Real ID comes with privacy pitfalls

State governments must resist the urge to use data needed to verify the identity of driver’s license applicants for other purposes, a privacy expert told attendees at an information technology conference.

Under the federal Real ID Act of 2005, state motor vehicle departments (DMVs) must collect, authenticate and electronically scan and store breeder documents, such as birth certificates, for every applicant. The law is intended to make sure that applicants are who they say they are and receive only one identity card or driver’s license.

Leslie Harris, executive director with the Center for Democracy and Technology, said privacy advocates see no reason why such information would be linked to other state databases. During an Information Technology Association of America conference on the issue, she said the Homeland Security Department should include privacy protections for personal driver data as they draw up regulations spelling out what states need to do to implement the federal law.

“The rule ought to insist that breeder data is kept absolutely segregated,” she said. She added the breeder data shouldn’t be used for other purposes.

“I think that there is a tension here between what you’re asked to do, which is spend extraordinary amounts of money to build this system, which could have a lot of other purposes in this case,” she said. “And, just as a financial matter, I think the desire to maximize use of those dollars would lead a state official to look at all kinds of other ways to leverage this investment. I not only encourage you not to do that but in fact we would be advocating quite vigorously that you should not be able to do that.”

Privacy advocates have long opposed the Real ID Act because they believe that it essentially creates a national database and national ID card. One requirement of the law is to allow information sharing of motorist data among DMVs to find out if individuals are holding more than one license.

One DHS official said privacy is an important element and that the department has been looking at ensuring privacy protection.

John Yacavone, legal services bureau chief with Connecticut’s DMV, said there is no provision in the Real ID Act that requires or even mentions information privacy or security data. He said there may be precedents in other federal laws concerning motor vehicles that could provide data protection.

“That is the challenge that we face,” he said.