The Impact of Real ID on Current State Laws
A review of U.S. state laws on privacy and driver's licenses shows that there is an enormous variety in the statutes that are on the books in the various states. This has two important implications. First, it is clear that many states do not have adequate protections in place to combat the type of privacy invasions that Real ID will spur, such as the ability of private businesses to grab all your data off the new, standardized "machine readable zones" that Real IDs will be required to contain.
Second, for Real ID to take effect, a lot of states that do have privacy laws and other laws governing driver's licenses will have to scrap or revise those laws. That process will often be complicated, controversial, and time-consuming, and is another of the many practical obstacles that this most impractical Act must overcome.
The following is a chart that provides an overview of the relevant state laws that will require change as a result of Real ID. It was prepared by Min-Jae Lee, Lauren Gelman and Jennifer Granick of the Cyberlaw Clinic of Stanford Law School. It provides state-by-state information based on the following five criteria:
- Any mention of liberty or privacy in the state constitution. Real ID is likely to conflict with these fundamental protections.
- Any controls over what type of information can be included on a driver's license. That in turn may govern what information can be contained in cards with machine-readable zones, such as bar codes, RFID chips, or magnetic strips. Where they exist, such provisions may need to be harmonized with Real ID - and where they're absent, they could allow the machine-readable zone to expand to contain an ever-growing amount of information about the cardholder.
- Any privacy protections that the state currently mandates for the technology employed in the driver's license, such as digital image capture or magnetic strips. For example, some states bar inclusion of social security numbers, or data not on the face of the card, from current magnetic strips to prevent them from expanding into all-encompassing digital dossiers.
- Any controls over who has access to the information contained on the physical license or in the MRZ. With a standardized national machine-readable zone, it will become easier than ever for a wide variety of peopl - from police officers and security guards to store clerks to bartenders - to access whatever data is on that license.
- Any controls over what data can be collected from driver's licenses, where and for how long that information may be stored, and who is authorized to access that information. Where restrictions are lacking, private-sector companies, for example, will be tempted to begin compiling license data they grab into valuable databases that will be sold or traded.
As the chart demonstrates, many of the statutes crafted by individual states to protect the safety of their roads and the privacy of their citizens will be swept under the rug in favor of an unfunded mandate poised to do little to protect the nation from terrorism. The laundry list of state laws that will need to be revised in the face of the federal statute represents not only an enormously daunting feat for legislators, but also an arrogant, big government rebuke of states' rights.
Overall, it is clear that the Real ID Act's attempt to impose a rigid uniformity upon state licensing practices will have a sweeping impact on state laws protecting citizen and consumer privacy.
View the chart here: PDF >
For more information on the burdens Real ID will place on state governments and agencies, see the ACLU paper "Real Burdens," and the results of a survey of state motor vehicles administrators on Real ID that was conducted in 2005.
Thanks to the Stanford Cyberlaw Clinic for preparing this chart.