Indianapolis – Months after CBS4 revealed the Bureau of Motor Vehicles was selling people’s personal information to third party companies, legislators are detailing how they plan to address the practice.
CBS4 found that even though the Driver’s Privacy Protection Act limits what kind of information the BMV can disclose, there are 14 exceptions that allow the bureau to sell data to certain industries. Those include lawyers, private investigators, police agencies and mobile home parks.
Essentially, a company applies for what the BMV calls “enhanced access.” If it can prove that it falls under the exception, and if the company pays a fee, it can access motor vehicle records, such as your title and registration information. Indiana is one of at least 30 states that allow this practice.
Few offer an “opt out” option.
Senator Rodney Pol proposes an “opt-in” requirement
Senator Rodney Pol represents district four near Lake Michigan. He immediately reacted after our story aired. He said he was not familiar with the practice prior to seeing our story. His biggest concern was what companies were doing with that information and whether Hoosier data was being unknowingly compromised.
“You’re seeing these data breaches that are happening and its incredibly costly both to the taxpayer and the individuals that suffer from them,” Pol said. “I have heard of law firms that have been hacked, I have heard of municipalities and school districts. You have a serious issue with the amount of information that is getting out there.”
He decided to introduce a bill that would make it so Hoosiers have to knowingly opt in to allow the BMV to share their information.
“In a situation like that, the individual should have the option of whether or not they want to opt in or opt out of providing that information. The more of a choice that individuals have and what information is shared, the better,” Pol explained.
Under his bill, the bureau would have to obtain written consent from a person whose personal information is being shared.
“What we would be creating is an opt-in approach where individuals would have to – or the bureau would have to – obtain written consent from a person whose personal information is being shared,” he said. “It kind of goes hand in hand with other legislation that we’re look at as well. What it requires is that they have to have that information and then it limits even when that information can be shared.”
Senator Pol said he is also considering what a consumer’s rights are if their information is breached once the third party obtains it. He also questions what kind of accountability the company would face if they were hacked and someone’s personal information was leaked.
“We need to be limiting what gets out. We need to be following up with the individuals that ultimately receive this information,” he clarified.
Representative Mike Andrade plans to amend a current statute
For Indiana State Representative Mike Andrade, this issue is personal.
“My son, the month prior, had just got his driver’s license,” Representative Andrade told CBS4. “My son just became 18. So now, it’s very relevant.”
Once Representative Andrade saw our story, he started questioning who could obtain his son’s information.
“It was so surreal to me,” he recalled. “Wait a minute! Who is going to be out there getting my sons information? No one has his information because he hasn’t applied for credit, he hasn’t applied for a car. This is his first legitimate information that is being put out there.”
Andrade, who represents district 12 near Hammond, confirmed he was drafting a piece of legislation that would strengthen an already-existing statute.
“There is a section that says where, ‘a person requesting the disclosure of personal information or highly restrictive personal information from the bureau records, who knowingly or intentionally misrepresents the person’s identity or makes a false statement to the bureau on an application required to be submitted under this chapter, commits a class c misdemeanor,’ which is 0-60 days in jail and the max is a $500 penalty fee,” Andrade read. “So, I think we have to work with that particular statutory code. We have to modify it.”
Andrade said until now, the penalty for misuse has appeared to be very light.
Looking down the list of companies that have accessed Hoosier data, Andrade pointed out how many tow companies were on there. He questioned how many LLCs were listed.
“So, I’m thinking, Spear Services? Who is Spear Services? What are they servicing? It just says services, what is the service they are providing?”
Andrade’s office reached out to the BMV and Secretary of Public Policy and Legislation. He said a representative sent him the CBS4 article and confirmed it was all accurate.
CBS4 is following up, trying to obtain more information about the sale of personal data
CBS4 followed up with the BMV, asking for additional sales. In particular, we are requesting to review what the state calls “batch” and “bulk” sales. We also requested more information about specific companies, why they were granted enhanced access and what the information was used for. A spokesperson responded that the bureau is working on the requests, but because it is a large volume of information and it is not stored electronically, it is taking time to compile.
Governor Eric Holcomb weighed in, pointing out it is a “fairly narrow scope” of entities the BMV sells to.
“That’s all statutory,” he said. “It’s not just selling to anybody, they’re a narrowly defined group of entities that can use that information.”
The governor said if the legislature wants to take a look at eliminating one of the entities, he is “happy to discuss it.”
“Let’s talk about who its being sold to and why it was included in the first place,” he said.
