Several months ago, Maryland implemented state legislation to enforce the provisions of the federal Drivers Privacy Protection Act (DPPA), which was passed by Congress to ensure that motor vehicle registration records would not be disclosed to just anyone. Although, in trying to pacify interest groups who regularly relied on such records, Congress provided more loopholes than any privacy advocate would like to see. When the dust had cleared, the only groups that could not get access to individual registration records were the press and the general public. Direct marketers could still get the names in bulk; insurance companies could get the information; private investigators could get it; even tow-truck operators could get it.
The act provided that states offer an opt-out, allowing individuals to have their records generally insulated from disclosure. When the law passed, a prevalent view in the privacy community was that the opt-out provision would not mean much because, statistically, most people don't bother to take advantage of such options.
But Maryland aggressively promoted the opt-out, and many drivers took advantage of it. Their desire to opt-out of the system was encouraged in part by widespread misreporting in the media, which left many drivers with the impression that they could prohibit their insurance companies from obtaining their records. Whether that played a large role in the matter, the result was Marylanders voting overwhelmingly to keep their records away from direct mailers and the like.
ACTING CONTROVERSIAL
DPPA has been controversial from the beginning. DMV records have traditionally been relied on by direct mailers and the press -- for the demographic information that can be gleaned from them, and because they are considered more accurate than phone or city directories.
These records have traditionally been open -- although that is generally unknown to the average driver -- and for Congress to mandate that states close them meant that access advocates saw a sizeable chunk of public records restricted for privacy reasons. Further, many thought Congress did not have the constitutional authority to require states to take such an action, but press advocates thought the argument was better made by the states than by the press. Only four states rose to the challenge -- South Carolina and Oklahoma first followed by Alabama and Wisconsin -- and DPPA was temporarily blocked in those states. But once a state has voluntarily passed implementing legislation, the constitutional challenge is probably vitiated.
GETTING IN LINE
On another front, the U.S. Court of Appeals for the Third Circuit in Philadelphia recently issued a decision putting the circuit in line with all other circuit courts that had looked at the matter. While the records at issue were of less universal application than motor vehicle records, the implications of the decision were equally damaging to the access side of the equation.
The case involved a review of a district court's decision that the Department of Veterans Affairs had to disclose payroll records -- including names and addresses, but excluding Social Security numbers -- to a union local that wanted to use them for monitoring compliance with the Davis-Bacon Act, which requires federal contractors to pay the local prevailing wage. The district court found that a 1988 Third Circuit decision, which allowed for disclosure of such lists without Social Security numbers, was binding and that the union met the Supreme Court's public interest analysis in Department of Justice v. Reporters Committee because disclosure of the names, addresses, and wage statements would allow the union to learn whether the federal agency was performing its statutory duty. But the Third Circuit ruled that monitoring an agency's performance was no longer an adequate reason for the minimal invasion of privacy involved and monitoring could be done without access to names and addresses.
The Supreme Court had already dealt with a similar issue in Department of Defense v. FLRA, when it ruled that the union representative for the bargaining unit did not have a right to the names and addresses of people in the bargaining unit. Even though Congress had said directly that collective bargaining was in the public interest, the Supreme Court decided that only the public interest analysis developed in Reporters Committee -- that disclosure of the information shed light on agency operations or activities -- was appropriate.
The workers whose names and addresses could have been disclosed probably never thought much about the matter one way or another. One reason for insisting that records were disclosable was that information is required by law to be posted at the worksite, albeit temporarily. As a policy matter, what are the expectations of individuals as to the privacy of their personal information?
WHAT'S EXPECTED?
One way to approach that question is to look at the reasons agencies give for disclosing such information as a "routine use" under the privacy act.
While I have not reviewed the privacy act notices on payroll records submitted in compliance with Davis-Bacon, it seems likely that the agencies allow this information to be disclosed for various purposes convenient to the agency. One problem the government had during its litigation over the issue of whether union representatives should be allowed access to names and addresses of members of the bargaining unit was that the Office of Personnel Management (OPM) had a routine use for disclosure where it was relevant to collective bargaining. Before the government decided to stop the disclosure of this kind of information, it was released as a routine use. During litigation, OPM amended its routine use notice to solve the problem in the government's favor. In other cases, courts have ruled that agencies may be legally required to create routine use exceptions, allowing unions access to personnel information because doing otherwise would violate the contract between the union and the agency.
Another way to look at the problem is to analogize it to the concept of fair information practices, which is the basis for statutory privacy rights. One of the important concepts in fair information practices is that the individual should have the right of access and correction, because it is the individual who is most concerned about the accuracy and integrity of his or her personal information. A bureaucracy cannot possibly monitor the accuracy of all the personal information in its possession, so privacy statutes allow the individual to point out discrepancies and force the agency to do something about them. In statutes like the Davis-Bacon Act, Congress must have realized that agencies cannot verify the accuracy of all wage statements provided under federal contracts.
But union locals have a much greater incentive in monitoring the accuracy of such statements in their localities, and they become a surrogate for the individual in trying to keep records accurate and complete. When they are cut out of the picture, the government is forced to assume the accuracy of the records. Even if an individual worker believes his or her wages were being unfairly reported, the worker would be more likely to bring the complaint to the union than to the government.
While the case law continues to provide a leg up for privacy, most individuals remain largely unaware of the potential benefits disclosure may have for them. But as the example in Maryland indicates, when encouraged to choose privacy, many individuals will do so.
Harry Hammitt is editor/publisher of "Access Reports," a newsletter published in Lynchburg, Va., covering open government laws and information policy issues.
May Table of Contents
