Brief Summary of Substitute Bill

Updates the federal references in statute as the acts existed on January 1, 2014, or such subsequent date.
Expands the specified entities that may be furnished lists of registered owners of motor vehicles by the Department of Licensing (DOL).
Prohibits personal information received by an authorized entity may to be released for direct marketing purposes.
Provides a list of provisions that must be included in the contract between the DOL and the data recipient.
Provides that the cost of the audits performed must be paid by the data recipient, as well as the initial cost to set up the system to disburse the data to the data recipient.
Requires that the DOL must collect a fee of $20 per 1,000 individual registered or legal vehicle owners. The DOL must prorate the fee when the request is for less than a full 1,000 records.
Requires that if the data request is a weekly, monthly, or other regular update of vehicle records that have changed, the DOL must collect a fee of 2 cents per individual registered or legal vehicle owner record provided.
Requires the DOL to deposit any funds collected to the DOL Technology Improvement and Data Management Account (Account). Expenditures from the Account can only be used for investments in technology and data management at the DOL.
Establishes audit procedures.
Provides a definition for "personal information."

Background:

The Driver Privacy Protection Act (DPPA), enacted by Congress in 1994, regulates state governments' release of personal information contained in an individual's motor vehicle record. The DPPA defines personal information as information that identifies an individual, including an individual's photograph, social security number, driver identification number, name, and address - but not zip code, telephone number, and medical or disability information. There are 14 specified allowable uses of personal information by different entities listed in the DPPA.

Regarding the disclosure of lists of registered motored vehicle owners, current Washington law is more restrictive than the DPPA in that there are less permissible uses and entities identified. The Department of Licensing (DOL) may furnish lists of registered and legal owners of motor vehicles to the following entities for the specified purposes: (1) motor vehicle manufacturers, for safety recalls; (2) United States and Canadian governmental agencies, for use in enforcement of vehicle or traffic laws; (3) commercial parking companies, to notify owners of outstanding parking violations; (4) the DOL agents, to provide certain information to motor vehicle dealers; (5) businesses making loans for the purchase of motor vehicles, to assist in determining whether to provide financing; and (6) the operator of a toll facility, to identify toll violators.

If a list of registered and legal owners of motor vehicles is used for any other purpose other than authorized, the entity or any authorized agent, or contractor responsible for the unauthorized disclosure or use will be denied further access to the information by the DOL. The following activities related to obtaining or the use of information contained in a vehicle record constitute a gross misdemeanor: unauthorized disclosure of information from a vehicle record; use of false representation to obtain information from a vehicle record; the use of information for a purpose other than what is stated in the request for information or disclosure agreement; or the sale or other distribution of any vehicle owner name or address to another person not disclosed in the request or disclosure agreement.

Within the DPPA, there are also penalties for violations by state Department of Motor Vehicles and persons who knowingly violate the provisions of the DPPA.

Summary of Bill:

The bill updates the federal references in statute as the act existed on January 1, 2014, or such subsequent date as may be provided by the DOL by rule for the manufacturers of motor vehicles, or their authorized agents, to enable those manufacturers to carry out the provisions of the federal regulations. The DOL may only provide a manufacturer, or its authorized agent, lists of registered or legal owners who purchased or leased a vehicle manufactured by that manufacturer. Data providers must not disclose this information to any other third party.

The purposes for which the DOL may furnish lists of registered owners of motor vehicles to specified entities are expanded to include the following:

legitimate businesses, or their agents for use in research activities and in producing statistical reports, as long as the personal information is not published, redisclosed, or used to contact individuals;
an insurer or insurance support organization or their agent for use in connection with claims investigation, antifraud, rating, or underwriting activities;
local government entities or their agents for use in providing notice to owners of towed and impounded vehicles; and
government agencies or their agents requiring the names and addresses of registered owners to notify them of outstanding parking violations.

Personal information received by an authorized entity may not be released for direct marketing purposes.

Prior to the release of any lists of vehicle owners, the DOL must enter into a contract with the entity authorized to receive the data. The contract must include a requirement that the DOL or its agent conduct both regular permissible use and data security audits subject to the following conditions and limitations:

The data security audits must demonstrate compliance with the data security standards adopted by the Office of the Chief Information Officer.
The DOL, when determining whether to conduct an audit, must first take into consideration any independent third-party audit an entity receiving data has had before requiring that any additional audits be performed.
If the security audit or permissible use audit meets recognized national or internal standards adopted by the Office of the Chief Information Officer, the DOL must accept the audit and the audit is deemed to satisfy the audit requirement.
A provision that the cost of the audits performed must be paid by the data recipient, as well as the initial cost to set up the system to disburse the data to the data recipient.

The DOL must collect a fee of $20 per 1,000 individual registered or legal vehicle owners. The DOL must prorate the fee when the request is for less than a full 1,000 records.

If the request requires a weekly, monthly, or other regular update of vehicle records that have changed, the DOL must collect a fee of 2 cents per individual registered or legal vehicle owner record provided.

The DOL must deposit any funds collected to the DOL Technology Improvement and Data Management Account (Account). Expenditures from the Account can only be used for investments in technology and data management at the DOL. Funds can only be spent after appropriation.

The bill provides the definition for "personal information" as information that identifies an individual, which includes an individual's photograph, social security number, driver identification number, name, address (but not the five-digit zip code), telephone number, or medical or disability information. An individual's photograph, social security number, medical or disability information is considered highly restricted information and can only be released to manufacturers of motor vehicles or their authorized agents, a governmental agency, or an insurer.