To Chairman Claggett, Vice Chair Workman, Ranking Member Mohamed, and members of the House Technology & Innovation Committee, thank you for this opportunity to provide interested party testimony on Amended House Bill 78.
I will confess the ACLU of Ohio will likely never be comfortable with the use of digital IDs. However, we also recognize many states are moving this direction and many people support this advance in technology and convenience. So, for now, the ACLU of Ohio is “interested party,” instead of “opponent,” on HB 78 with the sincere hope this bill can be improved in ways that respect and reflect civil liberties concerns.
The ACLU of Ohio’s main concern with HB 78 is the lack of specific privacy protections in the bill for your constituents. Indeed, any adequate privacy protections, assuming ones would eventually emerge, are entrusted via HB 78 to the Bureau of Motor Vehicles to “develop, implement, and administer a program” for the creation and use of digital IDs.
And, while it is true HB 78 also tasks the BMV with “any other procedures or requirements that the registrar determines are necessary to implement and administer this section and ensure the general privacy, security, and safety of the data and images exchanged through the program,” our fear is whatever is ultimately implemented and used will be inadequate to protect privacy, as has been the case in other states that have gone down this path.
In other words, the ACLU of Ohio believes and requests that adequate privacy protections be specifically included in the language of HB 78 instead of leaving it to a different entity, in the future, where the process, deliberations, and ability to impact the outcome are far less transparent and accessible.
More specifically, these are some of (but not all) the minimal privacy protections the ACLU of Ohio believes are crucial to this type of legislation and effort:
Tracking of Digital ID Users
The same convenience digital IDs will provide for Ohioans will also make it much more convenient for people to be tracked with no limits across multiple, additional entities and uses. HB 78 should ensure the data generated by, and online movements of, digital ID holders cannot be tracked and stored by government, and any third-party data brokers responsible for the operation of digital ID systems, for purposes other than those specifically needed for the intended use of a digital ID.
The use of digital IDs should not subject your constituents to tracking across multiple uses and purposes, exposing our whereabouts, purchases, transactions, and other uses that are possible via a digital ID but not with a current, hard copy ID. In addition, this prohibition should apply not just to the BMV and related entities responsible for digital ID operations, but also to private entities such as websites, online retailers, food delivery services, parking garages, and everyone else every single time we use a digital ID for any, and every, purpose.
Indeed, to best preserve civil liberties we must reject and prevent an eventual scenario where daily life becomes a “checkpoint society” where, in person and online, it becomes impossible to avoid proving our identity, again and again, to governments and corporations wherever we go or whatever we do.
User Control of Data
Related to the above concern, digital ID users should not have to reveal more personal information than necessary for the use of that ID. For example, if there is some reason a person is prompted to prove they are 21 years old or older, they should not be required to share their age, name, date of birth, and similar data for that transaction. Right now, the technology exists, and is used by some, to confirm one’s age without revealing the underlying data mentioned. HB 78 should require only a minimum amount of data necessary for a transaction.
Law Enforcement Access to Smartphones
House Bill 78 wisely bars law enforcement (among other government entities) from viewing any other content on a person’s phone when a person uses a digital ID to confirm their identity. However, in the spirit of this prohibition, the ACLU of Ohio believes it should be even stronger in favor of privacy rights.
In this context, we recommend further restrictions beyond just “viewing” a smartphone that include not allowing a law enforcement to offer to request even temporary possession of a smartphone. Nationally, the ACLU is aware of incidents in other states where people have “consented” to having their smartphones taken away only to have a law enforcement officer secretly use forensic tools to copy a phone’s entire contents or install spyware. That cannot and does not happen when a person maintains possession of their smartphone.
Digital ID Mandates
HB 78 anticipates the use of digital IDs for purposes such as access to government services and encounters with law enforcement. But it is silent on the use of digital IDs for potentially numerous other purposes by government and private entities. However, none of us should ignore all the possible applications that have emerged in other states and countries and will continue. Once it becomes easy enough to share one’s identity with the press of a button, demands will emerge from everywhere.
Accordingly, Ohio should place strict limits on the required uses of digital IDs to avoid future situations where people are required to use only digital IDs. As mentioned earlier, it is easy to envision demands for digital IDs to access websites, online retailers, food delivery services, parking garages, and much more.
Regulating this not only helps protect privacy, it prevents a bifurcated society that leaves behind those without smartphones, those without reliable internet access, those not eligible for digital IDs, and those without the tech savvy to navigate a society that only accommodates those with digital IDs. We see related scenarios like this already in many areas of Columbus where if one wants to park on a city street their exclusive option is to pay via a smartphone app.
Members of this committee, you have an important responsibility here. Digital IDs are increasingly part of our current lives and will be much more so in the future. The time to get privacy protections and other policy considerations right is now, before the proverbial train entirely leaves the station.
To be clear, there are more considerations and complexities than what I mentioned here today. Thankfully, Ohio is not forced to figure all these issues out on our own. Via other states and countries, there exists plenty of model language, best practices, and other helpful information to best guide how all this proceeds in our own state. As always, the ACLU of Ohio is available to help in this regard.
In short, the ACLU of Ohio urges ongoing thoughtful and thorough deliberation and consideration of Amended House Bill 78. We sincerely hope this committee agrees.
