The new legislative sessions that began in January have already produced two major but incomplete privacy stories. One story comes from a number of states, including Maine and Idaho. The other story comes from Washington.
The state story involves the Real ID Act, a federal law enacted in 2005. The law establishes strict federal standards for drivers’ licenses. Unless state license procedures meet those standards, the federal government will not accept the state’s licenses as identification.
There has been outrage about Real ID, and many other advocacy organizations from right to left also oppose the law. Some of the consequences for privacy arise from the requirement that states keep copies of all identification documentation provided by license seekers, as well as from the enhancement of the machine readability of the new licenses.
At the end of January, the Maine legislature approved a resolution saying the state refuses to implement the Real ID Act. The resolution cited four reasons. First, the federal law imposed an unfunded mandate. Second, the cost for Maine would be $185 million. Third, the resulting database will invite identity theft and invasion of privacy. Finally, the costs and inconveniences offer no benefits such as terrorism prevention.
What we have here seems to be a genuine state rebellion of a sort perhaps not seen since the 1800s. Further, Maine is not alone. Idaho followed suit in March. Other states are still working on similar action.
The chief sponsor of the Real ID Act is the former chair of the House Judiciary Committee. Since his party lost control of the House, he has lost his ability to control the issue. The rebellion plus the lack of a firm policy foundation for Real ID could force major changes, if not a total repeal.
What’s happened already is something of a privacy success, but the story isn’t over. The Bush Administration is going ahead with regulations, and the final outcome is far from clear. What is clear, however, is that the privacy argument must share the stage with the cost argument. Had Congress fully funded the law, then the state rebellion would likely have fizzled.
The second story begins with the pledge of House Democrats to implement all recommendations of the 9/11 Commission. The legislation to accomplish this pledge is H.R. 1, and the bill number tells you of the importance of the matter to the new House leadership.
The Commission recommended that there be a board within the executive branch to “oversee adherence to the guidelines we recommend and the commitment the government makes to defend our civil liberties.” The Intelligence Reform Act, passed in 2004 when the Republicans ran the Congress, established a civil liberties board. However, as H.R. 1 observes, that board does not have the authority necessary to protect civil liberties. The board is seen by some as too powerless and too subject to presidential control.
Title VII of H.R. 1 would replace the existing board with a Privacy and Civil Liberties Oversight Board as an independent agency within the executive branch. Board members would serve fixed terms, be from both political parties and not be under the President’s thumb. The board would also have subpoena power, a tool that could have great force and effect.
The bill would also establish privacy and civil liberties officers in federal agencies that have major functions related to national security and intelligence. Several privacy and civil liberties officers already exist, but other officers would be newly created. The privacy and civil liberties officers would have a broad portfolio and the authority to report directly to the head of the agency and to the board as well.
My favorite feature of the bill is the independence of the board. I have advocated an independent privacy board for a long time. However, the board’s focus is a bit too narrow. It is understandable that the 9/11 Commission focused on terrorism and the board’s responsibilities reflect that. I would like to see the board have some broader privacy responsibilities but no regulatory powers.
Regardless of the details, the major point is that for the first time since 1974, a bill to establish a privacy agency passed a House of Congress. A similar agency is also in a companion bill that passed the Senate.
The conclusion to both of these privacy stories has yet to be written. There could be more developments at any time.
