Summary
FSLDF is preparing a planned federal class action under the Driver's Privacy Protection Act, 18 U.S.C. § 2721 et seq. The planned complaint would allege that motor-vehicle records shared with ERIC were later made available to non-governmental organizations, including the Center for Election Innovation & Research (CEIR), for voter outreach in a way the statute does not permit. DHS raised similar concerns in its September 2026 letter. CEIR denies receiving motor-vehicle data on an ongoing basis or using it for partisan purposes (NOTUS). No complaint has been filed.
In a September 2, 2026 letter to the Attorney General, the Secretary of Homeland Security described earlier DHS referrals to the Department of Justice, including a request that DOJ review the legality of states' sharing of motor-vehicle and voter-registration data with private nonprofit organizations, and flagged concerns about potential violations of the Driver's Privacy Protection Act involving ERIC. These are DHS's stated concerns, not findings.
Federal law restricts turning information that a person gives the motor vehicle agency, in order to obtain a driver's license, over to private organizations without consent, except for uses the statute permits.
Overview
The Homeland Security letter. DHS's September 2026 letter to the Department of Justice flags potential DPPA violations in ERIC's handling of state motor-vehicle records, including records of people not registered to vote. Those are DHS's stated concerns, not findings. CEIR disputes wrongdoing.
The research exception, 18 U.S.C. § 2721(b)(5). That exception requires that personal information not be published, re-disclosed, or used to contact individuals. The planned complaint would allege that some recipients used data to contact individuals, which would place that use outside the exception.
Drivers who are not registered voters. ERIC's membership terms require member states to send motor-vehicle licensing and ID records, which include people who are not registered to vote, at least every 60 days (DHS letter quoting the model contract). The planned complaint would argue that this goes beyond what voter-list maintenance requires.
Private right of action, 18 U.S.C. § 2724. A person whose data was knowingly obtained, disclosed, or used for a purpose the statute does not permit may sue. The statute provides actual damages, but not less than liquidated damages in the amount of $2,500 (18 U.S.C. § 2724(b)(1)).
Injunction and deletion. The planned action would seek permanent federal orders barring ERIC from receiving DMV datasets without the individual's affirmative consent, except for uses the statute permits, and forensic deletion audits of transferred data held by subcontractors.
What the planned case would put at issue
Statutory damages. The planned complaint would seek actual damages, but not less than liquidated damages in the amount of $2,500 (18 U.S.C. § 2724(b)(1)), for drivers whose records member states transmit to ERIC. Outcomes are not guaranteed; any recovery would go to class members as the court directs, not to donors or FSLDF.
The public record. DHS's September 2026 letter, and DOJ's request for records from ERIC and CEIR, as reported by Just the News, describe issues FSLDF's planned complaint would examine. FSLDF does not know what DOJ will do with them.
The permissible-use defense. The planned complaint would anticipate a defense under the government-function and research exemptions in 18 U.S.C. § 2721(b)(1) and (b)(5). It would focus on re-disclosure to third parties who used personal details for contact and outreach. The statute bars use of research data to contact individuals.
Limits on secondary lists. The planned suit would ask whether the DPPA permits a nonprofit consortium to use DMV records to build lists of motorists for outreach.
Planned work
The planned work would include:
Following public developments on DHS's September 2026 letter to the Department of Justice.
Indexing state records requests about which motor vehicle departments transmitted driver records, including records of motorists who are not registered to vote, under an ERIC agreement.
Preparing declarations for initial named plaintiffs concerning outreach materials generated from records the Driver's Privacy Protection Act protects.
Milestones
The planned milestones would be:
Federal class complaint and preliminary preservation order. Drafting and filing the multi-district class action complaint, and moving for a preservation order covering internal data systems, downstream transfers, and communications with third-party recipients. $120,000.
Rule 12(b)(6) defense and discovery of downstream transfers. Opposing motions to dismiss on standing, including TransUnion, and on statutory scope, and seeking discovery from downstream recipients to map the chain of custody of exported driver records. $180,000.
Class certification and expert data audits. Retaining forensic cybersecurity and database experts to quantify the class and to verify which DMV data fields were transferred, and briefing and arguing the motion for class certification under Federal Rule of Civil Procedure 23. $180,000.
Dispositive motions or trial. Filing a motion for partial summary judgment on liability under 18 U.S.C. § 2724, and trial preparation. $240,000.
A gift may be designated to this project's fund or to Five Stones Legal Defense Fund as a whole. A designation is not a stake in any case.