Also, using the 'one is too many' argument is not valid. We could apply that to outlaw cars, electricity, or any other thing that is accepted as useful but also kills people. The DPPA law allows debt collectors, repo men, and other neccessary societal systems to function while providing protection for the data. If there have been only a handful of incidents over the years, then I think it would still be a net gain for society. If there is a better way to regulate the data and still allow the systems in society to function, that would be great to explore, but I don't see any obvious improvements.
You're wrong. They can function just fine without data from the DVM. Therefore, anybody being harmed by the sale of this data is one too many because there is nothing to offset this harm. Some harm is acceptable when it's offset by something else, like the utility of cars. That is not the case here.
Also, where is your evidence that someone has be hurt?
Work a little bit harder doing some old fashioned detective work instead of just paying the DMV for their records? It's a bit more work for them but I don't give a damn. Your suggestion that they'd be up shit creek without the DMV is just flat wrong.