I-Team: Gated communities storing visitors' personal information

Article and Video Courtesy of Channel 12 Palm Beach

By Danielle Waugh  

Published November 22, 2019

Watch VIDEO

 

WEST PALM BEACH — In the state that leads the nation for the most homeowners associations and gated communities, chances are you either live behind a gate or have visited a gated community several times.

At one time or another, you probably presented a driver's license to get in.
 

But have you ever wondered what happens to that information once you pull away from the guard shack?

The CBS12 I-Team obtained exclusive, undercover video showing security guards at gated communities taking photographs of drivers licenses and storing them in a computer database.

Data security and privacy experts tell the I-Team it's a "concerning" practice that puts your personal information at risk.

THE VIDEO

Our source, who wants to remain anonymous, works in the security industry.

He's seen private security firms, hired by HOAs, swiping and photographing licenses -- and came to the CBS12 I-Team to find out if this practice is legal.

Security guards stationed outside gated housing communities are photographing visitors' drivers licenses and storing them into a database (unidentified security expert).



The undercover video was taken at three different gated communities in Palm Beach County in the last few weeks.

 

It shows the computer and camera system inside gatehouses.

When a new visitor pulls up, the undercover footage shows security guards taking visitors' licenses and putting them under cameras.

Photographs of the front of the licenses appear on computer screens, and the visitors are let in.

The footage also shows what happens when a returning visitor pulls up to the gatehouse.

The computer system recognizes the license plate and displays the visitor's driver's license on screen -- proof that their information is being stored in a database.

"This is the first time I've seen HOAs doing this," said Al Saikali, the Chair of Privacy and Data Security Practice at Shook, Hardy & Bacon in Miami.

The I-Team showed Saikali the undercover footage.

"You are now collecting plutonium-like data that you don't need to have on your hands," he said.

POTENTIAL FOR IDENTITY THEFT

Second only to your social security number, your driver's license number is the most sensitive personal information you have, according to Saikali.

"You can use it to apply for a loan or credit cards," he said, "So you have to be careful when you're collecting them, to make sure it stays within your control."

One West Palm Beach man, who asked us not to use his name, recently became the victim of identity theft when he lost control of his driver's license number.

"Someone walked into a bank in Maryland and closed out my account with five figures in dollars," he told the I-Team.

"This person walked in with one piece of identification: a driver's license with my number on it."

The thief was able to steal 13 thousand dollars.

While the victim is working with police and his bank to find out how his information was compromised, he is being more careful about his personal information.

"To think someone can take a copy of your license or just your number and close out your account was upsetting," he said.

"It's like a pit in your stomach -- hard to believe this can happen. You need to be vigilant. Don't easily give out your driver's license."

Saikali said one of the biggest issues with HOAs keeping drivers' license numbers in a database is the potential for someone like a hacker to gain access to a treasure trove of personal information.

THE LAW

We showed the undercover video to James Green, Legal Chair for the Palm Beach County American Civil Liberties Union.

Green said the PBC ACLU recently received a complaint about HOAs demanding driver's licenses -- but this was the first time he was able to see what the guards were doing behind closed doors.

Green's biggest concern was the apparent "swiping" of licenses.

At one gated community, the security guard can be seen putting the license through a machine.

If that machine is reading the barcode on the back of the license, it could be a "swipe."

Florida Statute 322 prohibits the act of swiping a driver's license.

The law defines swiping as "the act of passing a driver license or identification card through a device that is capable of deciphering, in an electronically readable format, the information electronically encoded in a magnetic strip or bar code."

"I've got serious privacy concerns," said Green, "and HOA's should have serious liability concerns."

Statute 322 makes it a civil penalty to swipe an ID card without authorization, and makes each violation subject to a $5,000 fine.

The HOA in the undercover video with the security guard putting IDs through a machine did not respond to our request for comment.

While Green is most concerned with the swiping, Saikali said his biggest issue is the data collection and retention.

"You have an obligation to adopt reasonable security safeguards" under Florida Statute 501.171, he said.

While the statute does not define what a reasonable safeguard is, Saikali said that typically means things like encryption, password protection, and physical barriers to accessing personal information.

He said watching someone so easily walk into guardhouses to record the undercover video suggests safeguards are lacking.

To the HOA's keeping these databases, Saikali's advice is to stop.

"It's not necessary. It creates problems," he said.

HOA RESPONSE

Only one of the three HOA's in the undercover video responded to our request for comment.

A lawyer representing the HOA board told CBS12 News:

"[The association's] practice is to photograph vehicle license plates. A government-issued photo ID is required for visitors. The ID is scanned. The magnetic data strip is not read/swiped. All digital images are encrypted and kept for 60 days and then automatically erased. The images are stored on a password protected Server located in the Gate House which is manned 24/7.

Staff, Board members and their security team do not have the password for the server nor can they access or retrieve stored images. Should a need arise they must contact the company that provides and maintains the proprietary software that captures and stores the images and have them retrieve any images the Association might require."

Both Saikali and Green say visitors should limit how much personal information visitors provide to gated communities in these situations.

When we tested an HOA in Jupiter that told us they keep photographs of IDs, we were told we had no choice but to provide a license.

When we asked if we could provide a different ID, or refuse to let them take down our driver's license number, we were told it was the HOA rules

No license. No entry.

TV NEWS HOME NEWS PAGE