INDIANAPOLIS — Governor Eric Holcomb signed legislation Monday that will require the Indiana Bureau of Motor Vehicles (BMV) to disclose how they’re spending money generated from selling your personal information.
As WRTV Investigates uncovered, the state brings in $25 million a year by selling information like your name, date of birth, address, past addresses, odometer reading, what kind of car you drive, and your license plate number.
The language is part of Senate Enrolled Act 290 and requires the BMV to come before the State Budget Committee by December 1 of each year and disclose how they spent, or intend to spend, the money.
“I'm excited for the constituents,” said Rep. Greg Porter, D-Indianapolis. “They're the victims because they're the ones who didn't know their data is being sold to a third party."
Rep. Greg Porter filed an amendment to the legislation after seeing WRTV Investigates story.
PREVIOUS | Indiana BMV makes millions selling your personal information
“It was not even on our radar screen,” said Porter. “I want to thank WRTV for your work."
The law takes effect July 1.
WRTV Investigates filed a records request, obtained a massive spreadsheet and totaled it up. We found the Indiana BMV has collected $237 million over the last 10 years (2012-2022) from selling driver information.
"That's a lot of money,” said Porter. “It is a cash cow for the state.”
WRTV Investigates asked what the state is doing with the $237 million brought in from driver data sales.
“The revenue generated from sales to qualified entities goes to various accounts within the BMV, most significantly the Tech Fund,” a BMV spokesperson said. “The funds support maintenance and ongoing upgrades to infrastructure, databases, and security.”
The BMV refused to provide an on-camera interview on the topic.
“(Their statement) doesn’t give a whole lot of information about how the money is spent,” said Porter
Here’s who can buy your personal information:
- Attorney
- Auto Dealer
- Bail Bond
- Debt Collection Company
- Insurance Agent
- Insurance Company
- Mobile Home Parks
- Private Investigator
- Recovery Agent
- School Corporations
- Security Guard
- Sheriff and Police Departments
- Tow Company
Nearly everyone in the state interacts with the BMV at some point, whether it's to get your driver's license, a license plate, or your registration.
Yet most drivers have no idea their information is being sold.
“That’s stupid, that should be confidential,” Tiyonna Savage told WRTV while standing outside of a BMV branch.
The practice is legal, and the BMV doesn't even have to ask your permission to sell your information.
The BMV says it performs regular audits to ensure the data is used appropriately.
However, cybersecurity experts say all it takes is a data breach and your information is out there.
"Frankly, the government shouldn't be making it easier for companies to harvest data on us than it already is,” said Scott Shackelford, a cybersecurity expert and professor of business law and ethics at the Indiana University Kelley School of Business. “There could be a ransomware attack, there could be a phishing attack.”
Senate Enrolled Act 290, which takes effect July 1, does not include any measures allowing drivers to opt out of having their information sold.
“There is more that needs to be done with regard to BMV accountability,” said Porter.
Sen. Rodney Pol, D-Chesterton, agrees drivers should have the ability to opt in or opt out.
"We as a state are taking in that information,” said Pol. “We are requiring you provide that information to us. It is absolutely our duty to ensure that is safe. I'm always going to put the safety of our data and privacy of our citizens ahead of revenue and profit."
Pol filed legislation last year aimed at the BMV selling your personal information, but it did not get a hearing.
SEA 290 also allows the Indiana Department of Veterans Affairs to contact veteran license plate buyers about benefits and activities, however, the state can’t use the information for fundraising or solicitation.
SEA 290 also allows veterans to opt out if they don’t want to be contacted.
