Driver privacy bill targeting penny sales to refuel after idling this year

A sweeping proposal to curb Florida’s lucrative sale of driver data died unheard this year, but its House sponsor says it will return next Session stronger and more targeted.

Committee leaders declined to hear HB 357, dubbed the “Driver Privacy Act,” by Highland Beach Republican Rep. Peggy Gossett-Seidman, who plans to spend the Summer refining it with state agencies and industry stakeholders before reintroducing it in 2027.

“It needs a lot more work and deeper dives,” she told Florida Politics. “Every time I went to research it, it took me further. People talk about rabbit holes. This is like mammoth caves. There are so many people and entities involved.”

HB 357 and its upper-chamber companion (SB 942) by Miami Republican Sen. Alexis Calatayud aimed to expand confidentiality protections for personal information held by state and local Departments of Motor Vehicles (DMV).

The bill would amend Florida’s public records law to bar the sale or sharing of motor vehicle record information, as defined by the federal Driver’s Privacy Protection Act (DPPA), to marketing firms, debt collectors, insurance companies, data brokers, foreign countries of concern and foreign principals.

It would also make confidential email addresses, emergency contact information, secure login credentials, IP addresses, geolocation data and public-facing portal access logs collected by the Department of Highway Safety and Motor Vehicles.

Violations would be punishable as noncriminal infractions carrying fines of up to $2,000 for unauthorized data use.

Central to debate over the legislation and the privacy matters it concerns are so-called “penny sales,” bulk data transactions in which companies pay as little as 1 cent per record access.

Gossett-Seidman said she was told directly by representatives of LexisNexis, one of the nation’s largest data brokers, that the company spent $37 million last year alone on Florida penny records. A purchase package she reviewed also included Experian and Accenture as big buyers.

Between 2021 and 2023, Florida collected $263 million selling DMV data, with LexisNexis alone spending more than $90 million during that period. Gossett-Seidman said the state has generated more than $490 million from such sales since 2013.

The practice is widespread nationally. InvestigateTV reported in October that 23 states collected at least $282 million from DMV data sales to hundreds of companies. Georgia led with more than $53 million, followed by California at $49 million, Indiana at $25 million and Ohio at $20 million. Delaware, Wisconsin and Wyoming reported offering consumers limited opt-out options in certain situations.

The DPPA, enacted in 1994 after actress Rebecca Schaeffer was murdered by a stalker who obtained her address through California DMV records, restricts public access to driver information. But it contains 14 “permissible use” exceptions that allow insurers, private investigators, debt collectors and others to obtain records under certain conditions.

Gossett-Seidman said those may function as a broad opening through which data can be accessed at scale.

“We have no roadblocks,” she said. “Someone from anywhere can say, ‘For 1 cent each, I’ll take X amount of records. I’ll take 10,000.’”

The issue has also prompted litigation. In 2020, then-Attorney General Ashley Moody secured a nearly $10 million settlement with LexisNexis over underreported and improperly withheld revenue from DMV crash report sales. The company has also settled class-action cases in other states involving crash report data, including $5.1 million in North Carolina over allegations it improperly sold accident reports to law firms for marketing purposes.

In recalibrating her bill, Gossett-Seidman said she is striving to strike a balance between privacy and legitimate use. Insurance underwriting, accident reporting, vehicle recalls, interstate data exchanges and law enforcement investigations all depend on access to accurate driver records.

“Our data at the DMV, which we require to drive, is necessary to share with certain entities, absolutely,” she said. “But we need to look at the line to third parties. We do not have control of where our stuff goes. That is what we have to rein in.”

She said she has spoken with the Governor’s Office, Senate and House leaders, and officials at the Department of Highway Safety and Motor Vehicles, which has explored filtering mechanisms to screen out bad actors.

A future version of the legislation, she said, should establish clearer stopgaps to prevent downstream resales, limit transfers to foreign principals and create an opt-out option so Floridians can control how their information is used.

“We don’t have an opt-out now,” she said. “People should be able to choose that.”

Despite not seeing a single hearing, HB 357 recorded more than 30 registrations from lobbyists representing data brokers and insurance industry interests, including State Farm and the Consumer Data Industry Association.

Calatayud, who called Gossett-Seidman “the driving force” behind this year’s legislation, said she isn’t sure whether she’ll carry its Senate sequel.