National Conference of State Legislatures

Real ID Final Regulations: Brief #2

Identification Documents, Verification Systems and Privacy

January 18, 2008

This is the second brief in a series summarizing the final regulations for implementation of the Real ID Act of 2005. In particular, this brief relates to sections of subparts B, C, and D of the regulations. Brief #3 will focus on the physical security requirements for the department of motor vehicle (DMV) facilities and background checks for DMV employees and Brief #4 will address requirements for the Real ID compliant card. The final regulations, Brief 1 and other resources on Real ID are available at: http://www.ncsl.org/realid/

Identification Documents
Under the Real ID Act, states and territories are required to verify, with the issuing agency, the validity of the identification documents an applicant presents to establish:

identity;
date of birth;
proof of social security number or that the person is not eligible for a social security number;
the person’s name and address of principal residence; and
the person’s lawful status in the United States.

The regulations define “verify” to mean authenticating that a source document is genuine and has not been altered and then validating identity data contained on the document.

An applicant would have to present at least one of the acceptable documents proposed by the Department of Homeland Security (DHS) and sign a declaration under penalty of perjury that the information presented is true and correct:

a valid unexpired U.S. Passport (approximately 25 percent of Americans hold passports);
a certified copy of a birth certificate;
a consular report of birth abroad;
a valid, unexpired permanent resident card (Form I-551);
an unexpired employment authorization document (EAD) (Form I-766 or I-688B);
an unexpired foreign passport with valid U.S. visa affixed accompanied by Form I-94;
a U.S. certificate of citizenship;
a U.S. certificate of naturalization;
a REAL ID driver’s license (DL) or identification card (ID) issued subsequent to the standards established by the regulations; or
such other documents as DHS may designate later in the Federal Register.

States must retain a copy of the declaration and a new declaration must be signed when applicants present new source documents.

If an individual’s name has changed through adoption, marriage, divorce or other court order, the individual must present documents showing the legal name change. The documents must come from a court, government agency, or other entity as determined by the state. States must maintain copies of documentation as well as a record of both the recorded name and the name on the source documents. Depending on the form in which documents are retained, states must maintain them for a minimum of seven (7) years up to a maximum of ten (10). Brief #6 will address documentation and retention in greater detail.

States can have an exceptions process for individuals who, for reasons beyond their control, are unable to present all necessary documents and must rely on alternate documents to establish identity. Alternative documents for lawful presence may only be used to demonstrate U.S. citizenship. For more on the exceptions process, see Brief #1.

Verification of Identity Documents
NCSL, governors and motor vehicle administrators recommended that states be required to employ electronic verification systems only as they become available. They also recommended that DHS prohibit federal agencies from charging states transaction fees for accessing the required systems. The final regulation calls on states to use these systems as they become available or to use alternative methods approved by DHS, and it appears that states can still expect to pay transactional access costs.

The Act contemplates that states will need to have access to 6 national databases for the purposes of verifying the validity of the required identification documents. This includes access to:

Verification System	Status
Social Security On-Line Verification (SSOLV)	Almost all states currently use this system.
Department of State	DHS is working with the Department of State to make it available.
Electronic Verification and Vital Events (EVVE)	System is currently in a pilot phase.
Systematic Alien Verification for Entitlements (SAVE)	All 50 states have Memorandums of Understanding (MOUs) for access to SAVE; however, only 20 are currently using it to verify lawful status.
Student and Exchange Visitor Information System (SEVIS)	DHS expects states to access SEVIA via SAVE, and the draft regulations suggested that connection would be in place by May 2008.
All-State DL/ID Records System	DHS issued a request for proposals largely intended to develop this system in December 2007.

DHS stated in the draft regulations that it will support the development of, but will not operate, a federated querying system, where a state could conduct all queries through one portal. State participation will be voluntary. DHS is proposing to leave the operation of this data query, including the development of the business rules, to the states. Working toward this end, on December 13, 2007 DHS published grant guidelines requesting that states submit proposals, preferably collaboratively, to develop this “hub.” Applications are due to DHS on January 28, 2008.

Verification of Address of Principal Residence
NCSL, governors and motor vehicle administrators recommended that the address of principal residence be determined by having the applicant provide an affidavit and by providing corroborating documentation.

DHS defines principal address as, “The location where a person currently resides (i.e., presently resides even if at a temporary address) in conformance with the residency requirements of the State issuing the driver’s license or identification card, if such requirements exist.” DHS is requiring applicants to present at least two documents of the state’s choice that include the individual’s name and principal residence. A street address is generally required.

Verification of Birth Certificates
DHS anticipates states will be able to electronically verify the issuance of birth certificates though EVVE or another electronic system. If documents do not appear authentic or data does not match and an exceptions process is not appropriate, DHS forbids the state from issuing a REAL ID DL or ID until the information verifies. States are to refer applicants to the document’s issuing agency for resolution of the match failure.

Verification of U.S. Passports or Consular Reports of Birth Abroad
It is anticipated that a state will be able to verify these documents with the U.S. Department of State or through other methods approved by DHS.

Verification of Valid U.S. Visas Affixed in an Unexpired Foreign Passport
Individuals presenting this form of documentation would require a SAVE and SSOLV check.

Verification of Lawful Status
NCSL, governors and motor vehicle administrators recommended limiting the acceptance of foreign documents to official passports accompanied by appropriate and clearly defined U.S. immigration documents. The states also recommended limiting document verification to what could be accomplished through an enhanced SAVE program that is fully developed, operational in real-time and accessible to all jurisdictions at no cost to states. The state groups also recommended the expansion of SAVE to include Certificates of Naturalization.

Verification of Social Security Number
DHS proposes allowing an applicant to establish their social security number by presenting a social security card, a W-2 form, a SSA 1099, a non-SSA 1099, or a pay stub with the applicant’s name and SSN on it. An alien in the United States without authorization to work is generally not eligible for a SSN. In order to prove ineligibility for a SSN, an alien must present evidence that he or she is currently in a non-work authorized non-immigrant status. States will be required to check the validity of the number using SSOLV.

State Database and Connectivity to Other States’ Databases
The regulations require a state to maintain a motor vehicle database that contains at a minimum:

all data fields printed on the driver’s license and identification cards, individual serial numbers of the card, and social security numbers;
a record of the full legal name and recorded name (as noted above), without truncation;
all data fields included on the machine-readable zone that are not printed on the front of the card; and
motor vehicle driver histories, including motor vehicle violations, suspensions and points.

Prior to issuing a Real ID compliant license, states must check with all other states to determine if any state has already issued a Real ID driver’s license or card to the applicant. If a state receives confirmation that the applicant holds another Real ID, the regulations require the state to confirm that the applicant has terminated or is terminating the extant Real ID pursuant to state law before issuing a new REAL ID.

DHS is exploring use of AAMVAnet or expansion of Commercial Driver’s License Information System (CDLIS) or some other service as the platform for the state-to-state exchange.

Privacy
NCSL, governors and motor vehicle administrators recommended the “masking” of an address for persons in certain protected classes while securely retaining the information in the database. The state groups also recommended that the Driver Privacy Protection Act (DPPA) (18 U.S.C. Sec. 2721, etc. sec) be reconciled to reflect the new responsibilities of DMVs and advances in technology since the DPPA was passed.

The DHS privacy office issued a Privacy Impact Assessment (PIA) on the notice of proposed rulemaking (http://www.dhs.gov/xlibrary/assets/privacy/privacy_pia_realidfr.pdf), which analyzed:

concerns that the Real ID creates a national identity card or database;
how personal information will be protected from unauthorized access or use;
whether and how the personal information stored in digital format on the credentials will be protected against unauthorized use;
the use of a photograph and address on the credential; and
the requirement that DMVs conduct a financial history check on covered employees.

In response to these concerns, the DHS privacy office issued a PIA on the final rule. The PIA explains how the final rule addressed the concerns of the initial PIA. A copy of the report can be accessed at: http://www.dhs.gov/xlibrary/assets/privacy/privacy_pia_realidfr.pdf .

NCSL has identified a number of provisions in the final regulations that remain of interest as they relate to the protections of individuals’ identity.

Security Plan/Certification
A state’s security plan, as submitted for certification, is required to outline how it will protect the privacy of personally identifiable information collected, disseminated or stored. States must establish a privacy policy regarding personally identifiable information collected and maintained by the DMV. The regulations set the Driver’s Privacy Protection Act as the floor for use of personal information collected by DMVs, but states may set more stringent requirements, which will not be subject to DHS review.

Protection of Information Contained in Machine Readable Zone (MRZ) of the Card
At this time, DHS is not requiring the encryption of the information contained in the MRZ of the card. States are required to use a PDF417 2D bar code, with the following defined minimum data elements – expiration date, full legal name, transaction date, date of birth, gender, address as listed on card, unique identification number, revision date, inventory control number of the physical document, and state or territory of issuance.

Masking the Address for Persons in Certain Protected Classes
States are not required to comply with certain requirements when issuing driver’s licenses or identification cards in support of federal, state or local criminal justice agencies or programs that require special licensing and safeguards. These cards must not be distinguishable from other Real ID licenses or cards issued by a state.

For more information contact NCSL staff Jeremy Meadows (Jeremy.Meadows@ncsl.org, 202-624-8664) or Garner Girthoffer (Garner.Girthoffer@ncsl.org, 202-624-7753).