Call Your Web Designers, Dropdown Menus Not Enough for DPPA
Privacy. So highly regarded, yet so easily disregarded.
Today, the Second Circuit handed down a decision giving a clear warning to companies reselling personal information under the Driver's Privacy Protection Act ("DPPA"). Get ready to let your clients know to call their web designers -- some of their drop down menus may have to go.
Let's back track a little to see where exactly the Second Circuit drew the line in the sand.
As the name suggests, the DPPA protects drivers from the dissemination of their personal information associated with obtaining a driver's license. Taken in context, the DPPA was enacted after an actress was murdered by her stalker-turned-killer, who retrieved her personal info from the DMV (after presumably waiting in a very long line). The DPPA provides exceptions for specified purposes, and allows information to be resold for those purposes.
Here, in a fit of road rage, Aron Leifer took down Erik Gordon's license plate number. He went online, and using a private investigation service, retrieved Erik Gordon's personal information for $39. With info in hand, Leifer proceeded to harass Gordon, his family and his associates. How was he able to get this info so quickly?
Softech, a defendant in this case, is a data broker that provides access to DMV records, and often aids law enforcement. Arcanum is a private investigation service that operates Docusearch.com, a website where you can find someone's personal information based on a license plate number. Leifer used Docusearch.com to get Gordon's info. Arcanum gets its information from Softech. Gordon sued Leifer, Arcanum and Softech for violations of the DPPA. Confused yet?
Gordon settled with Leifer and the court found that Softech had disclosed Gordon's personal information pursuant to the exceptions in the DPPA. At issue was Arcanum. The court found that the district court wrongly granted summary judgment in favor of Arcanum because questions of fact remained regarding whether Arcanum used reasonable care to see if Leifer was using the information for a permissible purpose.
Leifer used an alias on Docusearch.com, the name on his credit card did not match his alias, and he listed a defunct company as his employer. Furthermore, the court found flaws with Docusearch.com's website. The mere dropdown menu was not enough to "articulate the true purpose ... behind a records request." The court even went further to state that the wording in the dropdown menu may have been overly broad.
While this case is limited to the private investigative field, this case gives great guidance for new, potential areas of confusion. With the expansion of the Internet, clients in heavily regulated fields need to ensure that web usability concerns don't trump statutory obligations.
Related Resources:
- Dismissal of Driver's Privacy Protection Act Suit Affirmed (FindLaw's U.S. Fifth Circuit Blog)
- Driver's Privacy Protection Act Seems Fairly Useless (FindLaw's U.S. Sixth Circuit Blog)
- Our Corporate Granpappy Wins Driver's License Info Dispute. Again (FindLaw's U.S. Eight Circuit Blog)