Section 1. Bulk vehicle records requests. The fees collected for bulk vehicle records requests are deposited as follows: 40 percent to the legislative auditor for reporting required by section 3 and 60 percent to the general fund.

Section 2.  Review and audit of purchases of bulk driver and motor vehicle records. The purchaser of bulk driver and motor vehicle records must annually engage an independent organization to audit its use of the data. The auditing organization must conclude whether the purchaser has effectively implemented security controls over the processing and use of the data consistent with controls recommended by the National Institute of Standards and Technology.  If a purchaser fails to submit an annual audit report to the commissioner of public safety and to the legislative auditor, the commissioner must not provide any additional data until the report is submitted.

Section 3.  Annual reports.  By March 1 of each year, the commissioner must report to the legislature on the entities that purchased bulk vehicle records, whether each entity submitted the required annual audit report, a summary of annual audit reports, and recommendations on how to improve the security or handling of the data. Also by March 1 of each year, the legislative auditor must report on similar issues but must also evaluate the annual reports submitted by purchasers.

Section 4.  Privacy classification for personal safety. If the commissioner discloses a name or address classified as private, the commissioner must notify the subject of the data. The commissioner must notify the recipient of the data and request that the data be removed from the recipient’s system. The commissioner must also notify the legislature. This section is effective the day following final enactment.

ACS/syl