Lawsuit against state officials for privacy violation moves forward

Welch v. Theodorides-Bustle, — F.Supp.2d —, 2010 WL 22365 (N.D. Fla., January 5, 2010)

Plaintiff sued the Florida Department of Highway Safety and Motor Vehicles and a number of state officials for violation of the federal Driver’s Privacy Protection Act, 18 USC §2721-25. Plaintiff claimed that the defendants turned over a large amount of protected personal information to a private party, and that that party then further disclosed the information to another entity that published the information on the web.

As a result, the personal information of a number of Florida drivers became available for viewing online by anyone.

The defendants moved to dismiss the suit for failure to state a claim. The court denied the motion.

There is an exception to the Driver’s Privacy Protection Act’s prohibition on disclosure of personal information when the disclosure is made by a government agency “in carrying out [the agency’s] functions.” The defendants did not deny that their conduct would violate the Act, but argued that the exception applied. The defendants essentially argued that the mere fact that the disclosure was made by a governmental entity made the disclosure to be automatically carried out in connection with that agency’s function.

The court rejected this ipse dixit assertion, holding that disclosure by a government agency being treated as automatically protected would accordingly make any violation of the Act by the government impossible.

Similarly, the court rejected the defendants’ argument that language in the contract with the entity to which the information had been provided rendered the disclosure proper. The receiving entity promised to use the information only for a proper purpose. But the self-serving recitals in that agreement, without specifying in detail what a proper purpose would be, would not bind third parties.

Alligator car photo courtesy Flickr user jeffdhartman under this Creative Commons license.