The Vermont Department of Motor Vehicles makes millions of dollars per year selling Vermonters’ personal data, according to records analyzed by VTDigger.
DMV officials say this practice, which is regulated by federal law, is routine. But privacy advocates have raised questions about whether giving private companies access to personal data could lead to abuse.
Joseph Cox, who investigated the practice for the Vice technology news site Motherboard in September, said the DMVs in every state he researched were selling data to private companies.
“This is a standard way for the DMV to generate revenue,” Cox said, “even if the people — that is, drivers — who provide the information in the first place aren’t necessarily aware of it.”
A push is now underway to tighten the Driver Privacy Protection Act, the 1994 federal law that regulates the sale of DMV data. Some lawmakers and privacy advocates are pushing to remove private investigators from the list of parties that are eligible to buy personal information. (About 50 PIs are authorized to purchase data in Vermont.)
Cox attributed the renewed attention on this law to a shift in how people view personal information. Recent scandals, like Cambridge Analytica’s illicit harvesting of Facebook user data, have brought new scrutiny to privacy issues.
“People pay much, much more attention to this — to even seemingly innocuous data such as your name, physical address, and maybe some contact information,” Cox said. “When this law first came about in 1994, we were in a much different place, privacy-wise, than we are today.”
On this week’s podcast, Cox discusses his reporting on DMV data for Motherboard. VTDigger’s Xander Landen breaks down how the practice plays out in Vermont. Michael Smith, the Vermont DMV’s operations director, describes why his department sells personal information. And Susan Randall, a Vermont private investigator, explains how access to data can serve as a check on law enforcement.
VTDigger is underwritten by:
This week: Records show that the Vermont Department of Motor Vehicles makes millions of dollars every year selling Vermonters’ personal data. The DMV says this is a routine practice that’s totally legal. But privacy advocates have raised questions about whether that access could be abused.
Xander Landen: Let’s see what we’ve got here. Armstrong Investigations and Consulting Services LLC out of Guilderland, New York. Boucher Private Investigations out of Montpelier, here in town. BlackRock Investigations Group. Boathistoryreport.com…
Our reporter Xander Landen has been looking into this practice.
Xander Landen: Censor Security, Inc., in Rutland. Carfax. You know Carfax.
Yeah, who doesn’t. Xander, what is this list?
Xander Landen: What I’ve got here is a list of the roughly 750 companies that the state of Vermont, specifically the Vermont DMV, has approved to buy the personal data of Vermont drivers since 2004. So it’s everyone who’s been approved.
Have these people all gotten data?
Xander Landen: That, unfortunately, from this list, I do not know. What I do know is that these are all the people that the state has said, you’re cleared to buy the personal data of Vermonters. And that data ranges from data that — when you submit a license application, or — with the exception of your social security number, and then anything about vehicle registration, anything about the criminal history that they may have on file, your driving history. Whether you’ve been stopped, you have traffic tickets, you have a DWI. You have points on your license or points against your license because of your driving history.
The DMV collects a lot of information about drivers in the state. They have a lot of information that they maintain. They also make a lot of money selling that information to private companies.
How much money are we talking about?
VTDigger is underwritten by:
Xander Landen: For the last three years or so it’s been about $4 million each year.
You met with officials from the Vermont DMV to talk about this practice. What did they tell you?
Xander Landen: I talked to Michael Smith at the DMV. He’s the operations manager there. And he and he said that this is an extremely common practice.
Michael Smith: I don’t know all 50 states, but I have never heard and I’ve been to many conferences with all the states. I’ve never heard of any state that said, ‘no, we’ve locked everything down. We don’t give it out.’
Xander Landen: All DMVs across the country sell the data that consumers and drivers give to them when they register their vehicles and then sign up to become licensed drivers in a state. This is a very common practice, and it’s a practice that’s set up under federal law.
Michael Smith: So DPPA, right — the Driver Privacy Protection Act — sets up various permissible uses for private information. And this is — it’s a federal law or whatever, it sets up various different ones.
Xander Landen: Federal law allows for DMVs to sell this information. And they’re required, in many cases, to sell the information — to companies like insurance firms, insurance companies, and trucking companies and auto manufacturers. It’s important in many cases. Think about, you know, cases where you have recalls of vehicle parts.
Michael Smith: While the recall that says that your floor mat’s going to hold your gas pedal down seems rather serious, well, people wouldn’t have found out about it. Think about that — is it Takata airbags that were blowing up on people? That wouldn’t have got out. You know what I mean?
Xander Landen: You have companies like Carfax that are trying to make accurate reports about the state of a vehicle or a vehicle’s history. They sort of rely on this information.
Michael Smith: So when you go buy a car, you run your Carfax. You see the little car fox or whatever on TV, right? So you run the VIN and say, okay, this thing’s got a flood brand on it. I don’t want to buy that.
Xander Landen: There’s companies that rely on this information, and DMVs have to give it to these companies. So they’re inherently going to be making money from those sorts of companies. But where DMVs have a little more discretion is with other sorts of private companies.
Xander Landen: Well, one thing that’s interesting is that there are about 50 private investigators on this list — private investigation firms that go to the DMV on a frequent basis to get information to investigate people on behalf of their clients.
Michael Smith: DPPA is set up with “shall” and “may,” right? Okay, so there’s, you know, what the definition of shall and may is?
Xander Landen: Sure.
Michael Smith: Shall is you’re gonna do it, may is you don’t have to. You can if you want. So, there are sections that talk about shall and may. Shall: we shall provide to vehicle manufacturers and people that are going to send stuff on your safety recalls. That’s a shall, right? And I believe the others that are listed in there are may.
Xander Landen: Private investigators rely on the DMV to get information about where people they’re looking into live, whether the people they’re looking into have a criminal history.
There aren’t that many big out of state companies that are on this list, but there are a few. There’s Deloitte, which is a huge financial consulting firm. You have Aristotle International Inc. here, which is a company that self identifies as a company that mines data to help political campaigns.
Michael Smith: So the DMV’s position would be that the federal government has established regulations and we try to comply with them the best that we can. When there is a “may” we would exercise our judgment to say, do we believe this is an appropriate use or do we not, right?
Xander Landen: The reason I think this is interesting and worth scrutiny is because I don’t think that most Vermonters, when they walk into the DMV and sign up to become a licensed driver in the state or to register their vehicle, know necessarily that that information is not only being maintained by the DMV, but could be sold by the DMV to companies that request it.
Now there are, like I said, strict standards and requirements. They’re not just going to sell it to anyone that asks. But the fact that the DMV has a lot of personal information and are profiting off of it is interesting.
Xander Landen: There was a recent report in Vice News highlighting how DMVs sell the information, particularly sell it to private investigators, that put this whole practice in the news again. It’s what inspired me to look into this locally.
Joseph Cox: Every DMV that we got records back from was selling this data in some capacity. Some were selling it in bulk and others were focused on sales to individual entities or businesses, but very generally speaking, it seems to be pretty widespread.
This is Joseph Cox, the reporter who investigated this story for Vice.
Joseph Cox: This is a standard way for the DMV to generate revenue, even if the people — that is, drivers — who provide the information the first place aren’t necessarily aware of it.
Joseph said there’s a push underway to make changes to that federal law Mike Smith was talking about, the DPPA.
Joseph Cox: When I spoke to someone from Epic, a privacy activism group, they said that this is a federal law, or one of federal laws, that should be updated in 2019, with our renewed focus on privacy. Generally speaking, what they suggested was that some of the exemptions could be taken out, specifically the private investigator one. It is one thing to be selling information for companies that need to recall vehicles that may be defective, that seems like a legitimate use case. It’s another to be selling to private investigators, who can then essentially do whatever they want with it.
His reporting revealed that in other states, DMVs have admitted that this level of access has led to abuse.
Joseph Cox: When we also spoke to DMVs earlier in the year, multiple agencies did confirm that the data has been abused, and that they had to cut off entities. So it’s not like this is a theoretical issue. It is actually happening. Of course, there are legitimate use cases of this data, and it is being used legitimately. But there is still the risk and the apparent history of abuse there as well.
Xander Landen: In response to it, Bernie Sanders, our senator came out and called on DMVs to stop profiting off of data.
Joseph Cox: And he put it in the wider context of you know, the internet is this amazing thing with connectivity, but there’s the side effects of more and more data being available for sale and for purchase. We got similar responses from other senators as well, but then also digital privacy experts saying that, you know, this law needs to be changed.
It keeps coming back to the DPPA, this anachronistic federal statute which just doesn’t really sit with where we are in 2019 when it comes with privacy, and the selling of data, and how that data can be abused.
Xander Landen: I talked to the ACLU about this, and they basically said that the practice at a minimum deserves a lot more scrutiny, a lot more oversight and transparency. The public deserves to know about why and how the information is being used. That’s their argument.
Then I also called Susan Randall, who’s a private investigator who relies actively on this information, purchasing this information. And like I said, there are about 50 private investigators on this list. So I wanted to hear from one of them, specifically, why do you need this information? And she had a really interesting argument.
Susan Randall: In my world, I believe that open government is good government. In other words, I believe in open access to information: anything that law enforcement and prosecutors are able to access, I believe that we should be able to access.
Xander Landen: She’s talking about how she works for public defenders and criminal defense attorneys who, as part of their work, they need to look into the credibility of witnesses called into court, for example, or the credibility of the case that a law enforcement officer or a prosecutor is making against a witness. And that requires the ability to investigate the people that are being called into court and the facts that law enforcement are bringing to the table.
Susan Randall: The reason I get hired — so let’s say you’re accused of a crime, and it’s a state crime. Either the state police or local law enforcement will be working with the prosecutor. On our side, it’ll be like you’re appointed a public defender from the state or a federal defender. Or if you have money, you hire an attorney. They then hire me. So I’m sort of a check and balance on what the police and the prosecutors are able to access.
I think just as a civil liberties issue, it’s really important for us to have access to the same information that the other branch of government has. In other words, you don’t want to be on the hot seat being accused of a crime and not able to then look into the witnesses that are testifying against you.
Xander Landen: The overarching message that she kept saying is that law enforcement officers should not be the only people that have the ability to access this information that’s kept by the government. That there needs to be some channel for an independent investigator, an independent person, to be able to come in and also be able to conduct independent investigations of these people.
Susan Randall: That said, do you have corrupt prosecutors that have access to everybody’s information and screw it up and go off the rails? You know, yeah, sure. It’s like “The Wire.” Do you have corrupt officials? Do you have corrupt private eyes that can break all the rules and get sanctioned and lose their license? Sure. But in my experience in the last 20 years, that’s not what I see happening. I see people using it for the right reasons.
And I’d actually like to see it not cost the average Joe, the middle class person that needs this information for their family court hearing or criminal defense, not have to hire me to go drive there, park my car, go inside, wait in line. It would be much better if you’re a licensed P.I. and you can get the information online the same way that law enforcement can. I mean, that’s just an equity issue.
Xander Landen: She compared our system to the system in Russia. She said that she was recently overseas, she needed to look into some case in Russia, and how there, there’s no way to access this kind of information about people.
Susan Randall: The only people that have access to anyone’s information are just, like, Putin’s police. I was like, you’re kidding me. Really? There’s no database? There’s no way that I can find where Svetlana’s living in this apartment building?
Xander Landen: Here at least there’s a channel, and it’s a highly regulated channel. It’s not like anyone or any private investigator for any reason can go in and use it. You have to have specific reasons. In her case, she’s only investigating people that are involved in criminal or civil cases in court.
She also made the point that maybe it would be better if our information in general, private information, was kept private. But the world that we live in has already changed to the point where that’s really not possible.
Susan Randall: Anymore, the world that we’re in right now, everybody’s information is available all over the place to everybody. My point being, I think it’s really, really dangerous to have only certain parts of our system have access to that information and not others. It’s either all out there or it’s not out there. And there’s no putting the horse back in the in the stall at this point. It’s all out there.
Xander Landen: Big tech companies have basically eroded the possibility of us ever attaining or retaining true privacy anymore, and because of that, it makes no sense to sort of limit other actors like private investigators from accessing it. In fact, it’s only dangerous to cut off some sort of channel for the public or an independent actor to be able to access it.
But Joseph Cox, the Vice reporter, said this change in how we look at personal data and privacy is exactly why the law that regulates DMV data is under new scrutiny.
Joseph Cox: When this law first came about in 1994, we were in a much different place, privacy-wise, than we are today. So I mean, we even had stories like the Cambridge Analytica-Facebook scandal where third parties were getting access to data without, necessarily, users’ consent — that story would not have been around 10 years ago, in my opinion. I don’t think journalists would have necessarily written it. And I don’t think people would have probably really cared about it.
Now, that’s happened. And after that, we’ve seen a wave of more privacy-focused stories. Which is not to say that journalists weren’t covering privacy before that. But it’s even more front of mind now, and we have politicians talking about it much more aggressively. It’s a great time for professional activist groups that have been on this issue as well.
This DMV story kind of fits into, in my opinion, this post-Cambridge Analytica landscape of privacy. People pay much, much more attention to this — to even seemingly innocuous data such as your name, physical address, and maybe some contact information. We’re not talking about passwords, we’re not talking about photos or social security numbers. This is, as far as it comes, you know, pretty basic biographical demographic data, but it is still a privacy-centric story, especially in 2013.
Xander, having dug into this for a couple of weeks and found out a lot more detail about this — even though it’s been going on for a long time — what’s your takeaway here?
Xander Landen: I think it’s easy to look at this and raise questions about, why is the government selling personal information to companies, you know, private actors, and sort of feel like that might not be a good thing. But I think that there are arguments to suggest that it’s an important and essential practice. I think there are questions to be raised for certain privacy concerns. But there are also arguments that Susan Randall, the private investigator, made, that DMV officials made, to say that this is an important channel for certain businesses and companies that rely on this information to receive it in a way that, without the DMV, they wouldn’t otherwise have it.
It was interesting how Susan kind of tied it to this broader conversation around data — how the world around data has changed, the way we think about data has changed.
Xander Landen: I think that that’s why I wanted to look into this, right? Because it’s a given that Google and Facebook, at this point, it’s a given that they’re using our information for profit — for a variety of reasons that are driven by profit. And when you see that the state is making millions of dollars profiting off of our private information, that inherently raises questions. And that’s why I looked into this. But I think there are a series of arguments to be made for why this is an important practice. And I think, you know, Susan Randall, the private investigator, has a point that we’ve reached a point in our society where the information, or private information, is pretty much out the window.
I don’t know if we’re ever going to have the same privacy that we had in the 1990s, or even five or 10 years ago. The information is likely already out there. That doesn’t mean that I think the state should be profiting off of it. The argument has already been made by our one of our senators that this is an inappropriate use of our personal information. But it certainly isn’t anything new. It’s been going on for four decades. It’s legal. And I don’t think it’s going to stop anytime soon.
Got it. Thanks, Xander.
Xander Landen: Thanks for having me.
Don't miss an episode. Get notified about new VTDigger podcasts and multimedia projects in your inbox.