alpha
Lesson 20 of 20 Outline

Dealer education / After the sale. Lesson 20 of 20. 8 minutes.

Records, customer data and the DMV's access to them

After this lesson you can

  • Know which business records the DMV requires, where they must be kept and for how long.
  • Say what an investigator may inspect and what confidential DMV records a dealer may not misuse.
  • Protect a buyer's credit information under the FTC Safeguards Rule.

Which records, where, for how long

Vehicle Code 320 defines your established place of business as the place where the books and records of the business are kept. Under 13 CCR 272.00, every record kept in the regular course of business that concerns the purchase, sale, rental or lease of a vehicle is open to inspection, and all of them stay at least three years unless another law says longer. Two clocks run longer. The dealer's copy of each Report of Sale stays four years (DMV Vehicle Industry Registration Procedures Manual, 8.020, read 2026-10-22). Each odometer disclosure statement you issue or receive, and each power of attorney, stays five years at your primary place of business, filed so it can be found (49 CFR 580.8). And since October 1, 2026, Civil Code 1784.44 adds its own list: ads and price quotes, signed purchase and finance papers, add-on disclosures, cancellation requests and refunds, and written complaints, each kept two years from the day it was made, in any legible form (OLIN 2026-10).

13 CCR 272.02 says where. The original paper records of a deal stay at the principal place of business, or at the branch where the deal happened, for 90 days. After that they may move to offsite storage in California, if you can produce them for the DMV within three business days. You may scan them at any time, and after the 90 days a scan serves for the rest of the three years, provided the electronic copy cannot be altered, is legible and complete, is retrievable on three business days' notice, and sits behind access controls and physical security. Once the scan qualifies, the paper may go, shredded, erased or otherwise made unreadable (Civil Code 1798.81). Hiring a storage or scanning company does not move the duty to produce (272.02(c)).

What an investigator may inspect, and when

A DMV investigator may inspect the records 272.00 describes at the place of business, or within three business days when they are offsite (272.02). Report of Sale forms and books are the department's property, which it may take up for inspection at any time (Vehicle Code 11714(e); manual, 8.020). A separate authority reaches the cars: a Highway Patrol officer, or a police, sheriff's or district attorney investigator whose primary duty is vehicle theft, may inspect any vehicle on a used car lot, and its title and registration, to establish rightful ownership, and must interfere with business as little as possible (Vehicle Code 2805).

Confidential DMV records you reach through a business partner

A dealer in the Business Partner Automation program processes registrations through a first-line service provider (Vehicle Code 1685; manual, 2.015). Access to the reporting system is restricted to authorized users (Vehicle Code 4456.2(c)) and ends the moment a license is no longer valid (OLIN 2024-08). The program's regulations say a business partner may use information from the DMV or a customer only for the purposes the program authorizes, and that all of it is confidential under Vehicle Code 1808.21, 1808.45, 1808.46 and 1808.47 (13 CCR 225.33); 225.51 binds the partner, its owners and its employees to the DMV's security requirements.

Those four sections carry the penalties. 1808.21 makes every residence address in a DMV record confidential. 1808.45 makes the willful unauthorized disclosure of DMV information, or its use for a purpose other than the one stated in the request, a misdemeanor, with a fine up to $5,000 and up to a year in county jail. 1808.46 adds a civil penalty up to $100,000 and suspension of requester privileges for up to five years, or revocation. 1808.47 requires anyone with access to confidential DMV information to set procedures protecting it and to bind any agent the same way. Running a plate for a friend, or looking up the address of a buyer who stopped paying, is the misuse these sections punish.

The OL 2000 outline groups this with the other unlawful dealer activities, and a record proves or disproves each: misuse of special plates (11713(j)); lending dealer supplies or permitting misuse of the license or books (11713(m)); selling at an unlicensed location (11714(b)); failure to pay the administrative service fee that 4456.1 attaches to a late report; a dishonored check to the department (11705(a)(13)); failure to transfer title (11705(a)(4)); employing an unlicensed salesperson, or failing to notify the DMV within 10 days of a hire or termination (11713(h)); bait and switch (11713(a) and (b)); and bird dog fees, since a person paid to steer a buyer to you is a salesperson under Vehicle Code 675 and needs the license 11800 requires.

A buyer's credit application

A buyer who finances with you, or whose financing you arrange, hands you a federal duty. The FTC's Safeguards Rule, 16 CFR part 314 as amended in 2021, treats a dealer that finances or arranges financing, or leases for more than 90 days, as a financial institution (314.2(h); FTC auto dealer FAQ, 2025). Cash buyers are outside it. The rule requires a written information security program (314.4): a Qualified Individual who runs it; a written risk assessment, repeated periodically; access controls; encryption of customer information in transit and at rest; multi-factor authentication for anyone reaching the systems; secure disposal within two years after the last use of the information; training; service providers bound by contract and checked; a written incident response plan; and a written report to the owners at least once a year. A dealer holding information on fewer than 5,000 consumers is excused from the written risk assessment, the annual penetration test, the written incident response plan and the annual report (314.6).

A notification event, added by the 2023 amendment, is the unauthorized acquisition of unencrypted customer information involving at least 500 consumers. You tell the FTC through its online form as soon as possible and within 30 days of discovery (314.4(j), in force since May 2024). California adds its own notice: a business holding computerized personal information tells each affected California resident within 30 calendar days, in a notice titled "Notice of Data Breach" under the headings the statute prescribes (Civil Code 1798.82).

The Privacy Rule, 16 CFR part 313, applies to motor vehicle dealers under the FTC's authority (313.1); a dealer that keeps its own contracts instead of assigning them follows the CFPB's twin, Regulation P (12 CFR part 1016), with the same notices. A buyer who signs a retail installment contract or lease with you is your customer and receives your privacy notice no later than signing, even when you assign the contract the same day (313.4; FTC Privacy Rule FAQ). An annual notice follows while the relationship lasts, unless you share only under the rule's exceptions and your practices have not changed (313.5(e)). Before sharing a customer's information with a nonaffiliated third party outside the exceptions, you give an opt-out notice and time to use it (313.7 and 313.10). Assigning the contract to the lender is one of the exceptions (313.14).

The Red Flags Rule, 16 CFR 681.1, reaches a creditor that regularly obtains consumer reports in connection with credit, furnishes information to a credit bureau or advances funds, which is any dealer that pulls credit. An auto loan is a covered account. The rule wants a written Identity Theft Prevention Program that identifies the red flags of identity theft in your accounts, detects them, responds to them and is updated, approved by the owners, with staff trained and service providers overseen. Appendix A to part 681 sorts red flags into five kinds: alerts from a credit bureau, suspicious documents, suspicious personal information, suspicious account activity, and notice from a customer or the police. When a credit file is done, the FTC's Disposal Rule and Civil Code 1798.81 agree: burn, pulverize or shred paper, erase media, or hire a disposal company you have vetted (16 CFR 682.3).

Sources

  • Vehicle Code 320, the established place of business; 11714(e), books and forms as DMV property; 2805, inspection of vehicles on a dealer's lot, read 2026-10-22.
  • 13 CCR 272.00 and 272.02, business records and their location, read 2026-10-22.
  • Vehicle Code 1685, the Business Partner Automation program; 4456.2(c), access to the reporting system; 13 CCR 225.33 and 225.51, use of information and information security, read 2026-10-22.
  • Vehicle Code 1808.21, 1808.45, 1808.46 and 1808.47, confidential DMV records and their misuse.
  • Vehicle Code 11713(a), (b), (h), (j) and (m), 11714(b) and 11705(a)(4) and (13), the unlawful activities named; 675, who is a vehicle salesperson; 11800, the salesperson license.
  • Civil Code 1784.44, the CARS Act's two-year records, read 2026-10-22; 1798.81, disposal of customer records; 1798.82, notice of a data breach, read 2026-10-22.
  • 16 CFR 314.2, 314.4 and 314.6, the Safeguards Rule; 16 CFR 313.1, 313.4, 313.5, 313.7, 313.10 and 313.14, the Privacy Rule; 12 CFR 1016.1, Regulation P's scope; 16 CFR 681.1 and its Appendix A, the Red Flags Rule; 16 CFR 682.3, the Disposal Rule; 49 CFR 580.8, odometer record retention, read 2026-10-22.
  • FTC, Automobile Dealers and the FTC's Safeguards Rule, FAQ (2025); FTC's Privacy Rule and Auto Dealers, FAQ; Fighting Identity Theft with the Red Flags Rule, a guide for business (2013), read 2026-10-22.
  • DMV, Vehicle Industry Registration Procedures Manual, sections 2.015 and 8.020; OLIN 2024-08 and OLIN 2026-10, read 2026-10-22.
  • DMV, Lesson Plan Guidelines for Used Vehicle Dealer Education Programs, OL 2000 (rev. 12/2007).