528 U.S. 141 (2000)
In 1994 Congress enacted the Driver’s Privacy Protection Act, which regulates the disclosure of personal information contained in the records of state motor vehicle departments.1 State DMVs require drivers and automobile owners to provide personal information that may include a person’s name, address, telephone number, vehicle description, Social Security number, medical information, and photograph as a condition of obtaining a driver’s license or registering an automobile.2 Many states sell this personal information to individuals and businesses, generating significant revenues such as the approximately $8 million received each year by the Wisconsin Department of Transportation.3
The DPPA generally prohibits any state DMV or its officers, employees, or contractors from knowingly disclosing or making available personal information obtained in connection with a motor vehicle record without the driver’s consent.4 The prohibition is subject to numerous statutory exceptions for uses such as motor vehicle safety, theft prevention, emissions compliance, and court proceedings.5 The Act also regulates the resale and redisclosure of drivers’ personal information by private persons who have obtained that information from a state DMV.6 Such persons must maintain records identifying to whom the records were disclosed and the permitted purpose for five years.7 Any person who knowingly violates the DPPA may be subject to a criminal fine.8 A state agency maintaining a policy or practice of substantial noncompliance may be subject to a civil penalty of not more than $5,000 per day imposed by the United States Attorney General.9
South Carolina law conflicts with the DPPA.10 Under that law, the information contained in the state’s DMV records is available to any person or entity that fills out a form listing the requester’s name and address.11 The form must state that the information will not be used for telephone solicitation.12 State law authorizes the DMV to charge a fee for releasing motor vehicle information and requires the DMV to allow drivers to prohibit use of their information for commercial activities such as telephone solicitation.13 Following the DPPA’s enactment, South Carolina and its Attorney General, respondent Condon, filed suit in the United States District Court for the District of South Carolina alleging that the DPPA violates the Tenth and Eleventh Amendments.14
The district court concluded that the Act is incompatible with principles of federalism, granted summary judgment for the state, and permanently enjoined the Act’s enforcement against the state and its officers.15 The Court of Appeals for the Fourth Circuit affirmed, and the Supreme Court granted certiorari in 1999.16
Whether the Driver’s Privacy Protection Act of 1994 is a valid exercise of Congress’s authority under the Commerce Clause to regulate the disclosure and resale of personal information from state motor vehicle records?17
Yes. The personal, identifying information that the DPPA regulates is a thing in interstate commerce, and the sale or release of that information in interstate commerce is therefore a proper subject of congressional regulation.20 The motor vehicle information which the States have historically sold is used by insurers, manufacturers, direct marketers, and others engaged in interstate commerce to contact drivers with customized solicitations.21 The information is also used in the stream of interstate commerce by insurers, manufacturers, direct marketers, and other entities for matters related to interstate motoring.22
Because drivers’ information is, in this context, an article of commerce, its sale or release into the interstate stream of business is sufficient to support congressional regulation.23 This holding applies directly to the established facts that state DMVs require drivers and automobile owners to provide personal information including name, address, telephone number, vehicle description, Social Security number, medical information, and photograph as a condition of obtaining a driver’s license or registering an automobile.24 Many states sell this personal information to individuals and businesses, generating significant revenues such as the approximately $8 million received each year by the Wisconsin Department of Transportation. South Carolina law makes the information contained in the state’s DMV records available to any person or entity that fills out a form listing the requester’s name and address. The form must state that the information will not be used for telephone solicitation.25
The Driver’s Privacy Protection Act of 1994 is a valid exercise of Congress’s authority under the Commerce Clause to regulate the disclosure and resale of personal information from state motor vehicle records.26
Whether the DPPA violates the Tenth Amendment by requiring states to administer and enforce its regulatory provisions in a manner that commandeers state officials?27
The Tenth Amendment prohibits Congress from commandeering the states’ legislative and administrative processes by requiring states to enact or enforce federal regulatory programs or by conscripting state officers to administer federal programs.28 However, a federal statute that regulates state activities rather than seeking to control or influence the manner in which states regulate private parties does not violate these principles.29
No. The DPPA does not require the States in their sovereign capacity to regulate their own citizens.30 The DPPA regulates the States as the owners of data bases.31 It does not require the South Carolina Legislature to enact any laws or regulations, and it does not require state officials to assist in the enforcement of federal statutes regulating private individuals.32 The DPPA’s provisions will require time and effort on the part of state employees to learn and apply the Act’s substantive restrictions. However, such commandeering is an inevitable consequence of regulating a state activity and presents no constitutional defect.33
The DPPA generally prohibits any state DMV or its officers, employees, or contractors from knowingly disclosing or making available personal information obtained in connection with a motor vehicle record without the driver’s consent, subject to numerous statutory exceptions.34 Any person who knowingly violates the DPPA may be subject to a criminal fine. A state agency maintaining a policy or practice of substantial noncompliance may be subject to a civil penalty of not more than $5,000 per day imposed by the United States Attorney General. These requirements regulate the states as owners of databases in the same manner as the statute upheld in South Carolina v. Baker.35
The DPPA does not violate the Tenth Amendment by requiring states to administer and enforce its regulatory provisions in a manner that commandeers state officials.36
Whether the DPPA is unconstitutional because it regulates states exclusively rather than through laws of general applicability?37
Even assuming general applicability is a constitutional requirement for federal regulation of the states. The DPPA satisfies any such requirement because it regulates the universe of entities that participate as suppliers to the market for motor vehicle information.38
No. The DPPA regulates the resale and redisclosure of drivers’ personal information by private persons who have obtained that information from a state DMV.39 Such persons must maintain records identifying to whom the records were disclosed and the permitted purpose for five years. The Act also makes it unlawful for any person to knowingly obtain or disclose any record for a use that is not permitted under its provisions.40 The DPPA therefore regulates both states and private actors participating in the market for motor vehicle information and is generally applicable rather than regulating the states exclusively.41
This conclusion follows from the established facts that the Act’s provisions do not apply solely to states.42 South Carolina’s conflicting law authorizes its DMV to charge a fee for releasing motor vehicle information while requiring the DMV to allow drivers to prohibit use of their information for commercial activities such as telephone solicitation.43
The DPPA is not unconstitutional because it regulates states exclusively rather than through laws of general applicability.44