Marketers Ignore Data as Florida Passes Bill to Fix DPPA ViolationThough Florida is currently violating a federal law restricting the sharing of driver's license data for marketing purposes, marketers say they have been steering clear of the data on their own.
The Driver's Privacy Protection Act originally was adopted in 1994 as an opt-out model in which consumers could choose not to have personal information shared with marketers. The law was amended in 1999 to require that states obtain drivers' opt-in permission before releasing data for third-party marketing purposes. The amendment took effect June 1, 2000.
A spokesman for the state Department of Highway Safety and Motor Vehicles said Florida still uses the opt-out model. However, the House and Senate passed a bill this week fixing the problem. The bill, if signed by Gov. Jeb Bush, is set to take effect Oct. 1. Last year, Bush indicated his support for a similar measure.
"At this time you can go to our Web site or go into a driver's license office and tell them that you want your personal information blocked, and that's the only way to block it at this time," the spokesman said. "We want to be in compliance with the federal law, but we are a cabinet agency and we can't do anything unless the legislature actually passes a law to let us do that."
One industry data provider said it gets driver data from Florida and other states but only under the provisions of the DPPA. Uses of driver's license data that do not require opt-in consent include motor vehicle safety, theft, emissions and product recalls; legitimate government agency functions; insurance use and employer use.
"We have for many years and continue to use the data for the permissible purposes," said Jennifer Barrett, chief privacy officer at Acxiom Corp., Little Rock, AR. "We stopped acquiring data from any state for any purpose other than those permitted when the DPPA went into effect. Even if they would sell it to us for that purpose, we wouldn't buy it, and to my knowledge that's the practice of other information providers in the industry."
Fellow data firm Equifax Inc., Atlanta, said it does not buy Florida drivers' data.
For the most part, the DPPA amendment put an end to the availability of driver data for marketers nationwide four years ago.
"It's my understanding that no state even asks people for consent because they know they are not going to get it and it's not worth the trouble," said Robert Gellman, a Washington-based privacy consultant and a DM News columnist. "I think we all know that opt in gets you 5-10 percent at best, and the list isn't worth anything at that level."
The South Florida Sun-Sentinel newspaper reported last month that while state lawmakers were drafting the legislation to fix the problem, the state Technology Office and the Department of Highway Safety and Motor Vehicles were planning to expand the sales of driver's license data.
The Sun-Sentinel article claimed that, "Corporate firms already pay the state about $27 million per year to buy state driver's license information. Then they resell it to businesses, such as insurance companies, direct mail firms, rental car companies and credit agencies."
However, the expansion of driver's license data sales will not contradict any Florida or federal law, said Carla Gaskin, spokeswoman "The data available through the portal will only be data permissible by DPPA," she said.
The American Civil Liberties Union sent letters last year about Florida's noncompliance to U.S. Attorney General John Ashcroft and Florida Gov. Jeb Bush. The letter to Ashcroft said in part, "We are writing to call your attention to the fact that, for the last several years, the State of Florida has had policies or practices that are in substantial noncompliance with an important federal law, the Federal Driver's Privacy Protection Act. Further, the State of Florida continues to violate the DPPA." A similar letter was sent to Bush.
"Enforcement of the DPPA comes from the Justice Department, but it's hard to believe that it is a high priority there," Gellman said. "I don't know of any actions brought against anybody under the DPPA." n