SHB 2729

HOUSE BILL REPORT
SHB 2729

This analysis was prepared by non-partisan legislative staff for the use of legislative members in their deliberations. This analysis is not a part of the legislation nor does it constitute a statement of legislative intent.

As Passed House:
February 7, 2008

Brief Description: Addressing the reading and handling of certain identification documents.

Sponsors: By House Committee on Technology, Energy & Communications (originally sponsored by Representatives Eddy, Pedersen, Appleton, Lantz, Williams, Upthegrove, Santos, Simpson, Hasegawa, Ericks, Ormsby and Springer).

Majority Report: The substitute bill be substituted therefor and the substitute bill do pass. Signed by 11 members: Representatives McCoy, Chair; Eddy, Vice Chair; Crouse, Ranking Minority Member; McCune, Assistant Ranking Minority Member; Herrera, Hudgins, Hurst, Kelley, Morris, Takko and Van De Wege.

Background:

Western Hemisphere Travel Initiative: In April 2005 the Departments of State and Homeland Security announced the Western Hemisphere Travel Initiative (Initiative), which requires individuals entering or re-entering the United States to present a passport or other federally-approved identification or proof-of-citizenship document.

The identification requirements of the Initiative for persons entering or re-entering the United States by land or sea take effect January 31, 2008.

Washington's Enhanced Driver's License: In 2007 the Legislature enacted ESHB 1289, which authorized the Department of Licensing (DOL) to issue a voluntary enhanced driver's license or identicard (EDL/ID) to all applicants who, in addition to meeting all other driver's license or identicard requirements, provide the DOL with proof of U.S. citizenship, identity, and state residency. The EDL/ID uses Radio Frequency Identification (RFID) technology, a wireless technology that stores and retrieves data remotely. A RFID chip is embedded in each EDL/ID and contains a unique reference number. At the border crossing station, a RFID reader uses electromagnetic waves to energize the tag and collect this reference number. The reader converts the radio waves reflected back from the RFID tag into digital information and transmits it to the Customs and Border Protection network, which is an encrypted, secure network. The reference number is compared to the Customs and Border Protection's records to verify that an individual's identity matches the information printed on the front of their EDL/ID card.

Collection of Personal Information from an Identification Document: There are no state laws that prohibit or restrict a non-governmental entity from using or distributing personal information gained through an EDL/ID or other identification card or document.

Public Records Act: Each state and local agency is required under the Public Records Act to make all public records available for public inspection and copying unless the record is exempted from disclosure. Examples of records exempted in statute include:

Summary of Substitute Bill:

Non-governmental Entities: A non-governmental entity may only electronically read an individual's driver's license or identicard to: (1) verify the authenticity of the document; (2) verify the individual's age or identity; or (3) comply with federal or state laws or regulations.

A business may only verify a consumer's age for two purposes: (1) to provide an age-restricted good or service; or (2) to provide a service for which there is a discount based on the consumer's age. A business may only verify a consumer's identity and the accuracy of personal information submitted by a consumer when the consumer pays with a method other than cash or returns an item.

A non-governmental entity may not store, sell, or share personal information collected from a driver's license or identicard unless the information is being stored, sold, or shared for the purposes of preventing fraud.

Any personal information collected from the driver's license or identicard must be destroyed within 60 days.

A business may not deny a consumer a good or service if the consumer exercises his or her right under this bill to: (1) not allow his or her driver's license to be read electronically for other purposes; or (2) not allow the storage, sale, or sharing of personal information, unless it is required by federal or state laws or regulations requiring identification verification.

Governmental Entities: A governmental entity may only electronically read an individual's driver's license or identicard if:
(1)   the individual knowingly makes the driver's license or identicard available to the governmental agency; or
(2)   the governmental agency lawfully seizes the driver's license or identicard.

A governmental entity or non-governmental entity may electronically read a driver's license or identification document to provide emergency assistance when an individual is unconscious or otherwise unable to make the driver's license or identicard available.

Civil Remedies: An individual whose personal information is read, stored, shared, sold, or otherwise used in violation of this bill may bring a civil action to recover actual damages, or $1,000, whichever is greater, and equitable relief, if available. The court shall award a prevailing individual reasonable costs and attorneys' fees. The court may allow up to three times the damage award if the violation is found to be willful or knowing.

Consumer Protection Act: A violation of this bill is a violation of the Consumer Protection Act.

Public Records Act Exemptions: A public records exemption is created for documents and related materials, including scanned images, used to establish identity, age, a residential address, a Social Security number, or other personal information required in connection with an application for a driver's license or identicard.

A public records exemption is created for personally identifying information collected through a driver's license or identicard containing radio frequency identification or similar technology used to facilitate border crossing.

Effective Date: The bill takes effect 90 days after adjournment of session in which bill is passed.

Staff Summary of Public Testimony:

(In support) Privacy and security are a zero-sum game. We need to attempt to lessen the damage going forward in term of privacy. The two-dimensional bar code on driver's licenses is not encrypted and the information on it can be easily captured. The radio frequency identification (RFID) tag in the enhanced driver's license also raises concerns. Information about a consumer should not be captured without the consumer's knowledge or actual consent.

The problems with RFID technology are threefold: (1) it can be read from several feet away; (2) the information is not encrypted; and (3) there is no way for the individual to know that the tag is being read at any given time.

There is an active market for difficult-to-acquire data. Many of the RFID chips cannot be encrypted in order to have a higher level of security.

A public education campaign would be helpful so that citizens and merchants are informed of this change. It may be hard for consumers to know when the provisions in this bill have been violated.

(With concerns) Financial institutions need to use and retain personal information from driver's licenses in order to comply with federal law. A technical fix is being offered to address this issue.

(Opposed) None.

Persons Testifying: (In support) Representative Eddy, prime sponsor; Jennifer Shaw, American Civil Liberties Union Washington; Magda Balazinska; Dan Kaminsky, IOActive; and Riana Pfefferkorn.

(With concerns) Gary Gardner, BECU.