Brief Description: Expanding the guidelines for identification documents.

Sponsors: Representatives Nixon and Simpson.

Hearing Date: 1/20/06

Staff: Kara Durbin (786-7133).

Background:

Radio Frequency Identification (RFID) is a tagging and tracking technology that uses tiny electronic devices equipped with antennae, which can transmit identifying information to a remote reader. The information gathered by the reader can be stored or matched to an existing record in a database.

RFID tags can be read at a distance without the knowledge of the person who carries the tag. A tag reader can extract the information in an RFID tag from anywhere between a few inches to up to 750 feet, depending on the type of tag. According to the U.S. Government Accountability Office, even the simplest RFID tags can be read up to 20 feet away.

At the federal level, several major initiatives are underway to use the technology. Many agencies propose using RFID to include physical and logical access control and tracking of various objects such as shipments, baggage on flights, documents, radioactive materials, evidence, weapons, and assets. Several agencies have initiated pilot programs to evaluate the use of RFID in specific applications. The Department of Homeland Security, for example, is currently testing e-Passports at the San Francisco International Airport. An e-Passport is a passport that contains the holder's biographic information and a biometric identifier, such as a digital photograph, embedded in a contactless chip that is set in the passport. Biometric identifiers provide inspectors a further means by which the identity of visitors can be verified.

There are no federal or state laws specifically prohibiting or restricting the use of RFID.

Summary of Bill:

A state or local agency must not issue an identification document that contains a contactless integrated circuit or other device that can broadcast personal information or enable personal information to be scanned remotely, except for a few limited purposes.

A state or local agency may give an identification document that contains a contactless integrated circuit to certain individuals under the following limited circumstances:

• To a person who is incarcerated in a state prison, county jail, juvenile facility, or housed in a mental health facility pursuant to a court order after having been charged with a crime; or
• To a person who subject to court-ordered electronic monitoring;
• To a driver for use on a toll road or bridge for the purpose of collecting a toll for use of the road or bridge; or
• To a patient who is in the care of a government-operated hospital, ambulatory surgery center, or oncology or dialysis clinic, so long as the identification document is valid for only a single visit and is removed when the patient is discharged.

If an identification document is given to an individual for one of these purposes, the identification may not contain, transmit, or enable remote scanning of any personal information other than an encrypted unique identifier number. The identification document must also use technology to resist cloning and spoofing.

In addition, the issuing entity must communicate in writing to the person who is being issued the identification document all of the following information:

(1) the identification document contains a circuit or device that can broadcast a unique identifier number or enable that number to be scanned remotely without his or her knowledge;

(2) countermeasures, such as a shield device, may be used to help control the risk of the identifier number being broadcasted or scanned remotely; and

(3) the types of locations of all scanners and readers used by the issuing authority or any other entity known to read the unique identifier number on the identification document.

A person or entity must not use radio waves to remotely scan or attempt to remotely scan a person's identification document without that person's knowledge. If a person violates this prohibition, he or she is guilty of a gross misdemeanor. A person claiming that his or her identification document was scanned may bring a legal action in court and seek damages. An injured person is entitled to actual damages, including damages for mental pain and suffering endured on account of the violation, or liquidated damages computed at the rate of $100 per day for each day of the violation, not to exceed $1,000, plus reasonable attorneys' fees and other litigation costs.

Appropriation: None.

Fiscal Note: Not requested.

Effective Date: The bill takes effect 90 days after adjournment of session in which bill is passed.