Estimated read time: 2-3 minutes
This archived news story is available only for your personal, non-commercial use. Information in the story may be outdated or superseded by additional information. Reading or replaying the story in its archived form does not constitute a republication of the story.
SALT LAKE CITY — The Utah Driver License Division shared Utahns' personal identifying information with three state agencies in violation of state law, a new audit shows.
The state auditor's office also found the division provided three other agencies more of drivers' private data than allowed under the law.
“From our perspective, the driver license division could take steps to better protect personally identifiable information," State Auditor John Dougall said.
"In an era when the security and privacy of personal information is already at significant risk, state agencies must be careful to limit sharing of information and must review compliance with the restrictions placed on the use and storage of sensitive information.”
The driver license division may only disclose drivers' personal information when it determines it is in the best interest of public safety. The law also allows the division to provide limited information to some entities.
Auditors found the division improperly shared drivers' private information with the State Tax Commission, the Utah population database at the University of Utah and the Office of State Debt Collection.
The division also gave the lieutenant governor's office, the Utah Department of Veterans and Military Affairs, and Intermountain Donor Services more information than the law permits, according to the audit.
Improperly shared information includes names, addresses, dates of birth, Social Security numbers, drivers' licenses numbers, gender, physical characteristics, addresses of people "undecided" about organ donation and license issue dates of "individuals who have outstanding debt" with the state debt collection office, the audit says.
In a written response to the audit, the driver license division said it understands the disclosure of drivers' personal data should be limited due to the sensitive nature of the information.
But the division contends the law is open to interpretation and that the Utah Legislature should clarify the language.
Auditors recognized that interpretations could differ and agreed the Legislature should clarify the law.
The audit says the driver license division should stop sharing drivers' personal data and other information not allowed by law and where there is no public safety interest. It recommended the division tell applicants for licenses what personal information may be shared and with whom it may be shared.
The law specifically permits the division to provide drivers' private data to licensed private investigators with a legitimate business need; auto insurance companies; organ donor organizations; other states' licensing authorities; specific Utah government agencies; and the U.S. Department of Defense.
The auditor's office said it expects to release a second report on the driver license database in six months, allowing the division time to correct any issues identified in the audit.
