Make state agencies acquire consent of individuals before releasing data

Make state agencies, before selling database information, acquire the consent of any individual whose data is to be released.

Many state agencies have the authority to collect data on Texas residents. In some instances, state agencies with data on Texas residents sell the information to private businesses for a profitable return without requiring consent or providing affected individuals a means of opting-out. The most visible example of data collection is the Department of Motor Vehicles (DMV), which maintains records on 22 million registered vehicles and their drivers. These records are all stored in the DMV database. The database is supposed to be protected by the Driver Privacy Protection Act, which limits who can buy the DMV’s information and what they can do with it. Yet in practice there are weak restrictions on who can purchase the information, as evidenced by the fact that the DMV sold to more than 2,500 clients in 2012 ranging from collection agencies and banks to towing companies and private investigators. In 2012, the DMV collected $2.1 million by selling information on Texas drivers from its database.

DSHS also sells “private” data. One report revealed that between 1999 and 2010, data pertaining to more than 27 million hospital visits was sold to private parties. Unlike the DMV database, information to hospital visits contains data of a heightened sensitivity, including tests and medications received. DSHS makes the data available through its website for the Texas Healthcare Information Collection Center for Health Statistics. A report detailed the frequency with which data is purchased:

According to DSHS spokesman Van Deusen, between January 2009 and July 2010, buyers paid to download 916 quarter-years of the hospital-patient Public Use Data Files years 2004 to 2009. They paid $4,600 per year, or $1,400 per quarter, for the years 2007–2009, according to the data order form. For years 2004–2006, buyers paid $525 per quarter. All buyers also paid DSHS a processing fee of $100 per quarter-year of data. (Hospitals receive discounts.)

Numerous other state agencies and departments are collecting data at an increasing rate. House Bill 2103 (83R), passed and signed by the Governor, is only one example. HB 2103 increases sharing of data among education resource centers. As data collection and sharing becomes more commonplace, protections should be implemented to ensure that private information is protected and that data is not being used for offensive and invasive purposes.

Texans should be informed that their data is being offered for sale to third parties, and sale of such data should be contingent on individual consent. One way to encourage individual consent is to offer a discount on services in exchange for consenting to release at any state agencies where data is provided, such as the DMV. If the state is profiting from the sale of data, there should be a corresponding benefit to the data source.

The Government Code should be amended with a new chapter governing personal information. It should require all state agencies, before selling database information, to acquire the consent of any individual whose data is included. Requiring state agencies to obtain consent before data may be sold has the potential to reduce revenue collections. However, this consequence should not take precedence over requiring consent for the sale of personal data that is compelled to be furnished by force of law.