Minnesota legislative auditor subpoenas Department of Public Safety over mishandled data

Legislative Auditor Jim Nobles used his subpoena power for the first time in his 35-year career after the state Department of Public Safety (DPS) refused to turn over information about data wrongfully turned over to private companies late 2018.

Nobles told legislators Thursday that he is seeking information about an incident in which the addresses of 1,500 people who registered their vehicles with the state were provided to three private companies.

The Minnesotans affected had requested that their information be kept private when they registered their vehicles, but the records were "inadvertently" sent to three companies — Experian, Polk and Safety First, which are authorized to receive it by the state, according to public safety officials.

"That was a shocking revelation," said state Sen. Ann Rest, DFL-New Hope, who was chairwoman of the audit subcommittee when Nobles testified about the subpoena.

Rep. Paul Torkelson, R-Hanska, who has conducted aggressive oversight of the state's vehicle licensing and registration system, known as MNLARS, called it "astonishing."

Department spokesman Bruce Gordon said in an e-mail that DPS was in the process of gathering and preparing the information the auditor requested when they received the subpoena.

"The auditor has received all information he requested," Gordon said.

Regarding the information that leaked to the private companies, DPS said previously that "there was no data breach," and there's no indication "that private data has been accessed or used unlawfully."

State and federal law requires DPS Driver and Vehicle Services to provide motor vehicle information to the companies, which use it for various purposes, including the administration of safety recalls. Names and addresses for Minnesota vehicle records are not considered public data.

State information technology officials have made the necessary changes to the bulk motor vehicle file, removing the records of people who requested that their personal information remain private, Gordon said previously.