The Loophole the DMV Uses to Sell Your Data to Private Investigators

As Department of Motor Vehicles (DMVs) around the country sell drivers' personal information to private businesses, including names, addresses, and more, some private investigators Motherboard spoke to said the reasons investigators can present to the DMV to access driver data are overbroad, leaving open the possibility of abuse.

"We need the data to do our work but there is little controls [sic] of this data and it's dangerous," Igor Ostrovskiy, a New York based private investigator with Ostro Intelligence, told Motherboard.

Private investigators can buy this data because of the Drivers' Privacy Protection Act (DPPA), a law written in the 1990s before privacy became the stronger cultural focus that it is today and which governs how DMVs can sell driver data. Multiple senators have criticized the sale of such data, and experts called for changes in legislation in how DMVs distribute the information of drivers to other entities, including to private investigators. 

When accessing DMV data, a private investigator may go straight to the DMV and register as a commercial requester, or buy records via a reseller service. Either service will likely present them with a form, asking them what their use of the data is.

"When you select the type of search you want, enter the info you have, the fields beneath are for permissible purpose. An end user must complete the form on every search," Valerie McGilvrey, a so-called skip tracer whose job involves locating people and who said she has accessed DMV data, told Motherboard in an online chat. McGilvrey said she has received DMV data on a CD; other DMVs provide a lookup tool online, Ostrovskiy said.

A section of the DPPA explicitly mentions private investigators, saying DMVs may disclose data, "For use by any licensed private investigative agency or licensed security service for any purpose permitted under this subsection."

Ostrovskiy said the most common uses he presented to the DMV were "fraud prevention and detection" or "antifraud activities." They also include gathering information for a lawsuit, or in "anticipation of litigation" before any legal action may have actually been taken. Ostrovskiy described some of these reasons as "really broad and up to interpretation."

"It’s so broad, how can you prove it anyways? I have a client who wants to stay anonymous until they file the suit or choose not to file. I have an NDA signed, I can’t reveal the info anyways. So I can’t really prove anticipation of litigation even if I had to," Ostrovskiy said. He said that some private investigators looking for more money will work for, say, stalkers. Many private investigators explicitly advertise their services as being able to surveil subjects, including those suspected of infidelity by their partners.

McGilvrey also said the permissible uses to access DMV data are broad. 

"When a database audits a PI for their searches under that term, the documentation requested can easily be faked," she added.

Dorian Bond, a private investigator with Bond Investigations, said that when DMVs ask what his permissible use is, he will show them the court case he is involved in, or the attorney he is working with.

"But sometimes you don't have a court case, you just have an insurance company," he said, so Bond will put down "insurance purposes" as his permissible use to access DMV data. Bond said most of his work covers insurance fraud investigations, which involves surveillance on people making insurance claims.

"We use it for legitimate uses," Bond said. (Bond's website includes a testimonial from an alleged customer who hired the firm to follow a suspected cheating spouse and surveilled them at an airport and elsewhere).

Bond said that private investigators go through multiple checks to receive their license from the state in the first place, may undergo audits for receiving DMV data, and face having their license revoked for abuse of data. Multiple DMVs previously told Motherboard they have cut-off data access to commercial requesters for misusing the information.

Lawmakers introduced the DPPA in 1994 after a stalker hired a private investigator who then obtained the address of actress Rebecca Schaeffer from the California DMV. The stalker went on to murder Schaeffer. The DPPA was designed to restrict the sale of drivers' data—the California DMV previously told Motherboard it would release addresses in "limited exceptions"—but this sort of data and more is still available elsewhere around the country.

"I certainly think that DPPA is riddled with loopholes that need to be closed," Lee Tien, senior staff attorney at activist group the Electronic Frontier Foundation (EFF) previously told Motherboard.

Last week, Motherboard published the full list of commercial requesters of data from the California DMV. The list included private investigators and bail bondsmen.

"The vast sale of Californians’ personal information to bail bondsmen, private investigators, and other bad actors is an appalling betrayal of the public’s trust," member of Congress Anna Eshoo, who represents California's 18th Congressional District and who led a group of nearly a dozen lawmakers in asking the California DMV questions on how and why it sells drivers' data, previously told Motherboard when presented with the findings.

In response, Francie Koehler, chair of the government affairs committee of the California Association of Licensed Investigators, wrote a letter to Eshoo saying, "Private investigators recognize that all of us together must continue to strive to protect the legitimate interests of individual citizens by ensuring that personal information is not disseminated inappropriately. Nevertheless, it is important to recognize and ensure that access to this information by licensed private investigators, with essential criteria and protections, serve beneficial interests worthy of protection when acting on behalf of the government, businesses, or citizens." Koehler also sent a copy of the letter to Motherboard.

"This law is like the saying that 'locks keep honest people out.' The law keeps honest people out but it’s easily susceptible to abuse or misuse," Ostrovskiy said of the DPPA.