# DPPA (Driver's Privacy Protection Act) The Driver's Privacy Protection Act, 18 U.S.C. sections 2721–2725, regulates personal information **obtained from a state motor-vehicle record**. It restricts disclosure by state DMVs and downstream obtainment, disclosure, or use, subject to enumerated permitted purposes; section 2724 supplies a civil action. (primary public record, [18 U.S.C. Chapter 123](../../web%20archive/2026-05-22/govinfo.gov/usc-18-chap123-dppa.md)) ## Source is the first gate Section 2725 defines “motor vehicle record” and “personal information.” DPPA coverage depends on the information's DMV source, not merely its relationship to a car or plate. *Andrews v. Sirius XM* held that information copied from a license in its owner's possession was outside the DPPA because it was not obtained from a DMV-maintained record. That persuasive source rule does not itself decide a roadside ALPR photograph, but it shows why a public-road image and a later DMV return must be separated. (primary public record, [Andrews v. Sirius XM](../../web%20archive/2026-08-10/cdn.ca9.uscourts.gov/james-andrews-v-sirius-xm-radio-inc-932-f-3d-1253-9th-cir-2019.md)) ## Obtaining, purpose, and redisclosure In the Eighth Circuit, *McDonough v. Anoka County* holds that merely accessing and viewing DMV personal information can be “obtaining” it; an impermissible obtain does not require a later improper use. Liability still requires knowing obtainment, disclosure, or use of personal information from a motor-vehicle record for a nonpermitted purpose. (primary public record, [McDonough v. Anoka County](../../web%20archive/2026-08-10/ecf.ca8.uscourts.gov/johanna-mcdonough-v-anoka-county-799-f-3d-931-8th-cir-2015.md)) Section 2721(b)(1) permits use by a government agency, including law enforcement, in carrying out its functions. That exception is purpose-specific, not a validation of every lookup. *Heglund* recognizes the privacy injury from an alleged substantive DPPA violation but does not validate every law-enforcement access. (primary public record, [Heglund v. City of Grand Rapids](../../web%20archive/2026-08-10/ecf.ca8.uscourts.gov/jennifer-heglund-v-city-of-grand-rapids-871-f-3d-572-8th-cir-2017.md)) *Cook v. ACS State & Local Solutions* holds that bulk acquisition or stockpiling is not a per se violation when downstream users have permitted purposes. An authorized recipient that resells or rediscloses personal information must keep recipient-and-purpose records for five years under section 2721(c). The case does not authorize an impermissible downstream use or decide public-road imagery. (primary public record, [Cook v. ACS State & Local Solutions](../../web%20archive/2026-08-10/ecf.ca8.uscourts.gov/cook-v-acs-state-local-solutions-inc-663-f-3d-989-8th-cir-2011.md)) The Supreme Court upheld the DPPA as a regulation of state motor-vehicle database owners and the market in motor-vehicle information; it did not decide ALPR images created outside a DMV database. (primary public record, [Reno v. Condon](../../web%20archive/2026-08-10/govinfo.gov/reno-v-condon-528-u-s-141-2000.md)) ## Application to Conway's withholding rationale Conway cited the DPPA alongside the Arkansas ALPR Act and FOIA exemptions. A source-and-field analysis should separate: (1) public-road image, plate, location, and timestamp fields created by an ALPR; (2) DMV-derived owner or vehicle information returned after a query; (3) audit and access metadata; and (4) any downstream disclosure or redisclosure. The DPPA may govern DMV-derived personal information and its uses; it is not a blanket answer for every field in a network, search, hot-list, or audit export. Whether another Arkansas confidentiality provision applies is a separate question. ## Notes The pending-opinion language formerly on this page is obsolete: the later Conway production documents an internal draft, not an Attorney General submission. No court or Attorney General opinion in this audit resolves the field-specific application to Conway's records.