September 28, 2005
The staff of the Committee on Open Government is authorized to issue advisory opinions. The ensuing staff advisory opinion is based solely upon the facts presented in your correspondence.
I have received your letter in which you referred to an opinion prepared on June 15, 2005, at your request concerning the ability of the Office of General Services (OGS) to include the driver’s license number of employees on parking permit application forms.
In brief, as indicated in the earlier opinion, it is my understanding that OGS obtains driver’s license numbers from the Department of Motor Vehicles, and then requests them directly from the applicants for parking privileges as means of confirming applicants’ identities. The purpose of obtaining the driver’s license numbers involves considerations relating to security and public safety.
Reference was made to §94(1)(d) of the Personal Privacy Protection Law and the requirement that an agency must provide various information to data subjects from whom it has requested personal information, such as the driver’s license number. You have asked whether OGS is required "to put this notification on the application form itself, or, if not, how should this information be communicated." As I interpret §94(1)(d), there is no particular method of providing the requisite information in the notification given to data subject. That provision states in relevant part that an agency must "provide each data subject whom it requests to supply information to be maintained in a record, at the time of the initial request, with notification as provided in this paragraph." While the items required in the notification may be included on an application form, there is no requirement that they must be included on the form. From my perspective, so long as an agency provides the required information in a manner that reasonably gives effect to §94(1)(d), it would be acting in a manner consistent with law.
You also referred to a portion of the earlier opinion in which I advised that OGS informed me that it discards and no longer "maintains" driver’s license numbers following the approval of an application. You wrote, however, that following the approval of an application, an employee may be placed on a waiting list. That being so, you asked whether "maintenance of the driver’s license number after an application has been approved, but before a permit has been issued, violates the PPPL."
I believe that this issue was addressed in the earlier opinion. Specifically, in the last substantive paragraph of that opinion, I wrote that "...maintenance of a driver’s license number after issuance of the identification card would appear to be inconsistent with the Personal Privacy Protection Law, for the license number, in my opinion, is not "relevant and necessary to accomplish a purpose of the agency required to be accomplished by statute or executive order...." If the driver’s license numbers are needed by OGS after an application is approved, but they remain "relevant and necessary" to a purpose of OGS until a permit is issued, I believe that OGS could validly "maintain" a driver’s license number until it is no longer relevant and necessary to OGS’ functions. On the other hand, if, following approval of an application, the driver’s license numbers are not needed to enable OGS to carry out its duties, I believe that they should be discarded to comply with the Personal Privacy Protection Law.
Lastly, you wrote that OGS uses the last five digits of employees driver’s license numbers as an identifier on its waiting list. You asked whether that would violate the Personal Privacy Protection Law. The issue for purposes of that statute is whether the last five digits constitute "personal information." That phrase is defined in §92(7) to mean:
"...any information concerning a data subject which, because of name, number, symbol, mark or other identifier, can be used to identify that data subject."
Since the driver’s license number consists of nine digits, I do not believe that the use or disclosure of the last five digits could reasonably be expected or used to identify an employee. As you are likely aware, the last four digits of the nine digit social security number are often used as a means of confirming one’s identity without any significant likelihood that public disclosure could identify the subject. In my view, the use of the last five digits of the driver’s license number is comparable.
I hope that I have been of assistance.
Robert J. Freeman
cc: Bernard Foreman