"The DPPA is one of several federal laws that should now be updated," Marc Rotenberg, president and executive director of privacy activism group EPIC, wrote in an email. "I would certainly reduce the number of loopholes," he added, referring to how the law might be changed.
The data sold varies from state to state, but it typically includes a citizen's name and address. In others, it can also include their nine-digit ZIP code, date of birth, phone number, and email address.
Rob Namowicz, a private investigator from Wisconsin, told Motherboard in an email he buys DMV records "to get driver license [sic] information on subjects I may be investigating."
The Virginia DMV has sold data to 109 private investigator firms, according to a spreadsheet obtained by Motherboard. The New Jersey Motor Vehicle Commission has sold data to at least 16 private investigation firms, another spreadsheet shows. The Delaware DMV has data sharing agreements with at least a dozen investigation firms, and Wisconsin has around two dozen current agreements with such firms, other documents show.
Motherboard did not obtain records from DMVs in all states, so the number of private investigators that have been granted access to citizens' data across the country is likely higher.