CFP'93 - Motor Vehicle Records, Freedom of Information and Your Privacy

by David Lewis

Deputy Registrar
Registry of Motor Vehicles
Commonwealth of Massachusetts

The Registry of Motor Vehicles in Massachusetts is a typical motor vehicle department that maintains records for 4.2 million drivers and 4.2 million motor vehicles. We also collect and track citations (approximately 1 million a year) and accidents (approximately 200,000 a year). These form the common components of an individual's driving history. We actually maintain records on about 7 million people when you include unlicensed drivers and out-of-state operators. The system utilized by Massachusetts is mainframe based (IBM MVS architecture) with one large integrated database (IDMS) serving all functions. We are using some client/server type software which will be expanding rapidly in the near future. However, the data will remain centralized for the foreseeable future.

The Registry of Motor Vehicles operates under an odd set of rules when it comes to selling data. We must, under the Massachusetts Freedom of Information Act, provide bulk (batch tape) registration and license records to whomever asks. We are prohibited from providing on-line access, except in specific cases such as insurance companies, to our data, which would accommodate the "one of" user. As with most motor vehicle departments, we retain none of the monies associated with selling these records. This creates rather interesting disincentive for the RMV as bulk requests take personnel time and effort, which have to be paid for, with no offsetting funding. Thus, the RMV, sometimes consciously and sometimes subconsciously, discourages any sales of data. For instance, the software that creates the flat file registration records leaves the data in a compressed format. Thus, for example, a 8-byte date is expressed internally as a two character hex field. Unless you can perform the IBM decompression of this field and then run it through a conversion routine to convert the resulting number into a date, any date is worthless to the buyer. Of course, because dates are very common in our records, this technique saves us tremendous storage space and works fine for internal use. We do provide vendors with the compression/decompression routines. However, the person with a PC or a non-IBM style mainframe is going to have to make a substantial investment in order to use this data. This barrier, and others like it (such as cost), are artificial and have kept the sales of data relatively low. Clearly, if we were told we could retain 10 cents on the dollar for the records sold, the same incentive would go the other way and we would be providing data on diskettes in any format requested. The collision between the freedom of information, personal privacy and entrepreneurial government is very obvious in this case.

The largest users of bulk data are insurance companies for the purpose of automobile insurance rating. In Massachusetts, they are restricted, by statute, to using the data they have obtained for that singular purpose, they cannot resell the data or use it, for instance, to rate a life insurance policy. The next largest buyers of bulk data are two local newspapers and R. L. Polk and Company. What they do with it we do not know although, at least in R. L. Polk's case, they are clearly reselling the data. After these groups, the volume of records sold drops off dramatically and fits into two categories: (1) cities/towns doing inquiries for parking tickets (yes, we have recognized parking as a business and we charge for there inquiries) and (2) vendors who buy accident data to match up to medicaid claims to find cases where the automobile insurance coverage should have paid instead of the medicaid state or so-called 'double dippers" that have collected on both coverages. All of this adds up to less than $1 million per year in revenue for an agency that earns $650 million annually. However, the RMV has estimated that if we were allowed to sell data on-line and retain 5% to 10% to cover our costs, we could easily increase sales to $20 million annually. Thus, sales of data are kept low because of cost and format, however, they could expand easily and rapidly, particularly if someone needed the revenue.

The question of what data is public and what data is private is much debated and subject to frequent change. In Massachusetts, it does boil down to the fact that unless data is specifically made private by statute, it is generally considered a public record. Of course, in the days of file drawers, this was not so much of a problem. What is and has made this data much more valuable is the ease of access to large, integrated files and the ability to "match" these files to other files thus creating composite records about a person. The technology of the future is going to enhance the ability to obtain and merge personal records.

At the same time, the constant search for a more efficient, cost effective, customer based government is contributing to the loss of privacy problem. Governments are creating and using common identifiers and sets of rules throughout their data structures. Without question, this standardization facilitates the merging of records. For instance, currently pending Federal legislation would (a) make motor vehicle departments Registry of Voters and (b) require suspension of driving privileges and the placing liens on vehicles owned by parents delinquent on their child support payments. All worthwhile goals that will make government function "better" for the public at large. At the same time, these acts also encourage common, standard identifiers and (potentially) central storage of data records. The net result is even more data about a person becomes readily available.

The other phenomena that has made driver license data so attractive is the almost universal acceptance of a driver's license as an ID card. In fact, it is becoming apparent to motor vehicle departments that they are really issuing an ID that has various attributes; a driver's license is just one of these attributes; the ID could be a firearm ID, a Liquor ID, a Welfare Card, etc. As the states continue to improve the quality and security of driver's licenses, the acceptance of the card as a universal ID will continue to increase. With the addition of digital images and digital signatures, magnetic strips (track 3 conforms to the ISO standard) and optical stripes, the license will become ever more accepted. We were very surprised to discover that, as part of our bid to accept credit cards, the winning vendor told us we could, potentially, use the license to create a credit card! Imagine where one could go with a chip on the license, one would have a virtual personal encyclopedia on this card (imagine if you lost this type of card). There are many issues that surround this technology and the very thought of a universal ID, however, I would like to concentrate on how we can support where government and technology is clearly going; freedom of information and privacy.

Freedom of information was generally designed to keep government records open. It allows public access to government records thus facilitating some level of public scrutiny of government agencies. It was not designed or intended to facilitate the building of databases of personal data. The act of applying for or utilizing a driver's license as an ID does not mean an individual has waived their right to privacy. It does mean your record is going to be recorded on a publicly available data base. It does not mean you agreed to have this data combined with other data for resale. It does mean, when you use your license as an ID, that you are willing to allow whomever you presented the license to as an ID to confirm the validity of that license; but only for the purpose of the proposed transaction. This does not mean that you were willing to have the merchant accumulate data about you, much of which has nothing to do with the transaction, and then resell that data. I think we would all agree that there is a need and value of an employer checking the driving record of a new school bus driver or valet. However, the employer that performs that check was doing it for the singular purpose of employment, nothing else. They may retain the data as part of your personnel record, but they certainly should not be reselling the data.

It appears to me that trying to bar governments from providing data to third party users is not going to be successful. It runs contrary to the principal of freedom of information and creates a situation where government becomes very closed and dangerous and has little public scrutiny. Therefore, the control has to be on the acquirer. I would suggest that acquirers of personal data should be (1) prohibited from using the data obtained except for the express purpose that was originally authorized by the individual, (2) prohibited from reselling any data they have obtained unless it is stripped of personal identifiers (this is not to infer that services that provide access to public databases would be prohibited from doing so) and (3) lastly, if the acquirer of personal data maintains their data either manually or electronically, that the individual has an absolute right of access and correction. This is essentially how automobile insurers have functioned in Massachusetts for a long time. To my knowledge, we have never received any complaint about an individual's privacy being violated by the access that has been provided to these companies (we have received complaints about incorrect or inaccurate records, all of which have been resolved). While this is not a perfect proposal, it would go a long way towards giving the individual some rights over data that is maintained by third parties while maintaining open access to government, and in this case, motor vehicle records.

Return to the CPSR home page.