Attachment C - DMV Privacy Confidentiality Policies revised 2023 (3).pptx
PPTX presentation 3 MB Posted
- Attached to
- RFP to Modernize the DMV Driver System
- Solicitation number
- CRFP 0802 DMV2700000001 2
- Issued by
- Kanawha County, West Virginia
About this file
This is a privacy and confidentiality policy document issued by the West Virginia Division of Motor Vehicles (DMV) that outlines requirements for protecting personally identifiable information (PII) under the federal Driver Privacy Protection Act (DPPA) and West Virginia's Uniform Records Disclosure Act. The document establishes mandatory standards for all DMV employees and permitted users who access DMV records containing sensitive personal information such as driver's license numbers, Social Security numbers, addresses, medical information, financial data, and photographs. The policy prohibits the release of PII to unauthorized individuals, news media, or for marketing and solicitation purposes, and restricts access to information directly related to valid work assignments. All PII must be stored securely in locked facilities, and computers must be locked or logged off when unattended to prevent unauthorized access or exposure.
The policy establishes comprehensive accountability measures and breach reporting requirements for all personnel with DMV record access, who must sign confidentiality agreements and receive training on PII protection responsibilities. Violations carry significant penalties, including criminal fines up to $500 and imprisonment up to six months for wrongful disclosure, as well as civil liability with minimum damages of $2,500 per individual whose information is misused, plus potential punitive damages and attorney fees. Breach incidents involving electronic systems must be reported immediately to DMV Privacy Officers at 304.926.0708 and subsequently to the West Virginia Office of Technology, while breaches involving Social Security Administration-provided information require notification to the Social Security Administration within 24 hours. The policy designates Jennifer Pierson and Anna Faulkner as DMV Privacy Officers responsible for addressing privacy questions and complaints.
View the file
Other files
Show all 11
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
WEST VIRGINIA DIVISION OF MOTOR VEHICLES
PRIVACY PROGRAM and CONFIDENTIALITY POLICIES
WHAT IS DPPA?
Protecting Personal Information The Driver Privacy Protection Act is a law that was enacted by the federal government in 1994 to make sure Motor Vehicle agencies restrict who can obtain DMV customer’s personal information from Motor Vehicle agency records. In response, West Virginia enacted the Uniform Records Disclosure Act found at §17A-2A-1 et seq.
To follow that law, first you must learn what information is considered protected, personal information.
PERSONALLY IDENTIFIABLE INFORMATION or PII is anything that identifies a person or that can be used to identify or locate a person.
PII cannot be released except by specific statutory permission. PII includes:
Photograph or computerized image Social Security number Driver License or ID number Name and address Telephone number Medical or disability information
Personally Identifiable Information (PII) also includes less obvious information, such as:
E-mail addresses, credit card numbers, bank account numbers and payment card information, information about citizens, co-workers, vendors and employers, and information in other formats computerized or on paper.
These identifiers are also protected from release and use unless permitted by law.
MINIMUM NECESSARY AND LIMITED USE
Making sure that employees only access the minimum necessary information and only use that information for a specific purpose, demonstrates our commitment to collecting the least amount of PII that we need to complete the customer’s business.
Always determine what elements of PII you actually need and only request that PII from a customer.
You may not require an individual to provide more than the minimum necessary PII.
PERMITTED USERS
A person or company must be a permitted user as defined under DPPA to receive personal information from DMV records.
DMV Employees Qualify as Permitted Users Only if the information accessed is directly related to the work assigned to the employee.
Users of DMV records are PROHIBITED from releasing PERSONAL information to anyone by the terms of a contract.
DMV employees are PROHIBITED from releasing PERSONAL information to anyone who does not qualify as a permitted user under the DPPA or to anyone who does not have a contract with DMV.
NOT PERMITTED!
DMV Employees and Users of DMV records are NOT permitted to access personal information out of curiosity, for birthday celebrations, to send get well cards or for any reason not related to work assignments.
NO personal information can be given over the telephone.
You cannot tell anyone or give anyone a document with a customer’s name, address, date of birth, financial information, medical or disability information, a social security number or a driver’s license number.
NEWS MEDIA
News Media Personnel are NOT permitted users and cannot be given personal information from DMV records.
Television stations Radio Stations Newspapers Internet E-mail
| CANNOT | BE RELEASED OR | ||
| RESOLD | for MARKETING, SURVEYS | OR SOLICITATION |
NO MARKETING, SURVEYS OR SOLICITATIONS
Even if a person or company qualifies as a permitted user, PII
SECURITY SAFEGUARDS POLICY
You cannot respect privacy unless you secure PII.
Pay careful attention to activities that can expose PII, including storage and disposal.
All PII must be securely stored or scanned and properly shredded.
PII can never be thrown in the trash can or dumpster.
LOCK IT – PHYSICIAL SECURITY
Store documents and files, CD’s, zip drives, and any other materials containing PII in a locked room or locked file cabinet.
Lock your computer anytime you step away from your work area even if it’s for a short break.
Log off your computer if you will be gone for the day and when you are on vacation.
ACCOUNTABILITY
Employees and permitted users are responsible for the security of Personally Identifiable Information (PII) that DMV collects & creates.
Employees and permitted users who access personal information that is not part of a valid work assignment or contract have committed a crime.
WRONGFUL DISCLOSURE
May result in permanent access revocation to DMV records and disciplinary action including
Criminal Penalties for wrongful disclosure
Failure to comply with the DPPA is a crime and is punishable by a fine of $500.00/ imprisonment for 6 months or BOTH.
THIS MEANS YOU!
CIVIL PENALTIES FOR WRONGFUL USE
THIS MEANS YOU.
A person who knowingly obtains, discloses or uses personal information from a DMV record contrary to law is liable to the individual whose record was used.
A judge must award a minimum amount of $2,500 to each person whose information was used or released and can award punitive damages, attorneys’ fees and any other appropriate relief.
The Accountability Policy Everyone is responsible for privacy and security of PII Everyone has access to lots of PII about co-workers, citizens and business partners It is your job to understand how the Privacy laws and policies apply to the PII you access It is your job to forward questions and complaints to the DMV Privacy Officer It is your job to report any mistakes that release or expose PII contrary to the law and privacy policies
The Accountability Policy Everyone with DMV record access must sign a confidentiality agreement Everyone is responsible to train co-workers on PII responsibility DMV will sanction anyone who fails to comply with privacy laws or privacy policies All privacy incidents or breaches must be reported to the DMV privacy officer DMV and WVOT privacy officers will monitor and ensure privacy law and policy compliance
CAN
I S H A R E S E N S I T I V E P I I " ' 1 0 . 0 8 . 2 0 " ' 1 5 ( S P I I ) ?
S T A R T Y E S Y E S N O D O N O T S H A R E Y E S N O
| S P I I | - S e n s i t i v e P e r s o n a l l y I d e n t i f i a b l e | I n f o r m a t i o n : | ||
| T h o s e e l e m e n t s | o f P I I t h a t m u s t | r e c e i v e | h e i g h t e n e d | |
| p r o t e c t i o n | d u e | t o | l e g a l | o r |
| p o l i c y | r e q u i r e m e n t s | s u c h a s : |
S e c u r i t y n u m b e r s c a r d n u m b e r s a n d m e d i c a l d a t a L i c e n s e n u m b e r s S o c i a l C r e d i t H e a l t h D r i v e r I n d i v i d u a l f i n a n c i a l a c c o u n t n u m b e r s D i s c i p l i n e o r g r i e v a n c e i n f o r m a t i o n _ Y E S
PII BREACH INCIDENT REPORTS
If you aren’t sure whether you should release PII, contact the DMV Privacy Officers at 304.926.0708 We all make mistakes – But, if you make a mistake, you are required to report it to the Privacy and Security Officers immediately. Waiting may allow a breach to continue or may prevent an early solution.
Jennifer Pierson, DMV Chief Privacy Anna Faulkner, DMV Privacy Counsel Tim Rutherford, DMV Privacy Security Officer 304.926.0708 304.926.0708 304.926.0703
PII ELECTRONIC OR COMPUTER SYSTEMS BREACH INCIDENT REPORTS
All unauthorized PII uses and disclosures by electronic means, including email, faxes, mainframe and other computer systems require an incident report to be filed with the WV Office of Technology. You must FIRST report it to the DMV Privacy Officers immediately, who will then report it to the:
West Virginia Office of Technology 304.558.9966 or 877.558.9966
SOCIAL SECURITY-PROVIDED INFORMATION BREACH INCIDENT REPORTS
If your work is in information technology and involves receiving Social Security Administration- Provided Information, then you must report all unauthorized uses and disclosures of that information to the Social Security Administration within 24 Hours:
Social Security Administration 1-877-697-4889
The Accountability Policy Names & Numbers to Know DMV Privacy Officers:
Jennifer Pierson and Anna Faulkner 5707 MacCorkle Ave., S.E.
Charleston, WV 25311 Or P.O. Box 17200 Charleston, WV 25317
304.926.0708 (W); 304.926.3886 (Fax) DMVLegal@wv.gov;
image1.jpg image2.png image3.png image4.png image5.png image6.png image7.png image8.png image9.png image10.jpg image11.jpg image12.jpg image13.png image14.png image15.png image16.png image17.png image18.png image27.png image28.png image29.png image30.png image31.png image32.png image33.png image34.png image35.png image36.png image19.jpg image37.png image38.png image39.png image20.png image21.png image22.png image23.png image24.png image25.png image26.png image40.png image41.png image42.png image43.jpg image44.jpg image45.png image46.png image47.png image48.png image57.png image58.png image59.jpg image49.png image50.png image51.png image52.png image53.png image54.png image55.png image56.png image60.jpg image61.jpg image62.jpg image63.jpg image64.png image73.png image74.png image65.png image66.jpg image67.png image68.png image69.png image70.png image71.png image72.png image75.png image76.png image77.jpg image78.jpg image79.jpg image80.jpg image81.jpg image82.jpg
File details come from the government source that posted it. Updated .