Sale of drivers' data reaps tens of millions a year for Pennsylvania
Pennsylvania is making tens of millions of dollars a year selling drivers' personal information, raising concerns among some motorists and privacy experts who said they weren't aware of the practice.
The records include gender, license class, expiration date and up to 10 years of traffic violations, all of which is available to insurance companies, credit businesses and employers at a price of $9 per driver.
Stephen Chesney, 41, an attorney from Brighton Heights, said he had no clue. “It's definitely concerning,” he said. “No one likes their information being sold.”
Annual collections from the practice hit a five-year high of $41 million in June, according to the most recent figures, up from $30 million the year before. The increase is mostly because of a fee hike to $8 from $5 in April 2014 to raise money for state transportation projects; the fee increases to $9 this summer.
“For the state, it's a revenue stream, but for the drivers, it's a privacy concern,” said Mark Rotenberg, president of the Electronic Privacy Information Center.
Pennsylvania has about 8.9 million drivers. Insurance companies can use their histories to validate what customers are reporting on their policies. Jonathan Greer, vice president for the Insurance Federation of Pennsylvania, said the federal Driver Privacy Protection act governs what kinds of records can be requested, and companies aren't permitted to sell them to third parties.
Paying for the information does not concern the industry, Greer said. Neither did the fee increase.
“It's the cost of doing business,” he said.
Lorrie Cranor, a professor at Carnegie Mellon University who runs its privacy engineering program, said it's the state's profit that's bothersome.
“In general, people don't like it when companies, or in this case, government agencies, sell their data,” Cranor said. “It's, ‘Why should you be able to make money off of my data?' ”
The profit factor shocked Mary Lechok, 58, of Ross. “People don't know that,” Lechok said. “They make money off everything.”
PennDOT maintains contracts with wholesale companies to purchase driver information in bulk, defined as at least 5,000 transactions per month. Those include LexisNexis, Acxiom, American Driving Records, Explore, Hireright, Insurance Services Office and TML Information Services. Drivers or their attorneys can request their information.
David Thaw, an information security expert at the University of Pittsburgh School of Law, said the kinds of records that can be obtained don't necessarily pose a threat of identify theft.
“I would not place this on the high-risk end of the spectrum,” he said, “providing the department and the insurance companies are following the rules.”
A proposal from state Sen. Don White, R-Indiana County, that passed 46-3 in June would allow companies to acquire driver records for all residents in a household without having all the drivers' names to determine who isn't paying correct premiums.
Gov. Tom Wolf opposes the proposal, citing privacy concerns, said PennDOT spokesman Michael Moser. But White said the practice is used in two dozen other states.
“This is routine information that PennDOT already has,” White said. “This will help with a small segment of the uninsured drivers in a household that aren't added to a policy when they should be.”
Moser said the agency requires applicants to supply names, addresses and license numbers for drivers whose records they are requesting. They must declare they will use the information for one of several lawful purposes and sign an affidavit under penalty of two years in prison or a $5,000 fine.
Frank Zuber, 43, of West View, said he accepts that private companies sell consumer information for millions of dollars.
“That's quite a scam,” Zuber said. “I expect it from a lot of things, but from the government, I don't know.”
Then he paused and chuckled.
“Well,” he said. “I guess that's sort of a stupid statement.”
Melissa Daniels is a staff writer for Trib Total Media. She can be reached at 412-380-8511 or firstname.lastname@example.org.