BILL ANALYSIS Ó
AB 2433
Page 1
Date of Hearing: April 19, 2016
ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION
Ed Chau, Chair
AB 2433
(Travis Allen) - As Amended April 14, 2016
SUBJECT: Voter registration database: Electronic Registration
Information Center
SUMMARY: Authorizes the Secretary of State (SOS) to join an
interstate voter data exchange, called the Electronic
Registration Information Center (ERIC) and waives all California
voter confidentiality and voter data security laws in order to
allow the SOS to share confidential voter records with ERIC.
Specifically, this bill:
1)Authorizes the SOS to apply for membership with ERIC and
requires the SOS, if the membership application is approved,
to execute a membership agreement with ERIC on behalf of the
state.
2)Requires the SOS to ensure that any confidential information
or data provided by another state to the SOS remains
confidential while in his or her possession.
3)Authorizes the SOS, notwithstanding any other law, to provide
confidential information or data to persons or organizations
pursuant to an agreement entered into under this bill.
AB 2433
Page 2
4)Permits the SOS to adopt regulations necessary to implement
the provisions of this bill.
EXISTING LAW:
1)Requires each state, pursuant to the federal Help America Vote
Act of 2002 (HAVA), to implement a single, uniform, official,
centralized, interactive computerized statewide voter
registration list at the state level that contains the name
and voter registration information, including the full
California driver's license or identification number (CDL/ID)
and last four digits of the Social Security number (SSN4), of
every legally registered voter in the state. (42 U.S.C.
Sections 15301-15545)
2)Provides that a person entitled to register to vote shall be a
United States citizen, a resident of California, not in prison
or on parole for the conviction of a felony, and at least 18
years of age at the time of the next election. (Elections
Code (EC) Section 2000)
3)Authorizes certain voter registration information, such as the
name, home address, telephone number, email address, and party
affiliation, to be shared specifically for election,
scholarly, journalistic, or political purposes, or for
governmental purposes. (Government Code (GC) Section
6254.4(a), EC 2194)
4)Requires, notwithstanding any other provision of law, a
voter's CDL/ID, SSN4, and signature to be confidential and not
disclosed. (EC 2138.5, EC 2194(b), GC 6254.4(c))
5)Provides for confidential voter registration for certain
AB 2433
Page 3
voters, including victims of domestic violence, reproductive
health care workers, public safety officers, and elected
officials (EC 2166, 2166.5, and 2166.7)
6)Prohibits voter information from being shared outside the
U.S., including the provision of access to voter information
on the Internet. (EC 2188.5)
FISCAL EFFECT: Unknown
COMMENTS:
1)Purpose of the Bill . This bill is intended to help ensure
California has accurate voter rolls. This bill is
author-sponsored.
2)Author's statement . According to the author, "The
Presidential Commission on Election Administration submitted a
report in 2014 stating the importance of accurate voter rolls
in state voter registration systems in order to ensure the
utmost integrity and participation in elections. The report
continues to explain that the decentralized nature of the
administration of American elections may have its most
pronounced and demonstrable effects in the registration
system. Unlike other countries, the United States does not
maintain a list of registered voters at the national level."
"Elections in our state are constantly evolving through online
registration, social media, the rise of online marketing
campaigns; we are changing the way in which our state engages
in the democratic process. Unfortunately, voter registration
systems remain largely based on outdated programs and tools.
For example, 1 in 8 voter registration records in America
AB 2433
Page 4
contain a serious error, such as a wrong address or which
county a voter is residing in. In addition, more than 51
million citizens, or 25 percent, remain unregistered to vote.
"The Commission concludes their report referenced above by
recommending that states participate in interstate
coordination programs that empower states to work together to
ensure they are utilizing the most up-to-date information for
the country's voters. This will ensure the best voter
experience?promoting trust and engagement in the election
process."
3)2014 Presidential Commission report . In 2013, the
Presidential Commission on Election Administration
(Commission) was established by Executive Order with the
mission to identify best practices in election administration
and to make recommendations to improve the voting experience.
The Commission submitted a report in January 2014 entitled, "The
American Voting Experience: Report and Recommendations of the
Presidential Commission on Election Administration." One of
the main recommendations reported by the Commission focused on
voter registration, specifically voter roll accuracy. In an
effort to increase the accuracy of voter rolls, the Commission
report makes the following recommendations with respect to
voter registration: 1) States should adopt online
registration, 2) Interstate exchanges of voter registration
information should be expanded, and, 3) States should
seamlessly integrate voter data acquired through the DMV with
their statewide voter registration lists.
4)ERIC . ERIC is a non-profit organization with the mission of
assisting states to improve the accuracy of America's voter
rolls and increase access to voter registration for all
eligible citizens. With the assistance of the PEW Charitable
Trust, ERIC was formed in 2013 and is owned, governed, and
AB 2433
Page 5
funded by the states that choose to join. As of December
2015, Washington D.C. and 15 states are members of ERIC,
including Alabama, Colorado, Connecticut, Delaware, Louisiana,
Illinois, Maryland, Minnesota, Nevada, Oregon, Pennsylvania,
Rhode Island, Utah, Virginia, and Washington.
According to information provided on the ERIC website, the ERIC
data center allows states to securely and safely compare voter
data, thereby improving the accuracy of the voter rolls.
States that choose to participate in ERIC are able to compare
information on eligible voters from official data sources
submitted by the states. Each member state submits at a
minimum its voter registration and motor vehicles department
data. The data includes names, addresses, date of births,
driver's license or state identification number, and last four
digits of the social security number (SSN4). Other
information, such as phone numbers, email addresses, and
record status are also submitted as available. According to
the ERIC website, ERIC has safeguards in place that anonymize
sensitive identifying data by converting it into
indecipherable characters that is unreadable and unusable to
potential hackers, such as "one-way hashing."
These records go through a data-matching exchange that
crosschecks the information against lists from other member
states as well as other data sources such as the National
Change of Address data from the United States Postal Service
and other existing government databases, such as death records
from the Social Security Administration. ERIC then reports
back to the states where there is a "highly confident match"
indicating a voter moved or died, or the existence of a
duplicate record. It is unclear, however, exactly how many
data points constitute a match. Once states receive the
reports they can then begin the process to clean up the voter
rolls, subject to state and federal law. Participating states
also receive information on unregistered individuals who are
potentially eligible to vote. This information will allow
states to reach out to those citizens to encourage them to
register to vote. Member states pay annual dues which vary
AB 2433
Page 6
depending on the population size of the state. Large states
usually pay more than small states.
This bill authorizes the SOS to apply for membership to the ERIC
program and, if approved, requires SOS to execute a membership
agreement with ERIC on behalf of the state. The bill contains
a provision that undermines all state laws designed to protect
voter privacy and the confidentiality of sensitive voter data,
such as Social Security numbers and driver's license numbers.
Specifically, this bill authorizes the SOS, notwithstanding
specific voter privacy laws, Government Code 6254.4(c) and
Elections Code 2194(b), or "any other law," to provide
confidential information or data to persons or organizations
if an agreement is entered into to participate in ERIC.
5)Privacy risks of releasing confidential voter registration
data . Current law permits only certain voter information,
such as the name, home address, telephone number, email
address, and party affiliation, to be shared specifically for
"election, scholarly, journalistic, or political purposes, or
for governmental purposes." Existing law explicitly requires
voters' CDL/ID numbers, social security numbers, and
signatures to be kept strictly confidential and not disclosed.
This bill changes California's longstanding policy to protect
certain personal identifying voter information from
disclosure. In effect, this bill would overturn California's
voter privacy laws to allow the SOS to provide confidential
voter data to an out-of-state nongovernmental organization.
The ERIC bylaws require the SOS to provide the following data
fields of all 17 million of California's registered voters:
a) All name fields, all address fields;
b) Full CDL/ID;
c) SSN4;
d) Date of birth;
e) Current record status;
f) Affirmative documentation of citizenship;
g) Title/type of affirmative documentation of citizenship
presented;
AB 2433
Page 7
h) Phone number; and
i) Email address.
The bill does not contain any requirements for the SOS to
inform a voter that their personal voter registration
information is being shared, nor does the bill require a voter
to consent to their information being shared.
6)Data security risks . According to documents from the ERIC
website, there are three primary components to ERIC's data
matching process: data collection, anonymization, and file
transfer.
To secure sensitive information, such as last four digits of the
SSN and DL number, ERIC provides an anonymization application
to each participating jurisdiction. The anonymization, also
known as "one-way hashing," converts sensitive identifying
data into indecipherable characters that is unreadable and
unusable to potential hackers. Documents state that to
further strengthen the security measures around the data, all
records are sent through the anonymization process twice -
once at the state level, before data is ever sent to ERIC, and
once by ERIC as it receives data. States are then given
account credentials to access a secure file transfer protocol
(sFTP) site where their anonymized files are uploaded to a
state-specific location. ERIC proceeds to run and generate
reports that are available for state-specific download on the
same sFTP site. According the ERIC's membership agreement,
participating states are required to upload all voter data
every 60 days.
The author and the Committee may wish to consider whether 17
million California voter records should be released to an
out-of-state nongovernmental entity, which may or may not have
sufficient cybersecurity countermeasures in place to protect
sensitive voter data, such as full CDL/ID numbers and SSN4s.
7)Is this bill needed ? Federal law, HAVA, required every state
to implement a computerized statewide voter registration
AB 2433
Page 8
database. California recently deployed its new statewide
voter registration system, called VoteCal, which as of March
2016 is live in all 58 counties. VoteCal made much-needed
improvements to the administration of elections in California
by streamlining the voter registration process; allowing
voters to update their voter registration records seamlessly
when they update their address with the Department of Motor
Vehicles (DMV) or with the state's Employment Development
Department; and by making it easier and more efficient for
elections officials to do "list maintenance," including
identifying and eliminating duplicate registrations,
transferring a voter's record from one county to another when
the voter moves, and canceling the registrations of
individuals who are no longer eligible to vote.
Aside from the benefits VoteCal provides, California already
has numerous processes in place for removing duplicate voter
records, deceased voters, felons, and people who have moved.
These checks are conducted with data from federal agencies,
including the Social Security Administration, the United
States Post Office National Change of Address Program.
California also checks voter registration data against
information from Department of Vital Statistics, DMV, the
Department of Corrections and Rehabilitation, and the
Department of Health Services. In addition, all county
elections officials receive reports from superior courts of
individuals convicted of felonies.
According to a 2014 National Conference of State Legislatures
report, states already cooperate in a wide variety of ways to
ensure the accuracy of voter data and to prevent duplicate
voter records. For instance, if a new voter in a state fills
out a voter registration form and indicates that he or she was
registered in another state previously, the jurisdiction
informs the other state that the voter has moved. This is
AB 2433
Page 9
already current practice in California.
8)Arguments in opposition : The American Civil Liberties Union
(ACLU) opposes this bill, not only because confidential voter
data would be shared but also because ERIC calls for states to
share DMV records as well. ACLU notes that "ERIC's
promotional publications explaining how ERIC functions
underscore the central role of motor vehicle agency data.
Specifically highlighted is address data from motor vehicle
agencies. However, the California DMV is explicitly
prohibited from sharing residence address data. California
Vehicle Code Section 1808.21(a) states, "Any residence address
in any record of the department is confidential and shall not
be disclosed to any person, except a court, law enforcement
agency, or other government agency, or as authorized in
Section 1808.22 or 1808.23." [These] sections create
exceptions that would not apply to ERIC."
"ERIC requires member states to send to ERIC voter file data
and motor vehicle data. It requires member states to use their
"best efforts" to transmit data from all agencies that
"perform any voter registration functions," including but not
limited to NVRA agencies. This "best efforts" requirement, if
complied with, presumably implicates a variety of California
state agencies and departments. California has a blanket ban
on state agencies sharing data. California Civil Code Section
1798.24 states "No agency may disclose any personal
information in a manner that would link the information
disclosed to the individual to whom it pertains." That code
section includes a list of exceptions, none of which would
include ERIC."
9)Double-referral . This bill was double-referred to the
AB 2433
Page 10
Assembly Elections Committee where it was heard on April 13,
2016, and passed 7-0.
REGISTERED SUPPORT / OPPOSITION:
Support
None on file.
Opposition
ACLU
Analysis Prepared by:Jennie Bretschneider / P. & C.P. / (916)
319-2200
AB 2433
Page 11