Ohio Advisory Opinions March 04, 2014: AGO 2014-007 (March 04, 2014)

Collection: Ohio Attorney General Opinions
Docket: AGO 2014-007
Date: March 4, 2014

Advisory Opinion Text

The Honorable Jon Husted

AGO 2014-7

Opinion No. 2014-007

Ohio Attorney General Opinions

Ohio Attorney General

March 4, 2014

The Honorable Jon Husted

Secretary of State

180 East Broad Street, 16th Floor

Columbus, Ohio 43215

SYLLABUS:

1. A Social Security number, driver's license number, name (first, middle, and last), street name, city, and state received by the Secretary of State from the Bureau of Motor Vehicles are personal information as defined in 18 U.S.C.A. § 2725(3) and R.C. 4501.27(F)(3). Other information that the Bureau of Motor Vehicles provides to the Secretary of State is personal information for purposes of 18 U.S.C.A. § 2725(3) and R.C. 4501.27(F)(3) if the information identifies an individual.

2. The Secretary of State is an authorized recipient of personal information under 18 U.S.C.A. § 2721(c) and R.C. 4501.27(C), and may disclose personal information for the permissible uses set forth in 18 U.S.C.A. § 2721(b)(l)-(10) and (13)-(14) and R.C. 4501.27(B)(2)(a)-(k) and (n)-(o).

3. The Secretary of State may disclose personal information to a member of the General Assembly pursuant to 18 U.S.C.A. § 2721(b)(1) and RC. 4501.27(B)(2)(a), provided the information is sought for use in carrying out the functions of the General Assembly.

4. The Secretary of State may disclose personal information to a journalist pursuant to 18 U.S.C.A. § 2721(b)(5) and RC. 4501.27(B)(2)(f), provided the journalist intends to use the information for research activities and does not publish or redisclose the information or use the information to contact the individuals to whom the information pertains.

Dear Secretary of State Husted:

You have requested an opinion regarding the disclosure of certain voter registration information that your office received from the Ohio Bureau of Motor Vehicles (BMV). According to your letter, the BMV sent electronic files to your office in October 2012 and in April 2013 that contain information collected by the BMV in relation to a person's change of address for both motor vehicle and voter registration purposes. The electronic files include information about each person who submitted a change of address form. Some information relates to each person's change of address. This information includes name and address ("street name, " city, state, zip code, and "county number"). It also includes additional identifying information about each person who submitted a change of address form, including date of birth, "license number, " and Social Security number. Each person's gender also is included.

The electronic files that the BMV transferred to your office also contain many other types of information about each person who submitted a change of address form. The electronic files include information about each person's motor vehicle record, including fields identified in your request as "license class code, " "license issue date, " and "license expiration date." The electronic files include information about each person's out-of-state record, including the fields "out of state person moved to, " "out of state date reported, " "out of state license number, " "out of state code, " "out of state [driver's license number], " "out of state [driver's license] expire date, " and "out of state reported to Ohio." The electronic files include what seem to be routine record-keeping information, including various timestamps, an address change date, an application number, and the field "doc presented literal." Finally, the electronic files include the fields "citizen flag" and "Ohio residency flag."

You have received two requests for the information contained in the electronic files you received from the BMV. One request is from a member of the General Assembly and the other is from a journalist. Your inquiry arises because of these requests. Your letter presents the following questions:

1. In response to a public records request, may the Secretary of State release information related to voter registration changes of address received from the BMV pursuant to the National Voter Registration Act of 1993 and R.C. 3503.11?

2.Must a requestor assert a "permissible use" for this information pursuant to the Driver's Privacy Protection Act of 1994 (DPPA), 18 U.S.C.A. § 2721(b), or R.C. 4501.27(B)(2)?

3. If a sufficient "permissible use" is not asserted, what information must be withheld as "personal information" or "highly restricted personal information?"

4.Do requests received by the Secretary of State from a member of the General Assembly and a journalist satisfy any of the "permissible use" exceptions under the DPPA or RC. 4501.27?

We begin by explaining the laws, federal and state, that must be considered to determine the answers to your questions.

The National Voter Registration Act and R.C. 3503.11

Pursuant to the National Voter Registration Act of 1993 (NVRA), 42 U.S.C.A. §§ 1973gg to 1973gg-10 (Westlaw 2013), and R.C. 3503.11, the BMV is required to allow eligible citizens to register to vote and update their voter registration when they apply for or renew a driver's license. Congress enacted the NVRA to enhance federal voting opportunities for eligible citizens by making it easier for citizens to register to vote and maintain their voter registration. See 42 U.S.C.A. § 1973gg. The NVRA's express purposes are to "increase the number of eligible citizens who register to vote" in federal elections, "enhance[] the participation of eligible citizens as voters in elections for Federal office[, ]" "protect the integrity of the electoral process[, ]" and "ensure that accurate and current voter registration rolls are maintained." 42 U.S.C.A. § 1973gg(b).

The NVRA requires states to offer voter registration by three means: in conjunction with a driver's license application, by mail, and through certain state offices. 42 U.S.C.A. § 1973gg-2. The NVRA also establishes requirements for the administration of the voter registration process, such as describing the kind of information that may be required on voter registration forms and the procedures by which states may remove a registered voter from federal voter rolls. 42 U.S.C.A. § 1973gg-3(c)(2); 42 U.S.C.A. § 1973gg-6(a)(3) and (4); 42 U.S.C.A. § 1973gg-7(b). Your inquiry relates to the NVRA's requirement that eligible citizens be given the opportunity to register to vote and update their voter registration when they apply for a driver's license, renew a driver's license, or change their address on their driver's license. 42 U.S.C.A. § 1973gg-2(a)(l); 42 U.S.C.A. § 1973gg-3. Specifically, your questions relate to the change of address provision in 42 U.S.C.A. § 1973gg-3(d):

Any change of address form submitted in accordance with State law for purposes of a State motor vehicle driver's license shall serve as notification of change of address for voter registration with respect to elections for Federal office for the registrant involved unless the registrant states on the form that the change of address is not for voter registration purposes.

Completed voter registration information must be transmitted from the state motor vehicle authority to "the appropriate state election official" within ten days or, if the voter registration information is received within five days before the last day for voter registration, within five days. 42 U.S.C.A. § 1973gg-3(e).

The General Assembly has implemented the NVRA by incorporating its requirements into RC. Title 35, which governs Ohio elections. 1993-1994 Ohio Laws, Part II, 2516 (Am. Sub. S.B. 300, eff Nov. 21, 1994). R.C. 3503.11 sets forth the voter registration duties of the BMV as follows:

When any person applies for a driver's license, commercial driver's license, a state of Ohio identification card issued under [R.C. 4507.50], or motorcycle operator's license or endorsement, or the renewal or duplicate of any license or endorsement under [R.C. Chapter 4506 or 4507], the registrar of motor vehicles or deputy registrar shall offer the applicant the opportunity to register to vote or to update the applicant's voter registration. The registrar of motor vehicles or deputy registrar also shall make available to all other customers voter registration applications and change of residence and change of name forms, but is not required to offer assistance to these customers in completing a voter registration application or other form.

The BMV, in accordance with state and federal law, permits a person who changes his address for purposes of his driver's license to update simultaneously his address for purposes of voter registration. A person may change his address with the BMV by completing a change of address form (BMV form 5756). In the alternative, the BMV's website allows a person to submit electronically all of the information that is required on the change of address form.

When a person completes the BMV's change of address form for driver's license purposes, the form also serves as a change of address notification for voter registration purposes. The lower half of the change of address form requires the person completing the form to provide information necessary to change his address for purposes of his driver's license including, for example, name, date of birth, driver's license number, old address, and new address. The person must sign and date this portion of the form.

The upper half of the change of address form informs the person completing the form that the information submitted on the lower half of the form also may be used to update his address for voter registration purposes. The upper half of the form states:

Under federal and state law (42 U.S.C. § 1973gg-3 and Ohio Revised Code § 3503.11), a change of address form submitted to the Ohio Bureau of Motor Vehicles also serves as notification of a change of address for voter registration purposes. By signing this form, you are consenting to the release of the information provided on this form to the Ohio Secretary of State's office for voter registration purposes. If you do not want your information to be released to the Ohio Secretary of State's office, or if you do not meet Ohio's voter eligibility requirements[], please check the "opt out" box below.

Below this statement, there is a box that the person completing the form may mark followed by the statement "I do not want the information provided on my change of address form to be forwarded to the Ohio Secretary of State's office for voter registration purposes." In other words, a person completing a driver's license change of address form may "opt out" of updating his address for voting. Finally, the person must sign and date the upper half of the form.

Similarly, if a person updates his address electronically through the BMV's website, he is asked to provide the information required to change his address for driver's license purposes. He receives the same statement provided on the paper form regarding updating his voter registration information and the same option to "opt out" of having his information submitted to the Secretary of State. Like a person completing a paper form, a person updating his address electronically provides his information (name, address, etc.) only one time. There is not a separate change of address form that must be completed and submitted electronically for purposes of voter registration.

R.C. 3503.11 states that the Registrar of Motor Vehicles or the deputy registrar shall send completed change of residence forms to the board of elections of the county in which the office of the Registrar or deputy registrar is located within five days after accepting the form. You explain that the BMV electronically transmitted information collected from the change of address form, including forms submitted in person or electronically through the BMV's website, to your office. Your office then sent the information to the appropriate county boards of elections.

Ohio's Public Records Law, R.C. 149.43

Ohio's public records law requires a public office to promptly prepare its "public records" and make them available for inspection "to any person at all reasonable times during regular business hours." RC. 149.43(B)(1). A public office also is required to make copies of its public records at cost and within a reasonable time. Id "RC. 149.43 is construed liberally in favor of broad access, and any doubt is resolved in favor of disclosure of public records." State ex rel. Cincinnati Enquirer v. Hamilton Crtiy., 75 Ohio.St.3d 374, 376, 662 N.E.2d 334 (1996); see also 2011 Op. Att'y Gen. No. 2011-012, at 2-108 to 2-109.

As used in R.C. 149.43, the term "public record" means "records kept by any public office." RC. 149.43(A)(1). Within RC. 149.43(A)(1), the General Assembly has established various exceptions to the definition of "public record." Records and information that are excluded from the definition pursuant to the exceptions are not subject to disclosure under R.C. 149.43. R.C. 149.43(A)(1), (B); see 2007 Op. Att'y Gen. No. 2007-042, at 2-427 ("[i]f a record is not a public record for purposes of R.C. 149.43, then the contracting coroner has no duty generally to make it available for inspection and copying, and R.C. 149.43 contains no specific provision for a coroner to make records that are not public records available to a journalist or insurer"); 2007 Op. Att'y Gen. No. 2007-025, at 2-262 (records excepted from the definition of public records under R.C. 149.43(A)(l)(v) are not required to be made available for inspection by the public).

Your inquiry concerns the exception set forth in R.C. 149.43(A)(l)(v). Pursuant to this provision, the term "public record" does not include "[rjecords the release of which is prohibited by state or federal law." RC. 149.43(A)(l)(v). You wish to know whether the DPPA and R.C. 4501.27 prohibit the release of the records your office received from the BMV for purposes of R.C. 149.43(A)(l)(v).

The Driver's Privacy Protection Act

Congress enacted the Driver's Privacy Protection Act of 1994 (DPPA), 18 U.S.C.A. §§ 2721-2725 (Westlaw 2013) as an amendment to the Violent Crime Control and Law Enforcement Act of 1994, Pub. L. No. 103-322, 108 Stat. 1796, to protect personal information contained in state motor vehicle records. This legislation responded to at least two concerns about the disclosure of this information: "a growing threat from stalkers and criminals who could acquire personal information from state DMVs" and "the States' common practice of selling personal information to businesses engaged in direct marketing and solicitation." Maracich v. Spears, 133 S.Ct. 2191, 2198 (2013); accordRoth v. Guzman, 650 F.3d 603, 606 (6th Cir. 2011).

The DPPA regulates disclosure of personal information and highly restricted personal information contained in state motor vehicle records. 18 U.S.C.A. § 2721(a); see also Reno v. Condon, 528 U.S. 141, 144 (2000). The DPPA provides that, unless one of its exceptions applies, "[a] State department of motor vehicles, and any officer, employee, or contractor thereof, shall not knowingly disclose or otherwise make available to any person or entity ... personal information ... or highly restricted personal information ... about any individual obtained by the department in connection with a motor vehicle record." 18 U.S.C.A. § 2721(a).

"Personal information" is defined as "information that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information, but does not include information on vehicular accidents, driving violations, and driver's status." 18 U.S.C.A. § 2725(3). Several types of "personal information" are further defined as "highly restricted personal information." See Kost v. Hunt, No. 13-583, 2013 WL 6048921, at *4 (D. Minn. Nov. 15, 2013) (the DPPA "designates a subset of the 'personal information' as 'highly restricted personal information'"). "Highly restricted personal information" means "an individual's photograph or image, social security number, [and] medical or disability information." 18 U.S.C.A. § 2725(4).

The DPPA bars any person from knowingly obtaining personal information for any unauthorized use and from obtaining personal information by "false representation." 18 U.S.C.A. § 2722. Persons who knowingly violate the DPPA's provisions are subject to criminal fines, 18 U.S.C.A. § 2723(a), and private rights of action by the person to whom the personal information pertains, 18 U.S.C.A. §2724.

The general prohibition on the disclosure of personal information and highly restricted personal information by a state department of motor vehicles is subject to a number of statutory exceptions, both mandatory and permissive. 18 U.S.C.A. § 2721(b). The exceptions that authorize disclosure are referred to as "permissible uses." Id A state department of motor vehicles is required to disclose personal information for uses related to, among others, motor vehicle or driver safety and theft, and compliance with federal statutes such as the Automobile Information Disclosure Act, 15 U.S.C.A. §§ 1231-1233 (Westlaw2013). 18 U.S.C.A. § 2721(b).

There also are fourteen enumerated uses for which disclosure of personal information by a state department of motor vehicles is permitted but not required. 18 U.S.C.A. § 2721(b)(l)-(14). For example, personal information may be disclosed by a state department of motor vehicles "[f]or use by any government agency ... in carrying out its functions." 18 U.S.C.A. § 2721(b)(1). Many of the permissible uses authorize a state department of motor vehicles to disclose personal information without the consent of the person to whom the information pertains. 18 U.S.C.A. § 2721(b)(l)-(10) and (14). Only three of the permissible uses require consent to disclosure by the person to whom the information pertains. 18 U.S.C.A. § 2721(b)(l 1)-(13).

The DPPA permits a state department of motor vehicles to disclose highly restricted personal information for fewer purposes than other types of personal information. A state department of motor vehicles shall not disclose highly restricted personal information "without the express consent of the person to whom such information applies, except uses permitted in subsections (b)(1), (b)(4), (b)(6), and (b)(9)." 18 U.S.C.A. § 2721(a)(2). Accordingly, highly restricted personal information may be disclosed by a state department of motor vehicles without consent only: for use by a government agency in carrying out its functions, 18 U.S.C.A. § 2721(b)(1); in connection with a court or agency proceeding, 18 U.S.C.A. § 2721(b)(4); by an insurer in claims investigation and antifraud activities, 18 U.S.C.A. § 2721(b)(6); and by an employer to obtain or verify information relating to a holder of a commercial driver's license as required by federal law, 18 U.S.C.A. § 2721(b)(9).

In addition to protecting personal information from disclosure by a state department of motor vehicles, the DPPA protects the disclosure of this information by "authorized recipients" of that information. The DPPA states, in relevant part, "[a]n authorized recipient of personal information ... may resell or redisclose the information only for a use permitted under subsection (b) (but not for uses under subsection (b)(l 1) or (12))" 18 U.S.C.A. § 2721(c).

Although "authorized recipient" is not defined by statute, it is apparent from the language of 18 U.S.C.A. § 2721(c) that an authorized recipient is a person or entity who has received personal information as authorized by 18 U.S.C.A. § 2721(b). See Welch v. Jones, 110 F.Supp.2d 1253, 1258 (N.D. Fla. 2011); Wiles v. Worldwide Info., Inc., 809 F.Supp.2d 1059, 1066-67 and 1071 (W.D. Mo. 2011) (authorized recipient "refer[s] to those persons or entities that obtained the information pursuant to one or more of the fourteen exceptions immediately preceding the reference to 'authorized recipient'"); Young v. West Publ'g Corp., 724 F.Supp.2d 1268, 1271 (S.D. Fla. 2010) (authorized recipient '"unambiguously refers to an individual or entity authorized to receive personal information for sale or resale'" (quoting Graczykv. West Publ'g Corp., No. 09 C 4760, 2009 WL 5210846, at *4 (N.D. 111. Dec. 23, 2009))); Roberts v. Source for Pub. Data, No. 08-4167-CV-C-NKL, 2008 WL 5234675, at *3 (W.D. Mo. Dec. 12, 2008) ("[f]rom the context of section 2721(c), and the references therein to recipients being authorized under particular section 2721(b) exceptions, it is clear that a recipient becomes authorized only by virtue of obtaining the information for a reason listed in section 2721(b)"). The Secretary of State is an authorized recipient of the change of address information received from the BMV.

The Secretary of State is authorized to receive personal information and highly restricted personal information from the BMV under 18 U.S.C.A. § 2721(b)(1). 18 U.S.C.A. § 2721(c); see also 18 U.S.C.A. § 2721(a)(2) (authorizing disclosure of highly restricted personal information). This provision permits the BMV to disclose personal information, including highly restricted personal information, "[f]or use by any government agency ... in carrying out its functions." 18 U.S.C.A. § 2721(b)(1); see also 18 U.S.C.A. § 2721(a)(2). The functions of the Secretary of State include various statutory responsibilities with respect to updating voter registration information. See, e.g., R.C. 3501.04 (Secretary of State is state's chief election officer); R.C. 3501.05(R) (Secretary of State must prescribe a program for updating voter registration information, such as name and residence changes); R.C. 3503.09 (Secretary of State must adopt rules for electronic transmission of name and residence changes for voter registration records); R.C. 3503.15 (Secretary of State must establish and maintain statewide voter registration database); 42 U.S.C.A. § 1973gg-8 (requiring each state to designate a state officer as the chief state election official responsible for coordination of state responsibilities under the NVRA); Harkless v. Brunner, 545 F.3d 445, 450-54 (6th Cir. 2008) (the Secretary of State is required to coordinate and implement the state's responsibilities with respect to voter registration under the NVRA). See also 42 U.S.C.A. § 1973gg-3(e) (BMV must transmit voter registration information to "appropriate state election official"). Therefore, the Secretary of State is an authorized recipient of the voter registration change of address information received from the BMV under 18 U.S.C.A. § 2721(b)(1).

R.C. 4501.27

Ohio law is nearly identical to the DPPA. R.C. 4501.27 prohibits the BMV from disclosing to any person or entity "any personal information" obtained by the BMV in connection with a motor vehicle record. RC. 4501.27(A). RC. 4501.27(F)(3) defines "personal information, " as used in RC. 4501.27, as "information that identifies an individual, including, but not limited to, an individual's photograph or digital image, social security number, driver or driver's license identification number, name, telephone number, or medical or disability information, or an individual's address other than the five-digit zip code number." Like the DPP A, Ohio law requires disclosure of personal information by the BMV for certain purposes, such as motor vehicle or driver safety and theft. R.C. 4501.27(B)(1). Ohio law further authorizes, but does not require, disclosure of personal information by the BMV for fifteen enumerated purposes. R.C. 4501.27(B)(2)(a)-(o). Only three require consent to disclosure by the person to whom the information pertains. R.C. 4501.27(B)(2)(l)-(n).

R.C. 4501.27 further defines several types of personal information as "sensitive personal information." RC. 4501.27(F)(5). "Sensitive personal information, " as used in RC. 4501.27, is "an individual's photograph or digital image, social security number, or medical or disability information." R.C. 4501.27(F)(5). Sensitive personal information, like highly restricted personal information under the DPP A, may be disclosed by the BMV for fewer purposes than other types of personal information. R.C. 4501.27(B)(3). Sensitive personal information may be disclosed by the BMV only if either of the following conditions are satisfied:

(i) The individual whose personal information is requested completes and submits to the registrar or deputy registrar a form prescribed by the registrar by rule giving express consent to such disclosure;

(ii) The disclosure is for one or more of the purposes described in [R.C. 4501.27(B)(2)(a), (d), (g), or (j)].

R.C. 4501.27(B)(3)(a). The permissible uses for which sensitive personal information may be disclosed under R.C. 4501.27 are the same as the permissible uses for which the DPPA authorizes disclosure of highly restricted personal information: for use by a government agency in carrying out its functions, R.C. 4501.27(B)(2)(a); for use in connection with a court or agency proceeding, R.C. 4501.27(B)(2)(d); for use by an insurer in claims investigation and antifraud activities, R.C. 4501.27(B)(2)(g); and for use by an employer to obtain or verify information relating to a holder of a commercial driver's license as required by federal law, R.C. 4501.27(B)(2)(j).

Finally, like the DPPA, Ohio law protects personal information from disclosure by a state department of motor vehicles and by an "authorized recipient" of personal information. R.C. 4501.27(C). RC. 4501.27(C) provides, in relevant part, that "an authorized recipient of personal information about an individual that the bureau of motor vehicles obtained in connection with a motor vehicle record ... may resell or redisclose the personal information only for a use permitted under division (B)(1), (B)(2)(a) to (k), (B)(2)(n), or (B)(2)(o) of this section." RC. 4501.27 does not define "authorized recipient" nor are we aware of any cases that have interpreted this term as used in RC. 4501.27. As in the case of the DPPA, the language of RC. 4501.27(C) indicates that the term refers to a person or entity that has received personal information as authorized by R.C. 4501.27(B). See Wiles v. Worldwide Info., Inc., 809 F.Supp.2d at 1066-67 and 1071 (interpreting analogous language in 18 U.S.C.A. § 2721(c)); Roberts v. Source for Pub. Data, 2008 WL 5234675, at *3 (same as prior parenthetical); see also State v. Wallace, 2012-Ohio-6270, 986 N.E.2d 498, at If50 (Ohio wiretap statute may be interpreted consistently with federal statute because state statute mirrors federal statute); 2006 Op. Att'y Gen. No. 2006-038, at 2-353 to 2-354 ("[a]t times, Ohio courts will look to case law interpreting the federal freedom of information act (FOIA) ... for guidance and support in interpreting RC. 149.43").

The Secretary of State is an authorized recipient of the change of address information it receives from the BMV. R.C. 4501.27(B)(2)(a) authorizes the BMV to disclose personal information, including sensitive personal information, "[f]or the use of a government agency ... in carrying out its functions." See also RC. 4501.27(C); RC. 4501.27(B)(3)(a)(ii) (authorizing disclosure of sensitive personal information). The functions of the Secretary of State, as previously explained, include updating voter registration information. See, e.g., R.C. 3501.05(R); R.C. 3503.09; R.C. 3503.15; 42 U.S.C.A. § 1973gg-8.

Thus, the DPPA and R.C. 4501.27 prohibit disclosure of personal information gathered by the BMV in connection with a motor vehicle record unless the disclosure is expressly permitted by statute. These laws further regulate disclosure of personal information by an authorized recipient such as the Secretary of State.

The DPPA and R.C. 4501.27 Authorize the Secretary of State to Disclose Personal Information for Certain Permissible Uses

Your first question asks whether you may disclose the information you received from the BMV. You also ask whether a "permissible use" must be asserted by a person who makes a public records request before you may disclose the information you received from the BMV. Your third question asks what information must be withheld if a permissible use is not asserted.

As a preliminary matter, we must consider whether the change of address information for voter registration purposes collected by the BMV on the change of address form is protected by the DPPA and R.C. 4501.27. The DPPA and R.C. 4501.27 control the disclosure of personal information if the information is obtained "in connection with a motor vehicle record." 18 U.S.C.A. § 2721(a); R.C. 4501.27(A). Therefore, we must determine whether the change of address form used by the BMV is a "motor vehicle record" for purposes of the DPPA or RC. 4501.27.

The DPPA defines a "motor vehicle record" as "any record that pertains to a motor vehicle operator's permit, motor vehicle title, motor vehicle registration, or identification card issued by a department of motor vehicles." 18 U.S.C.A. § 2725(1) (emphasis added). Ohio law similarly defines a "motor vehicle record" as "a record that pertains to a motor vehicle driver's or commercial driver's license or permit, a motor vehicle certificate of title, a motor vehicle registration or motor vehicle identification license plates, or an identification card issued by the bureau of motor vehicles." R.C. 4501.27(F)(1) (emphasis added). Here, the change of address information for voter registration purposes is collected from the BMV change of address form, as previously described. The BMV's change of address form is a "motor vehicle record" for purposes of the DPPA and R.C. 4501.27 because the form updates, and therefore "pertains to, " a person's motor vehicle records. In Ohio, a person who applies for a driver's license must provide an address as a condition of receiving that license and in connection with motor vehicle registration. See R.C. 4503.10(A)(2) (application for registration or renewal of registration of motor vehicles); R.C. 4506.07(A)(1) (application for commercial driver's license); R.C. 4507.06(A)(1)(a) (application for driver's license, motorcycle operator's license or endorsement, or motor-driven cycle or motor scooter license or endorsement). A person also is required to update her address with the BMV for driver's license and vehicle registration purposes. See, e.g., R.C. 4503.101(E) (owner or lessee of a motor vehicle holding a certificate of registration must notify Registrar of change of address); R.C. 4506.14(D) (person holding commercial driver's license must notify Registrar of change of address); R.C. 4507.09(C) (person holding driver's license must notify Registrar of change of address); R.C. 4519.05(C) (owner of registered snowmobile, off-highway motorcycle, or all-purpose vehicle must notify Registrar of change of address). Therefore, change of address information collected by the BMV is obtained "in connection with a motor vehicle record, " and the information is protected by the DPPA and R.C. 4501.27. But see Lake v. Neal, 585 F.3d 1059 (7th Cir. 2009) (voter registration form that is filled out at a state department of motor vehicles but is not part of the driver's license application does not "pertain to" a motor vehicle record; therefore, disclosure of the information in the form is not protected under the DPPA).

Next we consider whether you may disclose change of address information that the BMV provides to your office. Because the Secretary of State is an authorized recipient of personal information from the BMV, we look to the provisions of federal and state law that govern disclosure by an authorized recipient. 18 U.S.C.A. § 2721(c) and R.C. 4501.27(C) permit an authorized recipient to disclose "personal information" for the uses set forth therein. Therefore, we must determine whether the specific types of information received by your office from the BMV are personal information as defined by 18 U.S.C.A. § 2725(3) and R.C. 4501.27(F)(3).

The following types of information that the BMV provides to your office (and listed in your request) are specifically included in the pertinent definitions of personal information: Social Security number, driver's license number, name (first, middle, and last), street name, city, and state. 18 U.S.C.A. § 2725(3); R.C. 4501.27(F)(3). Therefore, the DPPA and RC. 4501.27 restrict the disclosure of this information.

The remaining types of information provided to your office (and listed in your request) are not among the types of information specifically enumerated in the definitions of personal information set forth in 18 U.S.C.A. § 2725(3) and R.C. 4501.27(F)(3). As discussed in detail at the beginning of this opinion, the information that the BMV provides to you includes many different types of information. For example, the BMV provides you a date of birth, "county number", "citizen flag, " "Ohio residency, " gender, information related to each person's motor vehicle record, information related to each person's out-of-state motor vehicle record, and other types of record-keeping information.

The foregoing types of information are not listed explicitly in the definitions of personal information set forth in 18 U.S.C.A. § 2725(3) or R.C. 4501.27(F)(3). Nonetheless, we must consider whether the information may constitute personal information pursuant to other language appearing in the definitional provisions.

The DPPA defines "personal information" as "information that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information." 18 U.S.C.A. § 2725(3) (emphasis added). R.C. 4501.27 similarly defines "personal information" as "information that identifies an individual, including, but not limited to, an individual's photograph or digital image, social security number, driver or driver's license identification number, name, telephone number, or medical or disability information, or an individual's address other than the five-digit zip code number." R.C. 4501.27(F)(3) (emphasis added). By using the language "information that identifies an individual, " the statutes contemplate a definition that extends beyond the types of information specifically listed thereafter. See Senne v. Vill. of Palatine, 695 F.3d 597, 608 (7th Cir. 2012) (broadly concluding that a person's name, address, driver's license number, date of birth, sex, height, and weight are "protected information" for purposes of the DPPA); Dahlstrom v. Sun-Times Media, LLC, No. 12 C 658, 2012 U.S. Dist. LEXIS 125853, at *7-8 (N.D. 111. Sept. 5, 2012) (height, weight, eye color, and birth month and year "fall within the ambit of 'personal information' under the DPPA" (citing Senne v. Vill. of Palatine)); Republican Party ofN.M. v. N.M. Taxation and Revenue Dep% 242 P.3d 444, 449 (N.M. App. 2010), rev'd on other grounds, 283 P.3d 853 (N.M. 2012) ("[although individual tax identification numbers are not specifically listed [in the DPPA's definition of 'personal information'], they are similar to social security numbers and meet the definition of personal information because they provide identifying information"); see also R.C. 1.47(B) ("[i]n enacting a statute, it is presumed that... [t]he entire statute is intended to be effective"); E. Ohio Gas Co. v. Pub. Util. Comm 'n, 39 Ohio.St.3d 295, 299, 530 N.E.2d 875 (1988) ("words in statutes should not be construed to be redundant, nor should any words be ignored").

Additionally, the terms "including" (in 18 U.S.C.A. § 2725(3)) and "including, but not limited to" (in R.C. 4501.27(F)(3)) indicate that "personal information" encompasses information beyond the types specifically listed in the statutes. The Ohio Supreme Court has found that

"including" implies that which follows is a partial, not an exhaustive listing of all that is subsumed within the stated category. "Including" is a word of expansion rather than one of limitation or restriction. Indeed, the United States Supreme Court, defining "including" ... stated that "the term 'including' is not one of all-embracing definition, but connotes simply an illustrative application of the general principle."

In re Hartman, 2 Ohio.St.3d 154, 156, 443 N.E.2d 516 (1983) (quoting Fed. Land Bank of St. Paul v. Bismarck Lumber Co., 314 U.S. 95, 100 (1941)); accord Craftsman Type, Inc. v. Lindley, 6 Ohio.St.3d 82, 83, 451 N.E.2d 768 (1983). Contra Camara v. Metro-North RR Co., 596 F.Supp.2d 517, 523 n.9 (D. Conn. 2009) (applying the doctrine of expressio unius est exclusio alterius to the definition of "personal information" set forth in 18 U.S.C.A. § 2725(3), court concluded that birth date and driver's license expiration date are not protected under the DPPA because they are not among the types of information listed in the statute).

Further, the purpose of these laws is to protect a person's identifying information. See Gordon v. Softech Int'l, Inc., 726 F.3d 42, 45, 56 (2d Cir. 2013) (discussing purpose and legislative history of DPPA); Senne v. Vill. Of Palatine, 695 F.3d at 607 (same as prior parenthetical); Roberts v. Source for Pub. Data, 2008 WL 5234675, at *5 ("[t]he DPPA is designed to protect personal information .... It protects drivers' privacy by placing restrictions on the purposes for which personal information may be obtained, used, and disclosed" (citations omitted)). This purpose supports a reading of the definitions of "personal information" that is not limited to the specific types of information listed.

Therefore, the remaining information that the BMV provides to you, even though not among the categories of personal information set forth explicitly in 18 U.S.C.A. § 2725(3) and R.C. 4501.27(F)(3), constitutes personal information if it identifies an individual. Whether information that the BMV provides to your office is personal information requires findings of fact. An opinion of the Attorney General cannot resolve questions of fact. See 1991 Op. Att'y Gen. No. 91-051, at 2-262 (Attorney General cannot determine questions of fact); 1991 Op. Att'y Gen. No. 91-019, at 2-96 (whether a particular operation meets statutory definition of "flea market" is a question of fact and cannot be determined by an opinion of the Attorney General). Therefore, we are unable by means of a formal opinion to make a final determination whether the types of information listed in your request, and not explicitly included in the definitions of personal information set forth in 18 U.S.C.A. § 2725(3) and R.C. 4501.27(F)(3), constitute personal information. Rather, your office must determine whether the remaining information that the BMV provided to you is personal information as defined by 18 U.S.C.A. § 2725(3) and RC. 4501.27(F)(3). See, e.g., 1983 Op. Att'y Gen. No. 83-057, at 2-232 ("[t]his office is not equipped to serve as a fact-finding body; that function may be served by your office or, ultimately, by the judiciary").

Thus, a Social Security number, driver's license number, name (first, middle, and last), street name, city, and state are personal information as defined in 18 U.S.C.A. § 2725(3) and R.C. 4501.27(F)(3). Other information that the BMV provides to the Secretary of State is personal information for purposes of 18 U.S.C.A. § 2725(3) and RC. 4501.27(F)(3) if the information identifies an individual.

You ask whether a "permissible use" must be asserted by a person who makes a public records request before you may disclose the information received from the BMV. You also ask what information must be withheld as "personal information" or "highly restricted personal information" if a permissible use is not asserted. As previously explained, the BMV may disclose personal information for fourteen "permissible uses." See 18 U.S.C.A. § 2721(b); R.C. 4501.27(B). As an authorized recipient the Secretary of State may disclose personal information received from the BMV as permitted by 18 U.S.C.A. § 2721(c) and R.C. 4501.27(C).

18 U.S.C.A. § 2721(c) states, in relevant part, that an authorized recipient may disclose personal information only for the permissible uses set forth in 18 U.S.C.A. § 2721(b)(l)-(10) and (13)-(14). R.C. 4501.27(C) states, in relevant part, that an authorized recipient may disclose personal information for the permissible uses set forth in R.C. 4501.27(B)(2)(a)-(k) and (n)-(o). The language of 18 U.S.C.A. § 2721(c) and RC. 4501.27(C) is unambiguous and therefore must be applied as written. State v. Elam, 68 Ohio.St.3d 585, 587, 629 N.E.2d 442 (1994) ("[w]here the wording of a statute is clear and unambiguous, this court's only task is to give effect to the words used"); Sears v. Weimer, 143 Ohio.St. 312, 55 N.E.2d 413 (1944) (syllabus, paragraph five) ("[a]n unambiguous statute is to be applied, not interpreted"). The plain language of these statutes therefore permits the Secretary of State to disclose personal information only for the permissible uses set forth in 18 U.S.C.A. § 2721(b)(l)-(10) and (13)-(14) and RC. 4501.27(B)(2)(a)-(k) and (n)-(o). If no permissible use is present, the Secretary of State may not disclose personal information he receives from the BMV under 18 U.S.C.A. § 2721(b)(1) and RC. 4501.27(B)(2)(a). See 18 U.S.C.A. § 2721(c); RC. 4501.27(C).

You also ask whether a person must "assert" a permissible use in order for you to disclose personal information. The DPPA does not prescribe a procedure for requesting or disclosing personal information as defined in 18 U.S.C.A. § 2725(3) or RC. 4501.27(F)(3). See State ex rel. Motor Carrier Serv., Inc. v. Rankin, 135 Ohio.St.3d 395, 2013-Ohio-1505, 987 N.E.2d 670, at ¶7; State ex rel. Motor Carrier Serv., Inc. v. Williams, Franklin No. 10AP-1178, 2012-Ohio-2590, at ¶13 (June 12, 2012). R.C. 4501.27 likewise does not establish a procedure for requesting or disclosing personal information as defined in 18 U.S.C.A. § 2725(3) or R.C. 4501.27(F)(3). R.C. 4501.27(E), however, grants the BMV rule-making authority. See also State ex rel. Motor Carrier Serv., Inc. v. Williams, 2012-Ohio-2590, at ¶13. Relying on this authority, the BMV has promulgated 10B Ohio Admin. Code 4501:1-12-02. See also State ex rel. Motor Carrier Serv., Inc. v. Williams, 2012-Ohio-2590, at ¶13. This rule creates a procedure for requesting information from the BMV that is protected by R.C. 4501.27. The rule requires the requestor to specify which permissible use exception authorizes disclosure by the BMV. 10B Ohio Admin. Code 4501:1-12-02(G)(2); see also State ex rel. Motor Carrier Serv., Inc. v. Williams, 2012-Ohio-2590 at ¶¶13-15. This administrative rule, however, applies only to requests for information from the BMV. Neither R.C. 4501.27 nor 10B Ohio Admin. Code 4501:1-12-02 establishes procedures for requesting information from an authorized recipient. Therefore, there is no requirement in the DPPA or R.C. 4501.27 that a person requesting personal information "assert" a specific permissible use.

Although a person requesting personal information from an authorized recipient has no statutory obligation to assert a specific permissible use when initially requesting the information, an authorized recipient has a statutory duty to record the permitted use for which personal information is disclosed:

Any authorized recipient ... that resells or rediscloses personal information covered by this chapter must keep for a period of 5 years records identifying each person or entity that receives information and the permitted purpose for which the information will be used and must make such records available to the motor vehicle department upon request.

18 U.S.C.A. § 2721(c) (emphasis added). RC. 4501.27(C) imposes the same requirement. Neither 18 U.S.C.A. § 2721(c) nor RC. 4501.27(C) prescribes the procedures that must be followed by an authorized recipient in order to determine the purpose for which the information will be used. We are not aware of any court decisions construing or further defining what is required by either statute. Absent direction in the statutes or from courts interpreting the statutes, an authorized recipient must exercise reasonable discretion to make this determination. See generally State ex rel. Preston v. Ferguson, 170 Ohio.St. 450, 459, 166N.E.2d 365 (1960) ("[w]here a statute clearly confers power to do a certain thing without placing any limitation as to the manner or means of doing it, and no statute can be found prescribing the exact mode of performing that duty or thing, the presumption is that it should be performed in a reasonable manner not in conflict with any law of the state") (emphasis omitted); State ex rel. Hunt v. Hildebrant, 93 Ohio.St. 1, 112 N.E. 138(1915) (syllabus) ("[w]here an officer is directed by the Constitution or a statute of the state to do a particular thing, in the absence of specific directions covering in detail the manner and method of doing it, the command carries with it the implied power and authority necessary to the performance of the duty imposed"); 2013 Op. Att'y Gen. No. 2013-039, slip op. at 6.

To facilitate the exercise of your responsibilities under 18 U.S.C.A. § 2721(c) and RC. 4501.27(C), we offer you this guidance. Based on the statutory obligation to record the permissible use for which personal information will be used by a requestor, an authorized recipient should obtain from the requestor information that identifies the person or entity who will receive the personal information and information about the purpose for which the personal information will be used. See Roth v. Guzman, 650 F.3d at 611 (addressing a Florida case in which state officials released information to a requestor where the requestor did not specify the purpose for which the information was requested, the court of appeals noted that "[n]ot surprisingly" the Florida court found that "state officials' disclosures for an unspecified purpose, when the DPPA requires that personal information not be disclosed except as provided for in [18 U.S.C.A. § 2721(b)], violated clearly established federal law of which the defendants' should have known"). In some cases, a requestor may provide that information when making her request for personal information. If, however, the requestor does not provide information about the purpose for which the personal information will be used, the authorized recipient should ask the requestor for information that will enable the authorized recipient to make a reliable determination of the purpose for which the personal information will be used.

The authorized recipient must then determine whether the intended use of the personal information comes within one of the permissible uses for which the authorized recipient may disclose the personal information under 18 U.S.C.A. § 2721(c) or R.C. 4501.27(C). Although no court has ruled on the provisions addressing the obligation of an authorized recipient to obtain or verify information about a requestor's permissible use of the personal information requested, the Sixth Circuit Court of Appeals has declined to impose liability on the BMV where the requestor provided "express written representations [to the BMV] that the disclosures were 'for use in the normal course of business'—as permitted by § 2721(b)(3) (and Ohio law)." Roth v. Guzman, 650 F.3d at 610. But see Gordon v. Softech Int'l, Inc., 726 F.3d at 53-58 (holding that resellers of personal information are subject to "a duty of reasonable care" before disclosing personal information). In Roth v. Guzman, it was alleged that the requestor falsely represented to the BMV the purpose for which he sought disclosure of personal information. Roth v. Guzman, 650 F.3d at 611. The court's opinion in Roth, although addressing disclosures by the BMV, highlights the obligation of an authorized recipient to obtain and verify from a requestor the intended permissible use of the requested personal information. The court found that it was sufficient that the BMV had obtained a representation from the requestor that the personal information requested would be used for a permissible use under 18 U.S.C.A § 2721(b). Roth v. Guzman, 650 F.3d at 610-12. It also seems sufficient, under the analysis used in Roth v. Guzman, for an authorized recipient to obtain information from the requestor explaining the intended use of the personal information. If the authorized recipient determines that the stated reason meets one of the permissible uses for which the authorized recipient may disclose personal information under 18 U.S.C.A. § 2721(c) or R.C. 4501.27(C), the authorized recipient may disclose the requested personal information. In that circumstance, the authorized recipient has satisfied the disclosure requirements of 18 U.S.C.A. § 2721(c) and R.C. 4501.27(C).

The DPPA and R.C. 4501.27 Authorize Disclosure of Personal Information in Response to Requests by a Member of the General Assembly and a Journalist

You also ask whether two requests received by your office satisfy the permissible use exceptions in the DPPA or R.C. 4501.27. The Secretary of State is an authorized recipient of personal information as defined in 18 U.S.C.A. § 2725(3) or RC. 4501.27(F)(3) and thus may disclose that information for the permissible uses set forth in 18 U.S.C.A. § 2721(b)(l)-(10) and (13)-(14) and R.C. 4501.27(B)(2)(a)-(k) and (n)-(o). 18 U.S.C.A. § 2721(c); R.C. 4501.27(C).

One request is from a member of the General Assembly (a state representative) and another is from a journalist. The state representative has informed your office that she is requesting the information to "evaluate] data to inform policy-making." We understand that she wants to evaluate compliance with Ohio and federal laws that require the BMV to transmit voter registration updates to the Secretary of State. See 42 U.S.C.A. § 1973gg-3(e); R.C. 3503.11. Your request does not provide information about the basis for the journalist's request. You note only that the journalist "has not asserted a 'permissible use' under the DPPA in connection with her request."

Among the permissible uses for which an authorized recipient of personal information may disclose personal information is use by a government agency. 18 U.S.C.A. § 2721(b)(1); 18 U.S.C.A. § 2721(c); R.C. 4501.27(B)(2)(a); RC. 4501.27(C). 18 U.S.C.A. § 2721(b)(1) authorizes disclosure "[f]or use by any government agency, including any court or law enforcement agency, in carrying out its functions, or any private person or entity acting on behalf of a Federal, State, or local agency in carrying out its functions." (Emphasis added.) R.C. 4501.27(B)(2)(a) authorizes disclosure "[f]or the use of a government agency, including, but not limited to, a court or law enforcement agency, in carrying out its functions, or for the use of a private person or entity acting on behalf of an agency of this state, another state, the United States, or a political subdivision of this state or another state in carrying out its functions." (Emphasis added.) For the purpose of these statutes, we read "government agency" to include a legislative authority or legislative body such as the Ohio General Assembly. In other contexts, numerous provisions of the Revised Code include the General Assembly in the definition of a "state agency." See R.C. 9.82(G); RC. 149.011(B); R.C. 152.09(A)(2); RC. 154.24(A)(4); RC. 5747.061(A)(1); RC. 5923.05(A)(2)(d); see also RC. 1.60 (broadly defining "state agency" to include "every organized body, office, or agency established by the laws of the state for the exercise of any function of state government"); R.C. 102.01(C) (defining "public agency" to include the General Assembly).

The government use exceptions of 18 U.S.C.A. § 2721(b)(1) and RC. 4501.27(B)(2)(a) use broad language that authorize the disclosure of personal information for use by a government agency in carrying out its functions. Kost v. Hunt, 2013 WL 6048921, at *12. The exceptions do not restrict the use with "more specific qualifications or limitations." Id. The exceptions also do not restrict disclosure to a particular person who must make the request on behalf or as a proxy of the government agency. Because the statutes do not limit or qualify the scope of the exception, we are not free to impose any such limitation or qualification on our own. See Perrysburg Twp. v. City ofRossford, 103 Ohio.St.3d 79, 2004-Ohio-4362, 814 N.E.2d 44, at 1J7; 2011 Op. Att'y Gen. No. 2011-019, at 2-167 ("where, as here, such limitations or qualifications are not included in the statute, we must give effect only to the words used and not insert words not used"); State ex rel. Cuyahoga Cnty. v. State Pers. Bd. of Review, 82 Ohio.St.3d 496, 499, 696 N.E.2d 1054 (1998) (in interpreting a statute, one must "give effect to the words used and not... insert words not used").

We read these exceptions to include disclosure to a member of the General Assembly, provided the member's intended use is reasonably related to functions of the General Assembly. Policy-making is a function of the General Assembly. See Pauley v. City ofCircleville, 137 Ohio.St.3d 212, 2013-Ohio-4541, 998 N.E.2d 1083, at ¶38 (creating an exception to a statute "is a policy decision that comes within the purview of the General Assembly"); Cincinnati City Sch. Dist. Bd. of Educ. v. Corners, 132 Ohio.St.3d 468, 2012-Ohio-2447, 974 N.E.2d 78, at ¶17 (legislative branch is the "ultimate arbiter of public policy") (quoting Arbino v. Johnson & Johnson, 116 Ohio.St.3d 468, 2007-Ohio-6948, 880 N.E.2d 420, at ¶21)); Walker v. City of Toledo, 2013-Ohio-2809, 994 N.E.2d 467, at ¶37 ('"[i]t is the function of the legislative body to determine policy'") (quoting Hudson v. Albrecht, Inc., 9 Ohio St. 3d 69, 73-74, 458 N.E.2d 852 (1984)). It is reasonable to infer that a member of the General Assembly may seek to collect or analyze information in order to inform policy-making or to craft legislation. Thus, the DPPA and R.C. 4501.27 permit the Secretary of State to disclose personal information to a member of the General Assembly pursuant to 18 U.S.C.A. § 2721(b)(1) and R.C. 4501.27(B)(2)(a), provided the information is sought for use in carrying out functions of the General Assembly.

That a member of the General Assembly may receive personal information pursuant to this "government agency" exception is supported by the legislative history of the DPPA. The DPPA was not intended to eliminate legitimate uses of the personal information of a state's licensed drivers that existed at the time the legislation was enacted, including use of that information by state government. See, e.g., Cook v. ACS State & Local Solutions, Inc., 663 F.3d 989, 995 (8th Cir. 2011) (legislative history indicates that "law was not meant to intrude on existing, legitimate uses of the information: 'Careful consideration was given to the common uses now made of this information and great efforts were made to ensure that those uses were allowed under this bill. Among those who will continue to have unfettered access are federal and state governments "' (emphasis added) (quoting Protecting Driver Privacy: Hearings on H.R. 3365 Before the Subcomm. on Civil and Constitutional Rights of the House Comm. on the Judiciary, 103d Cong., 2d Sess. (1994) (statement of Rep. James P. Moran))). Further, these laws are intended, inter alia, to prevent "stalkers and criminals" from obtaining personal information and to control disclosure of personal information to businesses engaged in bulk marketing and solicitation. See Maracich v. Spears, 133 S.Ct. at 2198; Roth v. Guzman, 650 F.3d at 606. Providing personal information to a member of the Ohio General Assembly does not undermine these purposes.

We next consider disclosure of personal information to a journalist under 18 U.S.C.A. § 2721(b)(5) and R.C. 4501.27(B)(2)(f). These statutes permit the disclosure of personal information "for use in research activities, " provided the personal information is not published, redisclosed, or used to contact individuals. The term "research activities" is not defined by either statute. In common usage, research is defined, in relevant part, as "the collecting of information about a particular subject." Merriam-Webster's Collegiate Dictionary 1059 (11th ed. 2005). See also R.C. 1.42 ("[wjords and phrases shall be read in context and construed according to the rules of grammar and common usage"). We may not impose a limitation or qualification where, as here, there is nothing in the language of the statutes to indicate that the scope of the exception for research activities is limited or qualified in its meaning. See Perrysburg Twp. v. City ofRossford, 103 Ohio.St.3d 79, at ¶7; State ex rel. Cuyahoga Cnty. v. State Pers. Bd. of Review, 82 Ohio.St.3d at 499; 2011 Op. Att'y Gen. No. 2011-019, at 2-167.

We read the exceptions in 18 U.S.C.A. § 2721(b)(5) and R.C. 4501.27(B)(2)(f) to encompass disclosure to a journalist so long as the intended use is for "research activities." See Young v. West Publg Corp., 724 F.Supp.2d at 1279-80 (holding that 18 U.S.C.A. § 2721(b)(5) is read broadly to permit disclosure of personal information for "legal research, " including, for example, "legal research done for academic or educational purposes"). This could include, for example, requesting and gathering information about compliance with 42 U.S.C.A. § 1973gg-3(e) and R.C. 3503.11 in order to write an article about Ohio's compliance with those laws. These exceptions prohibit the recipient from publishing or disclosing the information received and from contacting the individuals to whom the personal information pertains. 18 U.S.C.A. § 2721(b)(5); R.C. 4501.27(B)(2)(f). But see Republican Party of N.M. v. N.M. Taxation and Revenue Dep% 242 P.3d at 449-50 (stating that research exception could not be used to research "whether undocumented aliens were voting in federal, state, and local elections in New Mexico" because establishing voter fraud would require redisclosure of the personal information and would lead to contacting the individuals from whom the information was obtained, both of which are prohibited by the research exception). Accordingly, we conclude that the DPPA and R.C. 4501.27 permit the Secretary of State to disclose personal information to a journalist pursuant to 18 U.S.C.A. § 2721(b)(5) and RC. 4501.27(B)(2)(f), provided the journalist intends to use the information for research activities and does not publish or redisclose the information or use the information to contact the individuals to whom the personal information pertains.

Based on the foregoing, it is my opinion, and you are hereby advised that:

1. A Social Security number, driver's license number, name (first, middle, and last), street name, city, and state received by the Secretary of State from the Bureau of Motor Vehicles are personal information as defined in 18 U.S.C.A. § 2725(3) and RC. 4501.27(F)(3). Other information that the Bureau of Motor Vehicles provides to the Secretary of State is personal information for purposes of 18 U.S.C.A. § 2725(3) and RC. 4501.27(F)(3) if the information identifies an individual.

2. The Secretary of State is an authorized recipient of personal information under 18 U.S.C.A. § 2721(c) and R.C. 4501.27(C), and may disclose personal information for the permissible uses set forth in 18 U.S.C.A. § 2721 (b)(1)-(10) and (13)-(14) and RC. 4501.27(B)(2)(a)-(k) and (n)-(o).

4.The Secretary of State may disclose personal information to a journalist pursuant to 18 U.S.C.A. § 2721(b)(5) and R.C. 4501.27(B)(2)(f), provided the journalist intends to use the information for research and does not publish or redisclose the information or use the information to contact the individuals to whom the information pertains.

Very respectfully yours,

MICHAEL DEWINE, Ohio Attorney General

---------

Notes:

The Bureau of Motor Vehicles (BMV) is established within the Ohio Department of Public Safety. R.C. 4501.02(A). The Registrar of Motor Vehicles, appointed by the Director of Public Safety, administers the BMV. Id

Your letter includes a list of each category of information provided to you by the BMV. It is not clear whether the category identified as "street name" refers only to the street name or whether it includes the full street address (street name and house number).

We have rephrased and reordered your questions for ease of discussion.

The National Voter Registration Act of 1993 (NVRA), 42 U.S.C.A. §§ 1973gg to 1973gg-10 (Westlaw 2013), requires each state to designate "a State officer or employee as the chief State election official to be responsible for coordination of State responsibilities under this subchapter." 42 U.S.C.A. § 1973gg-8. In Ohio, that election official is the Secretary of State. See RC. 3501.04 (designating Secretary of State as the state's chief election officer); Harkless v. Brunner, 545 F.3d 445, 450-54 (6th Cir. 2008) (discussing the Secretary of State's responsibilities under the NVRA).

The General Assembly recently amended R.C. 3503.11 to alter the statute's procedure for the transmission of completed change of residence forms. Am. Sub. S.B. 200, 130th Gen. A. (2013) (effi Mar. 20, 2014). With respect to the transmission of change of residence forms, RC. 3503.11 as amended, states as follows:

The deputy registrar shall send any registration application or any change of residence or change of name form that was completed and submitted in paper form to the deputy registrar to the board of elections of the county in which the office of the deputy registrar is located, within five days after accepting the application or other form. The registrar shall send any completed registration application received at the bureau of motor vehicles headquarters location and any completed change of residence or change of name form processed electronically in systems or programs operated and maintained by the bureau of motor vehicles to the secretary of state within five days after accepting the application or other form.

Am. Sub. S.B. 200.

"Records" as used in R.C. Chapter 149 (documents, reports, records) includes:

any document, device, or item, regardless of physical form or characteristic, including an electronic record as defined in [R.C. 1306.01], created or received by or coming under the jurisdiction of any public office of the state or its political subdivisions, which serves to document the organization, functions, policies, decisions, procedures, operations, or other activities of the office.

RC. 149.011(G).

The mandatory disclosures required by 18 U.S.C.A. § 2721(b) are as follows:

for use in connection with matters of motor vehicle or driver safety and theft, motor vehicle emissions, motor vehicle product alterations, recalls, or advisories, performance monitoring of motor vehicles and dealers by motor vehicle manufacturers, and removal of non-owner records from the original owner records of motor vehicle manufacturers to carry out the purposes of titles I and IV of the Anti Car Theft Act of 1992 [Pub. L. No. 102-519, 106 Stat. 3384], the Automobile Information Disclosure Act (15 U.S.C. 1231 et seq.), the Clean Air Act (42 U.S.C. 7401 et seq.), and [49 U.S.C.A. §§ 301, 305, and 321-331].

The three permissible uses that require consent to disclosure by the person to whom the information pertains are 18 U.S.C.A. §§ 2721(b)(ll)-(13). These provisions state that personal information may be disclosed as follows:

(11) For any other use in response to requests for individual motor vehicle records if the State has obtained the express consent of the person to whom such personal information pertains.

(12) For bulk distribution for surveys, marketing or solicitations if the State has obtained the express consent of the person to whom such personal information pertains.

(13) For use by any requester, if the requester demonstrates it has obtained the written consent of the individual to whom the information pertains.

18 U.S.C.A. § 2721(b).

18 U.S.C.A. § 2721(c) states that an authorized recipient may "redisclose" personal information for the specified permissible uses. In the context of this statute, "redisclose" means disclosure of personal information by an authorized recipient that received the information from the BMV.

The mandatory disclosures under RC. 4501.27(B)(1) are as follows:

for use in connection with any of the following matters to carry out the purposes of any specified federal automobile-related act:

(a) Motor vehicle or driver safety and theft;

(b) Motor vehicle emissions;

(c) Motor vehicle product alterations, recalls, or advisories;

(d) Performance monitoring of motor vehicles and dealers by motor vehicle manufacturers;

(e) Removal of non-owner records from the original owner records of motor vehicle manufacturers.

RC. 4501.27(l)-(n) permit disclosure of personal information:

(1) For any use not otherwise identified in division (B)(2) of this section that is in response to a request for individual motor vehicle records, if the individual whose personal information is requested completes and submits to the registrar or deputy registrar a form prescribed by the registrar by rule giving express consent to such disclosures.

(m) For bulk distribution for surveys, marketing, or solicitations, if the individual whose personal information is requested complete [sic] and submits to the registrar or a deputy registrar a form prescribed by the registrar by rule giving express consent to such disclosures.

(n) For use by a person, state, or state agency that requests the information, if the person, state, or state agency demonstrates that it has obtained the written consent of the individual to whom the information pertains.

"Redisclose, " as used in RC. 4501.27(C), means the disclosure of personal information by an authorized recipient that received the information from the BMV. See note 9, supra.

Although the DPPA and R.C. 4501.27 authorize the BMV to disclose highly restricted personal information and sensitive personal information, respectively, for fewer permissible uses than other types of personal information, these statutes do not similarly restrict the subsequent disclosure of these types of information by an authorized recipient. See 18 U.S.C.A. § 2721(a)(2); 18 U.S.C.A. § 2721(c); RC. 4501.27(B)(3)(a); RC. 4501.27(C). Rather, 18 U.S.C.A. § 2721(c) and RC. 4501.27(C) state only that an authorized recipient may disclose "personal information" for the permissible uses set forth therein. There is no language in the DPPA or R.C. 4501.27 restricting disclosure of highly restricted personal information and sensitive personal information by an authorized recipient. Therefore, personal information that also is defined as highly restricted personal information or sensitive personal information, such as Social Security numbers, may be subject to disclosure as personal information by an authorized recipient for the permissible uses set forth in 18 U.S.C.A. § 2721(c) andRC. 4501.27(C).

T he definitions of personal information specifically exclude a person's five-digit zip code. 18 U.S.C.A. § 2725(3) (personal information includes "address (but not the 5-digit zip code)"); R.C. 4501.27(F)(3) (personal information includes "an individual's address other than the five-digit zip code number"). Therefore, under the plain language of the statutes, a person's zip code is not protected and its disclosure is not prohibited or restricted.

The DPPA and RC. 4501.27 also set forth mandatory disclosures as "permissible uses." 18 U.S.C.A. § 2721(b); RC. 4501.27(B). The mandatory disclosures do not apply to the questions you have presented and therefore are not discussed here.

Opinions of the Attorney General have advised that Social Security numbers are not public records for purposes of RC. 149.43. 2005 Op. Att'y Gen. No. 2005-047 (syllabus, paragraph 1); 2004 Op. Att'y Gen. No. 2004-045 (syllabus, paragraph 2). This advice is based, in part, on Ohio court decisions recognizing that persons have a constitutionally protected right to privacy in their Social Security numbers. 2005 Op. Att'y Gen. No. 2005-047, at 2-507 to 2-508; see also State ex rel. Highlander v. Rudduck, 103 Ohio.St.3d 370, 2004-Ohio-4952, 816 N.E.2d 213, at ¶25; State ex rel. WLWT-TV5 v. Leis, 77 Ohio.St.3d 357, 361, 673 N.E.2d 1365 (1997); State ex rel. Beacon Journal Publ'g Co. v. City of Akron, 70 Ohio.St.3d 605, 640 N.E.2d 164 (1994); Bardes v. Todd, 139 Ohio App. 3d 938, 944, 746 N.E.2d 229 (Hamilton County 2000)); 2004 Op. Att'y Gen. No. 2004-045, at 2-391 to 2-394. Thus, even though the DPPA and R.C. 4501.27 may permit release of Social Security numbers, you are prohibited from releasing Social Security numbers pursuant to R.C. 149.43(A)(l)(v) and the federal right to privacy.

"Redisclosed, " as used in 18 U.S.C.A. § 2721(b)(5) or RC. 4501.27(B)(2)(f), means a disclosure of personal information by a person or entity that receives the information pursuant to this exception. See notes 9 and 12, supra.

---------