11.1 Record-Access Law: Driver, Education, Employment & Medical Records

Record-Access Law: Driver, Education, Employment & Medical Records

Core Regulatory Standard: Subarea 2B carries 35% of the examination — the heaviest weight on the blueprint — and a large block of it is record-access law. Task T14 requires the candidate to perform a background check or investigation, supported by knowledge of the laws governing access to arrests and convictions, credit and consumer spending information, driver records, education and employment information, personal health information, electronic data and phone accounts, pre-employment screening, negligent hiring, and discrimination. Every one of those is a different statute with a different permission test. The unifying discipline is simple: name the record class, name the statute, name your permissible use, and document it before you pull.

---

1. Driver and Vehicle Records — Two Layers of Law

The Federal Layer: DPPA (18 U.S.C. §§ 2721–2725)

The Driver's Privacy Protection Act makes personal information from a motor vehicle record disclosable only for an enumerated permissible use. The ones investigators actually rely on:

Read § 2721(b)(8) carefully, because it is the row candidates misremember. It permits use by a licensed private investigative agency for any purpose permitted under subsection (b) — that is, it lets a licensed agency stand in the shoes of a permissible use, not create one. An agency still has to name the underlying permissible use, which in practice is almost always § 2721(b)(4) or § 2721(b)(6). Note what is not on the list at all: general curiosity, locating an old acquaintance, a client's personal dispute untethered from any proceeding, or marketing. Resale or redisclosure is separately restricted, and § 2724 creates a private right of action with liquidated damages.

The California Layer: Vehicle Code § 1808.21

California is stricter. Vehicle Code § 1808.21(a) provides that "any residence address in any record of the department is confidential and shall not be disclosed to any person, except a court, law enforcement agency, or other government agency, or as authorized in Section 1808.22 or 1808.23." Section 1808.22 carves out specific institutional requesters — a state- or federally licensed financial institution holding a signed written waiver, and a licensed insurance company or its authorised contractor requesting the address of another motorist or vehicle owner involved in an accident with the company's insured, each under penalty of perjury. Section 1808.23 carves out vehicle manufacturers for safety, warranty, emission, and recall purposes, licensed dealers completing registration transactions, and certain requesters under Civil Code § 1798.24(h).

The enforcement provision is the one to memorise. Vehicle Code § 1808.45 makes it a misdemeanour to disclose department record information without authorisation, to use any false representation to obtain information from a department record, to use information for a purpose other than the one stated in the request, or to sell or distribute it for undisclosed purposes — punishable by a fine not exceeding $5,000, up to one year in county jail, or both.

The two traps. First, candidates assume a licence makes DMV records freely available; it does not, and the residence address remains confidential. Second, the offence is not only obtaining the record — using a lawfully obtained record for a different purpose than the one declared is expressly a violation of § 1808.45.

---

2. Education Records — FERPA (20 U.S.C. § 1232g)

The Family Educational Rights and Privacy Act conditions federal funding on schools not disclosing personally identifiable information from education records without written consent. Practical consequences for an investigator:

• You cannot compel a school to release records. FERPA binds the institution, not you, but the institution's refusal is dispositive.
• Directory information — typically name, dates of attendance, major, and degrees awarded — may be released unless the student has opted out. Degree and attendance verification is therefore usually available, often through the registrar or a national clearinghouse.
• Written authorisation from the subject is the clean route to anything beyond directory information, and it is standard in employment screening.
• Diploma-mill detection is the real skill: verify that the awarding institution is itself accredited by a recognised accreditor, not merely that it issued a document.

---

3. Employment Verification

There is no single statute; the constraint is practical and contractual. Most California employers, on advice of counsel, confirm only dates of employment, position held, and sometimes final salary. Investigators should:

• Verify through the employer's HR or payroll function or an authorised verification service, not through a colleague who may be guessing.
• Obtain the subject's written authorisation, which unlocks materially more information and is required anyway when the product is an investigative consumer report.
• Treat a subject-supplied reference phone number with suspicion; confirm the employer's number independently.

---

4. Personal Health Information

HIPAA Binds Providers, Not Investigators

The HIPAA Privacy Rule (45 C.F.R. Parts 160 and 164) applies to covered entities — health plans, clearinghouses, and providers who transmit health information electronically — and to their business associates. A private investigator is ordinarily neither. That does not mean health information is fair game; it means the restriction operates on the source rather than on you, so the provider will refuse and any workaround is likely to be unlawful in some other way.

California's CMIA Reaches Recipients

California's Confidentiality of Medical Information Act (Civil Code § 56 et seq.) is broader in a way that matters directly to investigators. Civil Code § 56.13 provides that a recipient of medical information pursuant to an authorisation shall not further disclose that information except in accordance with a new authorisation or as otherwise required or permitted by law. An investigator who lawfully receives medical records — through a signed authorisation in a claims file, for example — is bound by that limit and cannot pass them along beyond the authorised purpose. Civil Code § 56.36 supplies the remedies.

The Lawful Routes

1. Signed authorisation from the patient, valid on its face and within its stated scope and expiry.
2. Subpoena duces tecum with the CCP § 1985.3 consumer notice, which is the ordinary litigation route.
3. Court order.

Pretexting a medical office to obtain records is not a grey area: it is a false representation, and depending on the facts it implicates BPC § 7561.1's dishonesty grounds, Penal Code § 530.5 identity theft, and civil liability under the CMIA.

---

5. Pre-Employment Screening (K47)

When an investigator's product is used for employment purposes, two consumer statutes attach at once.

California overlays employment law on top: the Fair Chance Act (Gov. Code § 12952) bars employers with five or more employees from inquiring into conviction history before a conditional offer and requires an individualised assessment before withdrawal, and Labor Code § 432.7 bars reliance on arrests that did not lead to conviction. An investigator who returns a report containing information the employer may not lawfully consider has created a problem for the client and for the agency.

Civil Code § 1786.50 is the penalty provision to remember: an investigative consumer reporting agency or user of information that fails to comply is liable for actual damages or $10,000, whichever is greater, plus costs and reasonable attorney's fees, with punitive damages available for grossly negligent or wilful violations.

---

Case Example: The Purpose That Changed

Scenario: An investigator obtains a subject's DMV record under a declared litigation-support purpose in a pending personal injury case. The case settles. Three months later a different client — the subject's former partner — asks the investigator to confirm the subject's home address. The investigator supplies the address from the earlier file.

Analysis. The original acquisition may have been lawful under DPPA § 2721(b)(4) and Vehicle Code § 1808.22/§ 1808.23. The redisclosure is not. Vehicle Code § 1808.45 makes it a misdemeanour to use information obtained from a department record "for a purpose other than the one stated in the request," punishable by a fine up to $5,000 and/or a year in county jail, and DPPA § 2721(c) independently restricts resale and redisclosure. Supplying a residence address to a former partner is also the classic stalking-facilitation fact pattern, which drags in the intake-screening duties of Content Area 2A and, if harm follows, the discipline grounds in BPC § 7561.1.