AGREEMENT , Betweenthe NEWYORKSTATEDEPARTMENTOF MOTORVEHICLES And STATEOF NEW JERSEYMOTORVEHICLECOMMISSION INTERSTATEFRAUDPREVENTIONINITIATIVE-COL THIS AGREEMENTis made betweenthe New York State Department of Motor Vehicles ("NY OMV''), an executive agency of the State of New York, and the State of New Jersey Motor Vehicle Commission ("NJ MVC"), a body corporate and politic established by P.L. 2003, c. 13.NY OMV and NJ MVC may collectively be referred to herein as the "Parties", and individually as the "Party"; WllNESSETH; WHEREAS the NJ MVC maintainsa databaseof the personal information of all oovers licensed in the State of New Jersey ("Personal Information"), including those holding commercial driver licenses ("CDLs") issued by the NJ MVC; and WHEREASthe NJ MVC maintains an image repository of all drivers licensed in the State of New Jersey, including those holding CDLs issued by the NJ MVC; and WHEREAS the NJ MVC is authorized to disclose personalinformation and images lrom its image repository to another governmental agency for use by that governmental agency in carrying out its functions, in accordance with N.J.S.A. 39;2-3.4(c)I and N.J.S.A. 39:3-10t2; and WHEREASthe NY DMV maintains a database of thepersonal information of all drivers licensed in the State of New York("Personal Information"), including those holding CDLs issued by theNY DMV; and WHEREAS the NY OMV maintains an image repository of all drivers licensed in the State of New York, including those holding CD Ls issued by the NJ OMV; WHEREASthe NY OMV is authorized to disclose personal information and images from its image repository to another governmental agency for use by that governmental agency in carrying out its fimctions, in accordance with the federal Driver's Privacy Protection Act ("DPPA") (18 U.S.C. §2721, et seq.); WHEREAS the Parties independently, and pursuant to separate contractual arrangements, have established relationships with a contractor, MorpboTrust USA, Inc., formerly L-1 Identity Solutions Operating Company ("Morpho"), to provide a facial recognition system that is integrated into each Party's driver license issuance process, by which such system compares the digitized image of a license applicant against all other digitized images in the Party's photo image database so as to permit identification of individuals with multiple license documents and prevent the issuance of a driver license based on a fraudulent application; and New Jersey MVC 108347 GULaw Privacy FR WHEREAS the Parties acknowledge that participation in the Interstate Fraud Prevention Initiative COL necessitatesthe disclosure of each Party's Personal Informationto the other Party to pennit a facial recognition comparison;and WHEREAS the Parties wish to engage in a regional facial recognition pilot program entitled "The Interstate Fraud Prevention Initiative - COL" ("IFPIC"), which involves the mutual exchange of the photo/ID imagesand personal informationcurrently maintainedby each of the Parties for the purposeof entering each photo/IO image into each Party's respectivefacial recognition system so that a comparison canbe performedand any matching images can be identified. NOW, THEREFORE,in consideration of the promises and mutual covenants contained herein, the Parties agi:eeas follows: I. The purpose of this Agreement is to assist the Parties in the identification of drivers, including commercial drivers, who have multiple license documents, prevent the issuance of driver licenses based upon fraudulent applications, and assist in the investigation of fraudulently obtained driver licenses and in the pursuit of administrativeend/or criminal actions against those individuals. 2. "Personal Information• is defined for the purpose of this Agreement, (a) pursuant to the federal Driver's Privacy Protection Act ("DPPA") (18 U.S.C. §2721, et seq.) end the New Jersey Driver's Privacy Protection Act ("NJ DPPA") {N.J.S.A. 39:3.3, et seq.), as "information that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone nwnber, and medical or disability information, but does not include information on vehicular accidents, driving violations, and driver's status" (See, §2125(3)); and(b) includes "private infonnation" as defined pursuant to the New York State Information Security Breach and Notification Act ("ISBNA") (General Business Law, §899-aa; State Technology Law, §208), as "any information concerning a natural person which, because of name, number, personal made,or other identifier, can be used to identify such natural person", such information " ... consisting of information in combination with any one or more of the following data elements, when either [such information] or the data element is not encrypted, or encrypted with an encryption key that has also been acquired: (1) social security number; (2) driver's license number or non-driver identification card nwnber; or (3) account number, credit or debit card number, in combination with any required security code, accesscode, or password that would permit accessto an individual's financial account; [excluding]publicly available information which is lawfully made available to the general public from federal, state, or local government records." 3. The documents and records provided by the NJ MVC may contain the names and addresses of individualsand other Personal Infonnation. NY OMV shall hold all such Personal Informationin confidence and shall only use the informationprovided by the NJ MVC in accordancewith the terms of this Agreement 4. The documents and records provided by the NY DMV may contain the names and addresses of individualsand other personal information. NJ MVC shall hold all such Personal lnfonnation in confidence and shall only use the informationprovided by the NY DMV in accordancewith the 2 New Jersey MVC 108348 GULaw Privacy FR termsof this Agreement 5. Each Pany shall take all stepsnecessaryto protect the other Party's Personal Information. a. Each Party shall safeguard the other's Personal Information to whichit has been given access against unauthorizeduse, access,disclosure, duplication, storage, or dissemination. b. Each Party's Personal Information shall only be accessible by the other's employees who have a need to know, the employees of Morpho who have a need to know and pursuantto the tenns of each Party's contract with Morpho,and authorized law enforcement or governmentagency employees in carrying out their functions consistent with the fraud prevention and detection_ initiatives set forth in this Agreement (collectively "Authorized Persons"). Authorized Persons shall !!Q1copy, duplicate, disclose, transmit or redistribute Personal Information in any fonn to persons other than Authorized Persons, whether in whole or in pert, or in any medium, whetherelectronic or hard copy, written or verbal. c. Each Party must ensure that only Authorized Persons will be granted access to the other's Personal Information, and such access shall be granted solely for the purpose of participating in the Regional Facial Recognition Program and performing a facial recognition system comparison. d. Each Party shall ensure that the other Party's Personal Information is .!!l!!stored on personal (non-business) computing or other electronic devices, or taken, removed or accessedin any form outside of the control of the receiving Party's facility where its facial recognitionsystem resides, except where required for criminal prosecution or administrativeaction. 6. The Parties are familiar with the security measures taken by each Pany with regard to data security and facility security, and agree that these measures are sufficient to meet any and all security requirements of their respective state. Prior to the exchange of the Personal Information,each Party will be given an opportunity to conduct a site investigation of the other Party's facility where its facial recognition system resides, in order to ensure the existence of adequate security measures for the propersafeguard of Personal Information. 7. The transfer of Personal Information shall be conducted in the following manner: a. NJ MVC will load relevant information on a password protected, encrypted external hard drive and have the information hand delivered by an Investigator from NJ MVC to an investigator from NY OMV who will deliver the device to the NY OMV Headquarters. b. NY OMV will load relevant information on a password protected, encrypted external hard drive and have the information hand delivered by an investigator from NY OMV to an investigator from NJ MVC who will deliver the device to the NJ MVC Headquarters. 3 New Jersey MVC 108349 GULaw Privacy FR 8. After exchanging Personal Information, each Party shall compare the images provided to it by the other Party and report back to the other Party coru:emingwhether there were any matches between the two databases. If there were matches, each Party shall independently determine whetherthe duplicate records occurred as a result of fraudulent activity and take the appropriate administrative action and/or refer the matter for criminal prosecution. Each Party shall advise the other Party of the outcome of any action taken. The Parties agree to fully cooperate in any investigation and administrativeaction against, and/or criminalprosecution of, individuals who are determinedto have fraudulentlyobtained, or attempted to fraudulently obtain, a driver license, including the exchange of supportingdocumentary evidence and the provision of witness testimony as may be required. 9. Ownership of each Party's Personal Information shall at all times remain the exclusive property of such Party and, by extension, the State of New York and the State of New Jersey, respectively. Because this information remains the sole property of the state which issued it, this information is not subject to disclosure under the New Jersey Open Public Records Act (N.J.S.A. 47:lA-I.I et. seq.), common law, or the DPPA in the state which is utilizing, but does not own, the data. All data transferred from one Party to the other shall be destroyed, and all traces of data on any equipmentor any storage device, shall be removed immediately after the data is no longer necessary for the purposes of this Agreement Destruction and removal of data shall be in accordance with National Institute of Standards and Technology ("NIST") standards. IO. F.ach Party shall cooperate with the other in the ongoing review of recipient Party's data control processes employed for the protection of Personal Information. a. In the event that NJ MVC confirms or suspects the unauthorized use or access of NY DMV's Personal Information provided hereunder, NJ MVC agrees to immediately, without delay, notify NY DMV's Information Security Office, as follows: i. ii. by email: Owen.McShane@dmv.ny.gov,or by telephone: (518)474-8805. b. In the event that NY OMV confinns or suspects the unauthorized use or access of NJ MVC's Personal Information provided hereunder, NY OMV agrees to immediately,without delay, notify NJ MVC Information Security Office, as follows: i. ii. by email: Tbomas.Flarity@dotstate.nj.us by telephone: (609) 984-5279 c. Each Party acknowledges that it understands and must comply with laws concerning the loss, misappropriation,compromise, or misuse of protected data provided hereunder, including: i. ii. iii. iv. the federal Driver's Privacy Protection Act of 1994 (DPPA) (18 U.S.C. §2721, et seq.). the New York State Information Security Breach and Notification Act (ISBNA) (General Business Law, §899-aa; State Technology Law, §208), the New Jersey Driver's Privacy ProtectionAct (N.J.S.A. 39:2-3.3 et seq.), and N.J.S.A 56:8-161 to -166 (security of personal information). 4 New Jersey MVC 108350 GULaw Privacy FR d. In the event that the security of personal information provided hereunder by NY OMV is breached in violation of the ISBNA, from a system inaintainedby NJ MVC, then NJ MVC shall be responsible for providing notice of breach to the subjects to whom such infonnation pertains. In the event that NJ MVC is authorizedto share such infonnation with another entity, NJ MVC shall hold its recipient responsible for providing such notice. Prior approval from NY OMV is required before any notifications are made to such persons. e. In the event that the security of personal infonnation provided herewider by NJ MVC is breached in violation of the New JerseyDriver's Privacy Protection Act or N.J.S.A. 56:8- 161 to -166, from a system maintained by NY OMV, then NY OMV shall be responsible for providing notice ofbreach to the subjects to whom such infonnation pertains. In the event that NY OMV is authorized to share such information with another entity, NY OMV shall hold its recipient responsible for providing such notice. Prior approval from NJ MVC is required before any notifications are madeto such persons. 11. Each Pal1y shallpromptly and securely dispose of the other Party's Personal Information upon the fulfillment of the purposefor which such information is hereunder provided, or as instructedby the other Party, in its sole discretion. Each Party shall coroply with the other's instructions for the secure disposal of its Personal Infonnation, and shall promptly provide written certification upon completion. 12. Neither Party shall use, access, disclose or disseminate the other Party's Personal Information after receipt of written notification from the other Party that any of the following events have occurred or that the occurrence of any such event is imminent: (a) unauthorized use, access, disclosure or dissemination of the other Pa11y's Personal Information by the recipient Party's officers, employees, subcontractors or agents; (b) breach of a material term of this Agreement;(c) completion of the Party's contractual obligations pursuant to this engagement; or (d) upon receipt of notice of termination of this Agreement by either Party. 13. The principal contacts for all notifications required or otherwise necessary under this MOU shall be as follows: ForNYDMV: Owen Mcshane Director, Division of Field Investigation 6 Empire State Plaza Albany, NY 12228 Owen.McShane@dmv.ny.gov (518) 474-8805 s New Jersey MVC 108351 GULaw Privacy FR ForNJMVC: Thomas Flarity Director, Security, Investigations and InternalAudit 225 E. State St. P.O.Box 175 Trcnton, NJ 08666 Thomas.Flarity@dot.state.nj.us (609) 984-5279 14. Whenever written notice is required to be given under the terms of this Agreement and when not otherwise specified, it shall be directed to each party at the address specified in paragraph 13, above. All notices and submissions, except as otherwise expressly provided in this Agreement,shall be sent with an acknowledging return receipt requested.The notices and submissions may be delivered by overnight delivery. 15. This Agreement may be amended by the written request of either Party. Any proposed amendment or modification must be submitted to the other Party prior to any formal discussion or negotiationof the issue. Any agreed amendment to this Agreement must be set forth in writing and such amendmentmust be signedby both Parties in orderto become effective and to modify or change this Agreement. 16. Either Party may terminate this Agreement for any reason upon ninety (90) days' written notice to theother Party. Notwithstanding the foregoing, the Parties expressly reserve the right to immediately suspend the provision of Personal Informationhereunder to the other Party in theevent that a breach of secwity has occurred or appears to the providing Party that a breach is imminent In such event, the providing Party will promptly provide the other Party with notification and will make good faith attempt to resolve the problem. In addition, the Parties expressly reserve the right to demand an immediate suspension of the use of Personal Information. 17. This Agreement shall be effective upon execution by both Parties and continue in full force and effect for one ( l) year from the date of execution, or completion of the pilot, whichever is earlier, unless eitherparty terminates this Agreement pursuant to paragraph 16 above. This Agreement may be renewed for 3 additional one (I) year terms upon expiration, pursuant to the written agreement of the Parties. Any additional renewal to further extend the expiration shall be made through a written amendmentto the MOU exchanged as described in section 14 of this document. 18. The Parties acknowledge that the NJ MVC is subject to the tenns and provisions of the New Jersey Tort Claims Act, N.J.S.A. 59:1-1, et seq. the New Jersey Tort Claims Fund, and the New Jersey Contractual Liability Act (N.J.S.A59:13-1 et seq.), and any claims submitted in accordance with this agreement are suiject to these statutes. Additionally,this Agreement is subject to appropriations and the availability of funds. 19. In accordance with Section 41 of the New York State Finance Law, the NY DMV, an entity of the State of New York, shall have no liability under this contract to the NJ MVC or to anyone else beyond funds appropriated and available for this contract. 6 New Jersey MVC 108352 GULaw Privacy FR 20. Nothing in this Agreement is intended to diminish or otherwise affect the authority of the Parties to carry out their respective statutory, regulatory or other official functions, nor is it intended to create any right or benefit, substantive or procedural, enforceable at law by any party against the United States, its agencies or officers, state or local agencies or officers carrying out programs authorized under federal,state or local laws, or any other persons. 21. No Party intends to create in any other individual or entity the status of third-party beneficiary and this Agreement shall not be construed so as to create such status. The rights, duties andobligations contained in this Agreement shall operate only between the Parties, and shall inure solely to the benefit of the Parties. The provisions of this Agreement are intended only to assist the Parties in determining and perfonning their obligations under this Agreement. The Parties intend and expressly agree that only they shall have any legal or equitable right to seek to enforce this Ag,eement, to seek any remedy arising out of a party's petfonnance or failure to perform any term or condition of this Agreement, or to bring any action for breach of this Agreement. 22. This Agreement may not be assigned or otherwise transferred by either Party without the prior written consent of the other. No such assignment or transfer shall relieve the Parties of any of their obligations or liabilities, whether accrued or unaccrued, under this Agreement. 23. The Parties retain all equitable and legal rights, including the right to seek injunctive relief, to prevent losses or damages resulting from the actual or anticipatory breach of this Agreement. 24. NO ARBITRATION: Disputes involving this contract, including the breach or alleged breach thereof, may not be submitted to binding arbitration (except where statutorily authorized), but must, instead, be heard in a court of competent jurisdiction. 25. If any provision of this Agreement is declaredby a court of competent jurisdiction to be invalid. illegal, or unenforceable, the other provisions shall remain in full force andeffect. 26. The Parties acknowledge that their obligation to safeguard the security of Personal Infonnation and other protected personal information provided hereunder shall survive the expiration of this Agreementby termination or otherwise. 27. Informationpertaining to the IFPIC operations of the Parties may be released to third parties by joint written agreement of the Parties. All press releases/events concerning the program, indictments and convictions, arrests or statistical information, shall be conducted jointly by the Parties, or if by one or the other alone, only after one day advance notice to the other Party. The release of all information shall be in accordance with the Federal DPPA, New Jersey DPPA, and New York ISBNA. 28. This Agreementrepresents the entire understanding and agreement between the Parties with respect to the subject matter hereof, and it supersedes all other negotiations, understandings and representations(if any) made by and between the Parties. 29. This Agreementmay be signed in counterparts, each of which, when so executed and delivered, shall be deemed an original, but such counterparts shall together constitute one and the same instrument. 7 New Jersey MVC 108353 GULaw Privacy FR • IN WITNESSWHEREOF, the Parties have executed this Agreementby their duly authorized officer or representative. State of New Jersey MotorVehicleCommission By: '='4~ TM-Yl KatharineTasch Executive Deputy Commissioner Acting Deputy Chief Administrator Date: / n I /Jq I l).c/1--f (TuJ~) Date: /0 / 07 / 2--0/ 'f (mm!ddlyyyy) (mmlddlyyyy) Approval u to form: BY ne C. Schwartz Deputy Attorney General Date: lo/o1 / 1'-f g New Jersey MVC 108354 GULaw Privacy FR