National Conference of State Legislatures

Real ID Draft Regulations: Brief #2

Identification Documents, Verification Systems and Privacy

March 5, 2007

Identification Documents, Verification Systems and Privacy

This is the second brief in a series summarizing the draft regulations for implementation of the Real ID Act of 2005. Brief 3 will be published on Tuesday, March 6 and will focus on the physical security requirements for the department of motor vehicle (DMV) facilities, and background checks for DMV employees. A copy of the draft regulations, Brief 1 and other resources on Real ID are available at: http://www.ncsl.org/realid

Identification Documents

Under the Real ID Act, states and territories are required to verify, with the issuing agency, the validity of the identification documents an applicant presents to establish:

identity;
date of birth;
proof of social security number or that the person is not eligible for a social security number;
the person’s name and address of principal residence; and
the person’s lawful status in the United States.

An applicant would have to present at least one of the acceptable documents proposed by the Department of Homeland Security (DHS):

a valid unexpired U.S. Passport (approximately 25 percent of Americans hold passports);
a certified copy of a birth certificate;
a consular report of birth abroad;
an unexpired permanent resident card (Form I-551);
an unexpired employment authorization document (EAD) (Form I-766);
an unexpired foreign passport with valid U.S. visa affixed;
a U.S. certificate of citizenship;
a U.S. certificate of naturalization; or
a REAL ID driver’s license (DL) or identification card (ID) issued subsequent to the standards established by the regulations.

If an individual’s name has changed through adoption, marriage, divorce or other court order, the individual must present an original or certified copy of the document showing a legal name change. The documents must come from a U.S. or State Court or government agency. States can have an exceptions process for individuals who, for reasons beyond their control, are unable to present all necessary documents and must rely on alternate documents to establish identity. An exceptions process cannot be used to demonstrate lawful status. For more on the exceptions process, see Brief 1.

Verification of Identify Documents

NCSL, governors and motor vehicle administrators recommended that states be required to employ electronic verification systems only as they become available. They also recommended that DHS prohibit federal agencies from charging states transaction fees for accessing the required systems.

The Act contemplates that states will need to have access to 6 national databases in order to verify the validity of the required identification documents. This includes access to:

Verification System

Status

Social Security On-Line Verification (SSOLV)

Almost all states currently use this.

Department of State

DHS is working with the Department of State.

Electronic Verification and Vital Events (EVVE)

Currently in a pilot phase.

Systematic Alien Verification for Entitlements (SAVE)

All 50 states have Memorandums of Understanding (MOUs) for access to SAVE; however, only 20 are currently using it to verify lawful status.

Student and Exchange Visitor Information System (SEVIS)

DHS expects a SEVIS-SAVE connection to be in place by May 2008.

All-State DL/ID Records System

To be determined.

DHS states in the draft regulations that it is supporting the development of, but will not operate, a federated querying system, where a state could conduct all queries through one portal. State participation will be voluntary. DHS is proposing to leave the operation of this data query, including the development of the business rules, to the states.

Verification of Address of Principal Residence

NCSL, governors and motor vehicle administrators recommended that the address of principal residence be determined by having the applicant provide an affidavit and by providing corroborating documentation.

DHS proposes to define principal address as, “The place at which a person has been physicially present and that the person regards as home; a person’s true, fixed, principal and permanent home, to which the person intends to return and remain even though currently residing elsewhere” (Black’s Law Dictionary).

DHS recognizes that there is no national database to verify principal address. Therefore, DHS is recommending that each applicant present at least two documents that include his or her name and current principal address. The states will retain the flexibility to determine for themselves which documents or combination of documents an applicant must present and how a state will validate or verify the information. States are required to establish a written policy on this issue, which would be part of a state’s initial certification package. Whatever documents states determine to be acceptable, they must contain a street address. Post office boxes and rural route numbers are not acceptable. One exception might be American Samoa as this territory does not use the same type of addresses commonly used in the 50 States. Documents issued monthly cannot be more than three months old at the time of application. Documents issued annually (e.g. property tax records) would need to be for the most current year. Applicants would also be required to sign a declaration affirming that the information they present is true and correct.

For minors and other dependents, parents and legal guardians would need to present photo identification (that the DMV would need to verify), and would be required to submit two or more address documents, and sign the affirmation.

Verification of Birth Certificates

DHS anticipates states will be able to electronically verify the issuance of birth certificates though EVVE. While EVVE has not been tested nationwide, reports say it “could” be in place and fully operational by May 2008. If such system is not available nationally by May 11, 2008, or a state is seeking to verify the validity of a birth certificate from a state that is not participating in the EVVE system, a state may establish and document its written procedures for how it will attempt to verify the records. At a minimum the applicant’s record should contain a notation that the

birth certificate was not electronically verified and that verification will be necessary at the next renewal or reissuance, if the information is at that time available for electronic verification. States can have an exceptions process for certain individuals born before 1935 (see Brief 1).

Verification of U.S. Passports or Consular Reports of Birth Abroad

It is anticipated that a state will be able to verify these documents with the U.S. Department of State.

Verification of Valid U.S. Visas Affixed in an Unexpired Foreign Passport

Individuals presenting this form of documentation would require only a SAVE and SSOLV check.

Verification of Lawful Status

NCSL, governors and motor vehicle administrators recommended limiting the acceptance of foreign documents to official passports accompanied by appropriate and clearly defined U.S. immigration documents. The states also recommended limiting document verification to what could be accomplished through an enhanced SAVE program that is fully developed, operational in real-time and accessible to all jurisdictions at no cost to states. The state groups also recommended the expansion of SAVE to include Certificates of Naturalization.

States would be able to use SAVE to verify the documents allowed to prove lawful status (see identification documents above). However, in the case of student aliens admitted for a duration status, states should use SEVIS. There will eventually be a connection between SEVIS and SAVE. If this is not available on May 11, 2008, DHS may require foreign students to present a certified statement from the registrar of the school in a sealed envelope demonstrating that he or she is still in school at the time of the application.

Verification of Social Security Number

DHS proposes allowing an applicant to establish their social security number by presenting a social security card, a W-2 form, a SSA 1099, a non-SSA 1099, or a pay stub with the applicant’s name and SSN on it. An alien in the United States without authorization to work is generally not eligible for a SSN. In order to prove ineligibility for a SSN, an alien must present evidence that he or she is currently in a non-work authorized non-immigrant status. States will be required to check the validity of the number using SSOLV.

State Database and Connectivity to Other States’ Databases

The regulations require a state to maintain a motor vehicle database that contains at a minimum:

all data fields printed on the driver’s license and identification cards, individual serial numbers of the card, and social security numbers; and
motor vehicle driver histories, including motor vehicle violations, suspensions and points.

States must provide to all other states electronic access to the information contained in the database in a manner approved by DHS pursuant to the regulation. Prior to issuing a Real ID compliant license, states must check with all other states to determine if any state has already issued a Real ID driver’s license or card to the applicant. The regulations have requirements regarding what steps a state must take if the query confirms that the individuals does hold a Real ID compliant license in another state.

It has not been determined whether the Commercial Driver’s License Information System (CDLIS) or some other service will be the platform for the state-to-state exchange. The draft regulations state that it will be necessary for the states, working with DHS and the Department of Transportation, to define the privacy protections.

Privacy

NCSL, governors and motor vehicle administrators recommended the “masking” of an address for persons in certain protected classes while securely retaining the information in the database. The state groups also recommended that the Driver Privacy Protection Act (DPPA) (18 U.S.C. Sec. 2721, etc. sec) be reconciled to reflect the new responsibilities of DMVs and advances in technology since the DPPA was passed.

The DHS privacy office issued a Privacy Impact Assessment (PIA) on the rule. The statement analyzed:

concerns that the Real ID creates a national identity card or database;
how personal information will be protected from unauthorized access or use;
whether and how the personal information stored in digital format on the credentials will be protected against unauthorized use;
the use of a photograph and address on the credential; and
the requirement that DMVs conduct a financial history check on covered employees.

A copy of the 24 page report can be accessed at: http://www.dhs.gov/xlibrary/assets/privacy/privacy_pia_realid.pdf

NCSL has identified a number of provisions in the draft regulations that may be of interest as it relates to the protections of individuals’ identity.

Security Plan/Certification

A state’s security plan, as submitted for certification, is required to outline how it will protect the privacy of personal information collected, disseminated or stored. In particular, it should demonstrate it has implemented best practices to protect the privacy of the license holder as guided by the fair information principles, which call for openness, individual participation (access, correction and redress), purpose specification, data minimization, use and disclosure limitation, data quality and integrity, security safeguards, and accountability of auditing.

Protection of Information Contained in Machine Readable Zone ( MRZ) of the Card

At this time, DHS is not requiring the encryption of the information contained in the MRZ of the card. States are required to use a PDF417 2D bar code, with the following defined minimum data elements—expiration date, name (up to 125 characters), issue date, date of birth, gender, address, unique identification number, revision date, and inventory control number of the physical document.

DHS encourages states to address concerns about the ability of non-law enforcement third parties to collect or skim personal information stored on the Real ID driver’s licenses or identification cards. (The requirements for the card will be covered in more detail in Brief 4. Discussion of the temporary card and the non-compliant will appear in a future brief).

Masking the Address for Persons in Certain Protected Classes

States are not required to comply with certain requirements when issuing driver’s licenses or identification cards in support of the Federal Witness Security Program, or operation by other federal, state or local criminal justice agencies. In addition, when requested by an authorized representative of the Federal Witness Security Program or the criminal justice agency, states should remove from public record appropriate material relating to the prior or the other identities of people involved in the operation and should take sufficient other steps, as directed by appropriate officials, to safeguard the identities of such persons. The regulations also exempt individuals who are entitled to enroll in state address confidentiality programs, whose addresses are entitled to be suppressed under state or federal law, by court order, or who are protected fro m disclosure of information pursuant to section 384 of the Illegal Immigration Reform and Immigrant Responsibility Act of 1996 from the requirement to have their address displayed on the REAL ID compliant card.

For more information contact NCSL staff Molly Ramsdell (Molly.Ramsdell@ncsl.org, 202-624-3584), Jeremy Meadows (Jeremy.Meadows@ncsl.org, 202-624-8664) or Garner Girthoffer (Garner.Girthoffer@ncsl.org, 202-624-7753).