FOX 13 Investigates: The state's license to sell your driver records
TAMPA (FOX 13) - The Florida Department of Highway Safety and Motor Vehicles sells your private driver records in bulk to more than 75 companies -- large and small -- without knowing how the federally protected information is actually being used by the buyer, a FOX 13 investigation has found.
In the past two years, the state DHSMV brought in $150 million from bulk sales of driver information about its 15.5 million licensed drivers and 18 million registered vehicles, data that is transmitted to most of the buyers on a periodic basis.
Despite the department's repeated claims that the DHSMV "heavily vets" any company that wants a pipeline to private data to ensure the company meets one of the federally allowable reasons to access the information under the Driver Privacy Protection Act, a FOX 13 investigation has found the department's background checks primarily consist of staffers looking up whether the company has an active business registration with the state.
The extent of Florida's driver data sales practices, reported for the first time by FOX 13 Investigates, raises questions about why the department is putting private information in the hands of third parties without providing oversight as to how the data is actually being used by the buyer.
"I firmly believe the state really needs to take a more proactive approach in screening these people, verifying why they're using the information and that they're using the information for the proper purposes," said attorney Brandon Robinson with Stetson University College of Law in St. Petersburg.
FOX 13 spent more than four months researching who has been buying your driver information.
Some of the 75 entities who receive driver data from the state of Florida on a regular basis are major, global companies such as Acxiom and Experian.
Others on the list were difficult to identify: there were businesses that seemed to have no websites, no storefronts, and no answers when we tried to contact them.
Among the findings:
No state registration: Despite the state's self-described heavy vetting process, some of the businesses are not registered in the state of Florida. At least one business owner who signed contracts with the state had only expired, out-of-state business registrations.
Building a mystery: Some of the companies purchasing bulk data from the state DHSMV seem to have no footprint apart from a business registration. In some cases, even the building out of which the business is said to operate raises more questions.
One of the businesses, according to its state registration, operates out of a condominium near Fort Lauderdale. There was no response to voicemails left on a number connected with the business.
Class action lawsuits: Some of the companies on the state's sales list have been sued over allegations they misused driver data purchased from several states, including Florida.
FOX 13 first started investigating whether the state is truly vetting data buyers after noticing a concerning correlation between Florida residents' transactions with the DHSMV and then receiving direct marketing ads.
The mailers utilize private driver information -- make, model and year of the car an individual drives -- and seem to be mailed to a person's home address soon after a driver provides information to a motor vehicle office.
Under the federal DPPA law, companies are not supposed to access private driver records for marketing purposes without an individual's expressed permission.
One would have to take the initiative to put the permission in writing to allow for this, because you are automatically opted out.
Robinson started receiving similar direct marketing ads after he recently bought and registered a car.
"It had to have been through the state records," he said. "Within a week? I mean, no one else could get the information that fast."
The risk goes beyond junk mail. If marketers got a hold of your private information, then who else can?
Apart from traffic citations, all the information pertaining to your driver record -- including your home address, date of birth, and details about the car you drive -- is private and protected under the federal Driver Privacy Protection Act.
Congress enacted the DPPA in the mid-'90s, responding to growing concerns that states were using sales of citizens' motor vehicle information as a revenue generator and that the practice posed considerable risks to an individual's privacy, financial security, and physical safety.
Lawmakers carved out several wide-ranging exceptions to the law, allowing certain business interests to access the information under certain conditions.
For instance, the data can be obtained for a research or statistical report, though the DPPA neither defines who qualifies as a researcher, nor who qualifies as a statistician.
According to the state DSHSMV, many businesses qualify for the DPPA exemptions.
"Heavily Vetted"
The DHSMV, through a spokesperson, repeatedly denied a connection between the direct marketing mailers and insisted the department vets any entity that wants to buy private information from the department.
"Anyone who comes to the department and requests that is heavily vetted," said DHSMV spokesperson Alexis Bakofsky in a June interview in Tallahassee.
"We go through numerous processes to vet," she later repeated.
"And all those agencies are heavily vetted by the department," she repeated yet again.
She was unable to provide details.
FOX 13 repeatedly asked the state to describe how they screen these companies to make sure they'll use your information legally.
Several weeks after the interview, the department sent an email saying DHSMV staffers vet the companies by confirming they have a registered business name with the state.
And that's it.
Robinson with Stetson Law says that's a problem.
"All they had to do to get the records is basically swear by penalty of perjury that they're using that information for an allowable purpose," he said, adding that it's relatively easy to register a business name with the state. Registrations usually do not include a description of what kind of services the businesses provide.
Driver Data to Data Brokers
The state of Florida sells your data to Acxiom and Experian, two large data brokers.
Both have been the subject of multiple congressional inquiries about how they use the information they collect.
"The average American is almost certainly unaware of the largely unregulated space in which these companies have been operating while they've been amassing detailed information about individuals' lives," said Sen. Al Franken, D-Minn., during a hearing of the Senate Committee on the Judiciary last November.
Patrick Tucker, a technology expert and the author of "The Naked Future: What Happens in a World that Anticipates Your Every Move," says the sales of private and protected driver data to data brokers deserve extra scrutiny, because the DPPA specifically prohibits use of driver data for marketing.
"The entire point [of data brokering] is to connect people that are creating data to people who want to sell them thing," he said. "That is marketing. That is their entire business model."
Tucker questions how data brokers could keep driver information entirely separate from their marketing operations, no matter what the stated reasons were for the purchase.
"Why would you collect all this information from all these places," he said, "if not for creating better, more specific, more responsive groups of people that you can then sell people when doing targeted marketing?"
Neither Acxiom nor Experian responded to requests for comment.
Federal Class Action Lawsuits
The DPPA contains criminal punishments and civil remedies for violations. On the civil side, the law contains a provision for $2,500 per violation.
Some of the companies on the states sales list have been involved in lawsuits alleging misuse of driver data. Two federal class action lawsuits have been filed in the past few months:
Cross-Sell: In 2014, the state of Florida signed a three-year agreement to sell protected driver records to Cross-Sell, a business that describes itself as a "market research and analytics company."
According to a federal class action lawsuit alleging violations of the Federal Driver Privacy Protection Act, the state of Nebraska banned the company from buying private driver records after the state found evidence they had been released to marketing companies.
Cross-Sell did not respond to requests for comment.
National Recall and Data Services: According to a federal class action lawsuit filed against the business and its owner Charles Holley, the company released private driver data to marketing companies in violation of federal law.
The lawsuit also says Holley has been banned from buying driver information from several other states after those states found evidence he was misusing it. Holley did not respond to requests for comment.
The DHSMV was giving National Recall and Data Services a direct pipeline to your personal information -- until one day after FOX 13 asked about it.
According to an email from Bakofsky, the department requested an "attestation regarding their data use" six months ago, but National Recall and Data Services did not send one.
"Not having received any notice from the company within the 180-day period, the department has revoked the MOU [Memorandum of Understanding] within the rights of the agreement," Bakofsky said.
FOX 13 sent several the DHSMV several requests for a copy of his entire contract with the state, specifically asking for the public record that detailed how Holley planned to use your private and protected driver records.
Last Friday, the DHSMV it could not provide the public record because it was "not in the vendor file."
"As you are aware, the department has continued to examine the process related to data records," a spokesperson said in an email. "This part of the process is certainly something that the department will review closer to ensure clerical errors like this do not happen in the future."
During the course of this investigation, FOX 13 asked DHSMV Executive Director Terry Rhodes about companies that buy Floridians' driver records from her department, but have been found to be in violation of the DPPA by other state DMVs. Neither Rhodes, nor a spokesperson, responded to the question.