Since I’ve been living in Europe, I’ve been generally impressed by the attention of European states to their citizens’ rights with respect to privacy. From the mandatory blurring of faces in Google Street View images in places like Germany, which seemed to surprise many Americans, to the reaction of the European Council to legislation such as the proposed three strikes law for illegal downloads, certain provisions of the ACTA treaty and the question of protecting personal data used by mobile geolocation services, Europe seems to come down on the side of protecting citizens. Europe has a Data Protection Directive, which governs all the European member states.
France is not an exception to this rule, so when I heard a report on the evening news last week about the French government selling personal data from vehicle registration records to businesses for commercial use, I looked up the details on the Internet.
According to an article in Le Figaro, prior to 2007, the French vehicle registration database was maintained by an association under the umbrella of the Committee of French Automobile Manufacturers. This association, the Auxiliary Association of Automobiles (AAA), centralised the data collected by each Prefecture. In return, the AAA was allowed to provide the data to manufacturers. In 2007, the state took over the management of the data, which was transferred to the newly created National Agency for Secured Titles under the auspices of the Interior Ministry. The agency continued providing the data to car manufacturers, including the name, date of birth, and address of vehicle owners, as well as the type and mark of the vehicle(s) they own.
An article of the law passed in 2009, known as Loppsi 2 [link to the Wikipedia article in French], granted the government the right to sell this information. It received quite a bit of publicity in 2010 because of some other worrisome provisions of the law relating to privacy and personal liberties. The subject came up again recently because last September the state introduced new measures to provide stricter regulation of the entities to which personal data could be sold, which will be limited to licensed businesses. It isn’t clear to me what these measures are, nor what is required to qualify as a licensed business, because the legifrance.gouv.fr site is so annoying that I gave up trying to find the text of these provisions in the law.
In 2009, an opt-out box was added to the vehicle registration form. According to the article, 52% of registrants opt out, but privacy advocates worry that many vehicle owners may simply not see the box. To see if the opt-out option was obvious, I looked up the form online, and it seems quite visible to me: the three boxes with the light blue background at the bottom of the page.
Here’s a zoomed version. The text in bold at the top says “I am opposed to the re-use of my personal data for the purpose of collecting sales leads.” There are separate boxes to be checked depending on whether the person has purchased or is leasing the vehicle.
Le Figaro reported that the Interior Ministry had declined to reveal figures concerning the revenue generated by the sale of this data, qualifying the release of such data as “premature.” I find that surprising, since transparency requires such information to be available to the public eventually. Hiding information about the price is not therefore not very reassuring.
For comparison, I checked the status of protection of personal data relating to vehicle registration in the countries of most interest to me.
On the website of the Service des automobiles et de la navigation (SAN) in Switzerland where I live, it says
In the Canton of Vaud, it is not possible to obtain the address of the owner of a vehicle in a directory, via internet or via sms.
The SAN only communicates the first name, last name, and address of a person following a justified written request, in return for an administrative fee of 20 CHF.
Nevertheless, a user can request the confidentiality of his data, and in this case, only competent authorities will have access to them.
A link to an op-out request form is provided on the site, but unfortunately, they don’t say what constitutes a valid justification for requesting the data. At any rate, the 20 CHF fee per license number might be dissuasive to anyone thinking of buying data for marketing purposes.
In the US, personal information is protected by the Driver’s Privacy Protection Act (DPPA). The text can be found at the Legal Information Institute’s website and states that personal information about the owner of a vehicle may be disclosed by a State’s Department of Motor Vehicles “For bulk distribution for surveys, marketing or solicitations if the State has obtained the express consent of the person to whom such personal information pertains.” It further adds, “Nothing in this paragraph shall be construed to prohibit a State from charging an administrative fee for issuance of a motor vehicle record.” According to a CNN transcript I saw, the Florida DMV is charging $0.01 per data record.
The Constitution of the French Republique says, “Son principe est : gouvernement du peuple, par le peuple et pour le peuple.” That’s the “government of the people, by the people, for the people” Americans will recognize from Lincoln’s Gettysburg Address. How can governments reconcile that with selling citizen’s private personal data to businesses for marketing purposes? Everybody knows businesses do that, but nothing says “On s’est fait baiser” like the government doing it too.