As we previously reported, in 2017, consumer plaintiff James Andrews filed a putative class action against Sirius XM Radio, Inc., alleging a violation of the Driver’s Privacy Protection Act, 18 U.S.C. § 2721, et seq. (“DPPA”). Andrews claimed that the satellite radio provider sent solicitation letters to him and putative class members using personal information obtained from motor vehicle records in violation of the DPPA’s limits on marketing uses. Sirius obtained the information through an agreement with the dealership from which Andrews purchased his vehicle. Sirius’ agreement with the dealership permitted Sirius to access the dealership’s electronic database containing copies of consumers’ driver’s licenses and forms transferring ownership of the vehicle (“Form 262”). 

The district court granted summary judgment in favor of Sirius XM, finding that because Sirius obtained Andrews’ personal information from his driver’s license and the Form 262 (neither of which constituted a Department of Motor Vehicles record), Sirius did not violate the DPPA. The pertinent issue on appeal to the Ninth Circuit concerned the scope of the DPPA – namely, whether the DPPA applies to personal information obtained indirectly from a DMV, including information obtained from driver’s licenses. 

In affirming the district court’s grant of summary judgment, the Ninth Circuit concluded “that the DPPA does not apply where the source of personal information is a driver’s license in the possession of its owner, rather than a state Department of Motor Vehicles” and thus “Sirius XM’s conduct fell outside the scope of the DPPA.” More specifically, the Court held that “[a] driver’s license, though issued by the DMV, becomes the possession of an individual, not the DMV that issued it.  …  A driver’s license in the possession of its owner is no longer maintained by the DMV, and so such a record is outside the bounds of the DPPA. The same is true of the Form 262 at issue here, which did not even pass through the DMV before the information made its way to Sirius XM.  …  Put another way, we conclude that where, as here, the initial source of personal information is a record in the possession of an individual, rather than a state DMV, then use or disclosure of that information does not violate the DPPA.” The Court reasoned, “Accordingly, given that the statute was clearly intended to prevent the unauthorized, nonconsensual, and involuntary disclosure of personal information from DMV records, we conclude that Andrews’ driver’s license was not a ‘motor vehicle record’ pursuant to the DPPA.” 

A copy of the Ninth Circuit’s decision can be found here.