or law enforcement agency, in carrying out its functions, or any private person or entity acting on behalf of a Federal, State, or local agency in carrying out its functions.

                (3) For use in the normal course of business by a legitimate business or its agents, employees, or contractors, but only -

                     (B) if such information as so submitted is not correct or is no longer correct, to obtain the correct information, but only for the purposes of preventing fraud by, pursuing legal remedies against, or recovering on a debt or security interest against, the individual.

                (14) For any other use specifically authorized under the law of the State that holds the record, if such use is related to the operation of a motor vehicle or public safety.

Driver's Privacy Protection Act of 1994, 18 U.S.C. § 2721(a), (b) (1994 & Supp. V 1999), amended by Pub. L. No. 106-346, 114 Stat. 1356 (2000) (amendment to be codified at 18 U.S.C. § 2721(a)).

The purpose of the Driver's Privacy Protection Act (the "DPPA"), as the Supreme Court noted in Reno v. Condon, 528 U.S. 141, 144 (2000), is to establish "a regulatory scheme that restricts the States' ability to disclose a driver's personal information without the driver's consent." Representative James Moran, who introduced the legislation in the United States House of Representatives, described the problem the statute seeks to correct thus:

            In 34 states across the country, there are virtually no restrictions on who has access to the name and address of licensees. In fact, very few Americans realize that by registering their car or obtaining a driver's license through the DMV, they are surrendering their personal and private information to anyone who wants to obtain it.

139 CONG. REC. E2747-02 (1993) (statement of Rep. James P. Moran). Accordingly, Representative Moran described the DPPA as "safeguard[ing] the privacy of drivers and vehicle owners by prohibiting the release of personal information - including a person's name and address - to anyone without a specific business-related reason for obtaining the information." Id.

As the statutory language, legislative history, and case law recited above all make clear, it is the dissemination of private information by state departments of motor vehicles such as the Texas Department of Public Safety that the DPPA seeks to regulate. But the transactions at issue in House Bill 3016 do not directly involve the DPS. The person accessing information from the magnetic stripe has presumably obtained possession of the license from the licensee, rather than from the DPS. Accordingly, it does not appear to be the case that in this situation the DPS has, in the terms of the DPPA, "knowingly disclose[d] or otherwise [made] available" any information. (We note as an aside that, given that the magnetic stripe information is "the information printed on the license and a physical description of the licensee," TEX. TRANSP. CODE ANN. § 521.126(a) (Vernon Supp. 2001), a transaction permitted by House Bill 3016 would not seem to implicate the DPPA any more than would any other instance in which a driver's license was used as proof of age for a commercial transaction.)

Assuming for the sake of argument, however, that a court were to take the view that allowing the use of magnetic stripe information by persons who sell alcoholic beverages to check for under-age drinkers did constitute the making available of information protected under the DPPA, we believe a case could be made that transactions permitted under House Bill 3016 are permissible under at least two separate exceptions permitted by the federal statute - the exceptions for use in the normal course of business to verify the accuracy of personal information submitted, see 18 U.S.C. § 2721(b)(3) (1994 & Supp. V 1999), and for "any other use specifically authorized [by state law] . . . related to . . . public safety." Id. § 2721(b)(14).

While there is little case law interpreting the DPPA, and accordingly little guidance concerning the breadth of the statutory exceptions, we note that subsection (b)(3)'s exception of "use in the normal course of business by a legitimate business . . . to verify the accuracy of personal information submitted by the individual" appears to us precisely to describe the activity popularly known as "carding" by those who sell alcoholic beverages. That is, a person attempting to purchase such a beverage is asked to provide verification for the claim that he or she is twenty-one years of age. What House Bill 3016 provides is a method by which that claim may be verified. When the license is provided, its electronic reading assures that the information on the face of the license has not been tampered with. Such a use as this is exactly the sort excepted by the language of 18 U.S.C. § 2721(b)(3).

Further, subsection (b)(14), the DPPA's "catch-all" provision, excepts from its coverage "any other use specifically authorized under the law of the State that holds the record, if such use is related to the operation of a motor vehicle or public safety." 18 U.S.C. § 2721(b)(14) (1994). The laws related to the possession of alcohol by minors are to be found in chapter 106 of the Alcoholic Beverage Code. The public policy which that Code articulates, and in light of which it is to be construed, is stated in section 1.03 of the Code:

            This code is an exercise of the police power of the state for the protection of the welfare, health, peace, temperance, and safety of the people of the state. It shall be liberally construed to accomplish this purpose.

TEX. ALCO. BEV. CODE ANN. § 1.03 (Vernon 1995).

In light of the fact that preventing minors from acquiring alcoholic beverages is therefore a matter related to the public safety, and the use of magnetic stripe information is specifically authorized by House Bill 3016 for that purpose, as well as for the other reasons articulated above, we conclude that House Bill 3016 does not fall afoul of the Federal Driver's Privacy Protection Act.

                                    SUMMARY

           House Bill 3016, which permits the use of magnetic stripe information on drivers' licenses and identification cards issued by the Texas Department of Public Safety for the purpose of compliance with the Alcoholic Beverage Code and rules promulgated by the Alcoholic Beverage Commission, does not violate or conflict with the Federal Driver's Privacy Protection Act, 18 U.S.C. § 2721.

                                         JOHN CORNYN
                                         Attorney General of Texas

HOWARD G. BALDWIN, JR.
First Assistant Attorney General

NANCY FULLER
Deputy Attorney General - General Counsel

SUSAN D. GUSKY
Chair, Opinion Committee

James E. Tourtelott
Assistant Attorney General, Opinion Committee