U.S. report: State privacy laws fail to stop data brokers from exposing public servants

A researcher with a nonprofit security project examined state-level consumer privacy statutes and concluded they do not adequately shield public servants from third-party resale of personal information derived from public sources. The study mapped how documents that are legitimately public — like property filings and court records — can be repackaged by brokers and made easily searchable, enabling harassment and, in extreme cases, violence. Complementary analysis of incident reports shows an upward trend in threats directed at local officials, including school board members and election staff, with threatening language far outpacing physical attacks. The absence of a private right of action in the surveyed statutes leaves affected individuals with limited legal recourse against misuse or resale of their personal data. Equally notable is that none of the laws reviewed allow employees to compel state agencies to remove or redact personal details from public records. The report argues lawmakers can respond without stifling legitimate oversight by narrowing how records are digitized and how remotely accessible those records become, rather than closing public records entirely. Policymakers will face a constitutional balancing act; restrictions on data availability must be drafted to withstand First Amendment and transparency challenges. For practitioners in security and risk management, the practical takeaway is that public records remain a persistent vector for doxxing and stalking even when brokers aggregate and resell those records. The author emphasizes that the modern ease of remote access multiplies risk compared with historical, in-person searches of civic archives. Concrete policy proposals include targeted redaction mechanisms and limits on commercial repackaging of collated public-data profiles. If adopted, such measures would shift the responsibility partially back onto agencies and platforms that host or sell aggregated records. Failure to act, the report warns, will sustain a market that makes locating and targeting officials trivial for malicious actors. The analysis concludes by calling for legislation calibrated to protect individuals without undermining journalistic and civic oversight functions.