EXPLANATORY JOURNALISM > Issues In A Broader Context

A swath of articles published today in TECHDIRT https://www,techdirt.com

WHY THE HELL ARE THEY SELLING RESIDENTS DATA?

Congressional Reps Want To Know Why The California DMV Is Making $50 Million A Year Selling Driver Data

Privacy

from the time-to-start-cutting-the-public-in-on-the-scam dept

Tue, Aug 11th 2020 2:57am — Tim Cushing

Congressional legislators -- apparently caught off guard by one state's revenue stream -- are asking the California Department of Motor Vehicles a
$50 million question:
why the hell are you selling residents' personal data?

A group of nearly a dozen lawmakers led by member of Congress Anna Eshoo wrote to the California Department of Motor Vehicles (DMV) on Wednesday looking for answers on how and why the organization sells the personal data of residents. The letter comes after Motherboard revealed last year that the DMV was making $50 million annually from selling drivers' information.

As Karl Bode noted last year when covering this revelation, this sale of data is codified. The Driver's Privacy Protection Act doesn't do much to protect drivers' privacy. It may prevent abuse of this data by government employees but none of that affects private sector access where the real money is made.
The data from the California DMV is sold to a variety of data brokers. The public records request that resulted in this windfall of transparency about the DMV's windfall of actual money didn't name any of its customers. But did show a steady increase in revenue over the five years the records covered.
The letter [PDF] signed by nine members of Congress -- including California Congressional rep Ted Lieu -- asks the DMV a lot of pointed questions about its practice of profiting off data Californians are forced to hand over in exchange for licenses. It asks the questions the records obtained by Motherboard left unanswered. First off, the legislators want to know who this data is being sold to.
The legislators also want to know if this data is being shared with ICE and other federal agencies for the purposes of locating undocumented immigrants. It also asks if Californians can ask to opt out of the data sales/sharing and whether the agency would honor any of these requests.
The legislators note that they're concerned about this practice they probably should have already been aware of -- especially the two California assembly members who also signed the letter.

[W]e’re troubled by press reports about the California DMV’s disclosure of vast quantities of data which could enable invasive biometric policing and be a symptom of a deeper privacy malady. [...] What information is being sold, to whom it is sold, and what guardrails are associated with the sale remain unclear.

The DMV has already answered some of these questions... sort of.
In a statement to Motherboard, the DMV said the $50 million/year it makes on data sales only offsets the cost of "administering its requester program." It denies selling information to marketers. It did not deny selling info to data brokers or other common customers for DMV data, like credit reporting agencies.

"The DMV takes its obligation to protect personal information very seriously. Information is only released according to California law, and the DMV continues to review its release practices to ensure information is only released to authorized persons/entities and only for authorized purposes. For example, if a car manufacturer is required to send a recall notice to thousands of owners of a particular model of car, the DMV may provide the car manufacturer with information on California owners of this particular model through this program," the statement added.

"Only released according to California law." That's the problem.
The law allows the DMV to sell data to private companies. It takes a few purchases to add up to $50 million. Handing out info to car manufacturers for recalls is probably something the DMV does for a minimal cost, if it even charges anything for it.
The DMV's statement sounds good but really says nothing. No one will really know what happens to the data the DMV collects until it starts handing over detailed answers to these questions from Congress.

Filed Under: anna eshoo, california, data, dmv, privacy, selling data, ted lieu

Read More | 6 Comments

Expand  

_________________________________________________________________________________

Forget TikTok. Feebly Secured Infrastructure Is Our Real Problem

(Mis)Uses of Technology

from the missing-the-broader-context dept

Tue, Aug 11th 2020 6:03am — Karl Bode

One of the dumber aspects of press coverage of the TikTok kerfuffle is the lack of broader context. How, exactly, does banning a Chinese-owned teen dancing app solve our security and privacy headaches in a world where apps and services everywhere are collecting most of the same data, if not more? And why the myopic focus on just TikTok when Americans attach millions of totally unsecured Chinese-made "smart" IOT devices to their home and business networks with reckless abandon? If you're going to freak out about U.S. consumer privacy and internet security -- why not focus on actually shoring up overall U.S. consumer privacy and security?
Many press outlets and analysts have innately bought into the idea that banning TikTok somehow seriously thwarts the Chinese government's spying efforts. In reality, China's spying capabilities, fueled by an unlimited budget, have no limit of potential other ways to get far more data thanks to United States' lax privacy and security standards. Case in point, last week in the midst of TikTok hysteria, a report quietly emerged showing that the U.S. satellite communications networks have the security of damp cardboard:
. . . Which is all to say: if you're going to freak out about TikTok, why not at least spend some of those calories discussing actually trying to fix our broader cybersecurity and privacy problems? Why not create systems that are simply resilient, transparent, and accountable by design?
The U.S. still doesn't have even a basic privacy law for the internet era, companies routinely face no serious penalty for privacy missteps, our privacy regulators are routinely kneecapped and under-funded, consumer data is routinely left open on the cloud, a new hack is revealed at least once a week, and nobody wants to spend the funds necessary to upgrade older infrastructure because doing so simply isn't sexy. To ignore this, then become utterly hysterical because the Chinese government might get some teen phone data, seems divorced from the broader context.
Yet most of the biggest pearl clutchers about the dangers of TikTok have been utterly absent from this broader reality.
They were nowhere to be found among efforts to fix a massive SS7 flaw that makes our cellular infrastructure vulnerable. . .