IN THE SUPREME COURT OF IOWA No. 17–1961
Filed January 3, 2020
MARK LEONARD MILLIGAN, Appellee, vs. OTTUMWA POLICE DEPARTMENT and CITY OF OTTUMWA, IOWA, Appellants.
Appeal from the Iowa District Court for Wapello County, Randy DeGeest, Judge.
A city appeals a district court judgment ordering it to release to a citizen the identities of all individuals detected as speeding by its automated traffic enforcement program under the Iowa Open Records Act. REVERSED AND REMANDED.
David E. Schrock and Skylar J. Limkemann of Smith Mills Schrock Blades Monthei P.C., Cedar Rapids, for appellants.
Steven Gardner of Denefe, Gardner & Zingg, P.C., Ottumwa, for appellee.
Brent L. Hinders, Eric M. Updegraff, and Alex E. Grasso of Hopkins & Huebner, P.C., Des Moines, for amicus curiae Iowa League of Cities.
George F. Davison Jr., Des Moines, for amicus curiae Iowa Freedom of Information Council.
3
MANSFIELD, Justice.
I. Introduction.
This case requires us to interpret provisions of the Driver’s Privacy Protection Act of 1994 (DPPA), 18 U.S.C. §§ 2721–2725 (2012), and a corresponding Iowa state law, Iowa Code § 321.11 (2017), to decide whether they overcome the general rule of public disclosure set forth in the Iowa Open Records Act, id. §§ 22.1–.14.
A city police sergeant was driving a patrol vehicle while off-duty. He received an automated traffic enforcement (ATE) citation for speeding from the city. As a private citizen, he then served a chapter 22 open records request. He specifically asked for the names of all persons who had and had not been issued ATE citations by the city after their vehicles were detected as speeding by an ATE camera.
The city denied the request for the names, contending the DPPA and Iowa Code section 321.11 prohibited disclosure of the requested information. This citizen went to district court, and the court granted his petition for mandamus, ordered the city to disclose the names, and awarded attorney fees and expenses. The city appealed.
On appeal, the city contends that the district court erred in ordering the production of records whose disclosure is prohibited by the DPPA and Iowa Code section 321.11. Additionally, the city contends the district court abused its discretion in awarding the citizen an unreasonable amount of attorney fees and costs.
We agree with the city’s first argument. Because the personal identifying information sought by this citizen comes from a vehicle registration and driver’s license database, its public disclosure is presumptively prohibited under the DPPA and Iowa Code section 321.11. Although both statutes allow disclosure under certain limited
4
circumstances, none of those circumstances apply here. Accordingly, we determine that the city did not commit an open records violation, and we reverse the judgment of the district court and remand for further proceedings consistent with this opinion.
II. Facts and Procedural Background.
The facts in this case are largely undisputed. To enforce its speeding ordinances, the City of Ottumwa uses an unmanned ATE vehicle provided by RedSpeed, a third-party contractor. After the ATE vehicle detects and photographs a speeding vehicle including its license plate number, RedSpeed documents the violation, accesses the National Law Enforcement Telecommunications System (NLETS) database to obtain the name of the registered owner of the vehicle, and uploads that information to an Internet portal. This enables a City police officer to review the materials and approve or reject the issuance of a citation. The reviewing officer also verifies the vehicle owner information. If the officer approves the issuance of a citation, RedSpeed relies on the registered owner’s information obtained from NLETS to mail the owner a citation, including the photographs of the violation and information on the vehicle’s speed.
As noted, the City’s ATE enforcement program is supported by use of the NLETS database. The NLETS database is a clearinghouse used nationally by law enforcement agencies. It contains motor vehicle, registration, and driver information submitted by state departments of motor vehicles.
On the night of May 24, 2016, an ATE camera detected an off-duty patrol car going forty-one miles per hour in a twenty-five miles-per-hour zone. It was later determined that the driver was Mark Milligan, a police sergeant who worked for the City. After discovering that Milligan was the driver, the City forwarded the citation to him, although the City was of
5
course the registered owner of the vehicle and the citation was actually issued to “Ottumwa PD.”
On August 1, Milligan—acting as a private citizen—submitted a written public records request to the City under Iowa Code chapter 22. He sought various records relating to the City’s ATE program. Among other things, he requested the following:
The names of violators issued citations from the Ottumwa Police Department once the violation is reported by Red Speed to the City of Ottumwa[,] Iowa.
The names of violators not issued citations after being reported as violations by Ottumwa Police Department. 1
1Milligan also placed eight other requests:
o The contractual agreement between Red Speed and the City of Ottumwa.
o All information provided to the City of Ottumwa, Ottumwa Police Department regarding all speed violations from Red Speed.
....
o Any and all policies and procedures established by the City of Ottumwa in regards to the issuance of citations by the Ottumwa Police Department once the violation is reported to the City by Red Speed.
o Any records or recorded conversations of Ottumwa Police Department personnel issuing verbal warnings for Red Speed Violations in lieu of actual citations.
o The individuals authorized to determine whether a citation is to be issued or not to be issued and any criteria established for such issuance or non-issuance of the citation.
o The calibration records of the Red Speed vehicle.
o The personnel authorized and trained to set up, calibrate, and have access to the Red Speed vehicle deployed in Ottumwa, Iowa by the Ottumwa Police Department.
o Any training records, and or certificates of training, specific to the set up and use of the Red Speed vehicle deployed in Ottumwa, Iowa.
6
Milligan later testified that he asked for this information “to see that the City of Ottumwa was enforcing their automated speed car enforcement fairly across the board between all citizens.”
On the advice of counsel, the City refused to release either set of requested names. The reason it gave for the denial was that “[i]nformation obtained by Red Speed is accessed through the NLETS portal and is confidential information under state and federal law.” The City did, however, provide the other requested items.
On September 12, Milligan filed in the Wapello County District Court a petition in equity and request for an order of mandamus pursuant to Iowa Code sections 22.5 and 22.10. He asserted that the City and its police department violated chapter 22 by withholding the information without “any lawful basis.” 2 He asked the court to order the City to provide the withheld information and reimburse his costs and attorney fees.
On February 9, 2017, the City filed a motion for summary judgment.
It asserted it was entitled to judgment as a matter of law because Milligan’s “requests seek confidential information that is prohibited from being disclosed under federal and state law”—meaning, the disclosure is
prohibited by the DPPA, 18 U.S.C. §§ 2721 and 2725, and Iowa Code sections 22.7(66) and 321.11. The City also asked for summary judgment
because Milligan had not provided any reasons for requesting the “confidential names of persons cited or not cited by the City.”
Following a hearing, the district court denied the City’s motion.
Later, the district court also denied a revised version of the City’s motion for summary judgment.
2Milligan named both the City and its police department as defendants, but for purposes of this opinion, we will refer to the defendants collectively as “the City.”
7
On November 2, the case was tried to the court. On November 28, the court issued its ruling. Implicitly, the court’s ruling recognized that the DPPA and Iowa Code section 321.11 limit disclosure of documents that would otherwise have to be produced under the Open Records Act. However, the court reasoned that both the DPPA and Iowa Code section 321.11 “exempt information on driving violations from their general prohibition on personal information disclosure.” It continued that “[t]he name[s] of speed regulation violators, which w[ere] requested, [are] information on driving violations, and [are] therefore, not confidential information under the DPPA or Iowa Code § 321.11.” Accordingly, the court concluded the City had failed to comply with chapter 22 and ordered the City to provide Milligan the requested information. The court also announced it would award attorney fees and invited a fee application. On December 5, the City filed a timely notice of appeal from the district court’s November 28 order and ruling.
Two days later, on December 7, Milligan submitted an application for attorney fees and nontaxable expenses. See Iowa Code § 22.10(3)(c). The City resisted the application, challenging both the hours billed and the hourly rates. On February 22, 2018, the court granted Milligan’s application in full, awarding $57,315.75 in attorney fees and expenses. The City timely appealed this order as well. We consolidated the appeals and retained them.
III. Standard of Review.
We review the district court’s interpretations of the DPPA, chapter 22 of the Iowa Code, and Iowa Code section 321.11 for correction of errors at law. Iowa Film Prod. Servs. v. Iowa Dep’t of Econ. Dev., 818 N.W.2d 207, 217 (Iowa 2012); Press–Citizen Co. v. Univ. of Iowa, 817 N.W.2d 480, 484 (Iowa 2012).
8
We review fact findings in chapter 22 actions, which are triable in equity, de novo. ACLU Found. of Iowa, Inc. v. Records Custodian, Atlantic Cmty. Sch. Dist., 818 N.W.2d 231, 232 (Iowa 2012); Press–Citizen Co., 817 N.W.2d at 484; Gannon v. Bd. of Regents, 692 N.W.2d 31, 37 (Iowa 2005).
We review the amount of an award of attorney fees and costs for an abuse of discretion. City of Riverdale v. Diercks, 806 N.W.2d 643, 652 (Iowa 2011).
IV. Did the District Court Err in Ordering the City to Produce the Names of Individual Vehicle Owners Requested by Milligan?
We must determine whether the DPPA and its Iowa counterpart, Iowa Code section 321.11, prohibit the City from releasing the names of individuals who were and were not cited for ATE speeding violations. To resolve this issue, we need to review closely the exceptions found in the DPPA and section 321.11.
A. The Iowa Open Records Act. At the outset, we acknowledge that the Open Records Act embodies “a liberal policy in favor of access to public records.” Mitchell v. City of Cedar Rapids, 926 N.W.2d 222, 229 (Iowa 2019) (quoting Hall v. Broadlawns Med. Ctr., 811 N.W.2d 478, 485
(Iowa 2012)). The Act provides, “Every person shall have the right to examine and copy a public record and to publish or otherwise disseminate
a public record or the information contained in a public record.” Iowa Code § 22.2(1). Also, “[a] government body shall not prevent the examination or copying of a public record by contracting with a nongovernment body to perform any of its duties of functions.” Id. § 22.2(2). Although the 2017 version of the Act contained sixty-eight enumerated exemptions from the disclosure requests, see Iowa Code § 22.7, they “are to be construed narrowly.” Mitchell, 926 N.W.2d at 229 (quoting Iowa Film Prod. Servs., 818 N.W.2d at 219).
9
Yet, this case does not concern one of those exemptions. Instead, our focus is on a federal statute and a state statute that independently prohibit the disclosure of certain government records under certain circumstances. The Federal DPPA, if it applies, would preempt any state law to the contrary, such as the Open Records Act. See Collier v. Dickinson, 477 F.3d 1306, 1312 & n.3 (11th Cir. 2007) (rejecting a qualified immunity defense because “[t]he law was clear at the relevant time that the DPPA preempted any conflicting state law that regulates the dissemination of motor vehicle record information”). In addition, specific state law prohibitions on disclosure located outside of chapter 22, such as Iowa Code section 321.11, can overcome the disclosure provisions in the Open Records Act. See Burton v. Univ. of Iowa Hosps. & Clinics, 566 N.W.2d 182, 189 (Iowa 1997) (“[C]hapter 22 does not trump or supersede specific statutes like sections 135.40–.42 on confidentiality of records.”).
B. The Driver’s Privacy Protection Act of 1994. The DPPA “regulates the disclosure and resale of personal information contained in the records of state motor vehicle departments (DMVs).” Reno v. Condon, 528 U.S. 141, 143, 120 S. Ct. 666, 668 (2000); see also Locate.Plus.Com, Inc. v. Iowa Dep’t of Transp., 650 N.W.2d 609, 614 (Iowa 2002) (“Congress also sought to curb the common practice by many states of selling information in motor vehicle records to businesses, marketers, and individuals.”). The genesis of the DPPA was the 1989 murder of a television actor at her home. Locate.Plus.Com, 650 N.W.2d at 614 n.2; Maureen Maginnis, Note, Maintaining the Privacy of Personal Information: The DPPA and the Right of Privacy, 51 S.C. L. Rev. 807, 809 (2000) [hereinafter Maginnis]. The actor was killed by a stalker who had hired a private detective to obtain her unlisted apartment address from the California Department of Motor Vehicles. Locate.Plus.Com, 650 N.W.2d at 614 n.2;
10
Maginnis, 51 S.C. L. Rev. at 809; William J. Watkins, Jr., Note, The Driver’s Privacy Protection Act: Congress Makes a Wrong Turn, 49 S.C. L. Rev. 983, 984 (1998) [hereinafter Watkins]. Congress enacted the DPPA, first, to address public safety concerns regarding stalkers’, domestic abusers’, and other criminals’ easy access to the personal information in state department of transportation records. See, e.g., Locate.Plus.Com, 650 N.W.2d at 614 & n.2; Watkins, 49 S.C. L. Rev. at 984–85. Second, the DPPA was intended to restrain many states’ practices of selling personal information in state DMV records to businesses and individuals. Condon, 528 U.S. at 143–44, 120 S. Ct. at 668; Locate.Plus.Com, 650 N.W.2d at 614; Maginnis, 51 S.C. L. Rev. at 808.
In pertinent part, the DPPA provides,
(a) In general.—A State department of motor vehicles, and any officer, employee, or contractor thereof, shall not knowingly disclose or otherwise make available to any person or entity:
(1) personal information, as defined in 18 U.S.C. § 2725(3), about any individual obtained by the department in connection with a motor vehicle record, except as provided in subsection (b) of this section[.]
18 U.S.C. § 2721(a)(1).
For DPPA purposes, the “State department of motor vehicles” in Iowa
is the Iowa Department of Transportation (IDOT). See Iowa Code § 307.27; Locate.Plus.Com, 650 N.W.2d at 611 (noting the IDOT maintains all motor vehicle records in Iowa, including personal information people disclose when obtaining a license or registering a vehicle). The DPPA defines “personal information” as
information that identifies an individual, including an individual’s photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability
11
information, but does not include information on vehicular accidents, driving violations, and driver’s status.
18 U.S.C. § 2725(3). The DPPA also defines “motor vehicle record” as “any record that pertains to a motor vehicle operator’s permit, motor vehicle title, motor vehicle registration, or identification card issued by a department of motor vehicles.” Id. § 2725(1). Thus, the name of an individual derived from a driver’s license or a motor vehicle registration constitutes confidential personal information. See id. This means that
under federal law, the name typically may not be disclosed by the IDOT or an IDOT contractor.
Section 2721(b) of the DPPA, however, carves out several exceptions to the nondisclosure rule. Id. § 2721(b). In some instances, such as vehicle recalls, disclosure of the personal information upon request is mandatory:
(b) PERMISSIBLE USES.—Personal information referred to in subsection (a) shall be disclosed for use in connection with matters of motor vehicle or driver safety and theft, motor vehicle emissions, motor vehicle product alterations, recalls, or advisories, performance monitoring of motor vehicles and dealers by motor vehicle manufacturers, and removal of nonowner records from the original owner records of motor vehicle manufacturers to carry out the purposes of titles I and IV of the Anti Car Theft Act of 1992, the Automobile Information Disclosure Act (15 U.S.C. 1231 et seq.), the Clean Air Act (42 U.S.C. 7401 et seq.), and chapters 301, 305, and 321–331 of title 49 . . . .
Id. In other instances, disclosure is permitted but not required. Relevant to our inquiry are the following permissible-use exceptions:
(b) PERMISSIBLE USES.—Personal information referred to in subsection (a) . . . subject to subsection (a)(2), may be disclosed as follows:
(1) For use by any government agency, including any court or law enforcement agency, in carrying out its functions, or any private person or entity acting on behalf of a Federal, State, or local agency in carrying out its functions.
12
....
(4) For use in connection with any civil, criminal, administrative, or arbitral proceeding in any Federal, State, or local court or agency or before any self-
regulatory body, including the service of process, investigation in anticipation of litigation, and the execution or enforcement of judgments and orders, or pursuant to an order of a Federal, State, or local court.
....
(14) For any other use specifically authorized under the law of the State that holds the record, if such use is related to the operation of a motor vehicle or public safety.
18 U.S.C. § 2721(b)(1), (4), (14).
In addition to restricting the initial disclosure and sale of personal information derived from motor vehicle records by state motor vehicle departments and their contractors, the DPPA “regulates the resale and redisclosure of drivers’ personal information by private persons who have obtained that information from a state DMV.” Condon, 528 U.S. at 146,
120 S. Ct. at 669. Simply stated, an authorized recipient may redisclose personal information in connection with a motor vehicle record obtained
directly or indirectly from a state motor vehicle department only for a use
that would have been a permissible basis for obtaining the information in the first place. See 18 U.S.C. § 2721(c) (“An authorized recipient of
personal information (except a recipient under subsection (b)(11) or (12)) may resell or redisclose the information only for a use permitted under subsection (b) (but not for uses under subsection (b)(11) or (12)).”).
Finally, the DPPA establishes civil and criminal penalties for violations. E.g., id. § 2722(a) (“It shall be unlawful for any person knowingly to obtain or disclose personal information, from a motor vehicle record, for any use not permitted under section 2721(b) of this title.”); id. § 2723(a) (“A person who knowingly violates this chapter shall be fined
13
under this title.”); id. § 2724(a) (“A person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter shall be liable to the individual to whom the information pertains, who may bring a civil action in a United States district court.”).
C. Iowa Code § 321.11. Iowa Code section 321.11 provides, in pertinent part,
1. All records of the department [of transportation], other than those made confidential or not permitted to be open in accordance with 18 U.S.C. § 2721 et seq., adopted as of a specific date by rule of the department, shall be open to public inspection during office hours.
2. Notwithstanding subsection 1, personal information shall not be disclosed to a requester, except as provided in 18 U.S.C. § 2721, unless the person whose personal information is requested has provided express written consent allowing disclosure of the person’s personal information. As used in this section, “personal information” means information that identifies a person, including a person’s photograph, social security number, driver’s license number, name, address, telephone number, and medical or disability information, but does not include information on vehicular accidents, driving violations, and driver’s status or a person’s zip code.
3. Notwithstanding other provisions of this section to the contrary, the department shall not release personal information to a person, other than to an officer or employee of a law enforcement agency, an employee of a federal or state agency or political subdivision in the performance of the employee’s official duties, a contract employee of the department of inspections and appeals in the conduct of an investigation, or a licensed private investigation agency or a licensed security service or a licensed employee of either, if the information is requested by the presentation of a registration plate number. In addition, an officer or employee of a law enforcement agency may release the name, address, and telephone number of a motor vehicle registrant to a person requesting the information by the presentation of a registration plate number if the officer or employee of the law enforcement agency believes that the release of the information is necessary in the performance of the officer’s or employee’s duties.
14
Iowa Code § 321.11(1)–(3). This section essentially incorporates the strictures of the DPPA into the Iowa Code. See Locate.Plus.Com, 650 N.W.2d at 615–16.
D. Answering the Question. As the foregoing demonstrates, the DPPA limits the City’s ability to redisclose personal information obtained by its contractor from NLETS, a clearinghouse of state department of motor vehicle information. Generally speaking, redisclosure is allowed only when initial disclosure would have been permitted on that basis. See 18 U.S.C. § 2721(c); Condon, 528 U.S. at 146, 120 S. Ct. at 669–70. To put the matter another way, information that started out as protected personal information under the DPPA does not lose that character just because it has been disclosed for a permissible use. Each redisclosure must be supported by its own permissible use. Is there a permissible use for the redisclosure sought by Milligan?
As we have already noted, relevant to our inquiry are the DPPA exceptions “[f]or use by any government agency,” “[f]or use in connection with any civil, criminal, administrative, or arbitral proceeding,” and “[f]or any other use specifically authorized under the law of the State that holds the record, if such use is related to the operation of a motor vehicle or public safety.” 18 U.S.C. § 2721(b)(1), (4), (14).
The United States Supreme Court has directed that DPPA exceptions should be construed narrowly. Maracich v. Spears, 570 U.S. 48, 60, 133 S. Ct. 2191, 2200 (2013). In Maracich, the Court held that § 2721(b)(4) does not authorize the disclosure of vehicle owners’ names and addresses to attorneys who wanted to use the information to solicit persons to join pending South Carolina litigation. 570 U.S. at 52, 133 S. Ct. at 2196. The Court acknowledged that § 2721(b)(4)’s “language, in literal terms, could be interpreted to its broadest reach to include the personal information
15
that respondents obtained here.” Id. at 59, 133 S. Ct. at 2200. Yet, the Court emphasized that “[a]n exception to a ‘general statement of policy’ is ‘usually read . . . narrowly in order to preserve the primary operation of the provision.’ ” Id. at 60, 133 S. Ct. at 2200 (quoting Comm’r v. Clark, 489 U.S. 729, 739, 109 S. Ct. 1455, 1463 (1989)). Accordingly, the Court said that “these exceptions ought not operate to the farthest reach of their linguistic possibilities if that result would contravene the statutory design.” Id.
We believe none of these three exceptions applies here.
First, Milligan is not a government agency, and he does not seek the records to carry out a governmental function. See 18 U.S.C. § 2721(b)(1). In fact, it is undisputed that Milligan was requesting the records in his capacity as a private citizen, using his personal home address, email, and telephone number.
Second, there is insufficient proof that the names were needed for use in another proceeding. See id. § 2721(b)(4). Milligan did testify in a conclusory fashion that he had a secondary purpose for seeking this information:
Q. And did you also seek this information for purposes of having it available for your federal lawsuit against the City of Ottumwa and the Chief of Police? A. Yes.
However, there was no testimony explaining why the names of persons cited or not cited for ATE violations were relevant or how they would be used in that case. No information about the federal lawsuit was offered into evidence.
Third, Milligan’s use of the records was not specifically authorized by a state law relating to motor vehicle or public safety. See id. § 2721(b)(14). Certainly the Open Records Act itself is not such a law.
16
In this regard, we note that the DPPA authorizes disclosure of information pertaining to “vehicular accidents” and “driving violations.” 18 U.S.C. § 2725(3). Likewise, Iowa Code section 321.11(2) authorizes disclosure of information pertaining to “vehicular accidents” and “driving violations.” Iowa Code § 321.11(2). This enables an insurance company, for example, to obtain a customer’s driving record—his or her past car accidents and traffic tickets. 3 In this case, the district court did not rely on any of the three exceptions found in §§ 2721(b)(1), (4), or (14) of the DPPA. Instead, it relied on the DPPA’s and section 321.11(2)’s language permitting disclosure of “driving violations.”
We disagree with the district court. ATE camera citations do not involve “driving violations.” Our court has recognized several features of ATE camera citations that distinguish them from traditional tickets for moving violations issued in person by a law enforcement officer. Most importantly, the ATE camera citation is issued to the vehicle owner, not the driver. See City of Davenport v. Seymour, 755 N.W.2d 533, 537 (Iowa 2008). The cited individual may or may not be a driver.
In addition, citations “are not reported to the Iowa Department of Transportation (IDOT) for the purpose of the vehicle owner’s driving record.” Id. By contrast, traditional citations are issued to the driver and reported to the IDOT, and go on the recipient’s driving record, which can result in higher auto insurance premiums or suspension of driving privileges after multiple moving violations. 4 In Seymour, we relied on these
3The DPPA permits personal information to be disclosed anyway for use by insurers in rating or underwriting. See 18 U.S.C. § 2721(b)(6).
4Here, for example, the City’s citation form states prominently, “PAYMENT OF THIS PENALTY AMOUNT WILL NOT RESULT IN POINTS AND CANNOT BE USED TO INCREASE YOUR INSURANCE RATES.” In other words, a person who is cited for violating
17
differences in holding that municipal ATE camera tickets were an alternative “system” for enforcing speeding or red light laws and therefore were not preempted by the uniformity requirement in Iowa Code section 321.235. Id. at 543. For the same reason, such citations cannot be considered driving violations within the meaning of the DPPA and section 321.11(2). 5 Accordingly, the redisclosure of the names of vehicle owners is prohibited by federal and state law. We find persuasive the court’s reasoning in New Richmond News v. City of New Richmond, 881 N.W.2d 339 (Wis. Ct. App. 2016). In that case, a police department relied on the DPPA in redacting personal identifying information such as names and addresses from two accident reports and one incident report it produced to a newspaper under the Wisconsin public records law. Id. at 347–48. The newspaper sued challenging the redactions. Id. at 348. The Wisconsin Court of Appeals framed the issue as follows:
It is undisputed that the Wisconsin DMV disclosed personal information from motor vehicle records to the police department. It is further undisputed that this initial disclosure of personal information was for a permissible use under the DPPA—namely, the police department’s officers used the information in the course of their duties to complete accident and incident reports. See 18 U.S.C. § 2721(b)(1)
(disclosure of personal information permitted “[f]or use by any government agency . . . in carrying out its functions”). The disputed issue is whether the police department’s subsequent redisclosure to the Newspaper of personal information contained in two accident reports and one incident report created by its officers would have been permissible under § 2721(c), which regulates the “redisclosure” of personal information by an “authorized recipient.” As relevant here,
the City’s ATE ordinance is not a “violator of the traffic laws” within the meaning of Iowa Code section 321.210, which authorizes IDOT to suspend a driver’s license when a person is “an habitual violator of the traffic laws.” Iowa Code § 321.210(1)(a)(2).
5Certainly, there can be no driving violation when no citation was issued.
18
such redisclosure is permissible “only for a use permitted under subsection (b).” Id. § 2721(c).
Id. at 350–51.
The court went on to hold that the police department’s redisclosure of the personal information in the accident reports was authorized by § 2721(b)(14) of the DPPA because Wisconsin had a separate law specifically mandating that law enforcement agencies provide the public with access to uniform accident reports. Id. at 352; see 18 U.S.C.
§ 2721(b)(14) (“For any other use specifically authorized under the law of the State that holds the record, if such use is related to the operation of a
motor vehicle or public safety.”). However, the newspaper could not obtain the unredacted version of the incident report because the only legal basis for its release in unredacted form was the Wisconsin public records law. Id. at 352–55. The court rejected the newspaper’s argument that releasing public records was an agency function for purposes of § 2721(b)(1):
[A]ccepting the Newspaper’s argument would lead to untenable results. If disclosure of personal information in response to public records requests constituted a “function”
of government agencies, for purposes of the DPPA’s agency functions exception, then any time an “authority” under the public records law received a public records request for personal information protected by the DPPA, it could disclose that information. This would include the Wisconsin DMV, which is an authority under the public records law.
Permitting the DMV to disclose personal information every time a public records request was made would eviscerate the protection provided by the DPPA, which was enacted to limit the circumstances in which state DMVs could disclose drivers’
personal information in order to protect their safety and privacy.
Id. at 354 (citation omitted). The court also found unpersuasive the newspaper’s argument that “redaction of personal information in police reports would prevent the public from verifying, and law enforcement from
19
demonstrating, that criminal and traffic laws are fairly enforced against all persons.” Id. at 355. In sum,
[T]he agency functions exception to the DPPA cannot be interpreted to permit the disclosure of personal information based solely on the fact that a public records request has been made. . . . [A] public records request is not, in and of itself, a sufficient basis to obtain personal information protected by the DPPA.
Id. “Thus, in circumstances where the DPPA prohibits the release of personal information obtained from DMV records, the public records law exempts that information from disclosure.” Id. at 356.
An Arkansas Supreme Court opinion upholding disclosure in Arkansas State Police v. Wren, 491 S.W.3d 124 (Ark. 2016), spotlights the same distinction between accident reports and other motor-vehicle-related records. In Wren, the requester sought access to certain accident reports under the Arkansas Freedom of Information Act (AFOIA) to solicit clients for his law practice. Id. at 125. Prior to disclosure of the reports to the requester, the Arkansas State Police redacted the names from the reports as personal information protected by the DPPA. Id. The Arkansas Supreme Court agreed with the requester that this was improper because vehicle accident reports created by police officers were not “motor vehicle records,” and therefore, names and addresses in such reports were not protected from disclosure by the DPPA. Id. at 128.
Our case is different from Wren. Milligan did not seek information on accident reports. 6 As already discussed, he did not seek information
6Additionally, there is authority contrary to Wren. See Pavone v. Law Offices of
Anthony Mancini, Ltd., 118 F. Supp. 3d 1004, 1006 (N.D. Ill. 2015) (concluding that the DPPA exclusion for accident reports “refers to information about the accident, not the personal information that is included in accident reports”); see also Wilcox v. Batiste, 360 F. Supp. 3d 1112, 1125 (E.D. Wash. 2018) (noting that the law is “unsettled” on whether personal information within accident reports is or is not protected by the DPPA).
20
on driving violations. Therefore, the names he requested would be considered “personal information” as defined by § 2725(3) of the DPPA. Those names were subject to the overall shield on the disclosure of such information set forth in DPPA § 2721(a)(1).
When a legal proceeding for a traffic violation is initiated in the Iowa courts, then subject to certain redactions the record is and should be publicly available from the courts. See Lucas v. Moore, ___ F. Supp. 3d ___, 2019 WL 4346344, at *4 (S.D. Ohio Sept. 12, 2019) (holding that a municipal court’s disclosure of certain personal information relating to a minor misdemeanor traffic offense on the public judicial website was permissible under the DPPA exceptions found in § 2721(b)(1) and (b)(4)), appeal docketed, No. 19-4010 (6th Cir. Oct. 17, 2019). This principle applies when a city brings a municipal infraction proceeding in court for violation of an ATE ordinance. Court dockets historically in Iowa have been open to the public, predating the Open Records Act. See Judicial Branch v. Iowa Dist. Ct., 800 N.W.2d 569, 575 (Iowa 2011), superseded in part by statute, 2015 Iowa Acts ch. 83, § 1 (codified at Iowa Code § 901C.2 (2016)), as recognized in State v. Doe, 903 N.W.2d 347, 351 (Iowa 2017). And they continue to be open to the public. But our case presents the different question whether a motorist’s personal information that is shielded from public disclosure by the DPPA and that is not filed in court can be obtained from a governmental entity. We conclude that it cannot be.
Note also that if we were to adopt Milligan’s position, then law enforcement in Iowa could be required under the Open Records Act to
Also, in Iowa, a separate statute makes accident reports filed by a law enforcement officer confidential subject to certain exceptions. See Iowa Code § 321.271(2); see also Shannon ex rel. Shannon v. Hansen, 469 N.W.2d 412, 415 (Iowa 1991) (discussing this statute).
21
disclose the names of persons issued warnings who never received traffic tickets. Also, in a case like Milligan’s, the requester would be able to obtain not just the names of individuals, but the actual vehicle license plate associated with each individual. 7 These things would surprise many Iowans, we think. A mass production of license-plate-and-name combinations could be used to facilitate stalking—exactly the situation the DPPA was enacted to prevent.
Because we are reversing the district court’s order that the names of individuals cited and not cited for ATE violations must be disclosed by the City to Milligan, we also reverse the supplemental order awarding attorney fees and costs to Milligan.
V. Conclusion.
For the foregoing reasons, we reverse the district court’s judgment and remand the case for further proceedings consistent with this opinion.
REVERSED AND REMANDED.
All justices concur except Wiggins, C.J., and Appel, J., who dissent.
7As we have discussed, Milligan wanted the names of persons cited and not cited “to see that the City of Ottumwa was enforcing their automated speed car enforcement fairly across the board between all citizens.” But logically, to determine if enforcement was occurring “fairly across the board,” one would need to see the photographs of the violation transmitted by RedSpeed to the City, which include the vehicle license plates.
22
#21/17–1961, Milligan v. Ottumwa Police Dep’t WIGGINS, Chief Justice (dissenting).
I respectfully dissent. Because I conclude that the Iowa Open Records Act requires the City to disclose the information Milligan sought and that neither the Driver’s Privacy Protection Act of 1994 (DPPA), 18 U.S.C. §§ 2721–2725 (2012), nor Iowa Code section 321.11 (2017) precludes the City from disclosing the requested information, I would affirm the district court’s order to produce.
My analysis begins with an examination of the Iowa Open Records Act, Iowa Code chapter 22. On appeal, the City does not dispute that the information Milligan requested qualifies as a public record under chapter 22 nor does it claim that any part of chapter 22 makes that information confidential. However, the inquiry does not end there but must involve review of the DPPA and Iowa Code section 321.11 and their effects on disclosure.
The DPPA limits the City’s ability to redisclose personal information it obtained from the Iowa Department of Transportation (IDOT). In order for the City to redisclose the information sought by Milligan, which it obtained from the IDOT, redisclosure must be allowed under the permissible use section of the DPPA. See 18 U.S.C. § 2721(c); Reno v. Condon, 528 U.S. 141, 146, 120 S. Ct. 666, 669–70 (2000).
The DPPA allows the disclosure or redisclosure of personal information for the following purposes:
(1) For use by any government agency, including any court or law enforcement agency, in carrying out its functions, or any private person or entity acting on behalf of a Federal, State, or local agency in carrying out its functions.
....
23
(4) For use in connection with any civil, criminal, administrative, or arbitral proceeding in any Federal, State, or local court or agency or before any self-regulatory body, including the service of process, investigation in anticipation of litigation, and the execution or enforcement of judgments and orders, or pursuant to an order of a Federal, State, or local court.
....
(14) For any other use specifically authorized under the law of the State that holds the record, if such use is related to the operation of a motor vehicle or public safety.
18 U.S.C. § 2721(b)(1), (4), (14).
It is clear to me that under any one of these exceptions, the City is
allowed to disclose the information sought by Milligan. Under § 2721(b)(1), disclosure is allowed because the City is exercising a lawful function under its ordinances when it issues a notice of violation to a person accused of or under investigation for failing to obey a speed limit. See City of Tallahassee v. Federated Publ’ns, Inc., No. 4:11cv395–RH/CAS, 2012 WL 5407280, at *2 (N.D. Fla. Aug. 9, 2012) (finding a city’s issuance of “a violation notice to a person accused of, or under investigation for, running a red light” was a lawful function of the city and, therefore, § 2721(b)(1) allowed the disclosure of the person’s name on the notice). The names of the persons not given a notice of violation are persons under investigation for failing to obey the speed limit.
Under § 2721(b)(4), disclosure is allowed because the City initiates an administrative proceeding, albeit as an informal process. See id.; see also Gilday v. City of Indianapolis, 54 N.E.3d 378, 384–85 (Ind. Ct. App. 2016) (holding § 2721(b)(4) allowed disclosure of a vehicle owner’s name and address on a parking ticket left on the vehicle because the disclosure was “for use in connection with” the administrative proceeding whereby the city finds parking violations and imposes fines).
24
Finally, under § 2721(b)(14), disclosure is allowed because the City’s ATE program is permitted by Iowa law and relates to motor vehicles and public safety. See Federated Publ’ns, Inc., 2012 WL 5407280, at *2 (finding § 2721(b)(14) allowed disclosure of the violators’ names on the notices of violation because the red-light program at issue was specifically authorized by Florida law and related to motor vehicle operation). We previously held that Iowa law allows a city to operate a speed camera program under its home rule authority. City of Davenport v. Seymour, 755 N.W.2d 533, 537–39, 543–44, 545 (Iowa 2008). Undoubtedly, the speed camera program relates to the operation of motor vehicles. Further, supporters of speed camera programs justify their operation as promoting public safety, id. at 544, even when no notice of violation is issued.
The majority concludes that ATE citations are not “driving violations” under the DPPA and, impliedly, that ATE citations are, therefore, not “personal information.” See 18 U.S.C. § 2725(3) (excluding “information on . . . driving violations” from the definition of personal information). In doing so, it relies on vehicular-accident-report cases. I disagree with this approach.
The accident-report cases are inconsistent—some allow disclosure, some do not. See Wilcox v. Batiste, 360 F. Supp. 3d 1112, 1125 (E.D. Wash. 2018) (acknowledging the unsettled question of whether personal information in accident reports is protected under the DPPA). Compare Mattivi v. Russell, No. Civ.A. 01–WM–533(BNB), 2002 WL 31949898, at *4 (D. Colo. Aug. 2, 2002) (holding disclosure of an accident report did not violate the DPPA because such reports are not a “motor vehicle record” under § 2725(1) of the DPPA), Ark. State Police v. Wren, 491 S.W.3d 124, 128 (Ark. 2016) (same), and New Richmond News v. City of New Richmond, 881 N.W.2d 339, 352 (Wis. Ct. App. 2016) (finding disclosure of
25
unredacted accident report to newspaper was allowed under § 2721(b)(14)’s exception for a use as authorized by state law), with Pavone v. Law Offices of Anthony Mancini, Ltd., 118 F. Supp. 3d 1004, 1006–07 (N.D. Ill. 2015) (holding accident reports are not motor vehicle records under the DPPA but § 2722(a), nonetheless, protects any personal information in such reports that is obtained from a motor vehicle record).
They are also distinguishable from the factual situation in this case.
Here, Milligan was not looking for all the details contained in accident reports—e.g., license plate numbers; driver’s date of birth, sex, license number, or home address; or the vehicle owner’s home address. See, e.g., Iowa Dep’t of Transp., Investigating Officer’s Crash Reporting Guide 3–4, 11–12 (2015), https://iowadot.gov/mvd/driverslicense/ InvestigatingOfficersCrashReportingGuide.pdf (providing instruction to law enforcement on completing accident reports, including what personal information to obtain); Iowa Dep’t of Transp., Form 433003, Investigating Officer’s Report of Motor Vehicle Accident 1 (2013), https://one.nhtsa.gov/nhtsa/stateCatalog/states/ia/crash.html (follow “Iowa Crash Report Form 433003, Rev. 11/2013” hyperlink) (IDOT’s accident report form for law enforcement). Rather, he just wanted the names of vehicle owners who were and were not issued ATE citations following a report of a violation. See Federated Publ’ns, Inc., 2012 WL 5407280, at *3 (noting redaction of some personal information on a violation notice may be required if that personal information is not necessary to the administrative proceeding or to the violation notice).
In any event, because I find that the information Milligan sought could be disclosed under the exceptions found in § 2721(b)(1), (4), and (14), my analysis does not change regardless of whether the information sought is personal information because, as the majority reasons, it does
26
not qualify as driving violations. Thus, I find the DPPA allows the City to redisclose the information sought by Milligan.
Accordingly, I also find that Iowa Code section 321.11 allows the City to redisclose the information sought by Milligan. Section 321.11 essentially codifies the DPPA into the Iowa Code. See Locate.Plus.Com, Inc. v. Iowa Dep’t of Transp., 650 N.W.2d 609, 615–16 (Iowa 2002). In this way, any prohibition against disclosure or redisclosure of personal information under section 321.11 is governed by the DPPA. As the DPPA does not prohibit redisclosure of the information Milligan sought, neither does Iowa Code section 321.11.
Having found that the Iowa Open Records Act requires the City to redisclose the information sought by Milligan and that neither the DPPA nor Iowa Code section 321.11 precludes the City from making such a redisclosure, I would hold the district court was correct in requiring the City to disclose the requested information to Milligan. See Federated Publ’ns, Inc., 2012 WL 5407280, at *2–3 (requiring the city to disclose the names of violators to a private party when the DPPA did not prohibit such disclosure and the state’s public records law required disclosure).
I also emphasize that Milligan is asking for only the names of persons, not extraneous information such as license numbers, plate numbers, or addresses. The release of this limited information will not be contrary to the purpose of the DPPA, which is to address public safety concerns regarding stalkers’ and other criminals’ easy access to the personal information in IDOT records and to restrain the sale of that information to businesses and individuals. Cf. Senne v. Village of Palatine, 784 F.3d 444, 447–48 (7th Cir. 2015) (balancing the utility of the disclosure against the risk of the harm that was the impetus for the DPPA); Ark. State Police, 491 S.W.3d at 128 (considering Congress’s intent in
27
enacting the DPPA when holding that accident reports are not motor vehicle records under the DPPA regardless of whether information in the report may have been obtained from the state department of motor vehicles).
Accordingly, I would hold the Iowa Open Records Act requires disclosure of the information sought and neither the DPPA nor Iowa Code section 321.11 protects the information requested from disclosure.
Appel, J., joins this dissent.