Can an employer share an MVR with another fleet?
No. An MVR pulled under one carrier's DPPA permissible purpose (typically 18 USC §2721(b)(9) for CDL pre-employment) cannot be re-used by a different carrier. Each motor carrier must establish its own permissible purpose and obtain its own driver consent before pulling. Sharing an MVR pulled by one carrier with another carrier exposes both to DPPA + FCRA liability.
The DPPA at 18 USC §2721(b) lists the permissible purposes for which a state DMV may release a driving record. The "use by an employer or its agent or insurer to obtain or verify information relating to a holder of a commercial driver's license" purpose is established at the time of the pull and does not transfer. A carrier that obtained the MVR for its own §391.23 pre-employment investigation cannot share that report with a third-party carrier without re-establishing the permissible purpose for the new carrier.
The FCRA layer reinforces the rule. When the MVR is bundled into a consumer-report package, FCRA §1681e(a) requires the consumer reporting agency to "maintain reasonable procedures" to ensure the report is provided only for §1681b permissible purposes. A second carrier receiving a transferred report from the first carrier doesn't come through the CRA at all — the chain of custody is broken and the second carrier has no documented permissible purpose for the new use.
Some staffing-agency and leasing-company arrangements look like sharing but technically aren't. When a staffing agency is the §391.23-of-record employer and leases drivers to motor carriers, the staffing agency is the carrier-of-record for §391 purposes and pulls one MVR for the §391.23 file. The lessee carrier is not the §391-of-record employer and doesn't need a separate MVR for §391.23 — but it still needs whatever screening its own internal policy requires, pulled under its own permissible purpose.
If two carriers are formally affiliated (parent + subsidiary, joint venture, sister companies), the safest pattern is still to pull a separate MVR for each §391-of-record entity. The DPPA permissible purpose attaches to the requesting party named on the DMV access agreement; treating two corporate entities as one for DPPA purposes is a documented audit risk.