Mobile Driver’s Licenses Face Privacy Scrutiny Ahead of NY Pilot

A New York lawmaker is pushing legislation that may yield model privacy guardrails amid a national push toward digital identification that’s already raised security and transparency concerns.

Mobile driver’s license proposals are booming, with increased interest from states and even the federal government as a potential tool in combating fraud and providing a more foolproof and secure way of verifying digital identities. New York is among the first dozen states to adopt digital IDs, with uses ranging from access to social benefits to airport security identification.

Michaelle Solages, a New York Assembly Democrat leading the charge on legislation in the state, recently convened a round table of lawmakers and agencies from different states, digital identity companies, and public interest groups to help develop the bill. Attendees included representatives of Google, iProov, the Better Identity Coalition, and the National Institute of Standards and Technology, which is working on a national mobile driver’s license initiative.

The proposal, which is still being drafted, would task contractors with developing a wallet application to be run and managed by the state, rather than contracting for a vendor-run product. It would make individual adoption of digital IDs voluntary and set controls on handling residents’ information and uses of their IDs, such as to purchase alcohol. It also would prohibit selling data to third parties and require law enforcement to acquire a warrant to access any data connected to an ID.

Importantly, said Solages, the privacy protections enshrined in the legislation would be flexible to apply to different contexts.

“Whether it’s for driving or for individuals to get access to benefits, we’re going to have different paradigms,” said Solages. “So, it’s important that we are working on solutions that are privacy-first, security, and cost effectiveness all intertwined.”

The proposal, while still being finalized, would be a stark departure from the path the New York DMV has taken: it entered into a $1.7 million dollar contract with the French biometrics firm IDEMIA in 2022 to build a digital identity platform and issue mobile driver’s licenses, according to public contract records. Months later, during 2023 budget proceedings, the DMV announced its pilot program, but without a timeline for adoption or public debate about how the program would protect New Yorkers’ privacy.

It’s one example of the “sea change” digital IDs will bring, said Ross Schulman, a senior fellow at the Electronic Frontier Foundation, who pointed to concerns over providers’ credibility on security and questions of surveillance uses that remain unanswered in often opaque partnerships between states and private providers.

“That’s the sort of thing that really ought to happen after a lot of debate publicly in legislatures,” said Schulman. “It’s not the sort of thing that should be tossed together as a deal between a DMV and some random company. These are really important questions.”

Zachary Martin, a senior policy adviser at Venable which works with Better Identity Coalition, a nonprofit focused on digital identity policy, agreed. Solages “deserves a lot of credit for getting a wide range of stakeholders together to talk about this and figure out what the challenges are, and figure out how to solve them before rolling it out completely,” he said.

A NIST spokesperson said in an email that it doesn’t directly consult with states on specific implementations, but it has “spoken with people in several states to help them understand our Digital Identity Guidelines and to discuss our plans for future guidance on” mobile drivers’ licenses.

IDEMIA, which also provides technology for the TSA’s airport PreCheck system and a member of the Better Identity Coalition, didn’t respond to requests for comment.

Third-Party Concerns

Besides the lack of public input, privacy advocates’ concerns over data security and third-party partnerships are rooted in the state’s contracts with third-party vendors.

The New York Civil Liberties Union and Surveillance Resistance Lab called for New York DMV Commissioner Mark Schroeder to pause the pilot digital ID plan, in a letter last month.

The groups said the program raises similar concerns to New York City’s attempt to add smart chips to municipal ID cards. Such programs can lead to increased government surveillance by creating mobile tracking and a digital record of where a person goes and services they access, such as purchasing alcohol or seeking medical care. The advocates said that such digital IDs need to come with technical protections too, such as encryption and granular controls over what data can be released, like allowing ID holders to indicate only that they are over 21, rather than provide their exact date of birth.

“It is no longer hypothetical to wonder what law enforcement would want with data that comes from something attached to you through a unique identifier that can both connect you to what you have done in the real world, and where you’ve gone, and can connect that to what you’ve also done online,” said Cynthia Conti-Cook, director of research and policy at the Surveillance Resistance Lab.

Private companies including SpruceID, which has contracted with the California Department of Motor Vehicles on implementing digital driver’s licenses, are eager to weigh in. A secure system would verify someone’s identity without needing to connect to a central database in real time, said CEO Wayne Chang.

“We care really strongly about ‘not phoning home,’” Chang said. “We want to make sure that when people use that in the digital world, when it’s on your phone using in-person or over the Internet, that we are not creating tracking either intentionally or not.”

Next Steps

The New York DMV mobile ID “is still in development and a specific timeline for rollout has not yet been determined,” New York DMV spokesperson Walter McClure wrote in an email.

Although the DMV declined to detail privacy protections for the pilot or any issues hindering its progress, Solages is hopeful that her roundtable is a sign of the agency’s willingness to engage on the issue of security and privacy.

“We want to work with the DMV to make sure that digital driver’s licensing is safer, secure and cost effective,” said Solages. “So, we hope that the DMV is willing to work with outside advocacy groups and multiple vendors to make sure that we have an initiative that works for all New Yorkers.”

While secure technology is an important factor for digital IDs, privacy needs to be girded with legislative guardrails, said Nick Doty, senior technologist at the Center for Democracy & Technology. The New York legislature has a chance to create a model to ensure those guardrails are essential to adoption, not an afterthought, he said.

“It can provide a different sort of protection we can get than from a technical design,” said Doty. “Legislatures can make sure it’s actually voluntary and limit what’s collected.”

Solages said she plans to introduce the bill in the coming weeks.

“We’re hoping that we can get it done, better as always. Because in New York, we always do things bigger, better.”