Oregon DMV Needs to Better Protect Driver Data and Improve Services for People with Limited English Proficiency, Audit Finds

Oregon Division of Driver and Motor Vehicle Services need to do a better job translate its online web portal for non-English speakers and ensure customer data is secure, according to a mostly positive audit.

The report released Wednesday by the Audit Division of the Secretary of State’s Office does not address the DMV’s latest high-profile data problem: revelations that information sent incorrectly so that 1,561 people who did not prove their citizenship to election officials were automatically registered to vote. At least 10 of the incorrectly registered voters voted, although election officials have since determined that five of those 10 were citizens when they voted.

Gov. Tina Kotek ordered a pause on the automatic voter registration program until an independent third-party audit is completed. That report is expected by the end of the year.

The audit also did not address a May 2023 hack that compromised personal information, including birthdates, addresses and driver’s license numbers, of approximately 3.5 million Oregonians. The MOVEit file transfer service hack affected more than 2,700 agencies and organizations and more than 95 million people worldwide.

Two Oregonians, Caery Evangelist and Brian Els, filed a class-action lawsuit in Marion County Circuit Court in April over the 2023 hack. The state is seeking to dismiss the lawsuit and a judge scheduled a November call to set a date. for a hearing on that motion.

Instead, the state audit looked at how the DMV, which has nearly 900 employees and a two-year budget of $311 million, assesses and collects fees and how well its newly expanded online services are working. Auditors found that the DMV and its computer systems are accurately assessing fees for the approximately 200,000 new driver’s licenses and more than 350,000 renewals it processes each year, as well as vehicle registrations, titles and license plates.

Registration and title fees vary depending on the license plate design, the county where the driver lives, the age of the vehicle, and fuel efficiency. Auditors analyzed all driver and vehicle transactions during fiscal year 2023 (more than 20 million rows of data) and found that 99.6% of those transactions were complete, accurate and valid.

But they also found that Oregonians who speak no English or have limited English proficiency have difficulty using the state’s online portal to renew licenses, vehicle registrations and update addresses. That portal, DMV2U, relies on Google Translate to translate addresses into other languages, and auditors found that it didn’t work well on mobile devices and often didn’t translate site content.

The audit also found that the DMV was not doing enough to ensure that employees could access only the data they needed and close accounts when employees quit.

“Without strong access controls, unauthorized individuals can surreptitiously access sensitive data, copy it, and potentially make undetected modifications or deletions for malicious intent or personal gain,” the report says.

DMV Administrator Amy Joyce wrote in a letter attached to the audit that she agreed with each of the auditor’s recommendations, which included having a more diverse group of people test its online services and periodically reviewing access to the devices. DMV data.

— Julia Shumway, Oregon Capital Chronicle

Oregon Capital Chronicle is part of States Press Roomthe nation’s largest state-focused nonprofit news organization.