DMVs sell the data for an array of approved purposes, such as to insurance or tow companies, but some of them have sold the information to businesses as well. Multiple states have made tens of millions of dollars a year selling data, hundreds of pages of documents from DMVs through public records requests, reported by Motherboard, revealed.
Members of the public may not be aware that when they provide their name, address, and in some cases other personal information to the DMV for the purposes of getting a driver's license or registering a vehicle, the DMV often then turns around and offers that information for sale. Many of the private investigators DMVs have sold data to explicitly advertise that they will surveil spouses to see if they're cheating.
"Under this MOU [memorandum of understanding], the Requesting Party will be provided, via remote electronic means, information pertaining to driver licenses and vehicles, including personal information authorized to be released," one agreement between a DMV and its clients reads.
Some of the arrangements allow a company to look up specific individuals, according to the documents. Contracts can roll for months at a time, and records can cost as little as $0.01 each, the documents add.
Multiple DMVs from across the country stressed to Motherboard that they do not sell the photographs from citizens' driver licenses or social security number.
“The selling of personally identifying information to third parties is broadly a privacy issue for all and specifically a safety issue for survivors of abuse, including domestic violence, sexual assault, stalking, and trafficking," Erica Olsen, director of Safety Net at the National Network to End Domestic Violence, told Motherboard in an email. "For survivors, their safety may depend on their ability to keep this type of information private."
The legality of the selling is backed by the Driver's Privacy Protection Act (DPPA), a law written in the '90s before privacy became a cultural focus. The DPPA was created in 1994 after a private investigator, hired by a stalker, obtained the address of actress Rebecca Schaeffer from a DMV. The stalker went on to murder Schaeffer. The purpose of the law was to restrict access to DMV data, but it included a wide range of exemptions, including for the sale to private investigators.
"The DPPA is one of several federal laws that should now be updated," Marc Rotenberg, president and executive director of privacy activism group EPIC, wrote in an email. "I would certainly reduce the number of loopholes," he added, referring to how the law might be changed.
The Virginia DMV has sold data to 109 private investigator firms, according to a spreadsheet obtained by Motherboard. The New Jersey Motor Vehicle Commission has sold data to at least 16 private investigation firms, according to another spreadsheet. The Delaware DMV has data sharing agreements with at least a dozen investigation firms, while also having direct access agreements with around 300 different entities.
Although the data can be sold for cheap, the DMVs have made a lot of money from these agreements. The Rhode Island DMV made at least $384,000 selling personal data between 2015 and this year, according to a spreadsheet obtained by Motherboard. When asked how much the Wisconsin DMV made from selling driver records, a spokesperson wrote in an email "Per these 2018 DMV Facts and Figures, $17,140,914 was collected in FY18 for driver abstract fees." The Florida Department of Highway Safety and Motor Vehicles made $77 million in 2017 by selling data, a local outlet found. Documents explicitly note that the contracts are “revenue generating” in purpose.
Several DMVs confirmed they sell data to third parties, including the Virginia DMV and the New Jersey Motor Vehicle Commission, who also said they have cut-off access in cases where data has been abused. A spokesperson from the Wisconsin DMV wrote in an email that "Wisconsin DMV directly informs customers that their information may be sold."
Alexis Bakofsky, deputy communications director from the Florida Department of Highway Safety and Motor Vehicles, said the agency had revoked access after abuse. "Since implementing the new controls in 2017, the department has cancelled three MOUs with requesting parties for misuse," she wrote. "Additionally, while there was no indication of misuse, the department proactively cancelled two MOUs with requesting parties for failing to provide adequate internal controls."