INDIANAPOLIS — The CBS4 Consumer Investigations team is learning more about who the Bureau of Motor Vehicles sells motor vehicle data to.

In November, CBS4 revealed that the BMV had earned more than $133 million selling personal information since 2011. Although a federal law known as the Driver’s Privacy Protection Act prevents the agency from disclosing the personal data of people, there are 14 exceptions. This means the BMV can legally sell registration and title details to tow truck companies, mobile home parks, law enforcement and private investigators.

We called dozens of the 1,446 companies that paid for improved access. Only one company was willing to do an interview.

Enhanced Access provides different search functionality and returns additional information for verified entities. To be approved for Enhanced Access, entities must be eligible and fall into one of the categories listed in the Enhanced Access section of the BMV Premium and Enhanced Services page. Category-specific requirements are also listed on this page. Entities must complete Step 1 on the Steps to Subscribe page by submitting the appropriate Subscriber Account Agreement. Upon completion, entities can determine eligibility for Enhanced Access and, if applicable, complete and submit State Form 54373 for review. Once received, IN.gov’s Enhanced Services team reviews the application, including all required business documentation. If approved, the entity will receive access based on their category. Entities approved for Enhanced Access are audited by the BMV. They can fetch one record at a time or perform a bulk search, as with basic access. There is an annual fee of $95 plus $10 per registration fee for these customers

“Every time you log in, you have to verify who you are first,” Doug Kouns, a former FBI agent and current private investigator, told CBS4. “Then you must click on authorized use and certify that you are using it for court.”

Kouns guided CBS4 through the process of accessing people’s records. With someone’s first and last name and date of birth, driver’s license number or social security number, he was able to access their name, current and past addresses, physical description, type and their license status, CDL information, suspension, disqualification and conviction information, title number, date of purchase of their vehicle, vehicle make, VIN, current and previous plate information, etc.

“Why would a private investigator want this enhanced access?” CBS4 anchor Angela Brauer asked.

“For example, we do a lot of accident investigation,” he explained. “We can look at a person’s driving record. This often tells us who the insurance company would be on the record or an address where someone is if we need to serve a subpoena or do an interview.

“Do you understand why people would be concerned about the release of this information? Brauer asked.

“Of course,” he replied. “That’s why you must first go through the verification process to become a private investigator where you can trust this information and certify every time you log in that you are using it for authorized use.”

Kouns has never been audited, but said if he was, he would be able to find out when he released the information and what case it corresponded to.

“It’s something we really need to have to do our job well,” he said.

In November, Indiana BMV confirmed it had suspended five corporate accounts. The first was that the business license was not valid at the time of verification. Another company did not respond to the BMV’s audit request.

Lawmakers have also expressed concerns about this practice. Worried about a possible data breach, Senator Rodney Pol introduced Senate Bill 196. It would require the BMV to obtain written consent from drivers before disclosing their personal information. It would also require the office to appoint a data manager to “oversee the management of strategic and tactical data.” At the last scrutiny, the bill was sent back to committee.

Now, CBS4 is learning more about the companies that have accessed people’s personal information. We have confirmed that there is something called “mass seekers”.

“The big thing is that these entities will get the entire database,” said Joseph H. Malley, a privacy attorney. “So if your state has three million drivers, they’re actually getting data from all three million drivers.”

Diagram: how the auto warranty industry obtains and distributes your personal information

Joseph Malley is a Texas-based privacy attorney. Since 2003, he has focused on online and offline data privacy. He has filed dozens of class action lawsuits and researched DPPA laws nationwide.

“Nobody really destroyed that pyramid,” Malley said.

According to Malley, the BMV sells to a number of companies with which it has contracts. These companies then resell the information to what he calls “down-liners”.

“The downliners are the ones you have to watch out for,” Malley told CBS4. “A bulk requester will get the data; they will then resell it to a reseller. A reseller, much like a pyramid scheme, will then sell it online. These smaller entities will then publish this data online. »

According to the BMV:

“Entities with bulk data access are also limited and require contracting directly with the BMV. Like limited and point-to-point registration, the contract outlines the terms and conditions, including but not limited to the definition of shared fields, fee structure, and sets out clear parameters on the authorized use of data. Before signing a contract, the BMV reviews the information requested and the entity itself to confirm that all information shared complies with the DPPA. There are also parameters in the contract requiring reporting to the appropriate party in the event of suspicious activity related to BMV data.

Bulk data sharing is handled via secure file transfer. Entities receive data from the BMV based on the terms of their contract. There is no public record of the number of times these entities receive data. »

Through public filing, CBS4 obtained a list of Indiana’s “mass claimants.” We then researched several companies to better understand what they do with Hoosier’s information.

FISCAL YEAR 2018 FISCAL YEAR 2019 FISCAL YEAR 2020 FISCAL YEAR 2021
Cross-sell Cross-sell Cross-sell Cross-sell
Info-Link Info-Link Info-Link Info-Link
R. L. Polk R. L. Polk R. L. Polk R. L. Polk
Experian Experian Experian Experian
Southern Indiana Gas Southern Indiana Gas Statistical surveys Statistical surveys
Statistical surveys Statistical surveys VeriHull VeriHull
VeriHull Avenue Cline Avenue Cline

Online, Cross-Sell says it “tracks new and used title/registration data in 26 states, providing comprehensive monthly reports that are customized for each customer’s unique market. Our powerful automotive industry reports detail sales by VIN, Make, Model, Owner City, Owner Zip Code, Dealer Seller Name, Dealer Seller Zip Code, and Lien Holder.

Cross-Sell did not respond to CBS4’s request for comment.

Malley called the company a “red flag”. He pointed to a federal lawsuit he filed in 2016 regarding violations of the Driver Privacy Act. The case was finally dismissed.

The BMV also sold personal information in bulk to a company called “Statistical Surveys”. It markets itself as the “most trusted market share data resource”.

Image Preview

CBS4 also questioned Info-Link, Experian, RL Polk and Verihull about their authorized use by the DPPA. We asked what companies do, why they pay for information in bulk, and what they do with it.

Experian was the only company to respond.

A spokesperson emailed:

“Experian Automotive is committed to helping manufacturers, dealers and consumers better understand the automotive industry, make informed vehicle decisions and improve vehicle safety. As part of this commitment, we obtain information, such as vehicle titles and registrations, from state DMVs to ensure the highest accuracy of our data. The use of certain data entrusted to Experian Automotive is highly regulated and we take data privacy and security very seriously. We strictly comply with all federal and state data privacy laws and restrictions, including the federal DPPA.

When we asked for a list of companies Experian had resold data to, how much money the company spent buying data in bulk in Indiana, and how often it received the information and periodic updates, Experian did not respond.

According to Malley, this information eventually ends up in questionable hands. Those at the bottom of the food chain are accused of sending shippers and operating behind robocalls.

“Let’s get to your question of these warranties, you rascals here,” he said, holding up an extended warranty postcard. “A person will go and set up a 7/11 office, these offices the size of a 7/11. They will set up folding tables and bring in about ten people. They will then sell these guarantees. These warranties cost around $4,000 per warranty. What happens is that when they get their hands on a person, they’ll say, “Hey, all you have to do is give me your credit card.” We’ll put a hundred dollars on it. I’ll send you the papers. If you don’t like it, well return it. Once they get that person’s credit card and it’s charged, that 7/11 group – the telemarketers – will receive a payment of $1,000.

CBS4 asked what the state could do differently. Malley suggested Indiana test the system if it isn’t already and see who their en masse applicants are reselling information to. We asked the BMV how it screens group applicants, but never received a response.

The attorney general said he has never investigated companies accused of violating the DPPA.