,, AmericanAssociation of Motor VehicleAdministrators AAMVA Digital Image Access and Exchange Participation Agreement May 11th, 2007 430l WilsonBoulcvfttd,Sulto400 Hawaii DOT • Arlington,VA 22203 110466 • (703) 522·1300 • Fax (703) 522-1553 GULaw Privacy FR DIGITALIMAGEACCESSAND EXCHANGEPARTICIPATIONAGREEMENT J. Statementof Purposeof the DigitalImageExchangeProjectand Scope of Agreement The chief Administratorsof official motor vehicle agencies in several states have joined in a Project to be administered by the American Association of Motor Vehicle Administrators(AAMVA), to deter license fraud and identity theft by any person seeking to transfer the privilege to obtain and to hold a motor vehicle operator's license from a fonner state of residence to a new state of residence. The Project is also intended to enable jurisdictions to begin implementationof certain provisions of the Real ID Act or other, similarrequirementsimposedby federal law to enhancethe security of state--issued motor vehicle operator's licenses. In furtheranceof these purposes, this Agreementis made and entered into by and betweenthe DEPARTMENTOF TRANSPORTATIONof the State of HAWAII, acting herein by BRENNON T. MORIOKA, its DIRECTOR, duly authorized, and the American Association of Motor Vehicle Administrators (AAMVA), acting herein by Reed Rusniak, its Project Administrator, duly authorized, for the purpose of facilitating the Project for jurisdictional members of AAMVA to provide and to obtain access to electronic, digital images of the holders of driver's licenses. Such digital images are captured and maintainedon file by each of the members that are electing to participate in the Project, and each such member has entered into a substantially identical agreement with AAMVA. By entering into this Agreement, the DEPARTMENT OF TRANSPORTATIONrepresents that it(]) has the legal authority to participate in the Project, (2) has the legal authority to take all actions necessaryto comply fuUywith all of the terms and conditions of this Agreement,and (3) intends to work cooperatively and to communicate directly with each of the other participating members, to the extent necessaryto administerthe Agreementand to accomplishthe purposes of the Project. 2. BasicDesign of Program (a) The Project will utilize available secure technologyto allow a driver licensing official in the applicant's new state of residence (State of Inquiry, or SOI) to electronicallyrequest and temporarily access the applicant's digital image and certain personal, identifying infonnation, as allowed by the Federal Driver Privacy Protection Act, 18 U.S.C. § 2721, et seq., regarding the applicant ftom the state of former residence (State of Record, or SOR). The temporary access to such digital image and other information is intended to help to ensure that the applicant claiming to have a valid license from the fonner state of residence is the individual who holds a license issued by that other state, and is not fraudulently using the personal identification information of another individual, or is not presenting a cowiterfeit license purporting to have been issued by the other state. The infonnation transmitted will also disclose if an existing license is suspended or revoked. If the record maintained by the SOR contains information indicatingthe data subject is deceased it shall also transmit that information to the SOI. (b) AAMVA agrees that, unless expressly requested and pennitted by DEPARTMENTOF TRANSPORTATION,no employee or agent of AAMVA will have access to any digital image or any other personal infonnation from an official motor Page2 of6 Hawaii DOT 110467 GULaw Privacy FR DIGITAL IMAGE ACCESS AND EXCHANGEPARTICIPATIONAGREEMENT vehicle record that is being exchanged in accordance with the provisions of the Agreement. 3. Compliancewith Termsof the Agreement The Administrator whose jurisdiction is engaged in the Project agrees that its employees. agents and contractorsshall be made subject to and bound by the terms of this . Agreement. The Administrator further agrees that it shall provide necessary and reasonable methods, controls and procedures to ensure compliance. The AAMVA Project Administrator will maintain and will make available to all AAMVA member jurisdictions the current list of all jurisdictions participating in the Project. If a jurisdiction fails to substantially comply with any term or condition of the Agreement, then the A.AMYA Project Administrator. acting with the approval of a majority of the other participating jurisdictions. may tenninate the Agreementwith such jurisdiction and notify such jurisdiction that it is no longer entitled to participate in the Project. Such terminationshall be effective on the date set forth in the notice. 4. ContinuingResponsibilityto ProtectPersonalInformation (a) The Administratoris mindful of his or her role in the Project as a guardian of the "personal and "highly restricted personal infonnation" (hereinafter ''personal infonnation") of individual licensees entrusted to his or her agency and agree that such personal information is subject to prohibitions, restrictions and conditions concerning authorized use and disclosure imposed by federal law. pursuant to the provisions of the Federal Driver Privacy Protection Act (DPPA), 18 USC § 2721 et seq. The Administrator also acknowledges his or her responsibility to maintain compliance with similar. applicable laws respecting privacy and security protection that is in effect in his or her jurisdiction. The parties agreethat the exchange of · "personal infonnationn between driver licensing authorities to deter license fraud and help prevent identity theft is authorized by the provisions of 18 USC § 2721(b)(l) to the extent that the licensing authorities are sharing and exchanging such infonnation to carry out their governmental functions. 0 (b) The Administratoragrees that all of the other participatingAdministratorsare entitled to expect that the digital image and personal infonnation that is conveyed in an electronic transmissionto another participating state will be protected from disclosure by that receiving state to at least the degree of protection affordedby the OPPA. (c) To the extent pennitted by law, the Administratorfurther agrees that he or she shall provide at least the standard of security and protection from disclosure and unauthorized use for digital images and personal information as required by the law of the jurisdiction from which the image was received. With reference to each participating jurisdiction that makes a request for a digital image and its accompanying, personal infonnation, the Administratorof the jurisdiction that is acting as the SOI shall furnish a copy or summary of its relevant laws, to the extent that such laws impose different standards or requirementsthan the DPPA. Page 3 of6 Hawaii DOT 110468 GULaw Privacy FR DIGITALIMAGEACCESS AND EXCHANGEPARTICIPATIONAGREEMENT 5. Proper Useand Safeguardingof Imagesand PersonalInformationAcquiredas SOI (a) The Administrator shall ensure that a digital image and the personal infonnationreceived therewith in an electronictransmissionfrom a participatingstate is used solelyby the motor vehicle agency(or the agencyof which it is a part) and only for the purposesidentified in this Agreement.Therefore, the Administrator agrees that no portion of the informationreceivedmay be accessedby or disclosed to any other person, agencyor public or private organization,nor shall the Administratorpennit any use of an image or personalinformationacquiredin thejurisdiction's capacity as an S01 that is not expresslyauthorizedby the terms of this Agreement. (b) A digital image and its accompanyingpersonal informationas received from an SORshall not be separatedby the SOI for displayor storage putposesbut shall remain togetherso that the image is clearlyconnectedto the accompanyingpersonalinfonnation and so that the SOR,which transmittedthe information,can be clearly identified. (c) The SOI may not download, format, print or otherwise use a receiveddigital image and/or the personal infonnation accompanyingit for any purpose other than the visual identificationof a license applicant. As used herein, "visual identification"may includethe use of facial recognitiontechnology. (d) An SOI shall not use a digital image acquiredfrom an SOR as an image on its own manufacturedlicense nor shall it resize or reconfigure the digital image in any mannerto alter the appearanceof the depictedindividual. 6. LimitedLaw EnforcementUse The Administratoragrees to provide a briefing for the law enforcementagencies and officers in its jurisdiction engaged in detecting and prosecuting license fraud and related violations. The briefing shall include a description of the nature of this Agreementand its limitations.A digitalimageand personalinformationreceivedfrom an SOR may be used for purposes of investigationand prosecutionof any individualwho is reasonably believed to have fraudulently attempted to obtain a license by using the personal informationof another individualwhose image and/or personalinformationhas been received from the SOR, or who is reasonablybelieved to have engaged in acts or conduct of a similar nature that constitutea violationof law. Except as may be required by law, the Administrator shall not permit a digital image or personal infonnation obtainedfrom an SOR to be accessed or used by a law enforcementagency or personnel of such an agencyfor any other purpose. 7. DlgitalImage & PersonalInformatlonto RemainProperty of SOR (a) The Administratoragrees that any digital image and the personalinformation conveyedtherewith that is transmitted,in whatever form, to another participatingstate, shall not be downloadedinto a generaldatabaseof the SOI. (b) Whenthe SOI has receivedthe imageand personal informationfromthe SOR and is satisfied that the applicant is the same individual,the SOI shall cause the image Page 4 of 6 Hawaii DOT 110469 GULaw Privacy FR .. DIGITAL IMAGEACCESSAND EXCHANGEPARTICIPATIONAGREEMENT and personal informationof the received reoord, in whatever format it may be in or may have been converted to, to be safely and securely discarded, unless the SO[ is requiredby law to retain such image and personal infonnation. If a retention schedule is applicable, the SOI shall discard such image and personal information as soon as the retention schedule authorizessuch action (c) If the SOI is not satisfied that the applicant is the same individual whose image and personal infonnation has been received from the SOR, it may retain the image and personal information in a secure, temporary file until such time as the SOI either confirms the identity of the applicant or refers the file to the appropriate person or agency for further investigation. If identity is confirmed, and except as provided in subparagraph (d) of this section, the image and infonnation shall be disposed of as required by the provisions of subparagraph (b) of this paragraph. (d) The Administrator of an SOI who has reason to believe that a license applicant in the SOI is using the image and/or personal infonnation from the record of another individual as received from the SOR shall promptly refer the matter to the appropriate law enforcement agency or official in the SOI. If investigation and/or prosecution are pursued, the image and personal infonnation may be shared with such investigatingand /or prosecutinglaw enforcementagenciesand officials, consistentwith the limitations concerninguse imposed by the provisions of paragraph 6, above. 8, Responsibilityfor Notifying Individualwho Is the Subject of Fraud or Misrepresentation The Administrator, when acting in the capacity of SOR, agrees to assume the responsibility to promptly notify each individual whose digital image and/or personal information has been improperly used by an applicant in another participating jurisdiction to obtain or attempt to obtain a driver's license, or for any other unlawful purpose that is known to the Administrator. The Administrator of the SOR shaJl provide sufficient information to the individual who is a victim or apparent victim of fraud or identity theft to allow such person to identify and contact the agency or agencies that have charge of the investigation and/or prosecution of the matter. The Administrator of the SOR shall advise the individual to whom the record relates to contact all major credit bureaus to obtain such person's own credit reports to detennine if credit has been wrongfully obtained using such person•s personal information. Page 5 of6 Hawaii DOT 110470 GULaw Privacy FR DIGITALIMAGE ACCESS AND EXCHANGEPARTICIPATIONAGREEMENT 9. Public Notice of Project The Administrator agrees to make public disclosure of his or her participation in the Project on its website and/or in other appropriate media, and shall describe and explainJhatthe goal of the Project is to deter license fraud and identitytheft. ACKNOWLEDGEDAND AGREED On behalf of the State of HAWAIi as a participant in this Agreementto Share Digital Images, I agree to be bound by and to honor the tenns of this agreement, provided that any infonnation provided by the State of Hawaii shal}be subject to the requirementsof part VIII (Traffic Records)of chapter 286 of the HawaiiRevised Statutes and chapter 19-121of the Hawaii AdministrativeRules. Signature: ~ PrintedName:BRENNONT. MORIOKA Title: DIRECTOROF TRANSPORTATION Date: Address: DEPARTMENTOF TRANSPORTATION P.O. Box: 869 PUNCHBOWLSTREET,5THFLOOR Cityrrown: HONOLULU State: HAWAll Zip: 96813 Tel: 808,587.2150 Fax: 808.587.2167 E-Mail: BRENNON.MORIOKA@HAW All.GOV ACCEPTED: Signature: (MMV PrintedName: ~e Dateof Acocptance: ProjectA~,tor) ~ J_ I , v S-", A.. f I ~? / 0 1 Page6of6 Hawaii DOT 110471 GULaw Privacy FR