Federal and state laws allow the New York Department of Motor Vehicles to sell consumers’ registration data to the highest bidder.
While representatives for the state DMV said they provide information in accordance with the law for a fee — those fees generated $62.2 million in 2017 for state coffers.
But on the heels of a year filled with data breaches and hacks, and a privacy scandal that forced Facebook CEO Mark Zuckerberg to testify on Capitol Hill, one local official is crying foul.
Erie County Clerk Mickey Kearns wants residents to know what they’re giving up at the DMV — in addition to the expectation of time and money.
DMV visits come with the expectation of being met with long lines, lengthy wait times and the outstretched hand of a clerk, in exchange for a new license, new registration or a new ID card.
But the hand most don’t see, Kearns said, belongs to the state of New York, which for the past decade, has been taking your registration data, and selling it to secret companies to pad state coffers.
“When you’re talking about breaches of security and the breach of trust, I think this is a breach by New York state,” Kearns said. “They are breaching the public’s trust.”
Kearns said the state is playing stock trader with personal registration information — selling it off to the highest bidder.
“It’s information, your name, the address of the owner of the vehicle, the make, the model, the year, the weight, the body style, the number of passengers, license number, the type of registration and transaction, the expiration and the VIN,” he said.
That information is worth tens of millions of dollars to the state — every year. In 2017, it was worth more than $62 million dollars.
And, Kearns said the state protects its investment by keeping the third-party companies secret.
“We do not know where this information is going and who these third party contractors are,” Kearns said. “I think people want to know who is getting their information and who those third parties are.”
Every two years, the state accepts bids from companies looking to acquire registration data. The companies must be licensed, and must be approved by the state.
“DMV does not sell customer names or addresses for marketing purposes,” said DMV Spokeswoman Lisa Koumjian. “Social Security Numbers are never sold. Any disclosure of customer data by DMV is in compliance with state law and the federal Driver Privacy Protection Act, which do not allow personal DMV data to be shared for marketing purposes.”
This is a practice that’s been going on for decades. DMV customers do not have the ability to opt out.
The DMV’s website provides information about the practice, but it is broad.
Last year, the state made $2.2 million from contract sales. Those companies are prohibited from using the data for surveys, marketing or solicitations.
But there is nothing in the law that prohibits those companies from selling the data to another party.
The state made $58 million on pay-per-search sales, the majority of which are insurance companies. The state made another $3 million in over-the-counter requests for information, most of which are driver license records.
The state says the information provided is “shared with bus companies, employers, insurance companies, researchers, and motor vehicle manufacturers, through each of the three sharing methods, makes our lives safer and more convenient. If this information were not made available traffic safety and commerce would be negatively impacted,” according to the DMV’s website.
The state provides information on which companies submit bids for the information. However, it does not provide information on the winning bidders.
Representatives from the DMV say the state provides bulk registration data, and separates it to protect individual identities.
That may be good in theory. But the reality is far different, says Arun Vishwanath, a cybersecurity expert and faculty associate at Harvard University’s Berkman Klein Center.
“Even if the DMV is de-identifying our data, in other words, anonmyzing it, take our names and giving everything else out there, it doesn’t take a lot for a company out there to take that data and put it all together,” Vishwanath said. “There are companies that do just that.”
In 2018, people exist in two realms: In person and online. When it comes to data, Vishwanath said, it’s easy to bring those two worlds together.
He said to think about data like a picture. The state separates the information — or bunches it up into bulk form — so the picture stays fuzzy, and unidentifiable.
But when companies pair that information with, say, what people willingly provide on Facebook or another form of social media, the picture becomes clearer.
“Let’s say I get data from the DMV, about where you live, what car you drive and your license number, and that’s all I have,” Vishwanath said. “It helps me if I can find out who you are because I can go to your social media accounts and find out what your interests are. Now, I have everything about you.”
That information is priceless for marketing, telemarketing and insurance companies, all of which, Kearns said, could getting ahold of registration data third-hand.
“To me, it’s an egregious breech because we are living in a digital world,” Kearns said. “We do not know where that information is going. We see on Facebook how people are using that information. So I’m very concerned.”
Facebook uses that data differently.
In his testimony this month on Capitol Hill, Facebook’s CEO Mark Zuckerberg said the company uses what people post, what they like and information from profiles to make online experiences more akin to a user’s interests.
That sets a dangerous precedent, Vishwanath said. And most users are blind to the ramifications.
“That’s the scary part of social media, isn’t it? You put out what you like. And then they feed you what you want,” Vishwanath said. “These are basically people that are playing marionette with your life.”
Kearns, who’s also a former state assemblyman, has asked the state, repeatedly for the names of the companies that buy registration data.
The state told Kearns they need more time, and the identity of the winning bidders may not be public.
“This is being done by your government for their benefit … to pad the New York state budget,” Kearns said. “We are going to get this damn information. I don’t care what it’s going to take. If we have to file a lawsuit, we’re going to get this information. I have a funny feeling that we’re going to be very interested to find out who these third parties, these contractors are that are on this list.”