ARC 6060C

ARC 6060C

TRANSPORTATION DEPARTMENT[761]

Adopted and Filed

Rule making related to driver's privacy protection and motor vehicle records

The Transportation Department hereby amends Chapter 4, "Public Records and Fair Information Practices," adopts new Chapter 301, "Driver's Privacy Protection—Motor Vehicle Records" and rescinds Chapter 415, "Driver's Privacy Protection—Certificates of Title and Vehicle Registration," Chapter 610, "Release of Computerized Driver's License and Nonoperator's Identification Card Records," and Chapter 611, "Driver's Privacy Protection—Driver's License and Nonoperator's Identification Card," Iowa Administrative Code.

Legal Authority for Rule Making

This rule making is adopted under the authority provided in Iowa Code sections 307.12, 321.11 and 321A.3.

State or Federal Law Implemented

This rule making implements, in whole or in part, Iowa Code sections 321.10, 321.11, 321.13 and 321A.3 and 18 U.S.C. Section 2721 et seq.

Purpose and Summary

This rule making adopts new Chapter 301, which combines content from current Chapters 415, 610 and 611, related to motor vehicle records and the federal Driver's Privacy Protection Act of 1994 (DPPA). The purpose of creating this new chapter is to join chapters with similar content and reduce the number of places an interested party would need to check to determine the privacy requirements related to personal information contained in motor vehicle records protected under the DPPA. Along with the adoption of new Chapter 301, the three current Chapters 415, 610 and 611 will be rescinded and Chapter 4 will be amended to refer to Chapter 301.

In addition to simply combining content from three separate chapters into one chapter, this rule making updates the rules to align with existing legal authority and Department practice and eliminates outdated or irrelevant requirements or options.

The following paragraphs further explain the amendments:

Applicability. The rule concerning applicability states that the chapter applies to personal information contained in motor vehicle records, which is covered under the DPPA and Chapter 301.

Definitions. The definitions rule combines definitions from Chapters 415, 610 and 611. No new definitions have been added.

Motor vehicle records access. The amendments outline the requirements and procedures implementing the DPPA and Iowa Code section 321.11 as these requirements pertain to accessing motor vehicle records. Specifically, the rules outline the process for accessing a motor vehicle record containing personal information depending on if the requester is seeking a motor vehicle record that contains personal information about another individual, or if the requester is seeking information from the requester's own motor vehicle records, or if the requester is a law enforcement agency. The rule states that the Department shall not release any personal information if requested by vehicle license plate number or validation sticker number, except as provided in Iowa Code section 321.11. The rules also provide that all requesters who obtain personal information from the Department are required to comply with the provisions of Iowa Code section 321.11 and the DPPA.

Electronic motor vehicle records. The Department has the ability to create an electronic file of motor vehicle records for authorized requesters under the DPPA, and the rule provides that the Department may either require the privacy act form to be completed or the Department may enter into a memorandum of understanding governing the terms of accessing motor vehicle records electronically.

Certified driving record abstracts. A certified abstract of a driving record contains information on the face of an individual's driver's license in addition to information regarding the individual's driver's license sanctions, reportable motor vehicle accidents, and convictions. A certified abstract of a driving record is often used in court proceedings or for other official purposes. Personal information in a certified abstract of a driving record may only be released if the requester completes and submits the applicable privacy act agreement form, provides any required proof of identity and authority to secure access to the information, and pays any applicable statutory fee. The rule also includes application provisions for law enforcement agencies or a person seeking the person's own record.

Public Comment and Changes to Rule Making

Notice of Intended Action for this rule making was published in the Iowa Administrative Bulletin on September 22, 2021, as ARC 5921C. A public hearing was held on October 14, 2021, at 1 p.m.

The Department received written and oral comments from an insurance agent and risk management consultant, Matthew Wilson with Molyneaux. Shelly Chandler and Susan Seehase from the Iowa Association of Community Providers also participated in the public hearing. The commenters had concerns about a recent change in status as an authorized requester of motor vehicle records. However, the commenters agreed that the amendments do not change who is considered an authorized requester under the law and are willing to continue to work with the Motor Vehicle Division to resolve their concerns outside of the rule-making process.

No changes from the Notice have been made.

Adoption of Rule Making

This rule making was adopted by the Department on November 9, 2021.

Fiscal Impact

This rule making has no fiscal impact to the State of Iowa because the Department is not adding any fees that are not already required by statute.

Jobs Impact

After analysis and review of this rule making, no impact on jobs has been found.

Waivers

Any person who believes that the application of the discretionary provisions of this rule making would result in hardship or injustice to that person may petition the Department for a waiver of the discretionary provisions, if any, pursuant to 761—Chapter 11.

Review by Administrative Rules Review Committee

The Administrative Rules Review Committee, a bipartisan legislative committee which oversees rule making by executive branch agencies, may, on its own motion or on written request by any individual or group, review this rule making at its regular monthly meeting or at a special meeting. The Committee's meetings are open to the public, and interested persons may be heard as provided in Iowa Code section 17A.8(6).

Effective Date

This rule making will become effective on January 5, 2022.

The following rule-making actions are adopted:

Item 1. Amend paragraph 4.9(13)"a" as follows:

a. Information other than personal information contained on electronic driver's license or nonoperator's identification card records that is provided by the licensee or card holder to the department for use by law enforcement, first responders, emergency medical service providers, and other medical personnel responding to or assisting with an emergency may be disclosed only as provided in Iowa Code sections 321.11 and 321.11A, 18 U.S.C. § 2721 et seq., and 761—Chapters 415, 610 and 611 761—Chapter 301.

Item 2. Adopt the following new 761—Chapter 301:

CHAPTER 301

DRIVER'S PRIVACY PROTECTION—MOTOR VEHICLE RECORDS

761—301.1(321) Applicability. This chapter applies to personal information and highly restricted personal information in records pertaining to driver's licenses, nonoperator's identification cards, and personal information and highly restricted personal information about vehicle owners in records pertaining to certificates of title, registration receipts and registration renewal receipts issued by the department or a county treasurer. In addition to information on current licensees and cardholders, motor vehicle records include information on individuals who do not currently hold a driver's license or nonoperator's identification card, including, but not limited to, operating records and records of driver sanctions.

This rule is intended to implement Iowa Code section 321.11 and 18 U.S.C. §2721 et seq.

761—301.2(321) Adoption. The department adopts the Driver's Privacy Protection Act of 1994 (18 U.S.C. §2721 et seq.) for motor vehicle records.

This rule is intended to implement Iowa Code section 321.11 and 18 U.S.C. §2721 et seq.

761—301.3(321) Definitions.

"Certified abstract of operating record" means the same as described in Iowa Code section 321A.3(1).

"Driver's license" means the same as defined in Iowa Code section 321.1(20A).

"Driver's Privacy Protection Act" means the Act adopted in rule 761—301.2(321).

"Highly restricted personal information" means an individual's photograph or image, social security number, or medical or disability information.

"Law enforcement agency" includes, but is not limited to, county attorneys, federal district attorneys, attorneys general, state and federal departments of justice, and a division or unit of a governmental agency if the division's or unit's primary responsibility is to prevent or detect crime or enforce criminal laws.

"Motor vehicle record" as used in the Driver's Privacy Protection Act means any record that pertains to a driver's license, nonoperator's identification card, certificate of title, registration receipt, or registration renewal receipt issued by the department or a county treasurer.

"Person" means an individual, organization or entity.

"Personal information" means information that identifies an individual, including the items listed in Iowa Code section 321.11 and 18 U.S.C. §2725 of the Driver's Privacy Protection Act adopted in rule 761—301.2(321). "Personal information" also includes information on an individual's nonoperator's identification card.

"Requester" means an individual, organization or entity that seeks from the department access to personal information or highly restricted personal information contained in the individual's own or another individual's motor vehicle record. A requester does not include an individual who is an authorized employee of the department or a county treasurer acting within the scope of the employee's office or employment.

"Sanction" means the same as defined in rule 761—615.1(321).

"Vehicle owner" as used in this chapter means a vehicle owner who is an individual, not a company, organization or other legal entity.

This rule is intended to implement Iowa Code section 321.11 and 18 U.S.C. §2721 et seq.

761—301.4(17A) Information and addresses. Information and forms for records pertaining to motor vehicle records may be obtained at any driver's license service center or by mail from the Motor Vehicle Division, Iowa Department of Transportation, P.O. Box 9278, Des Moines, Iowa 50306-9278; in person at 6310 SE Convenience Blvd., Ankeny, Iowa; by telephone at (515)237-3110; by email at privacy.agreements@iowadot.us; or on the department's website at www.iowadot.gov.

This rule is intended to implement Iowa Code section 17A.3.

761—301.5(321) Requirements and procedures. Notwithstanding Iowa Code chapter 22 and 761—Chapter 4, the following procedures implement the Driver's Privacy Protection Act and Iowa Code section 321.11 as the provisions pertain to access to records related to driver's licenses, nonoperator's identification cards, certificates of title, registration receipts and registration renewal receipts. The department does not provide the waiver procedure described in the Driver's Privacy Protection Act (codified as 18 U.S.C. §2721(d)).

301.5(1) The department shall require a requester who requests personal information or highly restricted personal information about another individual to:

a. Complete Form 431069, "Privacy Act Agreement for Request of Motor Vehicle Records," and submit the form to any driver's license service center or the motor vehicle division at the address in rule 761—301.4(17A).

b. Provide proof of identity and authority to access the information by completing Form 431069, "Privacy Act Agreement for Request of Motor Vehicle Records," and including a legible photocopy of the requester's driver's license or nonoperator's identification card.

c. Provide proof of authority to secure access to the personal information or highly restricted personal information by completing Part C of Form 431069, "Privacy Act Agreement for Request of Motor Vehicle Records," and providing the department with proof of the requester's status or other additional information the department may request.

d. Complete the certification on Part D of Form 431069, "Privacy Act Agreement for Request of Motor Vehicle Records," and provide any proof necessary to establish relevant facts.

301.5(2) The department shall require a law enforcement agency that requests personal information or highly restricted personal information about another individual to either follow the process in subrule 301.5(1) or complete and submit Form 431200, "Certified Motor Vehicle Record Request Form for Use by County Attorney's Offices and Law Enforcement Agencies," to any driver's license service center or the motor vehicle division at the address in rule 761—301.4(321). Nothing in this subrule shall preclude a law enforcement agency from completing and submitting Form 431069 or from entering into a memorandum of understanding with the department for the purposes of requesting personal information or highly restricted personal information.

301.5(3) The department shall require a requester who requests personal information or highly restricted personal information about themselves to either:

a. Complete and submit Part A of Form 431069, "Privacy Act Agreement for Request of Motor Vehicle Records," including a photocopy of the requester's driver's license or nonoperator's identification card to any driver's license service center or the motor vehicle division at the address in rule 761—301.4(321).

b. Provide valid proof of the requester's identity to any driver's license service center or the motor vehicle division at the address in rule 761—301.4(321).

301.5(4) Personal information and highly restricted personal information, except for an individual's photograph or image, may be disclosed with the express written consent of the individual or vehicle owner to whom such information applies. When the requester has obtained the written consent of the individual or vehicle owner to whom the information applies, the requester must attach that written consent on a completed Form 431069, "Privacy Act Agreement for Request of Motor Vehicle Records," and submit the form to any driver's license service center or the motor vehicle division at the address in rule 761—301.4(321). An individual's signature on the document providing express written consent allowing disclosure of the individual's personal information to another person must be notarized, or in the alternative, the signed written consent document must be accompanied by a copy of the individual's driver's license or nonoperator's identification card.

301.5(5) The statutory fee, if applicable, shall accompany the request for a motor vehicle record.

301.5(6) The department shall not release any personal information or highly restricted personal information if the request is made by plate number or validation sticker number, except as provided in Iowa Code section 321.11.

301.5(7) All requesters who obtain personal information or highly restricted personal information from the department are required to comply with Iowa Code section 321.11 and the Driver's Privacy Protection Act.

301.5(8) The department may transmit records to an authorized requester under this chapter by email.

This rule is intended to implement Iowa Code sections 321.10 and 321.11 and 18 U.S.C. §2721 et seq.

761—301.6(321) Electronic motor vehicle records files. Motor vehicle records files may be made available electronically to authorized requesters under the Driver's Privacy Protection Act upon approval by the department and upon payment of any applicable fees. The department may require the requester to complete and submit Form 431069, "Privacy Act Agreement for Request of Motor Vehicle Records," or Form 431200, "Certified Motor Vehicle Record Request Form for Use by County Attorney's Offices and Law Enforcement Agencies," to any driver's license service center or the motor vehicle division at the address in rule 761—301.4(321), including any required attachments, or may enter into a memorandum of understanding governing the terms of accessing the motor vehicle records files electronically.

This rule is intended to implement Iowa Code section 321.11 and 18 U.S.C. §2721 et seq.

761—301.7(321,321A) Certified abstract of operating records.

301.7(1) In accordance with Iowa Code section 321A.3, a certified abstract of the operating record of an individual is available. The record includes the information that is on the face of the individual's driver's license, plus information on the individual's sanctions, reportable vehicle accidents, and convictions. The certified abstract of operating record does not include the individual's photograph, social security number, or medical or disability information.

301.7(2) To obtain a certified abstract of an operating record of another individual, a requester shall complete Form 431069, "Privacy Act Agreement for Request of Motor Vehicle Records," and submit the form to any driver's license service center or the motor vehicle division at the address in rule 761—301.4(17A). Form 431069 must be completed with all required attachments before the department will process a request for a certified abstract of an operating record of another individual. A requester must attach a legible photocopy of the requester's driver's license or nonoperator's identification card to the form.

a. Personal information and highly restricted personal information protected by Iowa Code section 321.11 and the Driver's Privacy Protection Act may be released only if all of the following apply:

(1)The requester has complied with each of the following requirements:

1.Completed and submitted Form 431069, "Privacy Act Agreement for Request of Motor Vehicle Records," including proof of authority to secure access to the personal information or highly restricted personal information.

2.Included all required attachments with the form, including a photocopy of the requester's driver's license or nonoperator's identification card.

3.Paid the statutory fee by the methods permitted under Iowa Code section 321A.3, if applicable, for the requested record.

(2)The department is satisfied with the genuineness, regularity, and legality of the application and in any statement made within the application and in any required attachments.

b. Reserved.

301.7(3) The department shall require a law enforcement agency that requests a certified abstract of an operating record to complete to either follow the process in subrule 301.7(2) or submit Form 431200, "Certified Motor Vehicle Record Request Form for Use by County Attorney's Offices and Law Enforcement Agencies," to any driver's license service center or the motor vehicle division at the address in rule 761—301.4(321). Nothing in this subrule shall preclude a law enforcement agency from completing and submitting Form 431069 or from entering into a memorandum of understanding with the department for the purposes of requesting information under this rule.

301.7(4) The department shall require a requester seeking the requester's own operating record to either:

a. Complete and submit Part A of Form 431069, "Privacy Act Agreement for Request of Motor Vehicle Records," including a photocopy of the requester's driver's license or nonoperator's identification card to any driver's license service center or the motor vehicle division at the address in rule 761—301.4(321).

b. Provide valid proof of the requester's identity to any driver's license service center or the motor vehicle division at the address in rule 761—301.4(321).

301.7(5) The statutory fee, if applicable, shall accompany the request for a certified abstract of the operating record. There is no fee for an individual to view the individual's own operating record. Pursuant to the authority in Iowa Code section 321A.3, the department shall comply with the requirements of 781—Chapter 8 for payments accepted by credit card.

301.7(6) The single-use restriction in Iowa Code section 321A.3(8) applies only to the certified abstract of operating records and to persons who are subject to the fee listed in Iowa Code section 321A.3(1).

301.7(7) Any person who obtains a certified abstract of operating record from the department is required to comply with Iowa Code section 321.11 and the Driver's Privacy Protection Act.

This rule is intended to implement Iowa Code sections 321.11, 321.13 and 321A.3 and 18 U.S.C. §2721 et seq.

Item 3. Rescind and reserve 761—Chapter 415.

Item 4. Rescind and reserve 761—Chapter 610.

Item 5. Rescind and reserve 761—Chapter 611.

[Filed 11/9/21, effective 1/5/22]

[Published 12/1/21]

Editor's Note: For replacement pages for IAC, see IAC Supplement 12/1/21.