Under the Federal Driver Privacy Protection Act, personal information can be disclosed only to certain categories of requestors, and for certain permitted uses identified in the statute. For a detailed list of permitted users and uses under the Federal Driver Privacy Protection Act, please see the Permitted Users and Uses of Personal Information section.
Definition of "Personal Information"
The Federal Driver Privacy Protection Act broadly defines “personal information” as information that identifies an individual, including an individual’s:
• Driver identification number
• Telephone number
• Medical or disability information
Specifically excluded from the definition of personal information is information on vehicular accidents, driving violations, and driver’s status.
Redisclosure of Personal Information
While the Federal Driver Privacy Protection Act regulates the disclosure of information by the Registry of Motor Vehicles, it also restricts the redisclosure of that information. An authorized recipient of personal information may redisclose information only for another permitted use. Furthermore, the Federal Driver Privacy Protection Act requires that a record of such redisclosure, including the identity of the party to whom the information was disclosed and the purpose for which it was to be used, be retained for five years.
Punishments for Violation
Individuals who obtain, disclose, or use personal information from a motor vehicle record for a purpose not permitted under the Federal Driver Privacy Protection Act are liable to the individual to whom the personal information pertains. This liability includes:
• Actual damages or liquidated damages of $2,500 for each violation, whichever is greater
• Punitive damages upon proof of willful or reckless disregard of the law
• Reasonable attorney’s fees and other litigation costs
• Any other equitable relief as the court may order
An individual requesting the disclosure of personal information who misrepresents his/her identity or makes a false statement in connection with any request for personal information with the intent to obtain personal information in a manner not authorized by law shall be subject to criminal prosecution. Violators face:
• Up to $5,000 in fines, and/or
• Imprisonment in a jail or house of correction for up to one year