Title: An act relating to identification documents.

Brief Description: Addressing the reading and handling of certain identification documents.

Sponsors: Representatives Eddy, Pedersen, Appleton, Lantz, Williams, Upthegrove, Santos, Simpson, Hasegawa, Ericks, Ormsby and Springer.

Brief History:

Technology, Energy & Communications: 1/30/08, 2/1/08 [DPS].

HOUSE COMMITTEE ON TECHNOLOGY, ENERGY & COMMUNICATIONS

Majority Report: The substitute bill be substituted therefor and the substitute bill do pass. Signed by 11 members: Representatives McCoy, Chair; Eddy, Vice Chair; Crouse, Ranking Minority Member; McCune, Assistant Ranking Minority Member; Herrera, Hudgins, Hurst, Kelley, Morris, Takko and Van De Wege.

Minority Report: Do not pass. Signed by 1 member: Representative Hankins.

Staff: Kara Durbin (786-7133).

Background:

Western Hemisphere Travel Initiative: In April 2005 the Departments of State and Homeland Security announced the Western Hemisphere Travel Initiative (Initiative), which requires individuals entering or re-entering the United States to present a passport or other federally-approved identification or proof-of-citizenship document.

The identification requirements of the Initiative for persons entering or re-entering the United States by land or sea take effect January 31, 2008.

Washington's Enhanced Driver's License: In 2007 the Legislature enacted ESHB 1289, which authorized the Department of Licensing (DOL) to issue a voluntary enhanced driver's license or identicard (EDL/ID) to all applicants who, in addition to meeting all other driver's license or identicard requirements, provide the DOL with proof of U.S. citizenship, identity, and state residency. The EDL/ID uses Radio Frequency Identification (RFID) technology, a wireless technology that stores and retrieves data remotely. A RFID chip is embedded in each EDL/ID and contains a unique reference number. At the border crossing station, a RFID reader uses electromagnetic waves to energize the tag and collect this reference number. The reader converts the radio waves reflected back from the RFID tag into digital information and transmits it to the Customs and Border Protection network, which is an encrypted, secure network. The reference number is compared to the Customs and Border Protection's records to verify that an individual's identity matches the information printed on the front of their EDL/ID card.

Collection of Personal Information from an Identification Document: There are no state laws that prohibit or restrict a non-governmental entity from using or distributing personal information gained through an EDL/ID or other identification card or document.
            
Public Records Act: Each state and local agency is required under the Public Records Act to make all public records available for public inspection and copying unless the record is exempted from disclosure. Examples of records exempted in statute include:

• personal information on students in public schools, patients or clients of public institutions or public health agencies, or welfare recipients;
• information revealing the identity of persons who are witnesses to, or victims of, crime;
• test questions, scoring keys, and other examination data used to administer a license, employment, or academic examination;
• financial and valuable trade information; and
• credit card numbers, debit card numbers, electronic check numbers, card expiration dates, or bank or other financial account numbers supplied to an agency for the purpose of electronic transfer of funds.

Summary of Substitute Bill:

Non-governmental Entities: A non-governmental entity may only electronically read an individual's driver's license or identicard to: (1) verify the authenticity of the document; (2) verify the individual's age or identity; or (3) comply with federal or state laws or regulations.

A business may only verify a consumer's age for two purposes: (1) to provide an age-restricted good or service; or (2) to provide a service for which there is a discount based on the consumer's age. A business may only verify a consumer's identity and the accuracy of personal information submitted by a consumer when the consumer pays with a method other than cash or returns an item.

A non-governmental entity may not store, sell, or share personal information collected from a driver's license or identicard unless the information is being stored, sold, or shared for the purposes of preventing fraud.

Any personal information collected from the driver's license or identicard must be destroyed within 60 days.                

A business may not deny a consumer a good or service if the consumer exercises his or her right under this bill to: (1) not allow his or her driver's license to be read electronically for other purposes; or (2) not allow the storage, sale, or sharing of personal information, unless it is required by federal or state laws or regulations requiring identification verification.

Governmental Entities: A governmental entity may only electronically read an individual's driver's license or identicard if:
(1)   the individual knowingly makes the driver's license or identicard available to the governmental agency; or
(2)   the governmental agency lawfully seizes the driver's license or identicard.

A governmental entity or non-governmental entity may electronically read a driver's license or identification document to provide emergency assistance when an individual is unconscious or otherwise unable to make the driver's license or identicard available.

Civil Remedies: An individual whose personal information is read, stored, shared, sold, or otherwise used in violation of this bill may bring a civil action to recover actual damages, or $1,000, whichever is greater, and equitable relief, if available. The court shall award a prevailing individual reasonable costs and attorneys' fees. The court may allow up to three times the damage award if the violation is found to be willful or knowing.

Consumer Protection Act: A violation of this bill is a violation of the Consumer Protection Act.

Public Records Act Exemptions: A public records exemption is created for documents and related materials, including scanned images, used to establish identity, age, a residential address, a Social Security number, or other personal information required in connection with an application for a driver's license or identicard.

A public records exemption is created for personally identifying information collected through a driver's license or identicard containing radio frequency identification or similar technology used to facilitate border crossing.

Substitute Bill Compared to Original Bill:

The substitute bill allows a non-governmental entity to electronically read a driver's license or identicard to provide emergency assistance. The substitute bill creates some exceptions for when reading a driver's license or identicard may be permitted in order to comply with federal or state laws or regulations requiring identification verification. The substitute bill includes in the public records exemption scanned images of documents required to apply for a driver's license or identicard. The substitute bill requires that personal information collected from a driver's license or identicard be destroyed within 60 days, rather than 30 days. The substitute bill makes technical changes to the public records exemptions.

Appropriation: None.

Fiscal Note: Not requested.

Effective Date of Substitute Bill: The bill takes effect 90 days after adjournment of session in which bill is passed.

Staff Summary of Public Testimony:

(In support) Privacy and security are a zero-sum game. We need to attempt to lessen the damage going forward in term of privacy. The two-dimensional bar code on driver's licenses is not encrypted and the information on it can be easily captured. The radio frequency identification (RFID) tag in the enhanced driver's license also raises concerns. Information about a consumer should not be captured without the consumer's knowledge or actual consent.

The problems with RFID technology are threefold: (1) it can be read from several feet away; (2) the information is not encrypted; and (3) there is no way for the individual to know that the tag is being read at any given time.

There is an active market for difficult-to-acquire data. Many of the RFID chips cannot be encrypted in order to have a higher level of security.

A public education campaign would be helpful so that citizens and merchants are informed of this change. It may be hard for consumers to know when the provisions in this bill have been violated.

(With concerns) Financial institutions need to use and retain personal information from driver's licenses in order to comply with federal law. A technical fix is being offered to address this issue.

(Opposed) None.

Persons Testifying: (In support) Representative Eddy, prime sponsor; Jennifer Shaw, American Civil Liberties Union Washington; Magda Balazinska; Dan Kaminsky, IOActive; and Riana Pfefferkorn.

(With concerns) Gary Gardner, BECU.

Persons Signed In To Testify But Not Testifying: None.