In Kehoe v. Fidelity Federal Bank and Trust, James Kehoe sued Fidelity Bank for purchasing hundreds of thousands of motor vehicle records from the state of Florida in violation of the federal Drivers Privacy Protection Act. Fidelity Bank had purchased 565,600 names and addresses from the Florida motor vehicles department from June 2000-2003. This information was sold for pennies--literally, Fidelity was able to obtain the information for only $5,656. Fidelity used the information to target residents of Palm Beach, Martin, and Broward Counties for car loan solicitations.

Drivers Privacy Protection Act

The Drivers Privacy Protection Act protects the confidentiality of motor vehicle records. It was enacted in 1993 after stalkers, murderers, and robbers were shown to have used records at DMVs in order to locate victims. In 1999, Senator Shelby amended the law to require opt-in consent before a DMV could release personal information for marketing purposes. The amendment took affect June 1, 2000, but Florida law was never updated to reflect the federal law change.

The U.S. District Court for the Southern District of Florida ruled in June 2004 that James Kehoe needed to demonstrate actual damages before obtaining any monetary recovery under the DPPA. The Court relied upon the recently decided Doe v. Chao and statutory construction rules to rule that the DPPA's liquidated damages do not accrue to a plaintiff unless he can show actual damages.

Several days after the District Court decision, Kehoe appealed to the 11th Circuit Court of Appeals. EPIC is writing an amicus brief supporting his case.

Kehoe is an important case that will determine whether individuals can effectively employ the Drivers Privacy Protection Act to shield personal information from indiscriminate sale to private investigators, stalkers, junk mailers and others. The liquidated damages clause in the DPPA is a tool that provides an effective punishment against those who traffic in our personal information. Liquidated damages clauses are used in a number of privacy laws; they ensure that individuals who cannot demonstrate actual harm can still enforce their right to privacy.

Furthermore, the DPPA is important because it protects personal information collected by the state--a coercive power. When the state requires individuals to provide personal information, it should not redisseminate personal data indiscriminately. In this case, Florida was using information collected for valid, administrative purposes and reselling it to raise revenue for incompatible purposes, such as direct marketing.