June 15, 2005
The staff of the Committee on Open Government is authorized to issue advisory opinions. The ensuing staff advisory opinion is based solely upon the facts presented in your correspondence, unless otherwise indicated.
As you are aware, I have received your letter. Please accept my apologies for the delay in response. You have requested an advisory opinion concerning the ability of the Office of General Services ("OGS") to "require that an employee include his or her driver’s license number (Motor Vehicle Identification Number) on its East Garage seniority list parking application, medical permit application and regular permit application forms."
By way of background, the federal Driver’s Privacy Protection Act (the "DPPA", 18 USC §2721 et seq.) prohibits the release and use of certain personal information maintained by state departments of motor vehicles. Subdivision (1) of §2725 of the DPPA defines "motor vehicle record" to mean "any record that pertains to a motor vehicle operator’s permit, motor vehicle title, motor vehicle registration, or identification card issued by a department of motor vehicles." Subdivision (3) defines "personal information" to mean "information that identifies an individual, including an individual’s photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information, but does not include information on vehicular accidents, driving violations and driver’s status." Based on the provisions quoted above, I believe that the driver’s license number consists of personal information contained within a motor vehicle record that falls within the scope of the DPPA.
Although the DPPA imposes restrictions on the disclosure of personal information contained within motor vehicle restrictions, as I understand that statute, it permits disclosure of that information to OGS. Section 2721(b) pertains to "permissible uses", the first of which is "For use by any government agency, including any court or law enforcement agency, in carrying out its functions...." From my perspective, it is clear that OGS uses certain personal information contained within motor vehicle records for the purposes of assignment of parking permits or spaces, and perhaps most important, to establish identity in relation to considerations involving security and public safety. In short, OGS has an interest in knowing that a person is who he or she claims to be.
I have been informed that OGS obtains driver’s license numbers pursuant to a memorandum of understanding with the Department of Motor Vehicles. When obtained by OGS, the driver’s license numbers are compared with the driver’s license numbers on the applications for parking privileges in order to confirm a person’s identity. The numbers are also used to obtain drivers’ photos from the Department so that they can be reproduced on identification cards issued to permit holders. Following the issuance of the identification cards, I was told that OGS discards the driver’s license numbers, for at that point, they have no further use or significance to OGS. When that occurs, there is no possibility or danger that driver’s license numbers can be used or disclosed by OGS in a manner that might impact the privacy of the subjects of those records.
Notwithstanding the apparent ability of the Department of Motor Vehicles to disclose drivers’ license numbers to OGS, the purposes for which OGS uses those numbers, and the removal of those numbers from the custody or possession of OGS after identification cards have been issued, the question is whether OGS has the right to require individuals to provide their driver’s license numbers on the applications to which you referred.
In this regard, §94(1) of the Personal Privacy Protection Law pertains to agencies that maintain systems of records. The phrase "system of records" is defined in §92(11) of that statute to mean "any group of records under the actual or constructive control of any agency pertaining to one or more data subjects from which personal information is retrievable by use of the name or other identifier of a data subject." A data subject, according to §92(3) is a "natural person about whom personal information has been collected by an agency." In my view, the applications for parking privileges would constitute a "system of records" maintained by OGS.
Most significant in my view are two provisions in §94(1). That provision states in relevant part that an agency that maintains a system of records shall:
"(a) except when a data subject provides an agency with unsolicited personal information, maintain in its records only such personal information which is relevant and necessary to accomplish a purpose of th agency required to be accomplished by statute or executive order, or to implement a program specifically authorized by law...
(d) provide each data subject whom it requests to supply information to be maintained in a record, at the time of the initial request, with notification as provided in this paragraph. Where such notification has been provided, subsequent requests for information from the data subject to be maintained in the same record need not be accompanied by notification unless the initial notification is not applicable to the subsequent request. Notification shall include...
(iii) the authority granted by law, which authorizes the collection and maintenance of the information..."
It appears that there is legal authority for OGS to collect driver’s license numbers. Section 2 of the Public Buildings Law states that "the commissioner of general services shall have supervision and control of public buildings of the state of New York, including the capitol and executive mansion, with the buildings, grounds and premises adjacent or appurtenant thereto or connected therewith belonging to the state..." Section 200 of the Executive Law states that the Commissioner "may adopt, amend or rescind rules and regulations relating to the discharge of his functions, powers and duties and those of the office of general services as prescribed by law." In carrying out those duties, the Commissioner has promulgated regulations concerning "Facility parking and traffic" (9NYCRR Part 302). Section 302.1 states that "This part is established to control motor vehicle traffic and parking on State property", and §302.2 concerning "General parking rules" provides that "(a) No person shall stop, stand or park a motor vehicle on State property...except (1) as designated by the commissioner, or (2) as directed by a police officer or an authorized employee of the office" and (b) that "The operation or parking of a motor vehicle on State property shall be contingent upon the submission of the vehicle’s driver to all of the office’s then applicable security measures."
In consideration of the foregoing, again, I believe that OGS is legally authorized to collect the items at issue. Further, with respect to paragraph (a) of §94(1), if indeed OGS discards those items after issuance of an identification card, it would not "maintain" them in its records, and that provision would not be implicated. However, maintenance of a driver’s license number after issuance of the identification card would appear to be inconsistent with the Personal Privacy Protection Law, for the license number, in my opinion, is not "relevant and necessary to accomplish a purpose of the agency required to be accomplished by statute or executive order..."
I hope that I have been of assistance.
Robert J. Freeman
cc: Bernard Foreman