State investigates privacy concerns at Chicago movie theater parking garage
CHICAGO (CBS) -- Here's a story with more plot twists than a Hollywood who-dun-it playing on the big screen.
The drama plays out at a Northwest Side movie theater -- not in one of the auditoriums but in the parking lot out back.
CBS 2's Lauren Victory is always investigating, and this one could even stump Sherlock Holmes.
"You didn't see this big red sign?" CBS 2 asked Jake Pikula, pointing to a large red warning about parking charges at the lot for the Regal City North movie theater at 2600 N. Western Ave.
Pikula said he missed the sign and several others when he came to enjoy a movie recently. To be clear, this is not a story of people complaining about a lack of free parking.
"I have no problem paying for parking," Pikula said.
Neither does Alex Levin. Both men parked in the lot recently. Both are long-time customers who enjoyed free parking during the pandemic. In July, both got a surprise text message from ABM Parking and Regal Cinemas informing them they forgot to pay for parking.
"Very surprised when I got the text message," said Levin, who clicked on the link within the text message to find photos of his car and license plate along with a notification of an $80 charge. If he had properly paid the day of, he would've owed less than $10. That's not the problem.
"I don't know how they got my phone number and first name off the license plate," said Levin who showed CBS 2 the personalized message that began, "Hi Alex!"
"It just felt really creepy," said Pikula -- whose parents actually received the message. They own the car he drove to the theater and were nowhere nearby when Pikula parked in the lot.
"How did they get my dad's phone number? That's my biggest question," said Pikula. "That's really weird."
He and Levin are not alone in their concerns. CBS 2 discovered multiple comments in Google reviews for the theater that raise questions about how the parking lot is able to connect a license plate to an individual, then find that person's cell phone number to send the dreaded text.
How is someone connecting license plates and cell numbers? CBS 2 tried for days to figure out the puzzle, and the number of people involved seemed longer than the credits at the end of a blockbuster.
ABM operates the parking lot, and CBS 2 saw signs there with small print informing people about "plate recognition enforcement cameras in operation." But when initially pressed for details about what ABM uses to cross reference plates with vehicle registration data, ABM directed CBS 2 to a third party it uses called Flash Parking.
Flash referenced yet another third-party vendor when it sent a statement saying in part, "…Flash uses industry standard License Plate Recognition (LPR) technology to match license plates with vehicle registration information using Parkpliant, a third-party parking compliance vendor that understands and abides by applicable privacy laws."
Parkpliant, whose LinkedIn page says it leverages "multiple databases" to "obtain vehicle information," told CBS 2 it "utilizes similar techniques to obtain data for breaches of signage terms similar to camera operated toll roads that operate in Illinois."
CBS 2 repeatedly asked where the vehicle registration data comes from in the first place. None of the three companies would provide specifics. It should be noted that the keeper of vehicle registration data is the Illinois Secretary of State's Office. A state spokesperson denied the information came from them. Plus, vehicle registration data maintained by the State does not contain cell phone information.
CBS 2 tapped two computer engineering professors to weigh in.
"I should have the right to know what's being done with my data, how long it will be stored, who will have access to it," said Vivek Srikumar, an artificial intelligence researcher at the University of Utah, who is concerned about the security of the "multiple databases" being leveraged to send text messages.
Kevin Bowyer from the University of Notre Dame added, "I don't see how they're possibly doing that without some service that is provided at some point by the [Illinois Secretary of] State."
Again, the Illinois Secretary of State's Office adamantly denied selling data to a parking company. In fact, a spokesperson called the texted fines "extremely problematic."
After CBS 2 brought the parking lot privacy concerns to its attention, the Secretary of State launched an investigation, adding, "We are taking steps to address gaps in state sharing agreements to prevent abuse and prohibit the sharing and reselling of data to third parties that should not have access to it – let alone profit from it – in the first place."
"Kind of feels like an invasion of my privacy," said Levin.
There's a federal law in place to protect things like car records: the Drivers Privacy Protection Act, or DPPA. It provides very limited use of motor vehicle records to prevent bad actors from using a license plate to track people down. There are exceptions for legitimate government functions, insurance companies, or if you have the consent of the individual, but there doesn't appear to be an exception for private parking lot operators that would allow a company to use private registration data to text car owners of non-payment.
ABM and its third-party partners could not say which legal reason allows the companies to text someone to pay up for parking, but spokespeople insist their business practices follow the law. After going back and forth with the multiple companies several times, CBS 2 received the following as a final statement on behalf of ABM, Flash Parking and Parkpliant:
"Multiple nationwide data providers are used by our service partners in compliance with federal, state, and local laws to facilitate the process of contacting those in violation of the posted signage terms and conditions for the facility. While newer to some communities, the technology used to support gateless parking is becoming more common across the parking industry. While we recognize some may prefer a more traditional approach without such connectivity, this offering has proven largely popular with drivers for its convenience and speed of entry and exit from parking facilities. We continue to study and welcome feedback through customer surveys to guide the experience we provide."
"I will not be coming back to this movie theater," said Levin. Pikula also says it's "the end" for his trips to the Northwest Side Regal movie theater.
