BILL ANALYSIS Ó
AB 2399
Page 1
Date of Hearing: April 22, 2014
ASSEMBLY COMMITTEE ON JUDICIARY
Bob Wieckowski, Chair
AB 2399 (John A. Pérez) - As Introduced: February 21, 2014
As Proposed to be Amended
SUBJECT : Organ Donor Registry: Driver License Information
KEY ISSUE : Should an authorized organ donor procurement
organization be permitted to swipe a California driver's license
or identification card as an additional means of submitting
information on donors to the California Organ and Tissue Donor
Registry?
SYNOPSIS
This bill would allow the four state-authorized organ and tissue
procurement organizations to register donors and submit donor
information to the California Donate Life Organ and Tissue Donor
Registry (Registry) by swiping the donor's California driver's
license or identification card. Since the Anatomical Gift Act
was first enacted in 1988, most donors have registered through
the Department of Motor Vehicles when applying for, or renewing,
a driver's license or identification card. Online registration
is available, but seldom used. As a result, the procurement
organizations try to reach potential donors through outreach at
a variety of community events by setting up tables and
collecting donor information and recording that information on
paper forms. Information collected is then subsequently entered
into the registry. These outreach events give the organizations
the opportunity to reach people during the five-years between
the issuance of license and renewal. This bill would allow a
procurement organization to use the far more efficient method of
swiping the magnetic stripe on a driver's license or
identification card and transmitting the information directly to
the registry. The hope of the author and sponsor is that this
will help increase the number of donors in life-saving Registry.
According to Donate Life California, the non-profit entity that
administers the program and Registry, nearly 11 million
Californians have registered as donors; while this makes
California the largest of the state registries, California is
nonetheless well below the national average donation rate. In
order to address potential privacy concerns, the bill would
AB 2399
Page 2
require that the collection and transmission of information
comply with the Department of Motor Vehicle Information Security
Agreement, which uses the information security standards of the
National Institute of Standards and Technology. This bill is
supported by Donate Life California and the state-authorized
donor procurement organizations. The bill is opposed by the
California Right to Life Committee, although it appears that
CRLC's opposition has more to do with the existing program than
with this particular bill. The author will take amendments in
this Committee that are already reflected in the bill summary
and analysis.
SUMMARY : Authorizes an organ procurement organization to swipe
a driver's license or identification card to transmit a donor's
personal information to the organ and tissue donor register, as
specified. Specifically, this bill :
1)Provides that an organ procurement organization may swipe a
driver's license or identification card issued by the
Department of Motor Vehicles in an electronic device to
transmit information to the Donate Life California Organ and
Tissue Donor Registry for the purposes of allowing an
individual to identify himself or herself as a registered
organ donor.
2)Requires that information gathered or transmitted by the
procurement organization comply with the Department of Motor
Vehicle Information Security Agreement incorporating
information security standards and guidelines derived from the
National Institute of Standards and Technology.
3)Prohibits an organ procurement organization from retaining or
using any of the information obtained by electronic means for
any purpose other than operating the organ and donor registry.
4)Defines "organ procurement organization" to mean a person
designated by the Secretary of the U.S. Department of Health
and Human Services as an organ procurement organization.
EXISTING LAW :
1) Authorizes a business to swipe a driver's license or
identification card issued by the Department of Motor
Vehicles in any electronic device for any of the following
AB 2399
Page 3
purposes:
a) To verify age or the authenticity of the driver's
license or identification card.
b) To comply with a legal requirement to record, retain, or
transmit that information.
c) To transmit information to a check service company for
the purpose of approving negotiable instruments, electronic
funds transfers, or similar methods of payment, provided
that only the name and identification number from the
license or the card may be used or retained by the check
service company.
d) To collect or disclose personal information that is
required for reporting, investigating, or preventing fraud,
abuse, or material misrepresentation. (Civil Code Section
1798.90.1 (a).)
2) Prohibits a business that obtains information pursuant to
the above provision from retaining or using the information
for any purpose other those expressly described. Makes a
violation of this provision a misdemeanor punishable by
imprisonment in county jail for no more than one year, or by
a fine of no more than $10,000, or by both imprisonment and
fine. (Civil Code Section 1798.90.1 (a)-(c).)
3) Establishes, under the Uniform Anatomical Gift Act, a
not-for-profit entity designated the California Organ and
Tissue Donor Registrar, and requires that entity to maintain
the Donate Life California Organ and Tissue Donor Registry.
Requires the registrar to submit an annual written report to
the State Public Health Officer and the Legislature with
specified information, including the general characteristics
of donors as may be determined by information provided on the
donor registry. (Health & Safety Code Sections 7150 -
7151.40.)
FISCAL EFFECT : As currently in print this bill is keyed fiscal.
COMMENTS : The Uniform Anatomical Gift Act allows a person to
make a gift of his or her body (or any part, organ, or tissue)
for the purpose of performing transplants or for medical
research or education purposes. (Health and Safety Code Section
7150.35.) Since the Anatomical Gift Act was first enacted in
1988, most donor registrations have occurred through the
AB 2399
Page 4
Department of Motor Vehicles when someone applies for, or
renews, a driver's license or identification card. In 2003, SB
112 (Speier) authorized four non-profit "organ procurement
organizations" to establish and maintain the Donate Life
California (DLC) Organ and Tissue Donor Registry (Registry). As
in the past, most donor registrations occur at the time of
license application or renewal. Online registration is also
available, but apparently seldom used. Donor procurement
organizations also proactively register donors through outreach
at a variety of community events, often by setting up
informational tables, collecting information from voluntary
donors, and recording information on paper forms. Information
collected is then subsequently entered into the Registry. These
outreach events give the organizations the opportunity to reach
people during the five-years before a license or identification
card must be renewed.
However, this existing paper-form system has its drawbacks. To
begin with, paper forms take more time to complete, and the
information may be recorded illegibly or inaccurately. Paper
forms must then be transported to a place where the information
on the form can be entered into the Registry (which is not only
time-consuming but also presents another opportunity for error).
Allowing the use of electronic swiping and transmission, DLC
believes, will be faster and more accurate, and it will avoid
the need to transport paper forms. Information scanned from the
magnetic stripe - the same information that is on the front of
the license - can be encrypted and send to the Registry in real
time. The device that swipes information from the magnetic
stripe can be easily attached to a smart phone, making
collection and transmission all the easier.
Privacy and Security Standards : Pursuant to the legislation
creating the donor registry, DLC became an official state
partner of the California Department of Motor Vehicles (DMV).
As such, it must adhere to the Department's Information Security
Agreement, which incorporates information security standards
promulgated by the National Institute of Standards and
Technology (NIST). NIST standards represent current "best
practices" in information system management and technical
safeguards that are designed to protect the confidentiality,
integrity, and availability of the system and its information.
These standards cover everything from training and access
authentication to technical safeguards such as encryption.
(NIST, Special Publication (SP) 800-53.) Under existing law,
AB 2399
Page 5
the NIST standards already protect the integrity and security of
the Registry itself. This bill, as proposed to be amended, will
require that the Information Security Agreement and the NIST
standards also apply to the gathering and transmission of the
information to the Registry. In particular, information
collected by electronic devices - most likely attached to smart
phones - will be encrypted. Once submitted to the Registry, the
sponsor states, any information remaining on the device will be
deleted. Indeed the bill prohibits the organ procurement
organizations from maintaining or using the information for any
purpose beyond those authorized by the bill - that is, to submit
the information to the Registry, and nothing else. There is, of
course, no perfectly secure means of collecting and transmitting
digitized data, just as there is no perfectly secure means of
handling paper forms containing the same information.
This Bill Does Not Create the Organ Donor Registry; It Only
Provides Another and More Efficient Means of Submitting
Information to the Registry . Although an opponent of this bill
raises questions about the overall purpose of the Registry, the
security of the information in the Registry, and the extent to
which persons will be properly educated about the organ donation
program, it must be stressed that this bill does not establish
the registry; it does not define its proper purpose; and it does
not decide who may or may not make a donation or what level of
understanding they should have before deciding to donate. These
issues are already addressed by the existing law establishing
the Registry. This bill merely gives the four already-existing
and already-authorized donor procurement organizations an
additional tool for gathering information from donors and
submitting that information to the already-existing Registry.
As for the extent to which donors will property educated about
what they are agreeing to, the sponsor has informed the
Committee that DLC and DMV have created brochures that explain
the program, and that trained staff from the procurement
organizations attend to outreach events, explain the program,
and answer any questions that potential donors might ask. It
appears that people will have as much, if not more, information
as they would if they signed up at the DMV.
PROPOSED AUTHOR AMENDMENTS : In order to ensure that the
gathering of personal information and its transmission to the
Registry are done in a secure manner, the author will take the
following amendments in this Committee:
AB 2399
Page 6
- On page 2, at the end of line 2 insert: Information
gathered or transmitted for the above purpose shall comply
with the Department of Motor Vehicle Information Security
Agreement incorporating information security standards and
guidelines derived from the National Institute of Standards
and Technology.
- On page 4, line 6, delete "general characteristics" and
insert: aggregated data
- On page 4, line 9, delete "general characteristics" and
insert: aggregated data
ARGUMENTS IN SUPPORT : According to the author, sponsor, and
proponents, the intent of this bill is quite straightforward: to
provide a secure, efficient, and accurate system for allowing
donors to register their intent with the life-saving Donate Life
California Organ and Tissue Donor Registry. Nationwide, the
sponsor claims, 18 people die every day awaiting life-saving
organ transplants because of the lack of available organs. Yet,
the sponsor notes, just one donor who makes all of his or her
organs available upon his or her own death, "can save up to 8
lives and improve the lives of up to 50 others." In 2013 alone,
according to the sponsor, "the procurement organizations in
California coordinated 878 organ donors resulting in more than
3,000 lives saved. . . Since 2005, more than 120,000 lives have
been saved or healed through organ and tissue donation as a
direct result of the Donate Life California Organ & Tissue Donor
Registry." According to the author, "the use of paper forms at
[community] events is often a barrier to being added to the
Registry due to length of time to complete, illegible writing,
etc. Allowing the use of electronic transmission will be faster
and more accurate. Technology exists through a device attached
to an iphone and an electronic sign-up sheet is then completed
so that registrations are captured quickly and safely
(information is encrypted and once submitted to the registry
data base, it's deleted.") As to potential privacy and security
concerns, the author and sponsor point out that collection and
transmission will be governed by the same DMV Security Agreement
and NIST standards that presently protect access to, and the
security of, the Registry.
ARGUMENTS IN OPPOSITION : The California Right to Life Committee
(CRLC) opposes this bill for at least three reasons. First CRLC
claims that the definition of a "business" that can swipe a
AB 2399
Page 7
driver's license is too "expansive." CRLC asks whether this
definition would include "a gift shop as well as an organ
procurement company. Would such a 'business' encounter the
potential donor? At a hospital or at a school or at the
DMV?"[sic] Second, CRLC wants to know how much education an
organ donor would receive while the license is swiped. Third,
CRLC wants to know what accommodations will be made if someone
is signed up in error or change's his or her mind later on.
[NOTE: The first issue raised by CRLC - the broad definition of
"business" - appears to be based on a misreading of the statute.
Completely unrelated to the Registry, existing law permits a
"business," as defined, to swipe a driver's license for very
limited purposes, such as age verification. This definition has
no bearing on this bill or on the Registry. Rather, this bill
creates a separate and independent subdivision that allows an
"organ procurement organization," as defined, to swipe a
driver's license or identification card for the limited purpose
of collecting and transmitting information to the Registry. The
definition of "business" is in existing law and has no bearing
on this bill. The second issue - the amount of education
provided to a prospective donor - is not unique to this bill.
The person who signs up at an outreach event would receive the
same information, and would have the same opportunity to ask
questions or read a brochure, as does the person who signs up at
the DMV. As for the third issue, this too is more a question
about existing law than this bill, and existing law already
answers it: individuals may remove themselves from the Registry
at any time by going to the DLC website or calling DLC
directly.]
REGISTERED SUPPORT / OPPOSITION :
Support
Donate Life California (sponsor)
California Transplant Donor Network
One Legacy
Sierra Donor Services
Several Individual Transplant Recipients
Opposition
California Right to Life Committee
AB 2399
Page 8
Analysis Prepared by : Thomas Clark / JUD. / (916) 319-2334