States make money selling your personal DMV information

ST. LOUIS, Mo. (KMOV) - Scammers, hackers, and even telemarketers love getting your personal information, but some people in the Metro told News 4 Investigates they’re shocked to learn that their names, addresses, and other data are being sold for profit by a government agency, the Department of Revenue, which contracts all License Officers in the state.

“Frankly, it’s a little frightening. Very off-putting, you know,” said one person leaving the DMV.

“Anything the DMV has about you is for sale,” said Scott Granneman, a data expert and professor at Webster University.

“Look at your driver’s license. And then imagine what you filled out. Imagine the things you filled out on the form that the DMV has. Now, imagine that being made available to people. It’s a lot of information,” said Granneman.

He said it’s all perfectly legal under a federal law called the Driver’s Privacy Protection Act, known as the DPPA. Passed in the 1990′s after DMV information was used by a man to murder a Hollywood actress, the law prohibits states from selling driver data to just anyone. But it carved out exemptions on who can access it: courts and law enforcement agencies, for example, and also, certain types of businesses like insurance companies and entities conducting market research, even private investigators.

The restrictions that are provided have a lot of loopholes in them and a lot of opportunity for people to go ahead and acquire information about us that we might not be very comfortable with them acquiring. So even though the law is supposed to restrict selling your data, News 4 Investigates has learned states very often do and are making millions of dollars in the meantime.

News 4 Investigates pulled the data from Missouri. In the last five years, the state made well more than $2 million from selling DMV records.

It’s less than other states. Texas made a reported $3 million in 2020 alone. Illinois generated almost $45 million in 2022. Florida reportedly raked in $77 million for driver data back in 2017.

“Missouri is somewhat of a drop in the bucket complaint compared to Florida. But they’re still selling going off of information,” Granneman said. He told News 4 Investigates it’s often not exactly clear where the data is going.

He reviewed the list of the entities to which Missouri sold in 2022, and some of them raised more questions.

“There’s nothing stopping somebody from creating a marketing company and then getting this data at all,” said Granneman.

Nothing, he said, stops them from turning around and selling the data to someone else, especially now, when it’s easier than ever.

“Which is why we have the problem of our data sloshing around all over computer systems, all over the United States,” he said.

Granneman has long said federal laws need to be passed to protect Americans’ data overall. You don’t own your data. So if somebody else has data about you, they own that data, not you.

So News 4 took concerns about the DMV loopholes straight to Missouri US Senator Josh Hawley.

“The idea that the government could sell it and make it available to third parties, that’s appalling,” said Senator Hawley.

He told News 4 Investigates he would consider legislation to tighten the exemptions to the DPPA.

“The information you have to give, have it turned over to a third party and sold to them, that’s wrong, wrong, wrong,” he said.

Perhaps worst of all: the drivers we talked to said they had no idea.

“It takes Channel 4 to come out and tell people to pay attention to their identity,” said one woman leaving the DMV in the Central West End.

Again, this is all allowed under federal law. But states can make their own laws more restrictive. Wyoming and Arkansas have done that, for example.

A spokesperson from the Missouri Department of Revenue said in a statement:

“While the Department of Revenue doesn’t take a policy position, it follows the letter of the law, as laid out in state and federal statute, in this case RSMo 302.170.7. Every effort is made to ensure that only authorized users of authorized entities are provided information. This is something we take very seriously and efforts include manual verification, cross-referencing and routine spot checks. Any comparison between Missouri and other states’ practices would be speculative.

We’ll keep checking with lawmakers; for now, know your data might be sold.

Copyright 2023 KMOV. All rights reserved.