The 7th Circuit recently ruled that a Chicago suburb’s policy of printing personal information such as an individual’s name, home address, date of birth, sex, height, and weight on parking tickets violates the federal Driver’s Privacy Protection Act (DPPA), thus reversing a lower court’s dismissal of a class action complaint over the practice. The DPPA governs the privacy of personal information gathered by state Departments of Motor Vehicles (DMVs) by prohibiting any person from knowingly obtaining or disclosing personal information from a motor vehicle record, unless done pursuant to certain specified purposes and in line with delineated restrictions. Therefore, disclosure of information from a driver’s license or DMV file may be considered a violation of the DPPA.

The 7th Circuit confirmed this, stating that the DPPA prohibits a state DMV from knowingly disclosing or making available to a third party protected personal information. Based on this prohibition, the court found that the suburb’s practice of posting such information on drivers’ windows created “very real safety and security concerns” and that “the possibilities for identity theft are obvious.” If successful, the class action could cost the Chicago suburb of Palatine up to $80 million.

The DPPA is but one law governing the use of personal information. Any company contemplating using personal information should consider whether there are any laws that may regulate such use. Failure to comply could result in large penalties.

Arent Fox is continuing to monitor privacy-related issues. Please contact Sarah Bruno or Eva Pulliam with questions.