Immigrant advocates sound alarm on PennDOT sharing drivers’ personal info

Updated: September 10, 1:45 p.m.

Pennsylvania shares drivers’ personal information without being able to account for how it’s used, according to a new report released by Driving PA Forward and researched by students and faculty at Villanova University’s Farmworker Legal Advocacy Clinic.

Personal data shared with the Pennsylvania Department of Transportation — such as date-of-birth, address, height, eye color, photo — can wind up in the hands of federal law enforcement and private businesses without a driver’s knowledge, according to the authors, who filed multiple records requests with the state to get the information.

PennDOT confirmed parts of the report, while also saying it contains “inaccuracies.” The agency does share information in response to a “subpoena, warrant or lawful data request form,” as well as with federal law enforcement, according to PennDOT community relations coordinator Diego Sandino.

Last year, the Washington Post reported that millions of drivers’ images across the United States have been used in this way without their permission, a practice which has drawn bipartisan criticism. The rise in and unregulated use of facial recognition software has alarmed privacy advocates who say there should be more controls on personal data. The topic is of particular concern in states were driver’s licenses have been extended to undocumented immigrants. In Maryland, for example, U.S. Immigration and Customs Enforcement ran millions of facial-recognition searches for drivers after the state expanded access to driver’s licenses to undocumented people in 2013.

Driving PA Forward hopes to get a similar law on the books in Pennsylvania, but wants to avoid further information sharing with federal agents.

“Regardless of whether or not they’re going to expand licenses … there are concerns,” said Caitlin Barry, director of the Farmworker Legal Aid Clinic.

The report, which was based on information requested from PennDOT and the Governor’s Office of Administration, outlines three different ways the information travels. The first is through information requests placed directly to PennDOT.

The second is by uploading it to different state law enforcement databases, known as JNET and CLEAN.

“Once that information is placed in the databases, it may be accessed by government agencies and private businesses,” wrote the report authors.

This reference to private businesses is a point of contention between PennDOT and researchers at Villanova. PennDot disputes that any businesses have access to the information through these databases. The researchers say otherwise.

“JNET has granted access to private businesses,” wrote Barry in a follow-up email. “Their website states that [they] have provided access to 8 ‘business partners’ but they won’t disclose who they are or the purpose of the access.“

On this point the report says: “There is still no public access to the list of JNET users or the standards by which JNET grants access for individual searches.”

PennDOT sells information to private brokers, such as LexisNexis, through non-public agreements. In some cases, ICE has made arrests using information accessed through these companies. The report also points to a 2016 audit of PennDOT information shared with LexisNexis, which found some users were not filling out mandatory paperwork about how they would use the personal information they accessed, and were in some cases doing so under expired agreements.

Without that documentation, in the event of a security breach at LexisNexis, it would be hard to know whose data was leaked and to whom, the report noted.

“Pennsylvania takes its protection and stewardship of driver records very seriously and does so in compliance with all applicable laws and regulations,” said PennDOT spokesperson Sandino, in response to the report.

PennDOT was asked for comment Tuesday afternoon, and this story was updated after the agency replied late Wednesday.

Sandino confirmed that ICE has had access to the state law enforcement databases JNET since 2010, and also has access to CLEAN.

However, since Pennsylvania currently does not provide driver’s licenses to undocumented residents, he said, “the overall concern expressed – ICE access to records of undocumented individuals – is mitigated.”

Sandino said the report also conflated when information goes to a law enforcement database, and when it can go to a private business. Pennsylvania has a law on the books to regulate the sale of personal data “in specific authorized circumstances,” said Sandino.

These are some of the same laws the report authors argue should be tightened.

“The legislature should update the driver licensing laws to include privacy protections for all driver information,” they write.

The report authors also recommend PennDOT bar its information from being used to make immigration arrests, tighten who can request its information directly, and provide public updates on the “volume and nature” of the requests it receives.

The state should also place more restrictions on what information goes into law enforcement databases, and update the laws to stop information from being sold to private brokers without driver consent, they argue.

They also call for a moratorium on facial recognition searches.

“The technology itself, we know, is so susceptible to racial bias,” Barry said.

In June, there was the first known case of a person, a Black man accused of theft in Detroit, being wrongfully arrested solely on the basis of a facial recognition software match, NPR reported.

The quality of images uploaded, and what angle they were taken from, can affect the accuracy of the matches. In 2013, Pennsylvania expanded the number of images it kept in its database from 3.5 million arrest photos to more than 36 million kept by PennDOT.

Per a Right-to-Know request filed with the Governor’s Office of Administration, to use the JNET database to run a facial recognition match, a law enforcement entity must be doing so as part of a criminal investigation, or to identify someone who cannot identify themselves, such as the deceased.

However, immigration offenses are civil, not criminal. To allow ICE to access that technology, as the government said it did, thus goes against its own rules, Barry said.

“To see those standards and then to hear that it doesn’t appear that they’re actually being applied was startling,” she said.

‘Basic right of mobility’

PennDOT’s practices were discussed at a press conference Tuesday where lawmakers and immigration advocates pushed for a bill that would tighten information-sharing rules. They say personal information provided to apply for a license, including photos, should only be shared with the person who applied themselves — as required by the National Driver License Register — or in the event of a warrant or court order.

The bill would also allow undocumented immigrants to receive driver’s licenses.

That provision is on the books in New York, New Jersey, Delaware and Maryland, but often faces pitched battles to pass state legislatures. Philadelphia has a municipal ID card, a similar idea.

Supporters say the move would address the reality of unlicensed drivers, and will benefit everyone on the road.

“Pennsylvania will be more safe if everyone has drivers licenses,” said Luis Larin, statewide coordinator for Driving PA Forward. Those behind the wheel will have passed a test, and have insurance, rather than driving with no accountability.

Advocates for tighter immigration rules have long argued that such a process rewards those who break the law.

When similar legislation was introduced in 2015, Republican state representative Darryl Metcalfe criticized it, saying it was wrong “to accommodate … people who have no right to be on our soil in the first place.”

The bill would allow Pennsylvania residents applying for a license to submit either a social security number or a tax identification number, which undocumented immigrants who pay taxes receive.

This was the reality in the state until 2002, when PennDOT stopped issuing licenses to undocumented immigrants. “9/11 changed everything,” Larin said.

Julissa Morales, a member of the Movement of Immigrant Leaders in Pennsylvania (MILPA), spoke at Tuesday’s press event in the courtyard of St. Francis of Assisi Catholic Church in Harrisburg. She said at 12 years old, she stood with dozens of other young people on the capitol steps in 2014 to push for access to drivers licenses for their families. The bill introduced that year died in committee.

“Me and thousands of kids had our sense of security and safety denied,” she said. “When denying a driver’s license for all, you are denying the right of all children and families to feel safe when accessing their basic right of mobility.”

Proponents are also framing the bill as a nod to essential workers. Esvin Maldonado said he wakes up at 1 a.m. every morning to work on a dairy farm and depends on others for rides.

“Without agricultural workers, it would not be possible to bring fruit, vegetables, milk and dairy products to the tables of all families throughout the country,” he said in Spanish.

Advocacy groups are promoting “40 Days of Prayer and Fasting” in support of the bill and the undocumented agricultural workers who could benefit from it.

Pennsylvania is home to around 170,000 undocumented immigrants, according to the Pew Research Center.

WITF’s Alanna Elder contributed reporting. 

This story was updated to include a response from PennDOT and corrected to clarify that the Driving PA Forward report didn’t conclusively find that social security numbers have been shared with private businesses.