Oregon Driver and Motor Vehicle Services Division must do a better job to translate its online web portal for non-English speakers and ensure customer data is secure, an overwhelmingly positive review found.

The report released Wednesday by the audit division of the secretary of state’s office does not address the DMV’s latest high-profile data issue: revelations that the incorrectly sent information for 1,561 people who did not prove citizenship for election officials to automatically register them to vote. At least 10 of the incorrectly registered voters went on to vote, although election officials have since determined that five of those 10 were citizens when they voted.

Gov. Tina Kotek ordered a pause in the automatic voter registration program until an independent external audit is completed. That report is expected at the end of the year.

The review also did not address a hack in May 2023 that compromised personal information, including birth dates, addresses and driver’s license numbers, of about 3.5 million Oregonians. The hack of the file transfer service MOVEit affected more than 2,700 other agencies and organizations and more than 95 million individuals worldwide.

Two Oregonians, Caery Evangelist and Brian Els, filed a class-action lawsuit in Marion County Circuit Court in April over the 2023 hack. The state is seeking to dismiss the lawsuit, and a judge has scheduled a call in November to set a date for a hearing on that motion.

Instead, the state audit looked at how the DMV — which has nearly 900 employees and a two-year budget of $311 million — assesses and collects fees and how well its recently expanded online services work. Auditors found that the DMV and its computer systems correctly assess fees for the approximately 200,000 new driver’s licenses and more than 350,000 renewals it processes each year, as well as for vehicle registrations, titles and license plates.

Fees for registrations and titles vary depending on the design of the plate, the county where the driver lives, the age of the vehicle and fuel efficiency. Auditors looked at all driver and vehicle transactions through fiscal year 2023 – more than 20 million rows of data – and found that 99.6% of those transactions were complete, accurate and valid.

But they also found that Oregonians who don’t speak English or have limited English skills struggle to use the state’s online portal to renew licenses, vehicle registrations and update addresses. That portal, DMV2U, relies on Google Translate to translate directions into other languages, and auditors found that it did not work well on mobile devices and often failed to translate website content.

The audit also found that the DMV did not do enough to ensure that employees could only access the data they needed and to close accounts when employees left.

“Without robust access controls, unauthorized persons may surreptitiously access sensitive data, copy it, and potentially make undetected changes or deletions for intent or personal gain,” the report said.

DMV Administrator Amy Joyce wrote in a letter accompanying the audit that she agreed with each of the auditor’s recommendations, which included having a more diverse group of people test its online services and regularly reviewing access to DMV data.

— Julia Shumway, Oregon Capital Chronicle

The Oregon Capital Chronicle is part of The state’s newsroomthe country’s largest government-oriented non-profit news organization.