FB pixel

Judge blocks Trump administration bid for driver identity database

Court finds states likely to prevail on claims that bulk transfer of 17 million records violates federal privacy law
Judge blocks Trump administration bid for driver identity database
 

A federal judge in Virginia has temporarily blocked the Trump administration from taking custody of a nationwide database containing Social Security numbers and other identifying information for roughly 17 million commercial drivers.

Senior U.S. District Judge Anthony J. Trenga of the Eastern District of Virginia ruled that the government has not adequately explained why it needs the records and that there is a “compelling inference” they are being sought largely for immigration enforcement.

Trenga granted a temporary restraining order to 21 states and the District of Columbia that sued the Department of Transportation (DOT) and Federal Motor Carrier Safety Administration (FMCSA) after the agencies demanded a bulk transfer of records from the Commercial Driver’s License Information System (CDLIS).

The Department of Homeland Security (DHS) separately subpoenaed the same data for immigration enforcement.

The ruling prevents the American Association of Motor Vehicle Administrators (AAMVA), which operates CDLIS, from transferring the plaintiff states’ records to DOT, FMCSA or any other federal agency while Trenga considers whether to issue a preliminary injunction.

The judge’s ruling also prohibits federal officials from cutting off or threatening AAMVA’s contracts and funding because it has not provided the records.

The distinction between ordinary federal access to CDLIS and what the administration is seeking is central to the dispute.

Congress created CDLIS in 1986 as a clearinghouse that allows states to determine whether someone applying for a commercial driver’s license (CDL) is already licensed elsewhere or has an out-of-state driving record that could disqualify the applicant.

AAMVA has operated the system since 1988.

At its central site, CDLIS contains what are known as Master Pointer Records. They include a driver’s name, date of birth, Social Security number or alternative identifier, sex, driver’s license number and state of record.

The pointer record identifies which state holds the driver’s underlying licensing record. It is not itself the driver’s complete history, which remains with the states.

According to the states’ complaint, FMCSA asked AAMVA on June 25 to provide the name, date of birth, state, license number and Social Security number for every driver represented in the CDLIS central database going back five years, approximately 17 million pointer records.

It also requested information about when Social Security numbers had been removed from records that no longer contained them.

AAMVA told the government the request raised privacy and legal concerns.

After additional exchanges, FMCSA told AAMVA on August 11 that unless it produced the records by August 17, DOT could cancel AAMVA’s grants, seek enforcement of a subpoena and consider terminating its contract with the organization.

The threatened funding included about $10 million supporting operation of CDLIS itself.

Trenga said cutting it off could impair states’ ability to issue and renew commercial licenses and potentially disrupt broader driver licensing operations.

DHS entered the dispute after AAMVA initially resisted the FMCSA demand. It issued an administrative subpoena seeking essentially the same records, withdrew it after AAMVA indicated it would provide the information to FMCSA and then issued another subpoena when states objected and AAMVA considered allowing individual states to opt out.

The states filed a separate motion to quash the DHS subpoena, arguing that DHS was using its subpoena power to obtain identifying information about millions of people who were not identified as subjects of an investigation.

DHS has said the information is needed to investigate illegal practices involving commercial driver licensing and for immigration enforcement.

Trenga’s ruling goes considerably further than the administrative stay he entered when the states sued August 13. Although it is not a final decision on the legality of the government’s demands, the judge concluded that the states had demonstrated a likelihood of succeeding on several of their central claims.

Among them are claims under the Driver’s Privacy Protection Act (DPPA), the Privacy Act of 1974, the Administrative Procedure Act (APA) and the Constitution’s Spending Clause.

The court found that FMCSA had not explained how obtaining all 17 million records fell within the DPPA exception permitting government agencies to obtain motor vehicle information to carry out their functions.

FMCSA said it wanted the records to perform its safety and regulatory responsibilities and analyze the national commercial licensing program. But Trenga noted that the agency has performed those responsibilities for decades through individual CDLIS queries and audits of state licensing programs.

When pressed during the hearing, the judge wrote, federal officials were unable to identify something FMCSA could do with a bulk copy of the records that it could not already do through its existing access.

The court also pointed to the government’s acknowledgment that the records would be shared with DHS for immigration enforcement, which is not part of FMCSA’s statutory transportation-safety mission.

“In the absence of any substantive explanation” connecting the bulk transfer with FMCSA’s responsibilities, Trenga found a “compelling inference” that obtaining the files was driven in substantial part by immigration enforcement.

That conclusion directly challenges the administration’s public explanation for the demand.

Transportation Secretary Sean Duffy said August 13 that federal access is necessary to identify improperly licensed or unqualified drivers and argued that administrations have had access to CDLIS since 1988.

DOT also said AAMVA operates the system on behalf of the federal government and is legally and contractually obligated to provide the records.

The court drew a different line between having access to CDLIS and taking possession of a bulk copy.

Trenga noted that federal policy has long stated that CDLIS records are not controlled by FMCSA and that a DOT policy statement issued as recently as May described Master Pointer Records as owned by the states.

Other federal agencies can seek CDLIS information under established procedures, but that does not necessarily entitle the federal government to take custody of the entire central repository, the judge said.

The judge also found that FMCSA had never before demanded information on this scale and had not consulted the states before changing how the system would be used.

The Privacy Act presents another obstacle. Trenga found the states are likely to succeed on their argument that FMCSA cannot simply ingest the CDLIS data into a new or modified federal system of records without satisfying the law’s requirements governing notice, collection and subsequent disclosure.

The government also had not provided confidentiality assurances for the bulk data while acknowledging that it intended to distribute the records to DHS, which makes the case broader than a dispute over commercial driver regulation.

At issue is whether the federal government can convert a system built to let states conduct individualized identity and licensing checks into a centrally held federal dataset that can be analyzed and shared for purposes beyond those for which the information was originally assembled.

The ruling does not eliminate federal access to CDLIS. FMCSA can continue making the individualized queries it has historically used, and the underlying detailed driver records remain with the states. Nor has Trenga issued a final ruling that the administration can never obtain the data.

For now, the government cannot obtain the plaintiff states’ Master Pointer Records as part of the requested bulk transfer or punish AAMVA or those states for refusing to provide them.

The states have until August 27 to seek a preliminary injunction. The administration’s response is due September 3, and Trenga has scheduled a hearing for September 10.

Related Posts

Article Topics

 |   |   |   |   | 

Latest Biometrics News

 

Listen: How age assurance platforms earn trust

The world has more or less decided that some online services should be age-restricted. The question now is, how to…

 

Sri Lanka sets Q4 target for SL-UDI rollout

Sri Lanka is preparing to issue its first production digital identities next quarter, beginning a phased rollout of the country’s…

 

Madagascar strengthens trust architecture for national digital ID

Madagascar is strengthening the legal, institutional and technical foundations of its national digital identity program, introducing new cybercrime legislation as…

 

Cybastion backs Cameroon digital sovereignty with $75M infrastructure project

Cybastion has committed $75 million to fund the construction of digital infrastructure in Cameroon, including a data center and an…

 

Co-Develop, Caribou outline governance blueprint for DPI adoption

Digital public infrastructure (DPI) programs have grown to include more than 100 countries globally. Recognizing this expansion, Co-Develop and Caribou…

 

Socure brings Aeropay into RiskOS to connect identity verification with bank payments

Socure is extending its RiskOS platform further into payments through an integration with Aeropay that combines identity verification, bank account…

Comments

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Market Intelligence

Featured Company

Biometric Update Podcast

Most Read This Week

White Papers

Latest Webinars

Biometrics Industry Events