INDIANAPOLIS — The Indiana Bureau of Motor Vehicles is selling your personal information to private companies and individuals, and they don't have to tell you about it.
In 2022 alone, the state made nearly $25 million from the practice.
WRTV Investigates found information like your name, date of birth, address, past addresses, odometer reading, what kind of car you drive, and even your license plate number are all for sale.
It’s a practice that’s been going on for years, one that many drivers have no idea is happening.
“That’s stupid, that should be confidential,” Tiyonna Savage told WRTV while standing outside of a BMV branch.
The BMV doesn't even have to ask your permission to sell your information.
“I wasn’t aware,” Catherine Cox said outside of a BMV branch. “They should have to get approval from me.”
WRTV Investigates also found the BMV doesn't inform you of what they plan to do with your information while you’re renewing your driver’s license or registration and they don't allow drivers to opt out.
WRTV Investigates' Kara Kenney and a WRTV colleague took hidden cameras inside a local BMV office while our Kenney renewed her driver’s license.
After a short wait, a BMV employee asked Kenney some questions.
BMV Employee: Are you subject to fainting spells or seizures?
Kenney: No
BMV Employee: Has your license ever been suspended or revoked?
Kenney: No
After taking WRTV Investigates Kara Kenney’s picture for her driver’s license, the worker handed Kenney the paperwork about renewing her driver’s license.
Kenney then asked the employee about her personal information.
Kenney: Does this mean you can sell my information?
BMV Employee: No, not at all. It’s just acknowledging that information is correct.
WRTV Colleague: You guys don’t sell information?
BMV Employee: I don’t.
Kenney: Does the BMV though?
BMV Employee: No. Well, you’re not supposed to. Can’t tell you for sure what they do, but they’re not supposed to!
While workers at your local BMV may not be aware, WRTV Investigates found that the Indiana Bureau of Motor Vehicles is selling your personal information and it’s totally legal.
Things like your name, current address, past addresses, date of birth, make and model of your car, plate number, VIN, purchase date, driver record, license type and other types of information are for sale.
WRTV Investigates filed a public records request with the BMV and received a massive spreadsheet.
We totaled it up and found the Indiana BMV has collected $237 million dollars over the last 10 years (2012-2022) from selling driver information.
Here’s who can buy it:
- Attorney
- Auto Dealer
- Bail Bond
- Debt Collection Company
- Insurance Agent
- Insurance Company
- Mobile Home Parks
- Private Investigator
- Recovery Agent
- School Corporations
- Security Guard
- Sheriff and Police Departments
- Tow Company
Indianapolis private investigator Jack Sandlin says he pays the BMV for information.
“You can get vehicle titles, you can get registrations, driver's license information,” Sandlin said.
For example, Sandlin helps companies background check workers placed inside people’s homes.
He says the BMV does check his records before providing the information, to make sure he’s using the information for legitimate business reasons.
Sandlin is also a state lawmaker, so WRTV Investigates asked his response to drivers’ concerns about the BMV selling their information.
“Well, you have to have accountability,” Sandlin said. “You can’t just buy the information and do with it whatever you want.”
WRTV Investigates also found a lot of local attorneys and law firms on the list of those paying for access, including Indianapolis law firm Cohen and Malad.
"We use the information from the BMV mostly in motor vehicle accidents,” Irwin Levin, managing partner at Cohen and Malad, told WRTV. “We will get whatever information is public. Driver information, track down license plate numbers, sometimes find witnesses, that sort of thing."
Indiana is not alone.
Dozens of states sell or allow access to drivers’ personal information.
The federal Driver’s Privacy Protection Act limits how the data can be used, for example, it can’t be sold to third-party marketers who use the information to directly solicit you.
Scott Shackelford, a cybersecurity expert and professor of business law and ethics at the Indiana University Kelley School of Business, said even if companies follow the rules, your personal information isn’t necessarily safe.
“There could be a ransomware attack, there could be a phishing attack,” Shackelford said.
He pointed out if one of the thousands of individuals or companies gets hit with a data breach, your personal information could end up for sale on the dark web.
PREVIOUS | How scammers are selling your information on the dark web
"The internet is written in ink,” Shackelford said. “Once it's out there, it's out there. Frankly, the government shouldn't be making it easier for companies to harvest data on us than it already is."
He says the Indiana BMV should consider notifying drivers of the practice or giving them the option to opt out.
“They're supposed to be the stewards of these data,” Shackelford said. “To do it in this way and to not be transparent about the process, I think that part is particularly troubling for consumers."
WRTV Investigates emailed the BMV and stopped by the agency’s headquarters asking for an on-camera interview, but a BMV spokesperson's answer was always the same.
“Nobody is available for an interview," said Richard Lord, a BMV spokesperson.
Posted on the wall is the BMV’s mission, which is to “serve all Hoosiers by providing best-in-class driver and vehicle services in a timely and accurate manner while ensuring security and transparency.”
The BMV Commissioner, Joe Hoage, once served as the state’s Public Access Counselor, an office committed to government transparency.
“The government should be open to the public,” Hoage told WRTV Investigates Kara Kenney back in 2012.
A BMV spokesperson told WRTV via email, “Data is only available to qualified entities who meet the eligibility and use requirements in Indiana Code § 9-14-13-7 or § 9-14-13-8.”
The spokesperson, Communications and Media Relations Director Melissa Hook, went on to say, “Consumers do not have the option to opt out at this time."
The BMV says it performs regular audits to ensure the data is used appropriately.
Users can be suspended for a variety of reasons including but not limited to a customer no longer being in business, not responding to an audit request, or not complying with requirements in the in.gov agreement, said Hook in an email to WRTV.
Between 2017 and 2021, 49 data customers were suspended by the BMV.
“No malicious intent or system abuse has been identified in these audits,” Hook said in an email to WRTV.
WRTV Investigates also asked what the state is doing with the $237 million brought in from driver data sales.
“The revenue generated from sales to qualified entities goes to various accounts within the BMV, most significantly the Tech Fund,” Hook said. “The funds support maintenance and ongoing upgrades to infrastructure, databases, and security.”
WRTV Investigates also asked the BMV on March 1 if they plan to train or educate their staff on the BMV's practice of selling information, and we are still waiting on an answer.
So how can you protect yourself?
- Put a credit freeze on yourself and children. This will prevent someone from opening up credit cards or accounts in your name, even if they’ve stolen your personal information. A credit freeze keeps new creditors from accessing your credit report without your permission.
- Monitor your credit card statements and credit reports for fraudulent activity. This could alert you someone has stolen your identity
- Contact your lawmakers, state and federal. If you’re concerned about the BMV selling your personal information, let them know.
State Senator Rodney Pol, D-Chesterton, filed a bill last session aimed at the state’s practice of selling personal information, but it didn’t get a hearing.
“With growing cybersecurity threats across the country, Hoosiers rightfully feel unsafe about the status of their personal information,” said Pol in 2021. “It’s unacceptable that they should have to worry about big government willingly selling that personal information without their knowledge. I will be looking into legislative options to prohibit the BMV from selling personal information to private companies and individuals. It should be common sense that the government should never profit from violating Hoosiers’ right to privacy.”
