Motherboard's investigation, based on hundreds of pages of DMV documents, found that the Wisconsin DMV had data selling agreements with over 3100 different entities, including around two dozen private investigation firms. The Virginia DMV has similar arrangements with 109 private investigators, the documents showed. Some DMVs make tens of millions of dollars from the sale of data, and multiple DMVs confirmed to Motherboard that they have cut-off access to certain companies after the data was abused.
"Nobody—from agencies like the DMV to large corporations like Facebook and Google—should be profiting from sharing or selling personal information without meaningful consent. Congress must get serious about ending practices that violate the privacy of ordinary Americans," Sanders added.Multiple privacy experts have called for the law that permits the sale of DMV data to private investigators—the Drivers' Privacy Protection Act (DPPA)—to be changed. Senator Richard Blumenthal told Motherboard in a statement that Congress should take action on the law."Americans rightly expect that government agencies entrusted with their personal information are taking necessary measures to protect their privacy. DMVs should not be in the business of recklessly selling drivers’ personal information to third parties. Federal privacy laws should never license the sale of private information to stalkers and disreputable private investigators. This deeply disturbing report underscores the urgent need for Congress and states to take action to vigorously enforce the letter of the law, and close any loopholes exploited by malicious actors," he said.
On Monday Senator Mark Warner told Motherboard in a statement “This is just another example of how unwitting consumers are to the ways in which their data is collected, sold or shared, and commercialized. The standard talking point that consumers ‘don’t care about privacy’ has been increasingly disproven, as we learn that consumers and policymakers have been kept in the dark for years about data collection and commercialization practices." Senator Ron Wyden previously told Motherboard that if the DMV data has been abused by private investigators "Congress should take a close look at the Driver’s Privacy Protection Act, and, if necessary, close loopholes that are being abused to spy on Americans." Do you work at a company selling data? Do you know of an abuse of DMV data? We'd love to hear from you. Using a non-work phone or computer, you can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, OTR chat on [email protected], or email [email protected]
Update: This piece has been updated to include comment from Senator Blumenthal.
Subscribe to our new cybersecurity podcast, CYBER.