State lawmakers draft bills after learning BMV sells Hoosier data
Indianapolis – Months after CBS4 revealed that the Bureau of Motor Vehicles was selling people’s personal information to third-party companies, lawmakers are detailing how they plan to tackle the practice.
CBS4 found that while the Driver’s Privacy Protection Act limits the type of information the BMV can disclose, there are 14 exceptions that allow the office to sell data to certain industries. These include lawyers, private investigators, law enforcement and mobile home parks.
Basically, a business is asking for what BMV calls “enhanced access”. If it can prove it falls under the exception and the company pays a fee, it can access motor vehicle records, such as your title and registration information. Indiana is one of at least 30 states that allow this practice.
Few of them offer an “opt-out” option.
Senator Rodney Pol proposes an “opt-in” requirement
Senator Rodney Pol represents District Four near Lake Michigan. He reacted immediately after our story was broadcast. He said he was not familiar with the practice until he saw our story. His biggest concern was what companies were doing with this information and whether Hoosier data was unknowingly compromised.
“You see these data breaches happening and it’s costing the taxpayer and the people who suffer from it incredibly dearly,” Pol said. “I’ve heard of law firms that have been hacked, I’ve heard of municipalities and school districts. You have a serious problem with the amount of information that is circulating.
He decided to introduce a bill that would force Hoosiers to make an informed choice to allow BMV to share their information.
“In a situation like this, the individual should have the option of choosing whether or not to accept or refuse to provide this information. The more choices individuals have and what information is shared, the better, ”Pol explained.
Under its bill, the office would need to obtain written consent from an individual whose personal information is being shared.
“What we would create is an opt-in approach where individuals would – or the office should – obtain written consent from someone whose personal information is being shared,” he said. “It goes hand in hand with other laws that we are looking at as well. What this requires is that they must have this information and this limits even when this information can be shared. “
Senator Pol said he is also considering a consumer’s rights if their information is violated once the third party obtains it. He also wonders what kind of liability the company would face if it got hacked and someone’s personal information leaked.
“We have to limit what comes out. We need to follow up with the people who ultimately receive this information, ”he said.
Representative Mike Andrade plans to change current status
For Indiana State Representative Mike Andrade, this question is personal.
“My son the previous month had just obtained his driver’s license,” Representative Andrade told CBS4. “My son just turned 18. So now it’s very relevant.”
Once Rep Andrade saw our story, he began to wonder who could get his son’s information.
“It was so surreal for me,” he recalls. “Wait a minute! Who’s going to be there to get information on my sons? Nobody has their information because they haven’t applied for credit, they haven’t applied for a car. This is their first legitimate piece of information. is broadcast.
Andrade, who represents District 12 near Hammond, confirmed he was drafting a bill that would strengthen an already existing law.
“There is a section that says where, ‘a person requesting disclosure of personal information or highly restrictive personal information from office records, who knowingly or intentionally misrepresents the person’s identity or makes a false statement to the office on an application that must be submitted under this chapter, commits a class c misdemeanor, “which is 0 to 60 days in prison and the maximum is a fine of $ 500,” Andrade read. “So I think that we have to work with this particular statutory code, we have to change it.
Andrade said that so far the punishment for abuse appears to be very light.
Going through the list of companies that have accessed Hoosier data, Andrade highlighted the number of towing companies present. He asked how many LLCs were listed.
“So, I think, Spear Services?” Who is Spear Services? What do they serve? It just says services, what service do they provide? “
Andrade’s office contacted the BMV and the Secretary of Public Policy and Legislation. He said a representative sent him the CBS4 article and confirmed everything was correct.
CBS4 is following up, trying to get more information about the sale of personal data
CBS4 followed up with BMV, asking for additional sales. In particular, we are calling for a review of what the state calls “batch” and “bulk” sales. We also asked for more information on specific companies, why they were granted enhanced access, and what that information was used for. A spokesperson responded that the office is working on the requests, but since this is a large volume of information and is not stored electronically, compilation takes time.
Governor Eric Holcomb intervened, pointing out that this is a “fairly narrow scope” of entities that BMV sells to.
“All of this is statutory,” he said. “It’s not just about selling to anyone, it’s about a tightly defined group of entities that can use this information.”
The governor said if the legislature wished to consider eliminating any of the entities, he was “happy to discuss it.”
“Let’s talk about who it’s sold and why it was included in the first place,” he said.
Suggest a correction