H-4801.1

SUBSTITUTE HOUSE BILL 2446

ByHouse Transportation (originally sponsored by Representatives Ryu, Frame, Kloba, Sells, Valdez, Santos, Ortiz-Self, and Wylie)

AN ACT Relating to limiting the disclosure of personal information held by the department of licensing; amending RCW 46.12.630, 46.12.635, 46.20.037, 46.20.118, and 46.52.120; and adding a new section to chapter 46.01 RCW.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

NEW SECTION.  Sec. 1. A new section is added to chapter 46.01 RCW to read as follows:

(1) Except as provided in subsection (2) of this section, the department may not release personal information in response to a request submitted to the department to be used primarily for:

(a) Civil immigration enforcement purposes; or

(b) Criminal immigration enforcement purposes for a violation of 8 U.S.C. Sec. 1325 (improper entry by alien), 8 U.S.C. Sec. 1326 (reentry of removed aliens), or any successors to those provisions.

(2) The department is authorized to release personal information to be used primarily for the purposes identified in subsection (1) of this section in response to a court order issued under the authority of:

(a) A federal judge or magistrate serving in the judicial branch under Article III of the United States Constitution; or

(b) A state judge or magistrate serving in the judicial branch under Article IV of the Washington state Constitution.

(3) The department is not authorized to release personal information to be used for the purposes identified in subsection (1) of this section in response to a subpoena, summons, warrant, or other order or request issued by an executive branch agency unless so ordered by a judicial officer defined in subsection (2)(a) or (b) of this section.

(4) This section does not apply to the retrieval of information by entities granted permission to access driver record or vehicle or vessel license plate data through an electronic interface.

(5) For the purposes of this section, "personal information" means information that identifies an individual, including an individual's photograph social security number, driver identification number, name, address (but not the five-digit zip code), telephone number, and medical or disability information.

Sec. 2. RCW 46.12.630 and 2016 c 80 s 1 are each amended to read as follows:

(1) The department of licensing must furnish lists of registered and legal owners of: (a) Motor vehicles only for the purposes specified in this subsection (1)(a) to the manufacturers of motor vehicles or motor vehicle components, or their authorized agents, to enable those manufacturers to carry out the provisions of Titles I and IV of the anti car theft act of 1992, the automobile information disclosure act (15 U.S.C. Sec. 1231 et seq.), the clean air act (42 U.S.C. Sec. 7401 et seq.), and 49 U.S.C. Secs. 30101-30183, 30501-30505, and 32101-33118, as these acts existed on January 1, 2014, or such subsequent date as may be provided by the department by rule, consistent with the purposes of this section. However, the department may only provide a vehicle or vehicle component manufacturer, or its authorized agent, lists of registered or legal owners who purchased or leased a vehicle manufactured by that manufacturer or a vehicle containing a component manufactured by that component manufacturer. Manufacturers or authorized agents receiving information on behalf of one manufacturer must not disclose this information to any other third party that is not necessary to carry out the purposes of this section; and (b) vessels only for the purposes of this subsection (1)(b) to the manufacturers of vessels, or their authorized agents, to enable those manufacturers to carry out the provisions of 46 U.S.C. Sec. 4310 and any relevant Code of Federal ((Regulation[s]))Regulations adopted by the United States coast guard, as these provisions and rules existed on January 1, 2015, or such subsequent date as may be provided by the department by rule, consistent with the purposes of this section.

(2) The department of licensing may furnish lists of registered and legal owners of motor vehicles or vessels, only to the entities and only for the purposes specified in this section, to:

(a) The manufacturers of motor vehicles or vessels, legitimate businesses as defined by the department in rule, or their authorized agents, for purposes of using lists of registered and legal owner information to conduct research activities and produce statistical reports, as long as the entity does not allow personal information received under this section to be published, redisclosed, or used to contact individuals. For purposes of this subsection (2)(a), the department of licensing may only provide the manufacturer of a motor vehicle or vessel, or the manufacturer of components contained in a motor vehicle or vessel, the lists of registered or legal owners who purchased or leased a vehicle or vessel manufactured by that manufacturer or a vehicle or vessel containing components manufactured by that component manufacturer;

(b) Any governmental agency of the United States or Canada, or political subdivisions thereof, to be used by it or by its authorized commercial agents or contractors only in connection with the enforcement of: (i) Motor vehicle or traffic laws by, or programs related to traffic safety of, that government agency; or (ii) the laws governing vessels, vessel operation, or vessel safety programs administered by that government agency or as otherwise provided by law. Only such parts of the list under (b)(i) and (ii) of this subsection (2)(((b))) as are required for completion of the work required of the agent or contractor shall be provided to such agent or contractor;

(c) Any insurer or insurance support organization, a self-insured entity, or its agents, employees, or contractors for use in connection with claims investigation activities, antifraud activities, rating, or underwriting;

(d) Any local governmental entity or its agents for use in providing notice to owners of towed and impounded vehicles, or to any law enforcement entity for use, as may be necessary, in locating the owner of or otherwise dealing with a vessel that has become a hazard;

(e) A government agency, commercial parking company, or its agents requiring the names and addresses of registered owners to notify them of outstanding parking violations. Subject to the disclosure agreement provisions of RCW 46.12.635 and the requirements of Executive Order 97-01, the department may provide only the parts of the list that are required for completion of the work required of the company;

(f) An authorized agent or contractor of the department, to be used only in connection with providing motor vehicle or vessel excise tax, licensing, title, and registration information to motor vehicle or vessel dealers;

(g) Any business regularly making loans to other persons to finance the purchase of motor vehicles or vessels, to be used to assist the person requesting the list to determine ownership of specific vehicles or vessels for the purpose of determining whether or not to provide such financing; or

(h) A company or its agents operating a toll facility under chapter 47.46 RCW or other applicable authority requiring the names, addresses, and vehicle information of motor vehicle registered owners to identify toll violators.

(3) Personal information received by an entity listed in subsection (1) or (2) of this section may not be released for direct marketing purposes.

(4) Prior to the release of any lists of vehicle or vessel owners under subsection (1) or (2) of this section, the department must enter into a contract with the entity authorized to receive the data. The contract must include:

(a) A requirement that the department or its agent conduct both regular permissible use and data security audits subject to the following conditions and limitations:

(i) The data security audits must demonstrate compliance with the data security standards adopted by the office of the chief information officer.

(ii) When determining whether to conduct an audit under this subsection, the department must first take into consideration any independent third-party audit a data recipient has had before requiring that any additional audits be performed. If the independent third-party audit is a data security audit and it meets both recognized national or international standards and the standards adopted by the office of the chief information officer pursuant to (a)(i) of this subsection, the department must accept the audit and the audit is deemed to satisfy the conditions set out in this subsection (4)(a). If the independent third-party audit is a permissible use audit and it meets recognized national or international standards, the department must accept the audit and the audit is deemed to satisfy the conditions set out in this subsection (4)(a); and

(b) A provision that the cost of the audits performed pursuant to this subsection must be borne by the data recipient. A new data recipient must bear the initial cost to set up a system to disburse the data to the data recipient.

(5)(a) Beginning January 1, 2015, the department must collect a fee of ten dollars per one thousand individual registered or legal owners included on a list requested by a private entity under subsection (1) or (2) of this section. Beginning January 1, 2016, the department must collect a fee of twenty dollars per one thousand individual registered or legal vehicle or vessel owners included on a list requested by a private entity under subsection (1) or (2) of this section. Beginning January 1, 2021, the department must collect a fee of twenty-five dollars per one thousand individual registered or legal owners included on a list requested by a private entity under subsection (1) or (2) of this section. The department must prorate the fee when the request is for less than a full one thousand records.

(b) In lieu of the fee specified in (a) of this subsection, if the request requires a daily, weekly, monthly, or other regular update of those vehicle or vessel records that have changed:

(i) Beginning January 1, 2015, the department must collect a fee of one cent per individual registered or legal vehicle or vessel owner record provided to the private entity;

(ii) Beginning January 1, 2016, the department must collect a fee of two cents per individual registered or legal vehicle or vessel owner record provided to the private entity;

(iii) Beginning January 1, 2021, the department must collect a fee of two and one-half cents per individual registered or legal vehicle or vessel owner record provided to the private entity.

(c) The department must deposit any moneys collected under this subsection to the department of licensing technology improvement and data management account created in RCW 46.68.063.

(6) Where both a mailing address and residence address are recorded on the vehicle or vessel record and are different, only the mailing address will be disclosed. Both addresses will be disclosed in response to requests for disclosure from courts, law enforcement agencies, or government entities with enforcement, investigative, or taxing authority, except as provided in section 1 of this act, and only for use in the normal course of conducting their business.

(7) If a list of registered and legal owners of motor vehicles or vessels is used for any purpose other than that authorized in this section, the manufacturer, governmental agency, commercial parking company, contractor, financial institution, insurer, insurance support organization, self-insured entity, legitimate business entity, toll facility operator, or any authorized agent or contractor responsible for the unauthorized disclosure or use will be denied further access to such information by the department of licensing.

(8) For purposes of this section, "personal information" means information that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address (but not the five-digit zip code), telephone number, or medical or disability information. However, an individual's photograph, social security number, and any medical or disability-related information is considered highly restricted personal information and may not be released under this section.

Sec. 3. RCW 46.12.635 and 2019 c 278 s 1 are each amended to read as follows:

(1) Notwithstanding the provisions of chapter 42.56 RCW, the name or address of an individual vehicle or vessel owner shall not be released by the department, county auditor, or agency or firm authorized by the department except under the following circumstances:

(a) The requesting party is a business entity that requests the information for use in the course of business;

(b) The request is a written request that is signed by the person requesting disclosure that contains the full legal name and address of the requesting party, that specifies the purpose for which the information will be used; and

(c) The requesting party enters into a disclosure agreement with the department in which the party promises that the party will use the information only for the purpose stated in the request for the information; and that the party does not intend to use, or facilitate the use of, the information for the purpose of making any unsolicited business contact with a person named in the disclosed information. The term "unsolicited business contact" means a contact that is intended to result in, or promote, the sale of any goods or services to a person named in the disclosed information. The term does not apply to situations where the requesting party and such person have been involved in a business transaction prior to the date of the disclosure request and where the request is made in connection with the transaction.

(2) Where both a mailing address and residence address are recorded on the vehicle or vessel record and are different, only the mailing address will be disclosed. Both addresses will be disclosed in response to requests for disclosure from courts, law enforcement agencies, or government entities with enforcement, investigative, or taxing authority, except as provided in section 1 of this act, and only for use in the normal course of conducting their business.

(3) The disclosing entity shall retain the request for disclosure for three years.

(4)(a) Whenever the disclosing entity grants a request for information under this section by an attorney or private investigator, the disclosing entity shall provide notice to the vehicle or vessel owner, to whom the information applies, that the request has been granted. The notice must only include: (i) That the disclosing entity has disclosed the vehicle or vessel owner's name and address pursuant to a request made under this section; (ii) the date that the disclosure was made; and (iii) that the vehicle or vessel owner has five days from receipt of the notice to contact the disclosing entity to determine the occupation of the requesting party.

(b) Except as provided in (c) of this subsection, the only information about the requesting party that the disclosing entity may disclose in response to a request made by a vehicle or vessel owner under (a) of this subsection is whether the requesting party was an attorney or private investigator. The request by the vehicle or vessel owner must be submitted to the disclosing entity within five days of receipt of the original notice.

(c) In the case of a vehicle or vessel owner who submits to the disclosing entity a copy of a valid court order restricting another person from contacting the vehicle or vessel owner or his or her family or household member, the disclosing entity shall provide the vehicle or vessel owner with the name and address of the requesting party.

(5) Any person who is furnished vehicle or vessel owner information under this section shall be responsible for assuring that the information furnished is not used for a purpose contrary to the agreement between the person and the department.

(6) This section shall not apply to requests for information by governmental entities or requests that may be granted under any other provision of this title expressly authorizing the disclosure of the names or addresses of vehicle or vessel owners. Requests from law enforcement officers for vessel record information must be granted, except as provided in section 1 of this act. The disclosure agreement with law enforcement entities must provide that law enforcement may redisclose a vessel owner's name or address when trying to locate the owner of or otherwise deal with a vessel that has become a hazard.

(7) The department shall disclose vessel records for any vessel owned by a governmental entity upon request.

(8) This section shall not apply to title history information under RCW 19.118.170.

(9) The department shall charge a fee of two dollars for each record returned pursuant to a request made by a business entity under subsection (1) of this section and deposit the fee into the highway safety account.

(10) The department, county auditor, or agency or firm authorized by the department shall not release the name, any address, vehicle make, vehicle model, vehicle year, vehicle identification number, vessel make and model, vessel model year, hull identification number, vessel document number, vessel registration number, vessel decal number, or license plate number associated with an individual vehicle or vessel owner who is a participant in the address confidentiality program under chapter 40.24 RCW except as allowed in subsection (6) of this section and RCW 40.24.075.

Sec. 4. RCW 46.20.037 and 2012 c 80 s 1 are each amended to read as follows:

(1) The department may implement a facial recognition matching system for drivers' licenses, permits, and identicards. Any facial recognition matching system selected by the department must be used only to verify the identity of an applicant for or holder of a driver's license, permit, or identicard to determine whether the person has been issued a driver's license, permit, or identicard under a different name or names, except as permitted under subsections (4) and (5) of this section.

(2) Any facial recognition matching system selected by the department must be capable of highly accurate matching, and must be compliant with appropriate standards established by the American association of motor vehicle administrators that exist on June 7, 2012, or such subsequent date as may be provided by the department by rule, consistent with the purposes of this section.

(3) The department shall post notices in conspicuous locations at all department driver licensing offices, make written information available to all applicants at department driver licensing offices, and provide information on the department's web site regarding the facial recognition matching system. The notices, written information, and information on the web site must address how the facial recognition matching system works, all ways in which the department may use results from the facial recognition matching system, how an investigation based on results from the facial recognition matching system would be conducted, and a person's right to appeal any determinations made under this chapter.

(4) ((Results from))(a) Information or data generated through the use of the facial recognition ((matching)) system((:

(a) Are)), including system results that identify a potential match between two photographs:

(i) Is not available for public inspection and copying under chapter 42.56 RCW; and

(((b)))(ii) May only be disclosed when authorized by a court order((;

(d) May only be disclosed by the department))related to a suspected violation of RCW 46.20.0921.

(5) The department may provide the results of an investigation initiated or assisted through the use of the facial recognition system to a government agency, including a court or law enforcement agency, for use in carrying out its functions if the department has determined that person has committed one of the prohibited practices listed in RCW 46.20.0921 and this determination has been confirmed by a hearings examiner under this chapter or the person declined a hearing or did not attend a scheduled hearing.

(((5)))(6) All personally identifying information derived from the facial recognition matching system must be stored with appropriate security safeguards. The office of the chief information officer shall develop the appropriate security standards for the department's use of the facial recognition matching system, subject to approval and oversight by the technology services board.

(((6)))(7) The department shall develop procedures to handle instances in which the facial recognition matching system fails to verify the identity of an applicant for a renewal or duplicate driver's license, permit, or identicard. These procedures must allow an applicant to prove identity without using the facial recognition matching system.

Sec. 5. RCW 46.20.118 and 2009 c 366 s 1 are each amended to read as follows:

(1) The department shall maintain a ((negative)) file((. It shall contain negatives)) of all ((pictures))the driver's license, permit, and identicard photographs taken by the department of licensing as authorized by this chapter. ((Negatives))Photographs in the file shall not be available for public inspection and copying under chapter 42.56 RCW.

(2) The department may ((make))provide a copy of a photograph from the file ((available)) to official governmental enforcement agencies to assist in the investigation by the agencies of suspected criminal activity or for the purposes of verifying identity when a law enforcement officer is authorized by law to request identification from an individual, except as provided in section 1 of this act.

(3) The department shall make the file available to the office of the secretary of state, at the expense of the secretary of state, to assist in maintenance of the statewide voter registration database.

(4) The department may also provide a ((print))copy of a photograph from the file to the driver's next of kin in the event the driver is deceased.

Sec. 6. RCW 46.52.120 and 2017 c 147 s 9 are each amended to read as follows:

(1) The director shall keep a case record on every motor vehicle driver licensed under the laws of this state, together with information on each driver, showing all the convictions and findings of traffic infractions certified by the courts, together with an index cross-reference record of each accident reported relating to such individual with a brief statement of the cause of the accident and whether or not the accident resulted in any fatality.

(2) The records shall be for the confidential use of the director, the chief of the Washington state patrol, the director of the Washington traffic safety commission, and for such police officers or other cognizant public officials as may be designated by law, except as provided in section 1 of this act. Such case records shall not be admitted into evidence in any court, except where relevant to the prosecution or defense of a criminal charge, or in case appeal is taken from the order of the director, suspending, revoking, canceling, or refusing a vehicle driver's license.

(3) The director shall tabulate and analyze vehicle driver's case records and suspend, revoke, cancel, or refuse a vehicle driver's license to a person when it is deemed from facts contained in the case record of such person that it is for the best interest of public safety that such person be denied the privilege of operating a motor vehicle. The director shall also suspend a person's driver's license if the person fails to attend or complete a driver improvement interview or fails to abide by conditions of probation under RCW 46.20.335. Whenever the director orders the vehicle driver's license of any such person suspended, revoked, or canceled, or refuses the issuance of a vehicle driver's license, such suspension, revocation, cancellation, or refusal is final and effective unless appeal from the decision of the director is taken as provided by law.

--- END ---