SF3680 Summary

• Commissioner must establish written procedures limiting access to driver and vehicle services information system data to only authorized individuals, with access corresponding to official duties and statutory authorization.

• All data queries, responses, and actions involving data entry, updates, access, sharing, or dissemination must be recorded in a data audit trail, which is public unless otherwise classified by law.

• Commissioner must impose disciplinary action on individuals who willfully violate state or federal law when entering, updating, accessing, sharing, or disseminating data; unauthorized access must be forwarded to prosecuting authority.

• Individuals receiving disciplinary action must be notified in writing within 5 calendar days and may request reconsideration within 20 calendar days or proceed directly to a contested case hearing under chapter 14.

• Commissioner must arrange for independent biennial audits of the system to verify data classification, usage, and compliance, with audit results and reports submitted to legislative committees and the Legislative Commission on Data Practices within 30 days of completion.