By Shane Peterson |News Editor
Private vendors entrusted with dispensing drivers records to insurers are taking some off-road routes with that data, but several states are putting up roadblocks, with the latest being Washington.
On June 13, the states Department of Licensing terminated its contract with the Insurance Information Exchange (iiX). An investigation of the companys handling of Washington residents drivers records discovered that the company was selling drivers information in violation of state policy, state official say.
"We will not tolerate the illegal distribution of personal and private information," said Gov. Gary Locke at the time. "This termination is the proper response to this abuse, and we are evaluating our options for further legal action."
According to Linda Moran, senior assistant attorney general of the licensing and employment security division, who serves as general counsel of the DOL, the company could face gross misdemeanor charges under Washington statutes for the unauthorized disclosure of drivers records.
Government Technology ran a check on one of its own writers to find out just how easy it is to obtain the personal information. Its pretty
easy.
A Government Technology staffer asked columnist George Lindamood, who lives in Washington, for permission to look up his driving record, which Lindamood granted, providing his drivers license number and his date of birth, both necessary to order the information.
The staffer used editor Wayne Hansons credit card without indicating to the vendor that he was Hanson, or was acting with Hansons authority -- effectively posing as Hanson -- and visited one of the Web sites mentioned in the Washington DOLs investigative paperwork to request the writers drivers record.
No reason for the request was given, and the company responded in about a week with Lindamoods drivers record, which provided his home address and driving record, including infractions and accidents.
Lindamood noted that privacy is all but dead in the Information Age. "Im not at all surprised that Government Technology was able to obtain this information," he said. "My wife is more upset than I am."
When Department of Licensing officials learned how easily the data was obtained, they were not happy and said more stings are already under way. "We shut down the iiX and [the company that furnished the writers drivers record] was a subscriber of the iiX, so that company was shut down to access as well," said Denise Movius, assistant director of the DOLs drivers services division. "This leads us to believe the company contracted with another source."
Anatomy of a Sting
DOL spokesman Mark Varadian said the DOL notified the iiX back in 1998 that one of its subscriber companies was improperly distributing drivers records, adding that the company responded by assuring the DOL that the improper distribution would stop. The DOL then inserted a clause into its contract with the iiX that stipulated that the
department would have the option of auditing the company.
In February, the DOL discovered that a Web site was offering Washington drivers records. "It occurred to us that the only place that [these records] could be coming from out of Washington records must have been the DOL database," Varadian said. "That concerned us greatly. So,
without knowing at that point which service bureau would be involved, we went ahead and created three fictitious records in the database. We then went back onto the Web and into a couple of these Web sites and requested information on these fictitious records."
Staff from the DOL didnt identify themselves as employees of the department and didnt supply information that justified the release of the records. "At the back end, we were watching to see who was accessing those records and what service bureau that request was coming through, and thats what led us to the iiX," Varadian said.
Two companies responded to the requests, and both companies used subscribers of the iiX to furnish the records. Varadian requested that the names of the Web sites not be used in this story because the state may investigate the companies further.
Price of Privacy
The DOL terminated the contract, saying the iiX didnt ensure that its subscribers handled drivers records properly. "Their contract with us does stipulate that theyve got to guarantee that the way the data is used is correct, and its not going to be released to third parties," Varadian said. "The information has to be used in a manner thats legal and authorized. By looking over the records, we saw that that was not the case. The iiX was clearly not getting the correct certifications from their subscribers that they would need to access Washington data
according to the contract that they signed."
This situation is troublesome for states, Varadian said, because it could potentially hurt their residents wallets. "It puts us in an awkward position," he said. "We are trying to balance the protection of peoples privacy against the benefit they do receive from businesses getting that access, getting that information. If the worst-case scenario comes and you have to cancel all those contracts, youve protected everybodys privacy very well but theyre not going to be happy if they wind up paying higher insurance rates. We have to partner with these service bureaus. Theres no way around it, but, at the same time, they have got to play by the rules."
Insurance companies also feel the bite, said David Snyder, assistant general counsel of the American Insurance Association (AIA), an insurance trade organization. "DMV records are the only reliable source of prior driving experience, and insurers need access to this information in order to charge accurate rates" he noted. "Insurers have
recently used vendors more because the cost of obtaining a record can frequently be less than a dollar when obtained from a vendor, or $5 or more if an insurance company needs to design its systems and communicate directly with the DMV."
When contacted, officials of the iiX declined to comment, citing ongoing negotiations with Washington. However, according to the companys Web site, the firm began recertification of all its customers in January due to changes in state motor-vehicle-record agreements. The
iiX serves more than 20,000 insurance agents. Of those, many are sponsored for report ordering by some 450 insurance companies. These agents retrieve some or all of the reports mentioned above. Today, the iiX processes in excess of 25,000,000 report transactions each year.
"It is mandatory that iiX understand your ordering purposes for all underwriting reports, but specifically for MVRs [motor vehicle records]," the Web site informs iiX customers. Companies were supposed to return "permissible purpose" forms to iiX, which would cancel their contracts if they didnt. The forms stipulate that iiX will provide
reports for only the following purposes: underwriting an insurance policy and for end-user employment purposes with a signed consent from a prospective employee.
Driven by Demand
Like other states, Washington contracts with companies such as the iiX for a simple reason: volume. The state received 2.4 million requests for records in 1999, Varadian said. "We dont have the staff to be able to handle that many requests in a year," he explained. "Because of the
resource issue, we partner with these service bureaus, who then perform their certifications and bundle up the requests."
Washington is certainly not alone. Through June 23, Georgia had received nearly 3.5 million such requests, said Tom Bostick, executive director of the GeorgiaNet Authority.
Georgias laws on the distribution of drivers records require that no record can be distributed unless an individual gives written permission that the record be distributed, he added. "Georgia has been very restrictive," Bostick said. "We were one of the few states in which the
individual had to give written approval to access the driving record. In a lot of states, if it was for insurance purposes or to rent a car, its, No problem, here you go."
In Washington, state law defines drivers records as confidential. According to Moran, this is different from other states, in which drivers records are defined as public records. This difference means that drivers records are not available to the general public at all, only to statutorily authorized entities such as insurance companies.
The process is made more complex by the sheer number of companies dabbling in this market, Bostick said. He said the process can go as follows: A resident goes to an insurance company to request new automobile insurance; that insurance firm goes to company A to request that residents drivers record be pulled; A turns around and goes to another company, B, with the request for the record, and B goes to C -- usually the one with the actual contract with the state permitting it to pull the records -- to get the record for A.
Insurance companies need these alphabet intermediaries to cut their costs, said the AIAs Snyder. For insurance companies, iiX or Choicepoint offer an easy way to get
drivers records from all 50 states without having to go to each of the states, according to Laura Templeton, a spokeswoman for Pennsylvanias Department of Transportation.
Carrying a Big Stick?
Just who should be punished for these abuses is the big question.
"The way the relationship works is that the DOL has a direct contractual relationship with an insurance company or an agent for an insurance company," Moran said, adding that either the company or the agent could have secondary or tertiary contracts with other companies to support that direct contract with the Department of Licensing. "What
the DOL is looking at doing is creating a mechanism that would allow the DOL to audit all the folks in the chain. The only recourse the DOL has in terms of contractual relationships is with the entity the DOL has the contract with. Its the contractors responsibility to make sure that the others in the chain of contracts are abiding by the original contract.
"The policing incentive is that the entity with the contract with the DOL is at risk to not have a contract if they dont follow through and make sure everyone is doing their job," she continued. "Theres no direct enforcement mechanism between the DOL and any of these other companies in the chain."
Mike Sankey has a unique perspective on this issue -- hes currently the president of BRB Publications and editor of The MVR Book. The company publishes books and electronic products that provide exhaustive details on how to access public records in every state. Sankey was also the owner of one of the largest companies dealing in drivers records in the United States. His company, Rapid Info, which processed 400,000 records per month, was the second largest such firm west of the Mississippi.
"What happened in Pennsylvania -- and probably what has happened in Washington -- is that these companies, who are secondary sellers and signed up with iiX and signed this affidavit, lied," Sankey said. "Theyre just selling these records on the open market."
This problem is not new, Sankey said. "Everybodys been kind of looking the other way on this for a while because, for the most part, its easier for the states to allow a permissible user to get the record from the iiX instead of processing these by mail."
Sankey says fixing the problem may be as simple as knowing where the buck stops. "If I was a state administrator, Id go to the point of contact and say, You clean it up. My contract is with you, not with your customer [firms]. I think thats the way to do it."
