SHB 2729

HOUSE BILL REPORT
SHB 2729

This analysis was prepared by non-partisan legislative staff for the use of legislative members in their deliberations. This analysis is not a part of the legislation nor does it constitute a statement of legislative intent.

As Passed Legislature

Brief Description: Addressing the reading and handling of certain identification documents.

Sponsors: By House Committee on Technology, Energy & Communications (originally sponsored by Representatives Eddy, Pedersen, Appleton, Lantz, Williams, Upthegrove, Santos, Simpson, Hasegawa, Ericks, Ormsby and Springer).

Passed House: 2/7/08, 95-0.
Senate Amended.
Passed Senate: 3/7/08, 47-0.
House Concurred.
Passed House: 3/10/08, 94-0.
Passed Legislature.

Majority Report: The substitute bill be substituted therefor and the substitute bill do pass. Signed by 11 members: Representatives McCoy, Chair; Eddy, Vice Chair; Crouse, Ranking Minority Member; McCune, Assistant Ranking Minority Member; Herrera, Hudgins, Hurst, Kelley, Morris, Takko and Van De Wege.

Background:

Western Hemisphere Travel Initiative: In April 2005 the Departments of State and Homeland Security announced the Western Hemisphere Travel Initiative (Initiative), which requires individuals entering or re-entering the United States to present a passport or other federally-approved identification or proof-of-citizenship document.

The identification requirements of the Initiative for persons entering or re-entering the United States by land or sea take effect January 31, 2008.

Washington's Enhanced Driver's License: In 2007 the Legislature enacted ESHB 1289, which authorized the Department of Licensing (DOL) to issue a voluntary enhanced driver's license or identicard (EDL/ID) to all applicants who, in addition to meeting all other driver's license or identicard requirements, provide the DOL with proof of U.S. citizenship, identity, and state residency. The EDL/ID uses Radio Frequency Identification (RFID) technology, a wireless technology that stores and retrieves data remotely. A RFID chip is embedded in each EDL/ID and contains a unique reference number. At the border crossing station, a RFID reader uses electromagnetic waves to energize the tag and collect this reference number. The reader converts the radio waves reflected back from the RFID tag into digital information and transmits it to the Customs and Border Protection network, which is an encrypted, secure network. The reference number is compared to the Customs and Border Protection's records to verify that an individual's identity matches the information printed on the front of their EDL/ID card.

Public Records Act: Each state and local agency is required under the Public Records Act to make all public records available for public inspection and copying unless the record is exempted from disclosure.

Collection of Personal Information from an Identification Document: There are no state laws that prohibit or restrict a non-governmental entity from using or distributing personal information gained through an EDL/ID or other identification card or document.

Summary of Substitute Bill:

A person is guilty of a class C felony if the person intentionally possesses, reads, or captures remotely using radio waves, information on another person's enhanced driver's license, without that person's express knowledge and consent.

Exceptions are included for capturing the information on another person's enhanced driver's license: (1) to facilitate border crossing; (2) to conduct security-related research; and (3) inadvertently (provided that the information is promptly disclosed, and neither disclosed to any other party, nor used for any purpose).

The unlawful capture or possession of information on a person's enhanced driver's license is deemed a violation of the Consumer Protection Act.

Public Records Act Exemptions: A public records exemption is created for documents and related materials, including scanned images, used to establish identity, age, a residential address, a Social Security number, or other personal information required in connection with an application for a driver's license or identicard.

A public records exemption is created for personally identifying information collected through a driver's license or identicard containing radio frequency identification or similar technology used to facilitate border crossing.

Effective Date: The bill takes effect 90 days after adjournment of session in which bill is passed.

Staff Summary of Public Testimony:

(In support) Privacy and security are a zero-sum game. We need to attempt to lessen the damage going forward in term of privacy. The two-dimensional bar code on driver's licenses is not encrypted and the information on it can be easily captured. The radio frequency identification (RFID) tag in the enhanced driver's license also raises concerns. Information about a consumer should not be captured without the consumer's knowledge or actual consent.

The problems with RFID technology are threefold: (1) it can be read from several feet away; (2) the information is not encrypted; and (3) there is no way for the individual to know that the tag is being read at any given time.

There is an active market for difficult-to-acquire data. Many of the RFID chips cannot be encrypted in order to have a higher level of security.

A public education campaign would be helpful so that citizens and merchants are informed of this change. It may be hard for consumers to know when the provisions in this bill have been violated.

(With concerns) Financial institutions need to use and retain personal information from driver's licenses in order to comply with federal law. A technical fix is being offered to address this issue.

(Opposed) None.

Persons Testifying: (In support) Representative Eddy, prime sponsor; Jennifer Shaw, American Civil Liberties Union Washington; Magda Balazinska; Dan Kaminsky, IOActive; and Riana Pfefferkorn.

(With concerns) Gary Gardner, BECU.