Over the years, the Utah Drivers License Division (DLD) has provided the personal identifying information of 3,997,558 Utahns to the University of Utah (the U.) for research purposes without obtaining the license holders’ consent to do so. In fact, a Memorandum of Agreement between the DLD and the U. expressly prohibits the U. from telling licensees that it is using information provided by the DLD to contact them.
The Utah Legislature is now considering a bill (HB183) that would require the DLD to obtain the affirmative consent of license holders before transferring their personal identifying information to the U.
It is anticipated that the U. will oppose the bill even though the information transferred includes a person’s physical characteristics along with everything else required to steal the person’s total identity and even to access their bank accounts and credit files — drivers license or ID card number, first, middle and last name, sex, Social Security number, birth date, height, weight, hair color, eye color, birth place, mother’s maiden name, residence with up to 20 previous residences and date changed, mailing address, up to two previous names and date changed, etc.
The transfers have taken place even though 18 U.S.C. Chapter 123 prohibits the release of highly restricted personal information such as a Social Security number for research purposes without the written consent of the person whose number is being released. And the information is apparently used to contact people even though that is prohibited by federal law.
The University of Utah maintains the driver license records in the Utah Population Database along with other personal information such as birth and death certificates, Utah voter registration records, Utah divorce records, inpatient hospital claims, the Utah cancer registry, etc. The vast majority of Utahns don’t know that these records are being shared with the U.
Opponents of the release of their personal information argue that, regardless of the merits of the U.’s research, the U. does not have the right to demand that they make their personal identifying information available to the U. as a condition of receiving a drivers license.
Under the current system, the only way a person can prevent their personal identifying information from being transmitted to the University of Utah by the DLD is to forego obtaining a Utah driver license and that is simply not a realistic option. And once the University of Utah has an individual’s personal identifying information, the person cannot submit a GRAMA request to the U. to see what information it has on them. In addition, the U. refuses to remove personal identifying information from their databases even when requested to do so.
Perhaps even more grievous is that fact that even when an individual has declined to participate in a research study, they may still be included in the study because the U. obtains their information from the DLD and a wide range of other sources without their authorization.
While it may once have been acceptable for the DLD to share Utahns’ personal identifying information with the U. without first obtaining their consent this is no longer the case. Therefore, the Legislature must pass HB183 in order to stop the DLD from sharing the personal identifying information of millions of Utahns with the U. until each licensee’s explicit consent is obtained for the release of their personal identifying information.
After all, it is government’s responsibility to protect the extremely sensitive and valuable personal identifying information that it collects on its citizens, not to sell or give it to others who have the political clout to get it.
Ronald Mortensen, Ph.D., Bountiful, has written extensively on privacy issues and helped pass legislation that allows Utahns to make their voter records private.