Already besieged by problems including long wait times, the California Department of Motor Vehicles on Tuesday said it suffered a data breach in which federal agencies, including the U.S. Department of Homeland Security, had improper access to the Social Security information of 3,200 people issued driver’s licenses.
Notices of the data breach went out to those whose Social Security information — including whether or not a license holder had a Social Security number — was accessed during the last four years by seven agencies, including the Internal Revenue Service, the Small Business Administration, and district attorneys in San Diego and Santa Clara counties.
Some of the data were accessed as part of investigations into criminal activity or compliance with tax laws, officials said.
The issue was discovered by the DMV on Aug. 2 and access to the information was cut off, officials said. The disclosure of the information did not involve hacking or sharing information with private individuals, according to DMV spokeswoman Anita Gore.
“Protection of personal information is important to DMV, and we have taken additional steps to correct this error, protect this information and reaffirm our serious commitment to protect the privacy rights of all license holders,” Gore said. “That’s why DMV immediately began correcting the access error following a legal compliance review, ensured that no additional confidential information was disclosed to these entities, and has implemented several additional layers of review.”
The data breach is a particularly sensitive issue because California lawmakers decided in 2013 to issue driver’s licenses to immigrants in the country illegally who can provide proof of identity and California residency. State officials have promised that information on those license holders would not be shared with federal immigration officials.
The information shared with the seven outside agencies included whether a license holder had a verified Social Security card or was ineligible to be registered with Social Security, officials said.
The agency said 88 people who received or applied for an AB 60 license without proof of legal status had their information accessed. Six of those whose information was accessed by Homeland Security had applied for or received an AB 60 license.
One immigrant rights advocate noted that only a small number of AB 60 license holders are affected.
“There are presently over 1 million people who have successfully and safely obtained an AB 60 driver’s license in our state,” said Layla Razavi, policy director of the California Immigrant Policy Center. “If you are not one of the ... individuals who received this notice from the DMV, then you were not impacted by an unauthorized disclosure.”
The San Diego and Santa Clara district attorney offices accessed information in 3,000 of the cases announced Tuesday, officials said.
The letter to customers notes that state law requires notification of “unauthorized acquisition of computerized data that compromises” the confidentiality of personal information.
“We sent this letter and the attached notice to you based on having, in the past, shared your Social Security information in error,” wrote Albert C. Hwang, the DMV’s chief privacy officer.
The controversy comes as the DMV has been struggling in the last year to overcome a series of problems, including hours-long wait times at some field offices, computer crashes and mistakes in automatically registering people to vote.
In July, Gov. Gavin Newsom hired tech industry executive Steve Gordon as director of the DMV — its third in a year — to modernize and streamline the agency so that it can more efficiently and securely serve customers.
At the time he announced the appointment, the governor said: “People are outraged by their experience at DMV.”
The new problems come just months after a state audit in March found “significant deficiencies” in DMV operations, including technology and staffing problems and poor management practices.
The long wait times have also been blamed in part on the federal requirement that the state issue a Real ID, a new driver’s license and identification card required for airline passengers flying domestically starting in October 2020. Officials estimate up to 28 million Californians may apply for the card in the next year, officials say.
The DMV has also faced criticism for glitches in its “motor voter” program. The agency acknowledged tens of thousands of errors as people were unknowingly registered to vote or mistakes were made in their registration status.
The agency has 9,711 employees, 172 field offices and a $1.3-billion budget, and is tasked with licensing 27 million drivers and registering 35.7 million motor vehicles.