California Makes $50 Million Annually Selling Your DMV Data

from the dysfunction-junction dept

Earlier this year leaked data revealed that the Department of Motor Vehicles in numerous states has spent years selling citizen data to a laundry list of third parties, often without making such financial relationships or data transfers clear to patrons. Some of the data wound up being sold to the usual suspects (auto insurance and credit reporting companies being the most obvious), but much of it is routinely sold to more dubious third-party outfits and private investigators, which fairly obviously poses a risk to folks dealing with stalkers and psychotic exes.

A new report this week revealed that the California DMV alone is making $50 million annually selling this data to a laundry list of companies and third parties:

"In a public record acts request, Motherboard asked the California DMV for the total dollar amounts paid by commercial requesters of data for the past six years. The responsive document shows the total revenue in financial year 2013/14 as $41,562,735, before steadily climbing to $52,048,236 in the financial year 2017/18.

The document doesn't name the commercial requesters, but some specific companies appeared frequently in Motherboard's earlier investigation that looked at DMVs across the country. They included data broker LexisNexis and consumer credit reporting agency Experian. Motherboard also found DMVs sold information to private investigators, including those who are hired to find out if a spouse is cheating. It is unclear if the California DMV has recently sold data to these sorts of entities."

Granted all of this is perfectly legal due to the Driver's Privacy Protection Act (DPPA), a 90's law that critics say is in dire need of an update. That law was created in response to a series of abuses of DMV data, including the 1989 murder of actress Rebecca Schaeffer, after her killer obtained her home address from the DMV. And while the law was intended to stop the abuse of DMV data, it contained (surprise!) plenty of intentional loopholes making it okay to sell this data to a wide variety of individuals, including PIs, bail bondsmen, and consumer credit reporting agencies.

While the data sold can vary from state to state, it generally includes names, addresses, zip codes, dates of birth, phone numbers, and email addresses. Past leaks have shown that the Wisconsin DMV, for example, has personal data sales relationships with more than 3,100 different entities, and that the sale of this data is hugely profitable. California, for its part, insisted that it was doing everything it could to ensure this data isn't abused:

"The DMV takes its obligation to protect personal information very seriously. Information is only released pursuant to legislative direction, and the DMV continues to review its release practices to ensure information is only released to authorized persons/entities and only for authorized purposes. The DMV also audits requesters to ensure proper audit logs are maintained and that employees are trained in the protection of DMV information and anyone having access to this information sign a security document."

But if you hadn't noticed by now, these kinds of promises, be they coming from the DMV or Equifax, haven't been worth all that much. And when and if the data is leaked and abused, the penalties are usually a far cry from the profit made from selling this kind of data in the first place.

Filed Under: california, dmv, privacy, profit, selling information

Giant UK Pharmacy Fined For Selling Patient Data To Scammers

from the well,-well... dept

Lots of people talk about internet companies "selling" user data, and in many cases it's massively exaggerated. Often, what people think is selling data is something else entirely, such as targeted advertising, where no information goes back to the advertiser. For example: just try to go to Facebook or Google and "buy" someone's data. It can't be done. You can place ads against certain profiles or keywords, but you don't get back any data about the people who are being advertised to. That's not "selling" their data. However, that doesn't mean that some companies aren't selling people's data, and doing so in sketchy ways. And it appears that the UK's largest online pharmacy, Pharmacy2U, has now been been fined £130,000 not just for selling patient data, but for selling it to scammers.

The details show that Pharmacy2U did a deal with a marketing firm called Alchemy Direct Media to "rent" its customer list, and they seemed to not just reveal all sorts of private information about patients, but to then directly sell it to scam operations:

The Pharmacy2U database lists were advertised for rental on the Alchemy website. The data card for Pharmacy2U states that the data includes 77,621 0-12 month “buyers” and 36,207 13-24 month “buyers”. It also states that buyers include NHS patients, Pharmacy2U online patients and Pharmacy2U retail customers. It lists typical ailments that are treated including asthma, high blood pressure, diabetes, heart disease, high cholesterol, Parkinson's disease, epilepsy, erectile dysfunction, hair loss, weight loss, travel health, skin conditions, pain, migraine, cold and flu and nicotine replacement for smoking cessation. It also includes an age breakdown which shows that 82% of the buyers are over the age of 40. The cost is listed as £130 per 1000 records.

In November and December 2014, Alchemy supplied a total of 21,500 Pharmacy2U customers’ names and addresses to three organisations: Griffin Media Solutions, an Australian lottery company (“the lottery company”) and Camphill Village Trust Ltd.

On 20 November 2014, Griffin Media Solutions ordered 13,000 records on behalf of its client Woods Supplements (10,000 records plus a 30% oversupply to allow for duplicates). The data related to customers who had used Pharmacy2U within the previous 12 months. The order was approved by a senior executive of Pharmacy2U.

Woods Supplements is a trading name of Healthy Marketing Ltd, a Jersey-based mail order company. It sells health supplements to the general public via its website (www.woodshealth.com) and through mail order catalogues. Users of the website can search for an ailment (e.g. high blood pressure, high cholesterol, erectile dysfunction) and receive a list of recommended products. Some of the product descriptions highlight the side effects of the commonly prescribed drugs whilst stating that their products have fewer or no side effects.

[....]

On 9 December 2014, the lottery company ordered 3,000 records relating to males aged 70 or over who had used Pharmacy2U within the previous 6 months. The lottery company provided a copy of the proposed mailer and a corporate profile pack to Pharmacy2U which included a copy of their mail order lottery licence and a letter from the Northern Territory Government.

The mailer was headed “Declaration of Executive Order” and went on to say that the recipient had been “specially selected” to “win millions of dollars”. The mailer contained a form which recipients were asked to complete and return within seven days along with payment of an unspecified sum of money by cash, postal order, cheque or credit card. The form also requested date of birth, email address, telephone number and mobile number.

A senior executive of Pharmacy2U approved the order with the words “OK but let’s use the less spammy creative please, and if we get any complaints I would like to stop this immediately”. The data was sent to Australia.

Yes, it seems pretty clear the Pharmacy2U exec knew exactly what was going on, but still approved the sale of the data. "Let's use the less spammy creative please" is pretty damning. As ICO's deputy commissioner David Smith noted in a statement, it's somewhat astounding that Pharmacy2U didn't realize that it shouldn't be selling patient data:

ICO deputy commissioner David Smith said: "Patient confidentiality is drummed into pharmacists. It is inconceivable that a business in this sector could believe these actions were acceptable. Put simply, a reputable company has made a serious error of judgement, and today faces the consequences of that. It should send out a clear message to other companies that the customer data they hold is not theirs to do with as they wish.

"Once people's personal information has been sold on once in this way, we often see it then gets sold on again and again. People are left wondering why so many companies are contacting them and how they come to be in receipt of their details."

And, of course, Pharmacy2U put out a bland PR/lawyer-approved statement that is ridiculous on its face:

Daniel Lee, managing director of P2U, said: "This is a regrettable incident for which we sincerely apologise. While we are grateful that the ICO recognises that our breach was not deliberate, we appreciate this was a serious matter.

"As soon as the issue was brought to our attention, we stopped the trial selling of customer data and made sure that the information that had been passed on was securely destroyed. We have also confirmed that we will no longer sell customer data.

"We take our responsibilities to the public very seriously and want to reassure our customers that no medical information, email addresses or telephone numbers were sold. Only names and postal addresses were given, for one-time use.

"Following this incident, we have changed our privacy policy to highlight that we will no longer sell customer data and have implemented a prior consent model for our own marketing. We hope that this substantial remedial action will reassure our customers that we have learned from this incident and will continue to do all we can to ensure that their data is protected to the highest level."

Not deliberate? Only in the most narrow sense. The Information Commissioner's Office notes that Pharmacy2U was negligent in its actions, and "ought to have known that its customers had a reasonable expectation of confidentiality" in doing this. It also noted that "the senior executive of Pharmacy2U must have known" that people wouldn't like the sale of their data, because of his statement about the "less spammy creative" as well as the warning that "if we get any complaints I would like to stop this immediately." The report also notes that Pharmacy2U must have known substantial damage would likely occur: "it should have been obvious to Pharmacy2U that such a contravention would be of a kind likely to cause substantial damage or substantial distress to the affected individuals." In addition, the Commissioner found that Pharmacy2U "failed to take any" of the necessary steps to prevent this from happening.

However, despite all of that, the ICO still said that this was not "deliberate" because it did not appear that Pharmacy2U deliberately tried to violate the Data Protection Act. It was just negligent in doing so.

To be honest, the actual fine here seems like a slap on the wrist for something so blatant. Again, lots of people think that every company out there is "selling their data," but it's very rarely the case. Unfortunately, it's likely that the perception that everyone is selling everyone's data contributed to this ridiculous situation in which actual data (including private medical information) was actually being sold.

Filed Under: data, health information, pharmacy, scams, selling information, uk
Companies: pharmacy2u