Supporting Statment 1601 0005 01122012

DRAFT DOCUMENT – PREDECISIONAL

INFORMATION COLLECTION SUPPORTING STATEMENT

Minimum Standards for Driver’s licenses and Identification Cards Acceptable by Federal Agencies for Official Purposes

OMB Control No. 1601-0005

1. Explain the circumstances that make the collection of information necessary. Identify any legal or administrative requirements that necessitate the collection. Attach a copy of the appropriate section of each statute and regulation mandating or authorizing the collection of information. (Annotate the CFR parts/sections affected).

The REAL ID Act of 2005 (the Act) prohibits federal agencies from accepting state-issued drivers’ licenses or identification cards for any official purpose – defined by the Act and regulations as boarding commercial aircraft, accessing federal facilities, or entering nuclear power plants – unless the license or card is issued by a state that meets the requirements set forth in the Act. Title II of Division B of Pub. L. 109-13, codified at 49 U.S.C. 30301 note. The REAL ID regulations, which DHS issued in January 2008, establish the minimum standards that states must meet to comply with the Act. See 73 FR 5272, also 6 CFR part 37 (Jan. 29, 2008). These include requirements for presentation and verification of documents to establish identity and lawful status, standards for document issuance and security, and physical security requirements for driver’s license production facilities. For a state to achieve full compliance, the Department of Homeland Security (DHS) must make a final determination on or before January 15, 2013, that the state has met the requirements contained in the regulations and is compliant with the Act.¹ The regulations include new information reporting and record keeping requirements for states seeking a full compliance determination by DHS. As discussed in more detail below, states seeking DHS’s full compliance determination must certify that they are meeting certain standards in the issuance of driver’s licenses and identification cards and submit security plans covering physical security of document production and storage facilities as well as security of personally identifiable information. 6 CFR § 37.55(a). States also must conduct background checks and training for employees involved in the document production and issuance processes and retain and store applicant photographs and other source documents. 6 CFR §§ 37.31 and 37.45. States must recertify compliance with REAL ID every three years on a rolling basis as determined by the Secretary of Homeland Security. 6 CFR § 37.55.

Certification Process Generally

Section 202(a)(2) of the REAL ID Act requires the Secretary to determine whether a state is meeting its requirements, “based on certifications made by the State to the Secretary.” To assist DHS in making a final compliance determination, § 37.55 of the rule requires the submission of the following materials:

1. A certification by the highest level Executive official in the state overseeing the DMV that the state has implemented a program for issuing driver’s licenses and identification cards in compliance with the REAL ID Act.

2. A letter from the Attorney General of the state confirming the state has the legal authority to impose requirements necessary to meet the standards.

3. A description of a state’s exceptions process to accept alternate documents to establish identity and lawful status and wavier process used when conducting background checks for individuals involved in the document production process.

4. The state’s security plan.

Additionally, after a final compliance determination by DHS, states must recertify compliance every three years on a rolling basis as determined by DHS. 6 CFR § 37.55(b).

State REAL ID programs will be subject to DHS review to determine whether the state meets the requirements for compliance. States must cooperate with DHS’s compliance review and provide any reasonable information requested by DHS relevant to determining compliance. Under the rule, DHS may inspect sites associated with the enrollment of applicants and the production, manufacture, personalization, and issuance of driver’s licenses or identification cards. DHS also may conduct interviews of employees and contractors involved in the document issuance, verification, and production processes. 6 CFR § 37.59(a).

Following a review of a state’s certification package, DHS may make a preliminary determination that the State needs to take corrective actions to achieve full compliance. In such cases, a state may have to respond to DHS and explain the actions it took or plans to take to correct any deficiencies cited in the preliminary determination or alternatively, detail why the DHS preliminary determination is incorrect. 6 CFR § 37.59(b).

Security Plans

In order for states to be in compliance with the Act, they must ensure the security of production facilities and materials and conduct background checks and fraudulent document training for employees involved in document issuance and production. REAL ID Act § 202(d)(7)-(9). The Act also requires compliant licenses and identification cards to include features to prevent tampering, counterfeiting, or duplication. REAL ID Act § 202(b). To document compliance with these requirements the regulations require states to prepare a security plan and submit it as part of their certification package. 6 CFR § 37.41. At a minimum, the security plan must address steps the state is taking to ensure:

• the physical security of production materials and storage and production facilities;

• security of personally identifiable information maintained at DMVs including a privacy policy and standards and procedures for document retention and destruction;

• document security features including a description of the use of biometrics and the technical standards used;

• facility access control including credentialing and background checks;

• fraudulent document and security awareness training;

• emergency response;

• internal audit controls; and

• an affirmation that the state possesses the authority and means to protect the confidentiality of REAL ID documents issued in support of criminal justice agencies or similar programs.

The security plan also must include a report on card security and integrity.

Background checks and waiver process

Within its security plans, the rule requires states to outline their approach to conducting background checks of certain DMV employees involved in the card production process. 6 CFR § 37.45. Specifically, states are required to perform background checks on persons who are involved in the manufacture or production of REAL ID driver’s licenses and identification cards, as well as on individuals who have the ability to affect the identity information that appears on the driver’s license or identification card and on current employees who will be assigned to such positions. The background check must include a name-based and fingerprint-based criminal history records check, an employment eligibility check, and for newer employees a prior employment reference check. The regulation permits a state to establish procedures to allow for a waiver for certain background check requirements in cases, for example, where the employee has been arrested, but no final disposition of the matter has been reached.

Exceptions Process

Under the rule, a state DMV may choose to establish written, defined exceptions process for persons who, for reasons beyond their control, are unable to present all necessary documents and must rely on alternate documents to establish identity, date of birth, or SSN (including not having an SSN). 6 CFR § 37.11(h). Alternative documents to demonstrate lawful status will only be allowed to demonstrate U.S. citizenship. The state must retain copies or images of the alternate documents accepted under the exceptions process and submit a report with a copy of the exceptions process as part of its certification package.

Recordkeeping

The rule requires states to maintain photographs of applicants and records of certain source documents. Paper or microfiche copies of these documents must be retained for a minimum of seven years. Digital images of these documents must be retained for a minimum of ten years. 6 CFR § 37.31.

2. Indicate how, by whom, and for what purpose the information is to be used. Except for a new collection, indicate the actual use the agency has made of the information received from the current collection.

The collection of the information will support the information needs of DHS in its efforts to determine state compliance with requirements for issuing REAL ID driver’s licenses and identification cards. States may submit the required documents in any format that they choose. DHS has not defined specific format submission requirements for states. DHS will use all of the submitted documentation to evaluate State progress in implementing the requirements of the REAL ID final rule. DHS has used information provided under the current collection to grant extensions and track state progress.

Submission of the security plan helps to ensure the integrity of the license and identification card issuance and production process and outlines the measures taken to protect personal information collected, maintained, and used by state DMVs. Additionally, the collection will assist other federal and state agencies conducting or assisting with necessary background and immigration checks for certain employees. The purpose of the name-based and fingerprint based CHRC requirement is to ensure the suitability and trustworthiness of individuals who have the ability to affect the identity information that appears on the license; have access to the production process; or who are involved in the manufacture or issuance of the licenses and identification cards.

3. Describe whether, and to what extent, the collection of information involves the use of automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submission of responses, and the basis for the decision for adopting this means of collection. Also describe any consideration of using information technology to reduce burden. [Effective 03/22/01, your response must SPECIFICALLY reference the Government Paperwork Elimination Act (GPEA), which addresses electronic filing and recordkeeping, and what you are doing to adhere to it. You must explain how you will provide a fully electronic reporting option by October 2003, or an explanation of why this is not practicable.]

In compliance with GPEA, states will be permitted to submit the required information for their security plans, certification packages, and written exceptions processes electronically. States will be permitted to submit electronic signatures but must keep the original signature on file. Additionally, because they contain sensitive security information (SSI), the security plans must be handled and protected in accordance with 49 CFR Part 1520. 6 CFR § 37.41(c). The final rule does not dictate how States must submit their employees’ fingerprints to the FBI for background checks; however it is assumed States will do so via electronic means or another means determined by the FBI.

4. Describe efforts to identify duplication. Show specifically why any similar information already available cannot be used or modified for use for the purpose(s) described in Item 2 above.

This information will be collected directly from the states to assist DHS in making REAL ID compliance determinations and is not otherwise available.

5. If the collection of information has a significant impact on a substantial number of small businesses or other small entities (Item 5 of the Paperwork Reduction Act submission form), describe the methods used to minimize burden.

The information collection discussed in this analysis applies to states, state agencies, and certain employees involved in the card production process. Therefore, it is DHS’s belief that the information collection does not have a significant impact on a substantial number of small businesses.

6. Describe the consequence to Federal program or policy activities if the collection is not conducted or is conducted less frequently, as well as any technical or legal obstacles to reducing burden.

In accordance with the regulations, submission of certification materials and security plans will assist DHS in determining full compliance. DHS may also review documents, audit processes, and conduct inspections. Failure to make a compliance determination would prevent state-issued licenses and identification cards from being used for official purposes, which includes boarding commercial aircraft and accessing federal facilities. Additional requirements for recordkeeping, document retention and storage, as well as background checks for certain employees help to ensure the integrity of the card production and issuance process and will assist DHS during audits or inspections of a state’s processes.

7. Explain any special circumstances that require the collection to be conducted in a manner inconsistent with the general information collection guidelines in 5 CFR 1320.5(d)(2).

The collection of this information will be conducted in a manner that is consistent with the guidelines in 5 CFR 1320.5(d)(2).

8. Describe efforts to consult persons outside the agency to obtain their views on the availability of data, frequency of collection, the clarity of instructions and recordkeeping, disclosure, or reporting format (if any), and on the data elements to be recorded, disclosed, or reported. If applicable, provide a copy and identify the date and page number of publication in the Federal Register of the agency's notice, required by 5 CFR 1320.8(d) soliciting comments on the information collection prior to submission to OMB. Summarize public comments received in response to that notice and describe actions taken by the agency in response to these comments. Specifically address comments received on cost and hour burden.

A 60 Day Federal Register Notice soliciting for public comments was published on Monday, July 18, 2011 at 76 FR 42132. DHS has received comments from two commenters as it relates to this notice.

Both the commenter's suggestions relate to the overall program and not the actual collection of the information that will support the information needs of DHS in its efforts to determine state compliance with requirements for issuing REAL ID driver’s licenses and identification cards. DHS will consider the commenter's comment when determining whether any changes need to be made to the overall program.

A 30 Day Federal Register Notice soliciting for public comments was published on Wednesday, October 5, 2011 at 76FR 42130. DHS has received comments from two commenters as it relates to this notice.

Both the commenter's suggestions relate to the overall program and not the actual collection of the information that will support the information needs of DHS in its efforts to determine state compliance with requirements for issuing REAL ID driver’s licenses and identification cards. DHS will consider the commenter's comment when determining whether any changes need to be made to the overall program.

9. Explain any decision to provide any payment or gift to respondents, other than remuneration of contractors or grantees.

DHS will not provide any payment or gift to respondents.

10. Describe any assurance of confidentiality provided to respondents and the basis for the assurance in statute, regulation, or agency policy.

Information provided will be protected from disclosure to the extent appropriate under applicable provisions of the Freedom of Information Act, the Privacy Act of 1974, the Driver’s Privacy Protection Act, as well as DHS’s Privacy Impact Assessment for the REAL ID Act.

11. Provide additional justification for any questions of sensitive nature, such as sexual behavior and attitudes, religious beliefs, and other matters that are commonly considered private.

DHS will not ask any questions of a sensitive nature.

12. Provide estimates of the hour burden of the collection of information.

Assumptions:

All information collection burden hours are based on the estimates for years four through six of REAL ID implementation documented in the REAL ID Regulatory Evaluation. DHS recalculated annual costs based on years four through six because many of the initial start up costs associated with year one REAL ID implementation are sunk costs and therefore no longer valid. In this supporting statement, however, DHS has recalculated the burden hours based on 56 jurisdictions as opposed to the 51 used in the Regulatory Evaluation. The original estimates did not include the five U.S. Territories (Puerto Rico, the Commonwealth of the Northern Mariana Islands, Guam, the Virgin Islands, and American Samoa). Therefore, DHS multiplied the original burden hour estimates by 56/51 to include all jurisdictions defined in the regulations. Finally, DHS is using an updated $29.72 per hour labor rate based on the same Department of Labor category used in the original Regulatory Evaluation.

Table A.12: Estimated Annualized Burden Hours and Costs (A x B x C=D); D x E = F

Certification

DHS estimates that states will spend approximately 61,500 total burden hours annually collecting, maintaining and documenting the information reported to DHS as part of the certification process. States must certify that they meet the standards of the REAL ID regulation once every three years.

State recordkeeping requirements

States must maintain photographs of applicants and records of certain source documents. DHS estimates that ten percent of all IT costs are related to the recordkeeping requirements. Based upon the Regulatory Evaluation estimates for IT costs for Years Four through Six, DHS estimates that states will incur approximately $11.4 million dollars annually in costs for storing photographs of applicants and for storing copies or images of source documents. This data will be maintained by the states and will not be reported to DHS.

13. Provide an estimate of the total annual cost burden to respondents or recordkeepers resulting from the collection of information.

In addition to the costs associated with state certification and record keeping discussed in item 12 above, states must subject covered employees to a background check, which includes a name-based and fingerprint-based criminal history records check (CHRC). DHS estimates states will incur costs for employee background checks of $1.44 million in the first year, $0.61 million in the second year, and $0.37 million in the third year, for an annualized cost estimate of $0.80 million.

14. Provide estimates of annualized cost to the Federal Government. Also, provide a description of the method used to estimate cost, and other expenses that would not have been incurred without this collection of information.

The cost to the Federal Government according to internal estimates is $ 1.00 million per year, which includes 4 FTEs for grant and certification program management and travel costs.

15. Explain the reasons for any program changes or adjustments reported in Items 13 or 14 of the OMB Form 83-I.

There has been no program changes or new requirements established as a result of this collection request. The initial request only covered the first three years of REAL ID implementation and did not include the collection requirements for a full compliance determination by DHS.

This request is a revision to the original REAL ID information request that covered submissions of material compliance checklists and requests for extensions to meet the requirements of the regulation. This collection is being revised to cover the collection of information required under the regulation for full compliance, which was not covered in the original request, including recordkeeping requirements and employee background checks, and to include information to assist DHS in making full compliance determinations in the next three years of implementation.

States seeking certification of full compliance with the REAL ID Act must follow the certification requirements described in §37.55 of the regulation and referenced in the response to question one of this supporting statement. There are no new or additional costs associated with this revised information collection. All costs were included in the REAL ID final rule that was published in January 2008.²

There has been an increase in annual burden hours associated with this collection. This increase in burden is a result of the collection of information required for full compliance. The number of respondents also has increased from 51 to 56, as the previously approved collection did not include the five U.S. Territories (Puerto Rico, the Commonwealth of the Northern Mariana Islands, Guam, the Virgin Islands, and American Samoa).

16. For collections of information whose results will be published, outline plans for tabulation and publication. Address any complex analytical techniques that will be used. Provide the time schedule for the entire project, including beginning and ending dates of the collection of information, completion of report, publication dates, and other actions.

DHS will not publish the results of this collection.

17. If seeking approval to not display the expiration date for OMB approval of the information collection, explain the reasons why display would be inappropriate.

DHS is not seeking such approval. All information gathered under this collection will be in formats governed by individual state requirements and formats, thus display of the OMB number would be inappropriate.

18. Explain each exception to the certification statement identified in Item 19, “Certification for Paperwork Reduction Act Submissions,” of OMB Form 83-I.

DHS is not seeking any exceptions.

1 While the Act established a full compliance deadline of May 11, 2008, the Act also provided the Secretary with authority to extend the full compliance deadline for states that timely file a request for extension if the state provides adequate justification for noncompliance. See § 205(b) of title II of Division B, Pub. L. 109-13; See also 6 CFR § 37.63, which gives the Secretary authority to grant additional extensions. Pursuant this authority, the Secretary changed the full compliance deadline to January 15, 2013.

2 In this revised supporting statement, all information collection burden hours are based on the estimates for years four through six of REAL ID implementation documented in the REAL ID Regulatory Evaluation. DHS has recalculated the burden hours based on 56 jurisdictions and an updated $29.72 per hour labor rate.