Data is a very valuable commodity in today’s world.  Whether recording a purchase at the grocery store or identifying dangerous intersections, data is used in every aspect of our lives.  Crash report data is no exception to this. 

Motor vehicle crash reports contain a significant amount of private Personal Identifiable Information (PII).  In the hands of the wrong persons this data can be used with inappropriate or bad intentions.  As data owners law enforcement agencies have a responsibility to protect this information. 

Examples of PII on the crash report include:

•      Vehicle Owner, Driver, and Passengers’ Names, Addresses, and Phone Numbers

•      Vehicle Identification Numbers (VIN) and License Plate Numbers

•      Insurance Information

•      Witness & Property Owner Names and Contact Information

Restrictions on the release of PPI crash data is regulated by O.C.G.A. 50-18-72 When Public Disclosure Not Required and 18 U.S.C. § 2725 Driver’s Privacy Protection Act which define the approved release of crash data and its associated Personally Identifiable Information. Agency personnel who handle crash or driver records containing personal information should understand these code sections and the limitations placed on the sharing of PII data. 

All requests for crash report data should be verified to ensure the appropriate level of redaction is applied.  For redacted data requests, such as vehicle history and crash location history, PII must be removed prior to the release of information. When data containing PII is provided, an accompanying ‘statement of need’ or ‘data use agreement’ should be completed by the requesting party. 

One piece of data that is often overlooked is license plate information.  In Georgia, this information identifies the vehicle owner and can be used to link individuals and their information from other data bases.  This ‘big data’ linking practice has enormous negative privacy implications.  

Finally, report narratives are of significant concern. The narrative portion of the report must not include any public identification information. These include: