PROPOSED RULES
Original Notice.
Preproposal statement of inquiry was filed as WSR 08-02-041.
Title of Rule and Other Identifying Information: Chapter 308-10 WAC, Public records disclosure, the department of licensing (DOL) is considering adopting new rules governing access to digital information including the internet vehicle/vessel processing system (IVIPS), the disclosure of electronic records, and expanding and updating definitions in chapter 308-10 WAC. IVIPS is a DOL application that allows the user to access current vehicle or vessel record information from a secure internet site.
Hearing Location(s): Department of Licensing, Conference Room 413, 1125 Washington Street S.E., Olympia, WA 98507, on November 13, 2008, at 1:00 p.m.
Date of Intended Adoption: December 17, 2008.
Submit Written Comments to: Ben Shomshor, P.O. Box 9035, Mailstop 48026, 8005A River Road S.E., Olympia, WA 98507-9035, e-mail bshomshor@dol.wa.gov, fax (360) 902-7821 or 902-7822, by November 10, 2008.
Assistance for Persons with Disabilities: Contact Ben Shomshor by November 6, 2008, TTY (360) 664-8885.
Purpose of the Proposal and Its Anticipated Effects, Including Any Changes in Existing Rules: WAC 308-10-030 and 308-10-070 are both updated to reflect the current address of the agency public records officer.
New WAC 308-10-080 through 308-10-100 are added to define terms and clarify access to electronic vehicle and vessel records.
Reasons Supporting Proposal: DOL is responsible for upholding the highest level of public confidence and trust as custodian of personally identifiable information, as well as providing fair and equitable access to that information by legally privileged parties. Rule making is required to govern the department's actions when providing access to vehicle and vessel information through an automated system.
Statutory Authority for Adoption: RCW 42.56.040, 43.17.060, and 43.24.016 (2)(d).
Rule is not necessitated by federal law, federal or state court decision.
Name of Proponent:
Name of Agency Personnel Responsible for Drafting: Ben Shomshor, 8005A River Road S.E., Tumwater, WA, (360) 359-4019; Implementation and Enforcement: Hannah Fultz, 8005A River Road S.E., Tumwater, WA, (360) 359-4013.
No small business economic impact statement has been prepared under chapter 19.85 RCW. A small business economic impact statement is not required pursuant to RCW 19.85.030 (1)(a). The proposed rule making does not impose more than a minor cost on businesses in the industry.
A cost-benefit analysis is not required under RCW 34.05.328. The contents of the proposed rules are explicitly and specifically dictated by statute.
September 29, 2008
Hannah Fultz
Public Records Officer
OTS-1890.1
AMENDATORY SECTION(Amending WSR 06-16-039, filed 7/26/06,
effective 8/26/06)
WAC 308-10-030
Public records officer.
The department's
public records officer shall be designated by the director. The person so designated shall be located ((in the main
administrative offices of)) at the department's facility at
8005A River Drive S.E., Tumwater, WA 98501. The public
records officer shall be responsible for the following: The
implementation of the department's rules regarding release of
public records, coordinating the staff of the department in
this regard, maintaining, keeping current, and publishing an
index of all agency records and ensuring compliance with the
public records disclosure act requirements.
[Statutory Authority: RCW 42.17.260, 42.17.250, and 46.01.110. 06-16-039, § 308-10-030, filed 7/26/06, effective 8/26/06. Statutory Authority: RCW 42.17.250. 96-05-036, § 308-10-030, filed 2/15/96, effective 3/17/96; 92-09-107, § 308-10-030, filed 4/20/92, effective 5/21/92; Order MV 348, § 308-10-030, filed 12/24/75.]
[Statutory Authority: RCW 42.17.260, 42.17.250, and 46.01.110. 06-16-039, § 308-10-070, filed 7/26/06, effective 8/26/06. Statutory Authority: RCW 42.17.250. 92-09-107, § 308-10-070, filed 4/20/92, effective 5/21/92; Order MV 348, § 308-10-070, filed 12/24/75.]
"Antifraud activities" means actions with the immediate and direct intent of preventing fraud.
"Business need" means a requirement specific to the purpose for which the business is licensed, registered, certified and/or registered.
"Claim investigation activities" means actions performed in the process of collecting evidence to validate an insurance claim.
"Commercial purpose" means using or intending to use information for the purpose of facilitating a profit expecting business activity. By definition, nonprofit corporations do not engage in commercial purposes.
"Department of licensing (DOL)" is the agency created pursuant to chapter 46.01 RCW. The department of licensing shall hereinafter be referred to as the department. Where appropriate, the term department also refers to the staff and employees of the department of licensing.
"Designee" is a department employee authorized by the public records officer to receive and respond to a public records request.
"Director" means the director of the department of licensing as appointed by the governor.
"Driver Privacy Protection Act" or "DPPA" means a federal law protecting personally identifiable information of drivers and motor vehicle owners. Also referred to as 18 U.S.C. 2721 through 2725.
"Driver safety." Driver is the operator of a motor vehicle, and by extension, the other occupants of the motor vehicle. "Safety" is the state of being "safe," the condition of being protected against physical damage, accidents, harm or any other event. "Driver safety" includes the safety of passengers, drivers and pedestrians, and their motor vehicles or property.
"File transfer protocol (FTP)" means a protocol for exchanging files over the internet, most commonly used to download files placed on a server for that purpose.
"Fraud" means an intentional deception resulting in injury to another person which is made for personal gain.
"Individual" means a natural person.
"Investigation in anticipation of litigation" means an investigation where it appears likely that there will be litigation.
"Licensed security service" means a company licensed by the Washington department of licensing for licensed security services. It is synonymous with "private security company" as defined in RCW 18.170.010. "Private security company" means a person or entity licensed under this chapter and engaged in the business of providing the services of private security guards on a contractual basis.
"Listing" or "list" means an item-by-item series of names, figures, words or numbers written or printed one after the other.
"Marketing" means the act or process of promoting and selling, leasing, or licensing products or services. It includes any of the tasks necessary to identify the type and amount of goods and services desired by society, and the pricing, distribution, and promotion of those goods and services.
"Motor vehicle safety" means every vehicle as defined in RCW 46.04.320 that is self-propelled and every vehicle that is propelled by electric power obtained from overhead trolley wires, but not operated upon rails. "Safety" is as defined above under "driver safety." "Motor vehicle safety" includes the safety of passengers, drivers and pedestrians and their motor vehicles or property.
"Motor vehicle theft" means the taking and/or removing of another's vehicle with the intent of depriving the true owner of the vehicle. "Motor vehicle" is as defined in RCW 46.04.320. "Theft" is as defined in RCW 9A.56.020, and means:
(a) To wrongfully obtain or exert unauthorized control over the property or services of another or the value thereof, with intent to deprive him or her of such property or services; or
(b) By color or aid of deception to obtain control over the property or services of another or the value thereof, with intent to deprive him or her of such property or services; or
(c) To appropriate lost or misdelivered property or services of another, or the value thereof, with intent to deprive him or her of such property or services.
"Normal course of business" means a business practice specific to the purpose of the business by a legitimate, licensed business or its agent, employees, or contractors, but only:
(a) To verify the accuracy of personal information submitted by the individual to the business or its agencies, employees, or contractors; and
(b) If such information is not correct or is no longer correct, to obtain correct information, but only for the purposes of preventing fraud by, pursuing legal remedies against, or recovering on a debt or security interest against the individual. If acting as agent of lien holder, requestor must submit proof of contract with lien holder.
"Personal information" as used in the Driver Privacy Protection Act (18 U.S.C. 2725), means information that identifies an individual, including an individual's photograph, Social Security number, driver identification number, name, address (but not the five-digit zip code), telephone number, and medical or disability information, but does not include information on vehicular accidents, driving violations, and driver's status.
"Private investigative agency" means a "private investigator (or investigative) agency" a person or entity licensed under RCW 18.165.010, and engaged in the business of detecting, discovering, or revealing one or more of the following:
(a) Crime, criminals, or related information;
(b) The identity, habits, conduct, business, occupation, honesty, integrity, credibility, knowledge, trustworthiness, efficiency, loyalty, activity, movement, whereabouts, affiliations, associations, transactions, acts, reputation, or character of any person or thing;
(c) The location, disposition, or recovery of lost or stolen property;
(d) The cause or responsibility for fires, libels, losses, accidents, or damage or injury to persons or to property;
(e) Evidence to be used before a court, board, officer, or investigative committee;
(f) Detecting the presence of electronic eavesdropping devices; or
(g) The truth or falsity of a statement or representation.
"Pro se (representation)" a latin term meaning "on one's own behalf"; in courts, it refers to persons who present their own cases without lawyers.
"Profession" when applied to department records, or the release of department record information, means any state regulated business, profession or occupation administered by the assistant director, business and professions division.
"RCW" means the Revised Code of Washington.
"Representative" or "agent" means a person who acts, or has the power to act for another.
"Research activities" are actions taken in the course of systematic investigation to establish new facts.
[]
(2) What is the purpose of providing file transfers through secure file transfer protocols (SFTP) under contract? Two types of SFTP files are provided under contract.
The secured automated file extract (SAFE) is a mutually agreed upon file layout containing fields of information from DOL vehicle and vessel records. This information is provided on a regular basis (usually weekly or monthly) to parties approved as having permissible use(s) as described in federal and state laws.
The sharing of data through SAFE requires a contract between the customer (i.e., business, local/state agency) and DOL; the customer is then a contractor with DOL. The data shared and frequency of data will vary based on individual contracts. Contractors receiving SAFE data may utilize that data for compiling vehicle and vessel statistics, providing vehicle/vessel information for safety recalls/advisories, and vehicle demographics.
The vehicle owner information distribution system (VOIDS) provides rapid, high volume electronic access to motor vehicle registration name and mailing address information, as well as many other information fields available on vehicles information systems, to entities qualified through public disclosure requirements.
The sharing of data through the VOIDS system requires a contract between a customer (business, local/state government) and DOL; the customer is then a contractor with DOL. Contractors receiving VOIDS include city, counties, and law enforcement agencies. Generally, this process is for processing of traffic and parking violations, tolls, verification of vehicle owner, and/or monitoring/enforcing parking lots/areas.
(3) What is DOL's authority to provide personal information via IVIPS or SFTP to business entities and government? The authority to provide personal information through a secure internet connection electronically comes from the Washington state legislature and is applied through the following provisions of state law and regulations and federal law: 18 U.S.C. Section 2721 through 2725 Driver Privacy Protection Act (DPPA), RCW 46.12.370, 46.12.380, 46.12.390, chapter 42.56 RCW, RCW 42.56.070; chapter 308-10 WAC, WAC 308-10-045, 308-93-087, 308-93-088, 308-93-089.
(4) What personal information can be accessed through IVIPS? The only personal information available through IVIPS is the name and mailing address of the registered owner of a vehicle or vessel.
(5) For what purpose may the department disclose the names and addresses of vehicle or vessel owners through IVIPS or SFTP?
(a) In accordance with the federal Driver Privacy Protection Act (DPPA), 18 U.S.C. Section 2721, motor vehicle information can be released only for the following purposes:
(i) For use by any government agency, including any court or law enforcement agency, in carrying out its functions, or any private person or entity acting on behalf of a federal, state, or local agency in carrying out its functions;
(ii) For use in connection with matters of motor vehicle or driver safety and theft; motor vehicle emissions; motor vehicle product alterations, recalls, or advisories; performance monitoring of motor vehicles, motor vehicle parts and dealers; motor vehicle market research activities, including survey research; and removal of nonowner records from the original owner records of motor vehicle manufacturers;
(iii) For use in the normal course of business by a legitimate business or its agents, employees, or contractors, but only:
• To verify the accuracy of personal information submitted by the individual to the business or its agents, employees, or contractors; and
• If such information as so submitted is not correct or is no longer correct, to obtain the correct information, but only for the purposes of preventing fraud by, pursuing legal remedies against, or recovering on a debt or security interest against, the individual.
(iv) For use in connection with any civil, criminal, administrative, or arbitral proceeding in any federal, state, or local court or agency or before any self-regulatory body, including the service of process, investigation in anticipation of litigation, and the execution or enforcement of judgments and orders, or pursuant to an order of a federal, state, or local court;
(v) For use in research activities, and for use in producing statistical reports, so long as the personal information is not published, redisclosed, or used to contact individuals;
(vi) For use by any insurer or insurance support organization, or by a self-insured entity, or its agents, employees, or contractors, in connection with claims investigation activities, antifraud activities, rating or underwriting;
(vii) For use by any licensed private investigative agency or licensed security service for any purpose permitted under this subsection;
(viii) For use in connection with the operation of private toll transportation facilities.
(b) If your business purpose is allowed under 18 U.S.C. Section 2721, your request must also qualify under Washington state law. Under the provisions of chapters 42.56 and 46.12 RCW, the department may disclose the names and addresses of vehicle owners when:
(i) The requesting party is a business entity that requires the information for use in their normal course of business;
(ii) The request is in writing, signed by the person requesting disclosure, contains the full legal name and address of the requesting party or their business, and specifies the lawful purpose for which the information will be used;
(iii) The requesting party enters into a disclosure agreement with the department by which the party:
• Agrees they will use the information only for the purpose stated in the request for the information; and
• Will not use or facilitate the use of the information for the purpose of making any unnecessary inquiries or unsolicited business contact with a person named in the disclosed information.
Vessel information is disclosed to qualifying entities for "use in the normal course of business," or for product recalls.
[]
(a) You must complete in full the vehicle/vessel disclosure agreement application form available from the department of licensing's web site at www.dol.wa.gov/forms.html.
(b) Except as provided for in 18 U.S.C. Section 2721 (DPPA), RCW 46.12.370, 46.12.380 and WAC 308-93-087, you must also agree:
(i) To protect all personally identifiable information.
(ii) To protect lists of individuals from use for any commercial purpose, by you or by any other individual or organization you represent.
(iii) To refrain from using or facilitating the use of the information for the purpose of making any unsolicited business contact with a person named in the disclosed information.
(iv) That the information obtained will not be divulged to any third-party except as may be permitted by contract for any purpose other than stated on your application.
(c) DOL will review the information provided on your application to determine whether you are eligible for an IVIPS or file transfer account. If you are found eligible, you will be offered a contract for the account. The contract must be signed and returned to DOL with the required deposit before an account can be established.
(2) How does the department determine eligibility for an IVIPS account? Each application is reviewed on its own merits. Your application materials will be evaluated to determine whether or not access to the IVIPS system is allowable as a permissible use under federal and state law.
(3) What is your assessment based on and how do you determine access eligibility?
(a) The hours that you need to access the information.
(b) Your agreement to the limitations we set on your access to use of the information.
(c) If renewing an existing account, your "look up" activity or record access volume of IVIPS inquiries over the past year.
(d) If you are found ineligible for an IVIPS account, you will be notified of the reasons for the denial. Determination of ineligibility can be appealed to the program's contract review committee comprised of agency management. Decisions of the committee are final. The committee can be contacted by writing:
ATTN: Public Records Officer
Contract Review Committee
Department of Licensing
P.O. Box 2957
Olympia, WA 98507-2957
360-902-3760
(4) Do I need to enter into a contractual agreement with
the department for IVIPS or file transfers? Yes. A contract
must be entered into with the department stating the terms and
conditions under which you may receive public record
information. The contract helps both parties to be better
stewards of personal information.
(5) What information is required in order to enter into a contract? See subsection (1) of this section.
(6) How long is my contract valid? Contracts with private businesses are valid until the earlier of:
(a) Cancellation by either party;
(b) One year; or
(c) Thirty days following the expiration of your current business license.
Contracts with government agencies are valid for two years.
(7) How does an applicant demonstrate a business need for an IVIPS or file transfer account? Through a completed application to the department with stated approved reasons and proper documentation.
(8) Do we need to demonstrate a special business need to access IVIPS outside normal business hours? Yes. This need may be demonstrated by hours of business, type of business and specific needs. Final decisions will be made by the department.
(9) What is acceptable business verification? For purposes of this section acceptable business verification includes:
| If requestor is: | Then requestor must provide: |
| A licensed Washington business | A legible copy of current unexpired master business license. |
| A business not required to be licensed in this state | Its federal employer identification number or federal tax number (FEIN) or Uniform Business Identifier (UBI) on official letterhead with a notarized signature of the owner or an authorized representative; or |
| Letter showing exemption from business licensing and applicable law. | |
| An attorney | A legible copy of the bar card; and |
| A copy of current business license for working as an attorney; and | |
| Official letterhead with a notarized signature of the owner or an authorized representative of the law firm the requestor is employed by. | |
| A private investigator | A legible copy of the current private investigator's license; and |
| Business license for working as a private investigator; and | |
| Official letterhead with a notarized signature of the owner or an authorized representative of the private investigator firm the requestor is employed by. | |
| An out-of-state business not licensed in Washington | (a) If the business is required to be licensed, a (legible) copy of its current business license issued by the governmental authority with jurisdiction over the license; or |
| (b) If the business is not required to be licensed, its federal employer identification number or federal tax number (FEIN) on its official letterhead with a notarized signature of the owner or an authorized representative; or | |
| A letter showing exemption from business licensing and applicable law. |
(a) IVIPS is only available for volume users making more than fifty requests for information per year, and at least five requests per quarter. New applicants for IVIPS accounts should estimate their projected usage. DOL will confirm the usage of renewing applicants. Parties denied IVIPS access solely on the basis of frequency of use may obtain the same information through individual public disclosure requests.
(b) IVIPS represents an important means of information access for businesses requiring information at night or on weekends and holidays. IVIPS applications will be evaluated based on the applicant's need for "24/7" information.
(11) How much does access to electronic vehicle and vessel information cost? A security deposit of not less than twenty-five dollars must be placed with DOL before an IVIPS account can be opened. The minimum deposit may be increased by DOL for entities making more than six hundred twenty-five requests per month. The deposit is fully refundable on closure of the account so long as the account is not in arrears. An additional charge is assessed for each electronic IVIPS request for information.
File transfer accounts are subject to programming charges as listed below.
| One Time Request Public Disclosure |
||
| Position | Unit | Hours |
| CM | Contract management | 15 |
| ITS-5 | Programming | 40 |
| One Time Request Vehicle and Vessel FTP |
||
| Position | Unit | Hours |
| CM | Contract management | 15 |
| ITS-5 | Programming/test/ implementation |
40 |
| ITS-4 | Documentation | 5 |
| ITS-2 | Production control | 1 |
| ITS-4 | User system support | 2 |
| Initial Setup Cost Vehicle and Vessel FTP |
||
| Position | Unit | Hours |
| CM | Contract management | 15 |
| ITS-5 | Programming/test/ implementation |
40 |
| ITS-4 | Documentation | 10 |
| Production control | 1 | |
| User system support | 2 | |
| Monthly Upkeep and Maintenance Vehicle and Vessel FTP |
||
| Position | Unit | Hours |
| CM | Contract management | 15 |
| ITS-5 | Programming/test/ implementation |
2 |
| ITS-4 | Production control | 2 |
| ITS-2 | User system support | 2 |
| Initial Setup Cost Vehicle and Vessel VOIDS |
||
| Position | Unit | Hours |
| CM | Contract management | 15 |
| ITS-5 | Programming/test/ implementation |
20 |
| ITS-4 | Documentation | 5 |
| ITS-2 | Production control | 1 |
| ITS-4 | User system support | 2 |
| Monthly Upkeep and Maintenance Vehicle and Vessel VOIDS |
||
| Position | Unit | Hours |
| CM | Contract management | 15 |
| ITS-5 | Programming/test/ implementation |
1 |
| ITS-2 | Production control | 1 |
| ITS-4 | User system support | 1 |
| Initial Setup Cost Vehicle Parking Tickets |
||
| Position | Unit | Hours |
| CM | Contract management | 15 |
| ITS-5 | Programming/test/ implementation |
30 |
| ITS-4 | Documentation | 5 |
| ITS-2 | Production control | 1 |
| ITS-4 | User system support | 5 |
| Monthly Upkeep and Maintenance Vehicle Parking Tickets |
||
| Position | Unit | Hours |
| CM | Contract management | 15 |
| ITS-5 | Programming/test/ implementation |
1 |
| ITS-2 | Production control | 1 |
| ITS-4 | User system support | 1 |
All personally identifiable information must be destroyed securely.
(13) If I am an attorney, private investigator, or process server acting on behalf of an attorney, will notification of my inquiry be given to the registered owner (to include "whoever" accesses the information as a "representative" or "agent" of the private investigator or attorney, such as a process server)? Yes, the notice will contain the name, address, and contact telephone number of the requesting party if he or she is an attorney or private investigator. The notice must have instructions for who to contact if there are any questions. Additionally, if a contract holder, other than a private investigator or attorney, releases owner information to a private investigator or attorney, they must notify the registered owner and the department that a request has been granted. This notification must include the name, address, and phone number of the requesting party. (RCW 46.12.380(4).)
(14) When can I search by name, instead of by plate and/or VIN only? You must demonstrate a business need for name (also known as "alphabetic") search capability. These searches are available only to insurance companies, private investigators, attorneys, process servers, courts and other government agencies.
[]
[]