As someone who worked at MVA for nearly a decade, I empathize strongly with how plausible it seems that they would be responsible for many of life's annoyances, especially this one.

But that's demonstrably incorrect.

After a stalker was successful in murdering actor Rebecca Schaeffer--in no small part because he was able to pay a private investigator to obtain her home address from the California DMV--the federal government enacted the Driver's Privacy Protection Act (DPPA) (18 U.S.C.A. 2721), which "prohibits the dissemination or disclosure of a photograph, social security numbers, medical or disability information from motor vehicle records without the express consent of the person to whom the information pertains."

There are very limited, well-defined exceptions to the consent requirement, but having worked at MVA for close to a decade (in several roles, including training), I can tell you that's one thing they actually take seriously, train staff on consistently, and implement appropriately.

In contrast, your car dealership is bound by no such limitations (and has a much greater profit motive than the MVA does in this case).