Reno v. Condon

CHIEF JUSTICE REHNQUIST delivered the opinion of the Court.

The Driver's Privacy Protection Act of 1994 (DPPA or Act), regulates the disclosure of personal information contained in the records of state motor vehicle departments (DMVs). We hold that in enacting this statute Congress did not run afoul of the federalism principles enunciated in New York v. United States, and Printz v. United States.

The DPPA regulates the disclosure and resale of personal information contained in the records of state DMVs. State DMV s require drivers and automobile owners to provide personal information, which may include a person's name, address, telephone number, vehicle description, Social Security number, medical information, and photograph, as a condition of obtaining a driver's license or registering an automobile. Congress found that many States, in turn, sell this personal information to individuals and businesses.

The DPPA establishes a regulatory scheme that restricts the States' ability to disclose a driver's personal information without the driver's consent. The DPPA generally prohibits any state DMV, or officer, employee, or contractor thereof, from "knowingly disclos[ing] or otherwise mak[ing] available to any person or entity personal information about any individual obtained by the department in connection with a motor vehicle record." The DPPA defines "personal information" as any information "that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information," but not including "information on vehicular accidents, driving violations, and driver's status." A "motor vehicle record" is defined as "any record that pertains to a motor vehicle operator's permit, motor vehicle title, motor vehicle registration, or identification card issued by a department of motor vehicles."

The DPPA's ban on disclosure of personal information does not apply if drivers have consented to the release of their data. When we granted certiorari in this case, the DPPA provided that a DMV could obtain that consent either on a case-by-case basis or could imply consent if the State provided drivers with an opportunity to block disclosure of their personal information when they received or renewed their licenses and drivers did not avail themselves of that opportunity. However, Public Law 106-69, which was signed into law on October 9, 1999, changed this "opt-out" alternative to an "opt-in" requirement. Under the amended DPPA, States may not imply consent from a driver's failure to take advantage of a state-afforded opportunity to block disclosure, but must rather obtain a driver's affirmative consent to disclose the driver's personal information for use in surveys, marketing, solicitations, and other restricted purposes.

The DPPA's provisions do not apply solely to States. The Act also regulates the resale and redisclosure of drivers' personal information by private persons who have obtained that information from a state DM\T. In general, the Act allows private persons who have obtained drivers' personal information for one of the aforementioned permissible purposes to further disclose that information for anyone of those purposes. If a State has obtained drivers' consent to disclose their personal information to private persons generally and a private person has obtained that information, the private person may redisclose the information for any purpose. Additionally, a private actor who has obtained drivers' information from DMV records specifically for direct-marketing purposes may resell that information for other direct-marketing uses, but not otherwise. Any person who rediscloses or resells personal information from DMV records must, for five years, maintain records identifying to whom the records were disclosed and the permitted purpose for the resale or redisclosure. The DPPA establishes several penalties to be imposed on States and private actors that fail to comply with its requirements. The Act makes it unlawful for any "person" knowingly to obtain or disclose any record for a use that is not permitted under its provisions, or to make a false representation in order to obtain personal information from a motor vehicle record. Additionally, any person who knowingly obtains, discloses, or uses information from a state motor vehicle record for a use other than those specifically permitted by the DPPA may be subject to liability in a civil action.

South Carolina law conflicts with the DPPA's provisions. Under that law, the information contained in the State's DMV records is available to any person or entity that fills out a form listing the requester's name and address and stating that the information will not be used for telephone solicitation.

Following the DPPA's enactment, South Carolina and its Attorney General, respondent Condon, filed suit in the United States District Court for the District of South Carolina, alleging that the DPPA violates the Tenth and Eleventh Amendments to the United States Constitution.

We of course begin with the time-honored presumption that the DPPA is a "constitutional exercise of legislative power." The United States asserts that the DPPA is a proper exercise of Congress' authority to regulate interstate commerce under the Commerce Clause. The United States bases its Commerce Clause argument on the fact that the personal, identifying information that the DPPA regulates is a "thin[g] in interstate commerce," and that the sale or release of that information in interstate commerce is therefore a proper subject of congressional regulation. We agree with the United States' contention. The motor vehicle information which the States have historically sold is used by insurers, manufacturers, direct marketers, and others engaged in interstate commerce to contact drivers with customized solicitations. The information is also used in the stream of interstate commerce by various public and private entities for matters related to interstate motoring. Because drivers' information is, in this context, an article of commerce, its sale or release into the interstate stream of business is sufficient to support congressional regulation. We therefore need not address the Government's alternative argument that the States' individual, intrastate activities in gathering, maintaining, and distributing drivers' personal information have a sufficiently substantial impact on interstate commerce to create a constitutional base for federal legislation.

But the fact that drivers' personal information is, in the context of this case, an article in interstate commerce does not conclusively resolve the constitutionality of the DPPA. In New York and Printz, we held federal statutes invalid, not because Congress lacked legislative authority over the subject matter, but because those statutes violated the principles of federalism contained in the Tenth Amendment.

"We held in New York that Congress cannot compel the States to enact or enforce a federal regulatory program. Today we hold that Congress cannot circumvent that prohibition by conscripting the States' officers directly. The Federal Government may neither issue directives requiring the States to address particular problems, nor command the States' officers, or those of their political subdivisions, to administer or enforce a federal regulatory program."

South Carolina contends that the DPPA violates the Tenth Amendment because it "thrusts upon the States all of the day-to-day responsibility for administering its complex provisions," Brief for Respondents 10, and thereby makes "state officials the unwilling implementors of federal policy," South Carolina emphasizes that the DPPA requires the State's employees to learn and apply the Act's substantive restrictions, which are summarized above, and notes that these activities will consume the employees' time and thus the State's resources. South Carolina further notes that the DPPA's penalty provisions hang over the States as a potential punishment should they fail to comply with the Act.

We agree with South Carolina's assertion that the DPPA's provisions will require time and effort on the part of state employees, but reject the State's argument that the DPPA violates the principles laid down in either New York or Printz. We think, instead, that this case is governed by our decision in South Carolina v. Baker. In Baker, we upheld a statute that prohibited States from issuing unregistered bonds because the law "regulate[d] state activities," rather than "seek[ing] to control or influence the manner in which States regulate private parties." We further noted:
"The [National Governor's Association] nonetheless contends that § 310 has commandeered the state legislative and administrative process because many state legislatures had to amend a substantial number of statutes in order to issue bonds in registered form and because state officials had to devote substantial effort to determine how best to implement a registered bond system. Such 'commandeering' is, however, an inevitable consequence of regulating a state activity. Any federal regulation demands compliance. That a State wishing to engage in certain activity must take administrative and sometimes legislative action to comply with federal standards regulating that activity is a commonplace that presents no constitutional defect."

Like the statute at issue in Baker, the DPPA does not require the States in their sovereign capacity to regulate their own citizens. The DPPA regulates the States as the owners of data bases. It does not require the South Carolina Legislature to enact any laws or regulations, and it does not require state officials to assist in the enforcement of federal statutes regulating private individuals. We accordingly conclude that the DPPA is consistent with the constitutional principles enunciated in New York and Printz.

As a final matter, we turn to South Carolina's argument that the DPPA is unconstitutional because it regulates the States exclusively. The essence of South Carolina's argument is that Congress may only regulate the States by means of "generally applicable" laws, or laws that apply to individuals as well as States. But we need not address the question whether general applicability is a constitutional requirement for federal regulation of the States, because the DPPA is generally applicable. The DPPA regulates the universe of entities that participate as suppliers to the market for motor vehicle information-the States as initial suppliers of the information in interstate commerce and private resellers or redisclosers of that information in commerce.

The judgment of the Court of Appeals is therefore Reversed.