A Minnesota woman filed a lawsuit today against the Minnesota Department of Public Safety (DPS), alleging that state officials failed to keep her old and new identities separated in driver’s license databases after numerous violent attacks by her ex-husband, who has been a fugitive for nearly two decades.

“This is a case about a woman living in fear who has done everything in her capacity to protect both her and her daughter from her ex-husband, one of America’s most wanted men,” opens a lawsuit filed this morning, alleging violations of the Driver’s Privacy Protection Act and invasion of privacy.

That man evaded the grasp of law enforcement after violently attacking his ex-wife, being convicted of felony assault, and being handed a lenient probation sentence—which he violated. Before disappearing, he allegedly told the woman, “You can live in fear wondering if I am dead or alive.”

According to a City Pages profile of fugitives featured on America’s Most Wanted, he “talked about his interest in bomb-making, his fascination with militias and his hatred of the government. He owned several guns, including an AK-47 assault rifle. He admitted to police that he enjoyed working with poisons like potassium cyanide and liquid nicotine.”

In the intervening years, the man’s ex-wife took dramatic measures to protect herself and her daughter, including changing her name, getting a new Social Security Number, and obtaining a court order requiring DPS to ensure that any links between her old and new identities were obliterated. In 2006, she moved to a rural community in outstate Minnesota, but months later, her ex-husband was spotted in town.

According to court documents, she immediately moved again, and was later contacted by the local police department wishing to talk to her about her ex-husband. But the woman was confused as to how the police department found her: they said they searched DPS databases using her old identity, but found her new name and address. The woman contacted DPS to inform them her identities were linked in violation of the court’s order, and that her security was in jeopardy.

They never fixed the problem, the woman alleged in the lawsuit, and two months later a man she believes was sent by her ex-husband attacked her. In February 2010, the man was featured on America’s Most Wanted, and throughout the year she received threatening phone calls she believed were from him. Twice in 2011 and once in 2013, the woman was hospitalized after he found her and attacked.

In each assault, police reports were supposed to be confidential, but in 2012 the woman found out that local police department had been automatically sending copies of those police reports to her landlord, including reports under both her previous and new identities. The police department is not named in the lawsuit.

After a few quiet years, she recently found a note on her windshield, and later was attacked by him. Trying to figure out how the man found her, she requested a list of who had accessed her driver’s license. She was told there were 35 separate inquiries. Court documents quote a DPS official as saying, “I can’t believe [another DPS employee] put [the records] in that way,” promising to “break the link” between her old and new identities.

She moved again, but continued to receive phone calls threatening her life. So far this year, she says her ex-husband—still a fugitive—has attacked her three times, putting her in the hospital, and telling her “the plan was being implemented” to “finish” her. Court documents allege DPS officials had a policy on what to do in situations like her’s, but that someone had made an error. One state staffer remarked that she was “glad that she wasn’t the one who had done it,” according to a court filing, but promised they would take corrective measures to protect her identity.

That apparently hasn’t worked, she said in the legal complaint: this summer, she received several threatening letters from him, “each accompanied by a dead rodent.” The man remains a fugitive on a Minnesota county’s most wanted list.

The lawsuit alleges the state was prohibited from releasing her data by court order and law, but that officials “willfully and recklessly disregarded” their duties. The suit seeks damages in an unspecified amount.

For years, DPS officials have lobbied the Legislature to resist proposals to make it easier for Minnesotans to know who accessed their private driver’s license records and photographs. Currently, drivers can request a list of when their data has been accessed, but—due to DPS interpretation of a 2003 law originally enacted to protect browser cookie data—individuals cannot find out who accessed their data. As a result, a lawsuit is the only way to investigate privacy concerns involving driver’s license record access.