INDIANAPOLIS — For the first time, the Indiana Bureau of Motor Vehicles (BMV) is explaining to WRTV Investigates in detail why the agency sells driver data to companies and individuals.
The BMV’s General Counsel, Matt Kestian, spoke with WRTV Investigates on-camera about an issue we’ve been covering for the past three years.
The Indiana Bureau of Motor Vehicles had previously denied WRTV’s requests for an on-camera interview regarding driver data sales.
As WRTV Investigates reported, things like your name, current address, past addresses, date of birth, make and model of your car, plate number, VIN, purchase date, driver record, license type and other types of information are for sale.
PREVIOUS | Indiana BMV makes millions selling your personal information
The State of Indiana brings in $26 million a year from driver data sales. While the practice is legal, it is not popular among Indiana drivers WRTV spoke with.
- WRTV: Why does the BMV do this?
- BMV: The BMV releases data as required by federal law and state law.
The federal law is called the Driver’s Privacy Protection Act or DPPA, a 1994 law which passed after a crazed fan accessed actress Rebecca Schaeffer’s DMV records and murdered her.
DPPA limits the use of a driver’s motor vehicle record for certain purposes, but lays out 14 exceptions called “permissible use.”
Permissible use includes notice for towed vehicles, use by private investigators, court proceedings, motor vehicle safety recalls, private toll operations and insurance activities.
“Courts and law enforcement should be able to have access to government data,” said Kestian.
- WRTV: If I was a member of the public, and I wanted to find out what kind of car you drive, would I be able to find that out?
- BMV: No, that’s not one of the permissible uses under either federal or state law.
- WRTV: Because I’m not a private investigator, law enforcement, etc.?
- BMV: Correct. And if you were a private investigator, you’d have to be licensed. A person off the street would not be able to get data from us.
- WRTV: What is the one thing you wish people knew?
- BMV: That this isn’t the BMV’s program. This is nationwide. Federal law requires that we disclose the data and state law requires that we charge for it.
While all states disclose driver data, the amount they charge varies.
Some states allow drivers to opt out in certain situations including Delaware, Wisconsin and Wyoming.
For example, Delaware drivers can submit a notarized affidavit requesting that their address, phone number and social security number contained in driver/vehicle records be kept confidential.
Indiana Rep. Greg Porter, D-Indianapolis, has filed a bill that would allow Indiana drivers to opt out of data sales.
“I’m very concerned about identity theft,” said Porter.
Porter is not alone in his concerns.
Drivers filed a lawsuit against LexisNexis, a leading buyer of driver data in Indiana, alleging the company illegally sold driver information to law firms for marketing.
LexisNexis settled the lawsuit for $5 million.
“In 2021, we reached a nationwide class settlement agreement with the Gastons involving a dispute over whether the Driver’s Privacy Protection Act (DPPA) applies to crash reports,” read a statement from LexisNexis. “Although we disagreed with their interpretation of the law, we chose to settle the case.”
- WRTV: What is the BMV doing to make sure that this information is kept safe?
- BMV: It’s kept safe because the data is only going to companies or entities that have a legal reason to receive the data. They are subject to audits by the BMV. Our goal has been to audit everyone of these companies within a 5-year-period. We’re actually doing better than that. We’re auditing them every 3 years.
- WRTV: What do you say to people about data breaches? Is my information safe?
- BMV: We believe it is.
Since 2017, the BMV has suspended more than 200 companies for violating the terms of their state contracts.
But the BMV won’t provide the names of companies who’ve been suspended.
- WRTV: Why not give us copies of those audits?
- BMV: Indiana law makes audit information confidential.
WRTV Investigates learned the top data buyers in Indiana get large amounts of driver information, also known as bulk data.
According to the BMV, 9 entities have paid more than $50,000 over the past four years for bulk data including Auto Data Direct, City of Chicago Department of Finance, Datalink, Explore Information, Hire Right, Insurance Info, LexisNexis, Safety Holdings, and TML.
WRTV Investigates has attempted to contact every entity on this list, and we are still waiting to hear back from everyone with the exception of LexisNexis.
In a statement to WRTV, LexisNexis also emphasized the records they purchase can’t be used for marketing or solicitation purposes.
“LexisNexis Risk Solutions purchases motor vehicle records for insurance purposes when requested from our customers on a transactional basis, we do not obtain the records in bulk,” read a statement from LexisNexis.
“The records are subject to the requirements of the Driver’s Privacy Protection Act and can only be used for a permissible purpose. They cannot be used for marketing or solicitation purposes.”
The website for Explore Information says it provides information to insurance companies, government agencies and commercial fleets and that they are “are monitoring driver behavior, identifying location-based risk."
Matt Kestian, General Counsel at the Indiana BMV, emphasizes that companies have to have a legal reason to get bulk data, for example, for a vehicle recall.
“All of the 2005 Honda Accords that are out there, they would be requesting bulk data for everyone who is a registered owner of that car because there’s a recall on it or something like that,” said Kestian. “The most reliable way to find out who is currently the registered owner of a vehicle is the BMV’s records.”
The state’s contract with the City of Chicago says they can only use the data to find a vehicle’s owner for a parking citation or a toll fee. In a statement to WRTV, the company also emphasized the records they purchase can’t be used for marketing or solicitation purposes.
Rep. Porter’s opt-out bill has not yet received a hearing.
It is scheduled for a hearing on Monday February 2.
This is the 3rd year in a row Porter has filed this legislation, but it’s the first time a Republican has signed on as a co-author.
Kestian says it’s not all about dollars.
“The reason we are disclosing the data is not a way to make money,” said Kestian. “We are doing it because federal law requires it and state law requires us to charge."
Kestian points out tow companies, auto manufacturers, insurance agents and other businesses would have a hard time getting a hold of you without the information they receive from the BMV.
“They wouldn’t be able to drive the car, purchase the car or get car insurance under the language of that bill,” said Kestian. “They wouldn’t be able to drive on toll roads because there would be no way to send them an invoice for the bill. So, I think there are a lot of unintended consequences."
WRTV Investigates also found the BMV doesn't inform you of what they plan to do with your information while you’re renewing your driver’s license or registration and they don't allow drivers to opt out.
WRTV Investigates' Kara Kenney and a WRTV colleague took hidden cameras inside a local BMV office while our Kara Kenney renewed her driver’s license.
Kenney asked the employee about her personal information.
Kenney: Does this mean you can sell my information?
BMV Employee: No, not at all. It’s just acknowledging that information is correct.
WRTV Colleague: You guys don’t sell information?
BMV Employee: I don’t.
Kenney: Does the BMV though?
BMV Employee: No. Well, you’re not supposed to. Can’t tell you for sure what they do, but they’re not supposed to!
WRTV Investigates asked Kestian if the BMV is training staff on how to handle questions about data sales.
“Most importantly, we are training staff on how to handle data,” said Kestian. “From a branch employee’s perspective, they don’t disclose data. They accept data from customers they enter it into the system. They receive extensive training on what they can’t provide to the customer.”
Here’s some examples of who can buy driver data in Indiana:
