INDIANAPOLIS — The CBS4 Consumer Investigations team is learning more about who the Bureau of Motor Vehicles sells motor vehicle data to. 

In November, CBS4 revealed the BMV had made more than $133 million from selling people’s personal information since 2011. While a federal law known as the Driver’s Privacy Protection Act restricts the agency from disclosing people’s personal data, there are 14 exceptions. It means the BMV can legally sell registration and title details to tow truck companies, mobile home parks, law enforcement agencies, and private investigators.  

We called dozens of the 1,446 companies that paid for enhanced access. Only one company was willing to do an interview.  

“Whenever you sign on, you first have to verify who you are,” Doug Kouns, a former FBI agent and current private investigator, showed CBS4. “Then, you have to click on a permissible use and certify you’re using this for court.”

Kouns walked CBS4 through the process of accessing people’s records. With someone’s first and last name and date of birth, their Driver’s License number, or their social security number, he was able to access their name, current and past addresses, physical description, license type and status, CDL information, suspension, disqualification and conviction information, title number, when they purchased their vehicle, the vehicle make, VIN, current and previous plate information and more.

“Why would a private investigator want that enhanced access?” CBS4 Anchor Angela Brauer asked.

“For example, we do a lot of accident investigations,” he explained. “We can look up a person’s driver record. It often gives us who the insurance company is that would be on the registration or an address for where someone is if we need to serve a subpoena or do an interview.”

“Do you understand why people would be concerned about that information getting out there?” Brauer asked.

“Sure,” he responded. “That’s why you have to go through the vetting process first of becoming a private investigator to where you can be trusted with that information and certifying every time you log on that you are using it for a permissible use.”

Kouns has never been audited but said if he was, he would be able to pull when he ran the information and what case it was for.

“It’s something we really have to have to do our jobs right,” he said.

In November, the Indiana BMV confirmed it had suspended five company accounts. One was because the business license was not valid at the time of the audit. Another company hadn’t responded to the BMV’s audit request.

Lawmakers have voiced their concerns about this practice, too. Worried about a possible data breach, Senator Rodney Pol introduced Senate Bill 196. It would require the BMV to obtain written consent from drivers before it discloses their personal information. It would also require the bureau to designate a data steward to “oversee strategic and tactical data management.” At last check, the bill was referred to committee.

Now, CBS4 is learning more about the companies that have accessed people’s personal information. We have confirmed there is something called “bulk requestors.”

“Bulk being that these entities will obtain the entire database,” Joseph H. Malley, a privacy attorney, said. “So, if your state has three million drivers, they’re actually obtaining all three million drivers’ data.”

Diagram: How the auto warranty industry gets, distributes your personal info

Joseph Malley is a privacy attorney based in Texas. Since 2003, he has focused on online and offline data privacy. He has filed dozens of class-action lawsuits and dug deep into DPPA laws nationwide.

“Nobody has really taken down this pyramid,” Malley said.

According to Malley, the BMV sells to a select number of companies it has contracted with. Those companies then resell the information to what he calls “down-liners.”

“The down-liners are the ones you have to be careful about,” Malley told CBS4. “A bulk requestor will obtain the data; they will then sell it to a reseller. A reseller, just like a pyramid scheme, will then sell it down line. Those smaller entities then will post that data online.”

According to the BMV:

“Entities with access to bulk data is also limited and requires completion of a contract directly with the BMV. Like Limited Registration and Point to Point, the contract outlines the terms and conditions including, but not limited to, definition of fields shared, fee structure, and sets forth clear parameters on permissible use of the data. Prior to signing a contract, the BMV reviews the requested information and the entity itself to confirm all information shared aligns with the DPPA. There are also parameters in the contract requiring reporting to the appropriate party should any suspicious activity occur related to BMV data.”

Bulk data sharing is processed through a secure file transfer. Entities receive data from the BMV based on the terms of their contract. There is no public record for the number of times these entities receive data.”

Through public record, CBS4 obtained a list of Indiana’s “bulk requestors.” We then looked up several of the businesses to better understand what they do with Hoosier’s information.

Online, Cross-Sell says it “tracks new and used title/registration data in 26 states, providing comprehensive monthly reports that are custom made for each client’s unique market. Our powerful auto industry reports detail sales by VIN, Make, Model, Owner City, Owner ZIP, Dealer Seller Name, Dealer Seller ZIP and Lienholder.”

Cross-Sell did not respond to CBS4’s request for comment.

Malley called the company a “red flag.” He pointed to a 2016 federal lawsuit he filed involving violations of the Driver’s Privacy Protection Act. The case was ultimately dismissed.

The BMV also sold personal information in bulk to a company called “Statistical Surveys.” It sells itself as the “most trusted market share data resource.”

CBS4 also questioned Info-Link, Experian, R.L Polk, and Verihull about their DPPA permissible use. We asked what the companies do, why they paid for bulk information, and what they did with it.

Experian was the only company to respond.

A spokesperson emailed:

“Experian Automotive is strongly committed to helping manufacturers, dealers and consumers gain insight into the automotive industry, to make informed vehicle decisions, and improve vehicle safety. As part of that commitment, we source information—such as vehicle titles and registrations–from state DMVs, to ensure the highest accuracy of our data. The use of certain data entrusted to Experian Automotive is highly regulated and we take data privacy and security very seriously. We strictly comply with all federal and state data privacy laws and restrictions, including the federal DPPA.”

When we followed up asking for a list of companies Experian had resold data, how much money the company spent to purchase bulk data in Indiana and how often it received the information and periodic updates, Experian did not respond.

According to Malley, eventually, this information is ending up in some questionable hands. Those at the bottom of the food chain are accused of sending people mailers and operating behind robocalls.

“Let’s go to your issue of these warranties, these rascals here,” he said, holding up an extended warranty postcard. “A person will go set up a 7/11 office, these offices the size of a 7/11. They’ll put up fold-up tables and get about ten people in there. They’ll then be selling these warranties. These warranties go for about $4,000 per warranty. What happens is when they get a hold of a person, they’ll say, ‘hey, all you need to do is give me your credit card. We’ll put a hundred bucks on it. I’ll send you the paperwork. If you don’t like it, well return it. Once they get that person’s credit card and it’s charged, that 7/11 group – the telemarketers – will get a payment of $1,000.”

CBS4 asked what the state could be doing differently. Malley suggested Indiana test the system if it isn’t already and see to whom their bulk requestors are reselling information. We asked the BMV how it screens the bulk requestors but never received a response.

The attorney general said it has never investigated companies accused of violating the DPPA.