The State Of Texas Made $2.1 Million In 2012 Selling Drivers Personal Information

The CBS television network affiliate in the Dallas/Ft. Worth area reported that the State of Texas made $2.1 million in 2012 by selling the personal information of Texas drivers. Who buys this information collected by the Texas Department of Motor Vehicles:

"CBS 11’s I-Team Investigator Mireya Villarreal discovered nearly 2,500 agencies or businesses purchased the DMV’s data in some form last year. On this list there are towing companies, collection agencies, insurance companies, hospitals, banks, schools, city governments, and even private investigators."

The Driver Privacy Protection Act (DPPA) limits who can buy this information and what they can do with it. The report also highlighted the situation that Texas drivers cannot opt out of these sales.

CBS 11 provided a spreadsheet file which listed the companies that purchased information about Texas drivers. I spent some time reviewing the spreadsheet file and found:

• What happens in Texas doesn't stay in Texas. Companies from 30 different states purchased the information about Texas drivers
• Information about Texas drivers is popular. About 2,450 companies purchased information from at least 12 different business types
• Expected the unexpected. Businesses that purchased driver data included some you'd expect (e.g., auto dealers, banks, finance companies, title services), but also some you might not expect. The list of business types included auto actions, auto dealers, banks/credit unions, city agencies, collection agencies, finance companies, private investigators, salvage yards, title services, universities and colleges, and wrecker services
• Other who? The "Other" business type seemed to include some interesting organization names from the legal, oil, healthcare, software, and telecommunications industries; plus federal government agencies and some high schools.

The report did not mention the number records each company purchased, the total number of records purchased, or who the largest purchasers were. Knowing this would have enabled a deeper analysis. Then, you could compute an implied value to an average Texas driver's record.

The best comparison I can make is that the State of Florida made about $63 million in 2010 by selling drivers information, with an average value per record of about $ .01. This makes one wonder if Texas government officials did a poor job of selling driver information, or Florida government officials did an exceptional job.

While I didn't see in the Texas list of purchasers the high-profile names of data brokers from the Florida sales, I assume that intermediaries were used.

After reading the Texas DMV webpage about the DPPA, I felt that this page could do a far better job of informing consumers what is really happening. Other states say little in their websites about the money they make from DPPA sales.

What do you think of your state making money by selling your personal information?

Comments

[Attorney Joe Malley]

The article does not accurately discuss the sale of MVR's in Texas. The report merely discussed about 2,500 entities that obtain car registration data individually and not in "bulk", referring to obtaining the entire database. I would suspect that a majority of those entities actually have a valid DPPA exemption to obtain the data, excluding entities that were denied access due to DPPA violations.

What the report does not discuss is entities that obtain the "BULK" car registration database, nor the "BULK" Driver License records, which is roughly 20 million records obtained by about 250 companies on a monthly basis. We would also have to add the entities that obtain Driver License data individually. In short, there are 2 databases: Driver Licenses and Car registration Data. Entities can obtain the data one be one, or obtain all of the records. With that said, the report merely discussed maybe 5% of the total access to MVR data.

The "bulk" requesters in Texas include the largest Data Mining entities: Choicepoint, Acxiom, R.L Polk, Lexis Nexis. In Texas about 250 companies claim that the entire state population of drivers is associated with their entity and permitted to obtain such documents. It is improbable that ALL companies have an assocation with all Texas Drivers to be legally able to comply with the DPPA. Keeping in mind the most prevalent method for identity theft is to obtain the driver license data. Ironically, minor children that have an identification car, and/or elderly adults that are non-drivers have their records sold too.

In my research I have found:
1) sporting good chain being provided the entire database of records, claiming a DPPA exemption of 'towing" in case a vehicle just happens to be left on its property so they could contact the owner. The company signed a contract that they had no intent to use the data for marketing,but incurred a substantial monthly bill to obtain the millions of records for all Drivers Licenses, data not necessary since car registration data would have the data if towing was necessary;

2) Foreign Corporation obtaining data in 17 states, including Texas, with one office in a strip mall, and a website in Arabic and headquarters in a foreign country. Texas and 16 states were selling user data, including driver license data such entities. In lieu of the precautions within a MVR Dept to secure the data, anyone wanting to duplicate driver license data is now easily obtained and the data could be obtained globally. The initial concern being Terrorists that obtained Driver license data before they boarded the 9/11 flights;

3) Individual in Oregon that obtained identification data, similar to driver licenses,but inverted, and used for minor children. This individual had filtered his request to the state to only want "girls under 16". He would send the girls a letter saying they qualified for a beauty pageant and require pictures in a bathing suit and complete additional information. There was no state incorporation, and research showed no such contest. After I questioned how a state official could not have figured this out themselves, that they needed to notify the parents to be careful that a child had been in contact with this person, the state stopped such activity based upon my request;

4) Much of the data is sold to marketing companies that then sell it to Websites that "resell" the data to anyone online that checks a box on a site that they have a valid DPPA exemption. Such is the method used by Stalkers/abusers to locate an ex-wife,family,girlfriend to abuse their victims. I have been notifying state and national abuse victims entities for years to warn victims how easy it is to obtain such data; however the state requirement to register a vehicle or to obtain a driver license, voids any protection.

In regard to the state profit, noting there are many states that sell this data, and in response to:

"The best comparison I can make is that the State of Florida made about $63 million in 2010 by selling drivers information, with an average value per record of about $ .01. This makes one wonder if Texas government officials did a poor job of selling driver information, or Florida government officials did an exceptional job."

Florida has a population of about 20 million residents, while Texas has 26 million people. I am not aware of the actual profit for Texas on the sales of ALL MVR data, but estimate by comparison, it's in excess of 20%, or roughly a SEVENTY-FIVE MILLION DOLLAR YEARLY PROFIT.