Lawmakers probe what the BMV does with your data
What exactly does the Indiana Bureau of Motor Vehicles do with driver data?
That’s been the burning question from the general public and some legislators for years now.
In what was essentially the functional equivalent of an impromptu interim study committee session (because the topic was not assigned over the summer), the House Committee on Roads and Transportation on Monday pondered the pros and cons of potentially restricting how BMV shares Hoosiers’ data.
Rep. Greg Porter (D) of Indianapolis has been one legislator pressing for more rules on what the BMV can and can’t do with driver data. Rep. Porter, along with other lawmakers, has filed legislation for several years now to try to protect the data of certain groups of Hoosiers.
Rep. Porter earned a committee hearing on his bill this year, HB 1027, though that’s all it was, merely a hearing. The deadline for House bills to be voted out of House committees had already passed on January 27. House Roads Chair Jim Pressel (R) of Rolling Prairie opted to hold the hearing to begin the discussion.
Chair Pressel and Rep. Porter had signed onto a letter last year to Legislative Council asking for an interim committee on the topic of BMV data sales . . . but the interim transportation committee was not assigned a topic for 2025.
What BMV does with your data – and how much money the agency makes from sharing it – has been a hot topic in Indiana since a 2023 investigation by WRTV-TV in Indianapolis, which revealed that BMV reaped $25 million in 2022 in fees for driver personal information, and a whopping $237 million over the course of a decade. The data in question includes names, addresses, car makes and models, and license plate numbers made available to certain entities under state and federal law.
Indiana isn’t alone in this increased scrutiny from the public, who are concerned that data made available to third parties could be used for nefarious purposes. The 1994 Driver’s Privacy Protection Act (DPP) was designed to protect privacy, but it contains 14 “permissible uses” that allow the sale of data to entities like insurance companies, tow companies, debt collectors, and private investigators.
HB 1027 would have barred BMV from selling personal data belonging to anyone under 21, anyone 65 or older, or anyone who chooses to opt out. To cover any revenue loss caused by these restrictions, Rep. Porter proposed in the bill that the State Board of Finance could transfer funds to BMV, if approved by the governor, for fiscal years before July 1, 2028.
Rep. Porter pointed out that the DPP is “a 30-year law,” implying it was not written in the context of today’s age, with technological advancements shifting modern data privacy and cybersecurity concerns.
“This practice is raising concerns about security and privacy for our constituents’ personal information. So, this is a consumer-friendly bill. We want to just protect those individuals out there,” Rep. Porter contended.
Other states have adopted opt-out laws akin to those in the Porter proposal.
Wisconsin and Wyoming both have systems in place for drivers to opt out of having their data shared. The General Assembly in 2023 did adopt SEA 290-2023, which requires the bureau to publicly disclose how it spends money collected from data sales.
Money is a point of opposition regarding barring BMV from sharing data for certain age groups of people.
The agency still collects roughly $25 million per year from the fees it charges to distribute data to companies that ask for it. That money is used for operations, such as maintenance and upgrades to infrastructure, databases, and security.
The Legislative Services Agency fiscal note for HB 1027 does predict that revenue impacts on the bureau would be minimal with Porter’s proposal. The BMV’s data-sales program generated an average of $25.5 million per year in 2023 and 2024. Roughly $15.5 million was directed to the BMV Commission Fund, while about $10 million annually supported the Indiana Office of Technology.
BMV is opposed to HB 1027, not just because of finances, but also because of what BMV General Counsel Matt Kestion called “unintended consequences.”
Kestion explained that the BMV isn’t necessarily “selling” data just to make money – it’s required to disclose it to certain entities under the federal DPP, and Indiana’s Access to Public Records Act. The “sale” is the fee the BMV charges for the records.
He noted that BMV data is available at no charge for those with permissible use via a written request. But requesting it manually “would be cumbersome and inefficient,” he explained. Enhanced digital access programs through the Indiana Office of Technology exist because it is more efficient, and companies are willing to pay for that service.
Kestion elaborated that the bill contains unclear definitions that could create serious unintended effects, as it does not define the difference between “selling” or “disclosing” data.
He warned that HB 1027’s system could unintentionally block core functions tied to BMV data. If large groups of Hoosiers’ data could not be disclosed, he explained, young drivers under 21 might be unable to purchase vehicles or secure insurance because insurers depend on driving-record data to assess risk. Automakers could also lose access to accurate, up-to-date ownership information needed to notify drivers of safety recalls.
Kestion further cautioned the bill could even interfere with law enforcement operations by preventing officers from running license plates or driver records for people within the age groups affected by the opt-out provision, creating potential safety and operational problems.
For clarification, the state is not simply selling data to just anyone willing to pay, such as telemarketers.
A range of entities are permitted to purchase personal information from the BMV, including attorneys, auto dealers, bail bond services, debt collection companies, insurance agents and insurance companies, as well as mobile home parks and private investigators. Recovery agents, school corporations, security guards, sheriff and police departments, and towing companies can also obtain this information.
The BMV conducts audits regularly to ensure that these entities are using the data properly in accordance with the law.
All of those who testified, in addition to BMV officials, opposed the proposals outlined in HB 1027. All were industry representatives whose business practices could be adversely affected by restrictions on obtaining data.
Hamilton Smith, on behalf of the Indiana Towing and Wrecker Association, testified that towing companies need BMV data to notify vehicle owners when their cars are towed, as required by state law. Without that data, drivers may not be able to find where their cars are towed.
“It’d be challenging for us to obtain that information, provide the notice, and then comply with our statutory obligation,” Smith asserted.
Further testimony from the insurance, bank, and credit bureau industries reflected similar sentiments. Insurers use BMV data for claims and underwriting purposes (not marketing), subject to regulatory oversight, and the data helps match rates to risk. Bank lenders need to be notified when vehicles serving as collateral are towed. Credit bureaus rely upon BMV to verify identities and prevent fraud, serving as consumer protection.
To demonstrate the point that BMV data is needed for identity verification, Trevor Vance, representing the Consumer Data Industry Association, pointed out to the committee that, in just a simple Google search, he found “six Greg Porters, three Jim Pressels, one Dave Heine, one Ethan Lawson” . . . and that was only looking under obituaries.
Rep. Porter, noting the lack of public testimony in favor of his measure, pointed out that he could have lined up plenty of consumers to share their side and concerns about the data distributions.
“Individuals that I’ve talked to … could have lined up a bunch of individuals to say why they didn’t want their data sold and how we’re not going to profit from that data,” Porter emphasized.
As far as what’s next, this hearing on HB 1027 is just the beginning. Chair Pressel hopes to earn an interim committee assignment to dive into the topic further this summer, he tells your favorite transportation newsletter.
“If we could separate the two and say, ‘Is this really about dollars because the state of Indiana is collecting dollars for that service,’ or is this about somebody’s data being put out to somebody selling me an insurance policy?” Rep. Pressel pondered. “So that’s not happening, but I think it’s fair to be transparent with the public, and let’s have that conversation. And do we need to do something?”
Can legislators reach a middle ground with the BMV and affected industries? He’s not sure yet. Pressel recognizes that those who testified against HB 1027 on Monday had good reasons to be concerned, in his eyes.
“I don’t know, but it’s a great conversation. If there’s a way to thread the needle, we’ll get to that,” Rep. Pressel commented. “I think it’s a great summer study.”