Government Fails to Enforce Privacy on New IDs
Balancing national security and civil liberties requires delicate diplomacy to ensure a balance between legitimate security needs and the privacy rights of Americans. Since 9/11, preserving that balance has been ignored and forgotten. Earlier this month, the Department of Homeland Security had a chance to get it right when it released new rules for implementing the Real ID Act. But once again, privacy was kicked to the curb.
The goal of the Real ID Act, to make the driver’s license a more reliable form of identity, is a good one. Setting minimum standards to ensure that the process of getting a driver’s license is more secure and making it tougher to fake a driver’s license isn’t unreasonable; however, almost everything else associated with this program is.
Although the new rules roll out full implementation over the course of a decade, the impact on privacy won’t get a reprieve. States that have not already done so will start collecting and storing more personal information from drivers and the development of a centralized repository of personal information on 240 million Americans will soon follow. But like the proverbial frog in boiling water, many of us may not fully feel the privacy loss until it’s too late.
Most disappointing, the hard decisions on how to implement Real ID — including how to protect privacy — have been left to the states. Simply put, there are no privacy rules. States are simply encouraged to follow a set of "best practices" for protecting privacy. But there are no consequences if states choose not to do so and thus no guarantees that the personal information collected for Real ID won’t be used for a variety of state and even federal uses, populating and repopulating numerous government databases and easily available to businesses and other interests.
While the government disavows the notion that Real ID will quickly become a national ID card, the failure to provide privacy rules and limitations on secondary uses gives lie to that assertion. Indeed the ink is not yet dry on the new regulation, and the department is already speculating on a variety of other government purposes for which a Real ID card may be required, such as buying cold medicines that contain ingredients used to create methamphetamines. And Congress has already thrown around proposals that would require a Real ID for employment or to receive federal housing benefits.
At the end of the day, the Real ID regulations leave open the strong possibility that we will soon have a centralized ID database, one housing a wealth of personal data on virtually every American citizen. While the current DHS rules haven’t made a decision one way or the other, DHS makes clear that it strongly supports the use of a centralized database for purposes of Real ID. The department strongly suggests that the states take the easy way out by leveraging the current technology used to run the national commercial drivers license database, which is a centralized repository of information for this select group of drivers.
If the DHS and states choose to go that route, the security risks are enormous; the potential for abuse by government and business are mind-bending. A central database containing that much information creates an irresistible target for identity thieves, terrorists or other computer criminals, not to mention unscrupulous government employees. DHS could have shown leadership here by insisting on a much more privacy friendly query system that did not expose personal information to risk or by building such a system themselves But by taking a hands off approach, they avoid any obligations under the federal Privacy Act, which while not a complete answer at least offers some protection for the data.
The phased implementation of Real ID does offer some hope, in that it gives Congress and the next president the chance to do what the current administration has refused to do: Take decisive action on this dangerous law by repealing it and devising a rational approach to driver’s license reform that doesn’t threaten the privacy rights and civil liberties of virtually all Americans.
