Class Action to Proceed in Arkansas for Improper Access of DMV Data

An Arkansas court recently certified a class action lawsuit against several companies that purchased the entire Arkansas motor vehicle records database and used it for marketing and other purposes. The lawsuit alleges that such actions constituted a violation of the federal Driver Privacy Protection Act. The Act imposes liability on those who, inter alia, obtain personal information from the motor vehicle records to use for purposes not specifically authorized in the Act. While marketing is not a permitted purpose under the Act, a permitted purpose includes when "the requester demonstrates it has obtained the written consent of the individual to whom the information pertains." 18 USC § 2721(b)(13). The Act provides for statutory damages of no less than $2,500 for each violation, in addition to punitive damages. According to the Arkansas court, case law proof of actual harm does not need be shown before a plaintiff can recover damages. The plaintiffs allege that the defendants accessed the Arkansas driver database after representing that they would be using the information for a lawful purpose. However, according to the complaint, the defendants were not planning to use the information for an authorized purpose, nor had they obtained individuals written consent. The complaint thus alleges that use of the data for marketing and other purposes was not lawful.

Tip: Companies using personal information obtained from motor vehicle records with the intent to use the information for marketing purposes should proceed with caution, and should ensure that they have appropriate permission before making such use of the information.