Curious Iowa: What personal information is available online for free?

If you’ve ever searched your name on the internet, you likely found phone numbers, current and past addresses, and even names of family members associated with you in the results.

One Cedar Rapids resident wondered what personal information is available online for free — and what information is kept private. They wrote to Curious Iowa, a Gazette series that answers readers’ questions, to find the answers.

It’s is a timely question as Iowa’s new state consumer privacy law will go into effect on Jan. 1. Iowa is one of 19 states with signed data privacy laws.

We spoke with experts about what information is available through public records, how companies acquire personal data, and how Iowans can keep their personal information safe online.

What personal information is public — and how is it gathered?

  Buy Photo

Court records, voter registration record information, marriage licenses, birth and death certificates, and property records — including aerial and street-level photographs — are public information. Addresses and phone numbers provided on documents filed with the State of Iowa are public record too.

Additionally, there are many websites dedicated to selling personal information, like Truthfinder.com and Spokeo.com.

Dan Tuuri, information security analyst for TrueNorth Companies, said public information is readily available for appropriate uses, but the problem comes when attackers string together data from multiple sources.

“So now, if I go to a Register of Deeds, as an example, I can see the purchase price, I can see the mortgage amount, I can look at those documents by design,” Tuuri said. “But the attacker would say, ‘How do I now compile that and start to look at other sources and tell a story?’”

  Buy Photo

Sites that aggregate data collect information in various ways. Remember those long terms of use agreements you likely breeze past when signing up for a website?

“Now some companies will blatantly write in those agreements, we may decide to sell the data we collect, name, address, phone numbers, some of that stuff to these people finder sites or other informational sites,” said Brandon Potter, chief technology officer for ProCircular, a cybersecurity firm in Coralville.

  Buy Photo

Randy Evans, executive director of the Iowa Freedom of Information Council, said that when you fill out a warranty registration, for example, more data than is needed may be requested like one’s household income, how many people live in one’s house and their ages.

“And they're doing it under the guise of wanting to allow them to better serve their customers, but they're turning around and selling that to a data brokerage company,” Evans said.

He added that “there are no real restrictions being placed on the ability of companies to mine this data.”

Another way companies gather information is by using tracking cookies that build out a profile of information, like how much time was spent on a website, what terms were searched for, and what information was submitted in forms.

Social media is a gold mine of information. Even if someone’s profile is marked as private, games, groups and other add-on modules can access data.

While social security numbers, driver’s license numbers and non-operator’s license numbers are protected data, data breaches happen. This can lead to personal data being sold on the dark web — or becoming available on the public internet. If you’re notified that your data was a part of a leak, take necessary action and monitor your credit closely.

“You can freeze credit, so if that data is exposed, somebody tries to open an application or buy a car or a house, it will block that credit inquiry and it just won’t happen, right?” Potter said. “Tax fraud, we’re coming up to tax season, that identity will be used if it’s available to potentially file fraudulent tax returns, things like that.”

Are there ways to opt out?

You can opt out of people finder sites, but it’s a tedious process. If you can scrub it from one site, you’ll have to scrub it from other sites your data has been sold to. Once you’ve requested the removal of your data, you’ll need to continuously check that it doesn’t return in new places. If you delete data stored on social media platforms, it will recollect. Potter said it’s important to educate yourself and children that once it’s on the internet, it’s on the internet.

“It’s going to be too much for you to find every people site every which way with how things are connected, so focus on the ones that you engage with directly,” Potter said. “Delete the data that might be in Facebook, delete the data that might be on other social media platforms … and then just be diligent moving forward.”

Voting records are public record and Iowa law does not allow them to be made private. This information can be requested, but it can only used “to request a registrant’s vote at an election, for a genuine political purpose, for bona fide political research, for a bona fide official purpose by an elected official.” Using information from voter registration for commercial purposes is a serious misdemeanor under Iowa law.

According to the Iowa Secretary of State’s website, social security numbers, driver’s license numbers, non-operator ID numbers and the name of the agency where a voter registration form was completed are never given to anyone requesting voter lists.

Iowans who are survivors of domestic violence, sexual assault, stalking, assault and trafficking can enroll in the Safe at Home address confidentiality program. The program provides substitute addresses, mail forwarding service and confidential voter registration and absentee voting.

Tuuri said that Iowans should be aware of just how much information is available online and of the information you use to control your own identity. In 2008, Sarah Palin’s email was hacked by then college student David Kernell. Kernell, who died in 2018, was able access the then-vice presidential candidate’s account using biographical details that were easy to find online.

“So when we’re filling out an application for a new credit card or a new relationship with a bank and we’re provided the questions, you know, what was your mother’s maiden name, maybe we want to answer it with something that is a different answer that provides a greater level of security.” Tuuri said. “If I give a random string of characters that resembles a password as my mother’s maiden name, the software application doesn’t care, and now, as a result, when I need a reset, they’re not going to find that information online because it’s a different key or a different token.”

What is the Iowa Data Privacy Law?

While there are a number of federal data privacy laws in the United States, like the Health Insurance Portability and Accountability Act (HIPAA) and the Children’s Online Privacy Protection Act (COPPA), there is not a comprehensive federal data privacy rights law in place.

“I’d love to see a federal standard for privacy, so it’s not state specific … it really puts a blanket rule across that provides citizens of the United States the ability to control what information, even though they may need to submit it for something to be transparent, what can be used and what can be viewed,” Potter said. “That obviously won’t handle anything that’s on the dark web or a breach that that data gets exposed, but you being able to control what’s stored and how it’s used will minimize that risk in the long run.”

States like Iowa have reacted by passing their own laws.

Signed by Gov. Kim Reynolds in March 2023, the Iowa Data Privacy Law will allow Iowa residents access to their data and control over the sale of it. It also requires businesses to secure data and be transparent with how data is processed and whether it is shared or sold.

The law applies to a person or entity conducting business in Iowa or producing products or services targeted toward Iowans who meet a specific threshold of data of individual Iowans processed or sold in a year. The law does not apply to personal data controlled or processed by the State of Iowa and its political subdivisions, financial institutions, HIPAA-covered entities, nonprofit organizations, or higher education institutions.

When the law takes effect Jan. 1, consumers can confirm whether their personal data is being processed by an entity; get a copy of their data; delete their data; and opt out of the sale of personal data.

Iowa businesses that meet the threshold must provide all Iowa consumers with a privacy notice that includes the categories of personal data processed, the purpose for processing personal data, categories of personal data shared with third parties and who the third parties are, the consumer’s rights and the process which consumers may exercise their rights. This includes providing how consumers may appeal the business’ refusal to take action on requests to exercise their consumer rights.

How are transparency and privacy needs balanced?

While it may be unnerving to discover just how much information is public and free to access, public records allow citizens to engage with their government, Evans said.

“There are times that the public has a legitimate interest in knowing, so we ought not give in hastily to the temptation to want to make everything confidential,” he said.

He gave the example of a homeowner wanting to know whether they are being taxed differently than someone in the same city that owns comparable real estate.

“And the only way you can answer that is by readily making the ownership records, the property tax documents available to anybody who asks.” Evans said. “Before computers, if you wanted to know who owned a particular piece of real estate, you had to go to the courthouse. Computers have made it easier for us to do that kind of research.”

Evans said there needs to be a balance between transparency and privacy.

“But I don’t think we want to set up a situation where the public has no way of knowing whether the high school teacher has been charged in another county with sex crimes against juveniles, for example.” Evans said. “Or we don’t want to be deprived of sort of doing our own due diligence about who we hang out with or who our kids are hanging out with. And it’s access to this kind of information that’s one of those tools that parents and citizens use to sort of govern their affairs.”

Have a question for Curious Iowa?

Tell us what to investigate next.

Comments: bailey.cichon@thegazette.com