2015-01-22-dn-repo2_2.JPG

Scott Doody has been in the repo business for decades. He's been shopping for a license plate reader to make his business more efficient, but is worried that private use of the devices could be outlawed because of privacy concerns. Dennis Nett | dnett@syracuse.com

SYRACUSE, N.Y. -- Scott Doody has been trawling Central New York streets for

more than a decade, looking for cars to repossess. To keep up with the times, he

wants to buy an automatic license plate reader.

The fast-action, car-mounted camera can take more than 100 pictures of license plates every minute, sorting them against a database of cars slated for repossession. The technology, a staple in law enforcement, has become expected in his business. It makes a repo man's job of fishing for cars in a vast sea easier.

"Every repo company either has them or is considering them," Doody said. "The more plate readers there are out there, the better it is for the industry."

That's because the repo men share data with each other, for a fee, through a network.

But the sharing doesn't stop there.

The largest database of license plate scans - 2 billion records and growing - is owned by a private company that boasts it has eyes in every city in the U.S.

The license plate pictures taken by an army of repo men across the country go into that commercial database. The data, including the license plate number and where the picture was taken, is then sold again to global information brokering companies. The same companies that offer credit checks and identity protection are also selling license plate scans showing where you've been, accompanied by records about what you own, where you live and who you know.

The data's life becomes endless in systems where license plate records are bundled with other personal information and sold, over and over.

The practical uses of the data are both infinite and chilling, said Jennifer Lynch, an attorney with the Electronic Frontier Foundation.

Insurance companies, for instance, can buy access to the license plate scans. Car insurance companies, Lynch said, could see where you've been and decide you have a higher risk based on the neighborhoods you frequent. Lynch wasn't certain whether insurance companies are using the data this way.

"I would definitely be concerned with insurance companies getting access to this," said Lynch, whose San Francisco-based nonprofit focuses on preserving privacy in the digital age.

The data has endless possibilities. Potential employers could run background checks and see what bars you've been parked near. A life insurance company could see that you like CrossFit, a workout regime that can have a high injury rate, by looking at data that shows your car is frequently parked in the gym lot. Your spouse's divorce lawyer could see that you've been visiting the same hotel every third Thursday.

As state legislatures wrestle with limiting how long government can stash away piles of license plate data about law-abiding citizens, private companies are building massive databases of the same records, largely unchecked by federal or state law.

Most states and civil liberties organizations have focused their concerns about license plate readers on police use and how long police agencies keep the data. There, the debate is clearly outlined: Lawmakers must weigh the invasion of privacy for law-abiding citizens against law enforcement's ability to quickly solve crimes and find missing people.

In private industry, the data is used for everything from risk management to background checks. Insurance companies, lawyers, private detectives, risk management groups and mortgage companies are among the industries that can see where you've been. They can easily and legally see license plate data that's been combined with a pile of other personal information, including driving records.

Your records meet Big Data's First Amendment Right

Companies that collect the data are operating in a virtual Wild West. There are almost no laws regulating who can collect license plate data and what can be done with it. In Syracuse, for instance, Destiny USA is collecting license plate data from the mall parking lots.

Whenever someone tries to make a law, big data businesses fight back with lawyers and an unusual weapon: the First Amendment. They argue that because license plate data starts as a snapshot on a public street, your records are their right.

The largest private database of license plate records is owned by Digital Recognition Network, also known as DRN. DRN serves private industry, but also collects data that's used by law enforcement. It's sister company, Vigilant Solutions, provides license plate technology and data to law enforcement.

To keep the data piling up, DRN has contracts with 550 companies that hunt the streets across the nation with car-mounted, fast-action cameras.

When lawmakers in Utah and Arkansas tried to stop DRN, the company filed First Amendment lawsuits.

Utah lawmakers backed down under the legal pressure. Following the lawsuit, the governor and lawmakers amended the restrictions to give private companies carte blanche: They can collect plate records at will and keep them as long as they like. The suit was dismissed in April.

DRN is still fighting in federal court against Arkansas' attempt to restrict plate hunting.

"The whole notion that there is a privacy concern ... is just not valid," said Brian Shockley, Vigilant's vice president for marketing. "It's not a people. It's a license plate. It's not connected to personal information, at all."

DRN and Vigilant don't connect the data to personal information, Shockley said. That happens when the data leaves DRN's database.

The license plate data is rarely used on its own. It's combined with DMV information that identifies who owns the car. New York made more than $4.3 million selling personal DMV data this year and last, according to state contracts.

A few keystrokes and a stranger knows you

TransUnion is one of the companies that combines DMV records with license plate data and other records.

The Chicago-based company, which operates across the globe, had revenue of $1.1 billion in 2012, according to company reports.

A demo of TransUnion's top-of-the-line search showed the breathtaking speed with which a stranger can learn almost anything about you.

Type in one name. Up pops a map of where your car has been spotted over the course of the past three months. Mouse over the location and the map tells you what each place is. A few more mouse clicks show your phone numbers, email addresses, social media accounts and home addresses. Yet another few taps on the keyboard and there is social network work map, showing you, your family members, spouses, friends, acquaintances.

Just like that, a stranger--perhaps a private detective or a risk manager -- knows you well. What will you ever know about this search? Likely nothing.

TransUnion added license plate data to its list of available searches a year ago when it purchased a company called TLO. TLO's main product was vehicle location searches.

"We have created a groundbreaking new product for your investigative and risk management needs," the company's website reads.

TransUnion's spokesman, David Blumberg, said that only law enforcement or other "credentialed customers" can access reports with the license plate data. The list includes private detectives, lawyers, people who work at mortgage companies, people who work at insurance companies, people who work in risk management and people who work in fraud detection.

While access to driver's license data is restricted by federal law, license plate data is not. Blumberg said that, for now, TransUnion is applying the same restrictions to license plate data voluntarily.

He would not answer questions about what rules the company uses when operating and selling U.S. data overseas. It has operations across the globe.

So far, federal legislation has focused only on limiting law enforcement and government use of license plate readers. And that has gotten little traction.

DRN's biggest competitor, a Chicago-based company called MVTRAC, is planning to start selling data it's been piling up for the past seven years, said Scott Jackson, the company's CEO.

"We're contacted daily by Homeland Security, by police agencies," Jackson said.

Like DRN, it has repo agents fanned out across the country using license plate readers that feed MVTRAC's database.

Jackson, also a member of the American Recovery Association, a national organization that represents repo men, said the public's concerns about personal data piling up are misguided.

"I get why it could creep people out," Jackson said. But he said people should be far more concerned about how Facebook and other companies are mining their personal data through their phones.

"I was at Nordstrom the other day and I got an alert on my phone telling me I was at Nordstrom," Jackson said.

But there's enough talk about privacy concerns and license plate data to worry Doody, the Syracuse repo man who has spent months shopping for a license plate reader. He's decided to hold off on the $15,000 purchase.

"I want to make sure it's not going to get outlawed after we make the investment," Doody said.

Contact Marnie Eisenstadt anytime: email | twitter | 315-470-2246