Privacy concerns at Chicago movie theater parking garage prompt proposed law change
CHICAGO (CBS) -- CBS 2 set out to solve a movie theater mystery a few months ago that led to a full-blown investigation by the State of Illinois over privacy concerns.
The drama's only intensified.
Not only did CBS 2 hear from more upset customers, but also from the Illinois Secretary of State, Alexi Giannoulias. CBS 2's Lauren Victory explained how her reporting inspired action that'll affect everyone in the state.
A story about a movie date gone sideways popped into CBS 2's inbox one day from Henry Villa.
"There was no way I was paying that fee," Villa said, talking about a fine he received after visiting the Regal Cinemas on Western Avenue in Chicago.
He said he never saw the signs about penalties for unpaid parking in the theater's garage. The car he shared with husband Matthew McNally was caught on camera by garage license plate readers. What would've cost them $4 to park ballooned to an $80 fine, then more.
"They're saying a balance is due of $240," said McNally, reading from a letter on behalf of the parking garage operator, ABM Parking. The letter informed the couple they were sent to collections.
"It was just one of those things like I couldn't figure out for the life of me, even after reading the letter, like, where is this from?" said McNally.
Also confusing: why the notice for a Chicago garage was sent to McNally's mother's house in Evergreen Park. Momma McNally was not on their date, but some fancy technology was.
ABM Parking Services acknowledges on its signage that "plate recognition enforcement cameras" are in use in the garage.
"I get reading people's license plate numbers and looking for people with arrest warrants. But, that information shouldn't be able to be used for parking tickets like this," said McNally. "Now they know what car I drive? Just because I parked in a parking garage?"
"It just felt very creepy," said Jake Pikula, who had a similar experience at the same theater.
CBS 2 reported in August how a text that said it was a parking fine from ABM went to Pikula's dad, David. Again, it was Jake, not David, who drove to the movies and left without paying for parking.
VICTORY: "What are some of the questions popping up in your mind?"
JAKE PIKULA: "First of all, how did they have my dad's phone number?"
How is the garage matching license plates with people's cell phone numbers and addresses? Where are they getting private information?
ABM Parking Services and its third-party vendors (Parkpliant and Flash Parking) passed that question off to each other but never answered it clearly except to claim what they're doing is legal.
Some customers aren't buying it with more than 40 of them complaining about parking fees and/or privacy on Yelp. Multiple reviews cited CBS 2's previous investigation.
"I think it's crazy," said Illinois Secretary of State Alexi Giannoulias, reacting to CBS 2's August report during a sit-down interview in late November.
Giannoulias said the report led his office to launch an investigation into how the Chicago parking garage is able to text or mail fines to customers without people agreeing to provide that information. Giannoulias said the Illinois Attorney General's Office is now involved in the case.
"People across the State should be as outraged as I am based on your important story of bringing this to light," he said.
In theory, we're told the main collectors of private information that could link a person to a license plate to an address are municipalities with city sticker programs, car dealerships, and the Secretary of State's office. Cell phone numbers are not part of the data the state collects.
"Most of the sharing of data is for important purposes," Giannoulias said, referring to the fact that his office generates about $46 million a year for the state by selling vehicle registration and driver information to more than 1,300 hundred purchasers.
"We share it with the court system. We share it with the States Attorney's Offices," he said, adding tow truck companies, insurance providers, several cities, and multiple collection agencies to the list.
Everyone who buys data from the Illinois Secretary of State's Office must sign an agreement.
An example access agreement was provided to CBS 2 through a public records request. In bold, it reads, "Purchasers agree that information received shall not be made available to other persons, firms, corporations, partnerships or other entities without the prior express written consent of SOS, except as authorized by this Agreement."
"They're [purchasers] not allowed to share that with another party, and what they're doing is, they're doing it anyways, we're finding out," said Giannoulias, who said CBS 2's report prompted his office to tighten up language in the access agreements.
"[The CBS 2 story] made us work harder to go after these shared agreements and take a look at who is doing this unlawfully," he said.
Only 13 of the 1300-plus data collectors that sign access agreements with the Illinois Secretary of State are authorized to resell the information. That re-sale and any use of driver/vehicle information, for that matter, needs to be done under the guidelines of the Driver's Privacy Protection Act (DPPA), which allows driver and vehicle data to be shared for specific reasons.
We found some DPPA examples on an Illinois Secretary of State Information Request Form:
- "For use in connection with matters of motor vehicle or driver safety and theft."
- "For use by an insurer or insurance support organization or by a self-insured entity or its agents, employees or contractors in connection with claims investigation activities, antifraud activities, rating or underwriting."
- "For use in providing notice to the owners of towed or impounded vehicles."
CBS 2 asked multiple times, but none of the companies connected to the Chicago parking garage could provide the DPPA reason that would allow a business to scan license plates, match it to a person's private information then text or mail that person a parking fine.
Not one of the businesses involved, ABM, Flash Parking, or Parkpliant, was approved by the Illinois Secretary of State's Office to access state vehicle registration data. The companies might have sourced the information from somewhere else, but from whom? CBS 2 asked that same question, over and over, for months. We're not the only ones looking for an answer.
Giannoulias said his office sent multiple interrogatories to all three companies after CBS 2's first story aired. He said his investigators have gotten little to no cooperation from any of them.
In the meantime, CBS 2 wondered about websites that advertise vehicle registration information available for a fee. After entering only a license plate number, one website spit out the owner's name, current city and the SUV's VIN for $2.95.
Giannoulias said websites like that are most likely not authorized to have that info.
Who could be sharing private information that they're not supposed to is one question. Another: how to prevent it from happening again.
Giannoulias said CBS 2's investigation lit a fire in his office regarding legislation already under consideration.
"It was a great reminder of what's happening across the city, across the state, and it shows evidence that this information is being used unlawfully," he said.
Giannoulias plans to file a bill in Springfield next month that will make it a crime to sell or pass along vehicle and driver information without authorization from the Illinois Secretary of State's Office.
"What we want to avoid and what's important to me, is making sure that this private, personal information is not in the wrong hands," said Giannoulias.
The bill goes beyond punitive measures.
If passed, new and used vehicle dealerships would be prohibited from selling or misusing personally identifying information obtained from customers during a transaction. Violators would risk losing a dealership license.
Also under the soon-to-be proposed law, the 13 entities permitted to resell information would be required to submit written contracts to the state from anyone purchasing data from them.
The bill would amend the DPPA reasons someone could request information from the state, too. Of note, private investigators would be removed from the list.
"So that someone who has been a victim of domestic abuse, for example, their information can't be handled by a private investigator who's been hired. Someone finds out where their address, their phone number and all their personal information is. We have to protect these individuals," said Giannoulias, explaining why specifically "private investigator" would no longer be a permitted reason to access state vehicle and driver data.
Back to Villa and McNally, the Chicago moviegoers who said they weren't happy with their unexpectedly expensive date thanks to the $240 parking fine.
"If you're gonna track me down, then I'm gonna track you down," said Villa who told he us he called, texted and emailed people working for the parking garage operator and finally got a hold of a higher-up. "Instead of giving up, I kinda went a little crazy."
That person wouldn't void the fee, Villa said, until he asked a pointed question: "How are you getting this consumer data?"
After that, his $240 fine was canceled.