004.01
Disclosure
Prohibited, Exceptions.
Notwithstanding any other provision of state law to the contrary, the
Department and any officer, employee, authorized agent, or contractor of the
Department shall not disclose personal information or sensitive personal
information about any person obtained by the Department in connection with a
motor vehicle record, except as provided in these rules and regulations.
004.01A If an officer, employee, authorized
agent or contractor of the Department acts to disclose personal information or
sensitive personal information contained in a motor vehicle record, the
officer, employee, authorized agent or contractor of the Department shall
disclose such personal information only upon completion of each of the steps
listed in sections 004.03 and 004.04 of these rules and regulations.
004.01B In no event shall any authorized
agent or contractor of the Department disclose any personal information or
sensitive personal information contained in a motor vehicle record without
first having executed and filed with the Department a Memorandum of
Understanding.
004.01C Prior to the
disclosure of any personal information or sensitive personal information
contained in a motor vehicle record by any officer or employee of the
Department, that officer or employee must meet the requirements listed in
section 006.06 of these rules and regulations.
004.02
Compliance with
Federal Law or Regulation.
Personal information shall be disclosed by the Department or any
officer, employee, agent, or contractor of the Department to carry out the
purposes of Titles I and IV of the Anti-Car Theft Act of 1992, 15 U.S.C. 2021
et seq., the Automobile Information Disclosure Act,
15
U.S.C. 1231 et seq., the Clean Air Act,
42 U.S.C.
7401 et seq., and 49 U.S.C. chapters 301,
305, and 321 to 331, as amended, and all federal regulations enacted or adopted
to implement such federal laws.
004.03
Disclosure,
Procedure for Verifying Identity of Requestor.
Personal information contained in a motor vehicle record may only be
disclosed as follows:
004.03A No
personal information from any motor vehicle record identified under section 004
of these rules and regulations shall be disclosed without the consent of the
record holder unless the identity of the requestor is verified and the purpose
of the requestor is verified and is a purpose identified under section 004.04
of these rules and regulations.
004.03A1 The
request must be made on a form prepared by the Department under section 002 of
these rules and regulations and all of the required sections must be
completed.
004.03A2 The identity of
the requestor must be verified as follows:
004.03A2a The identity of a person who is
making a request in person shall be verified by examination of either a
driver's license with a photograph, a Nebraska state identification card with a
photograph, a United States passport, a certified United States birth
certificate, a professional license with photograph, or a Nebraska state
employee identification card with photograph.
004.03A2b The identity of a person who is
making a request by mail shall be verified by receipt of an Application for
Copy of Driving Record form, an Application for Copy of Vehicle Record form, an
Application for Multiple Driving Records form, or an Application for More Than
One Vehicle Record form, with a completed notarization section whereby a notary
public, by signature and seal, acknowledges that the request was acknowledged
by the requestor in their presence.
004.03A3 The purpose of the requestor shall
be verified by receipt of the signed statement of the requestor on the
Application for Copy of Driving Record form, an Application for Copy of Vehicle
Record form, an Application for Multiple Driving Records form, or an
Application for More Than One Vehicle Record form, used to make the
request.
004.04
Mandatory
Disclosure.
Upon the verification of the identity and purpose of a requestor
pursuant to sections
004.03A2 and
004.04A-P of these rules and regulations, the Department and any officer,
employee, agent, or contractor of the Department having custody of a motor
vehicle record, shall disclose and make available the requested motor vehicle
record, including the personal information contained in the record, for the
following purposes:
004.04A For use by
any federal, state, or local governmental agency, including any court or law
enforcement agency, in carrying out the agency's functions or by a private
person or entity acting on behalf of a governmental agency in carrying out the
agency's functions;
004.04B For use
in connection with matters of motor vehicle or driver safety and theft; motor
vehicle emissions; motor vehicle product alterations, recalls, or advisories;
performance monitoring of motor vehicles, motor vehicle parts, and dealers;
motor vehicle market research activities, including survey research; and
removal of non-owner records from the original owner records of motor vehicle
manufacturers;
004.04C For use in
the normal course of business by a legitimate business or its agents,
employees, or contractors but only:
004.04C1
To verify the accuracy of personal information submitted by the individual to
the business or its agents, employees, or contractors; and
004.04C2 If such information as so submitted
is not correct or is no longer correct, to obtain the correct information, but
only for the purposes of preventing fraud, by pursuing legal remedies against,
or recovering on a debt or security interest against, the individual.
004.04D For use in connection with
any civil, criminal, administrative or arbitral proceeding in any federal,
state, or local court or governmental agency or before any self-regulatory
body, including service of process, investigation in anticipation of
litigation, and execution or enforcement of judgments and orders, or pursuant
to an order of a federal, state, or local court, an administrative agency, or a
self-regulatory body;
004.04E For
use in research activities, and for use in producing statistical reports, so
long as the personal information is not published, redisclosed, or used to
contact individuals;
004.04F For
use by any insurer or insurance support organization, or by a self-insured
entity, or its agents, employees, or contractors, in connection with claims
investigation activities, anti-fraud activities, rating, or
underwriting;
004.04G For use in
providing notice to the owners of abandoned, towed, or impounded
vehicles;
004.04H For use only for
a purpose permitted under this section either by a private detective, plain
clothes investigator, or private investigative agency licensed under
Neb. Rev. Stat.
§§ 71-3201 through
71-3213;
004.04I For use by an
employer or the employer's agent or insurer to obtain or verify information
relating to a holder of a commercial driver's license that is required under
the Commercial Motor Vehicle Safety Act of 1986,
49
U.S.C. 31301 et seq., or pursuant to
Neb. Rev. Stat.
§§
60-4,132 and
60-4,141;
004.04J For use in connection with the
operation of private toll transportation facilities;
004.04K For bulk distribution for surveys of,
marketing to, or solicitations of persons who have expressly consented to such
disclosure if the requestor has obtained the notarized written consent of the
individual who is the subject of the personal information being requested and
has provided proof of receipt of such written consent to the Department or an
officer, employee, agent, or contractor of the Department on a form prescribed
by the Department;
004.04L For any
use if the requestor has obtained the notarized written consent of the
individual who is the subject of the personal information being requested and
has provided proof of receipt of such written consent to the Department or an
officer, employee, agent, or contractor of the Department;
004.04M For use, including redisclosure
through news publication, of a member of a medium of communication as defined
in
Neb. Rev. Stat.
§
20-145
who requests such information in connection with preparing, researching,
gathering, or confirming news information involving motor vehicle or driver
safety or motor vehicle theft;
004.04M1
Example. A local nonprofit organization
publishes a listing of all license plate numbers and their owners in their
county as a fund raising activity. This publication does not qualify as a media
exemption because it does not involve motor vehicle or driver safety or motor
vehicle theft.
004.04M2
Example. A credit bureau makes available
a listing of new title holders for consumer credit purposes. This activity does
not qualify as a media exemption because it does not involve motor vehicle or
driver safety or motor vehicle theft.
004.04N For use by the federally designated
organ procurement organization in Nebraska to establish and maintain the Donor
Registry of Nebraska as provided in Neb. Rev. Stat.
§
71-4822;
004.04O For any other use specifically
authorized by law that is related to the operation of a motor vehicle or public
safety;
004.04P For any use if the
request for the record is made by the record holder.
004.06
Request
Maintained.
The Department and any officer, employee, authorized agent, or
contractor of the Department that receives a request under section
004.03A2 of these
rules and regulations shall keep the original of that request or a copy thereof
for a period of not less than five years.
004.07
Denial of Request,
Procedure.
If any request submitted under section
004.03A2 of these
rules and regulations is not met, in whole or in part, the requestor shall
receive notice by letter from the Department or authorized agent of the
Department acting on that request.
004.07A Said notice shall include:
004.07A1 A description of the contents of the
motor vehicle record(s) withheld and a statement of the specific reasons for
the denial, correlating specific portions of the records to specific reasons
for the denial, including citations to the particular statute and subsection
thereof;
004.07A2 The name of the
officer, employee or authorized agent of the Department responsible for the
decision to deny the request.
004.07B The Department, if the notice is
issued by an officer or employee thereof, or other public body, if notice is
issued by an authorized agent, shall maintain a file of all letters of denial
of requests for motor vehicle records. This file shall be made available to any
person on request.
004.08
Redisclosure of
Personal Information Contained in Motor Vehicle Records.
Any person receiving personal information contained in a motor vehicle
record or records pursuant to section 004.02 or 004.04 of these rules and
regulations may redisclose or resell that information only to the extent
allowed in this section.
004.08A An
authorized recipient of personal information disclosed under section 004.02 or
004.04 of these rules and regulations, except a recipient under section
004.04K of these
rules and regulations, may resell or redisclose the information only for the
uses permitted under section
004.04 of these rules and
regulations, but not including the use for bulk distribution for surveys,
marketing, or solicitations as set forth in section
004.04K of these
rules and regulations.
004.08B An
authorized recipient of personal information for bulk distribution for surveys,
marketing, or solicitations under section
004.04K of these
rules and regulations may resell or redisclose personal information only in
accordance with the terms of such section concerning the right of individuals
who have so consented to such disclosure.
004.08C An authorized recipient who resells
or rediscloses personal information shall:
004.08C1 Make and keep for a period of not
less than five years records identifying each person who received personal
information from the authorized recipient and the permitted purpose for which
it was obtained; and
004.08C2 Make
such records available for inspection and copying by a representative of the
Department upon request.
004.08C3
Have a written contract with every customer to which it transfers personal
information. Such contract shall require that the customer limit disclosure as
required by Neb. Rev. Stat.
§
60-2910.
The customer shall maintain a record of all disclosures of personal information
and reasons for disclosure for not less than five years. The authorized
recipient shall provide a list of all customers and copies of signed contracts
to the Department upon request.
004.08C4 Strictly limit Internet distribution
of personal information by an authorized recipient to end users through secure
private channels, for properly identified customers of the authorized
recipient.
004.08C5 Shall agree to
a biennial independent cyber security audit at the recipient's cost. The audit
shall investigate the security of the authorized recipient's information
storage and distribution systems and records of disclosure of personal
information as required by the Uniform Motor Records Disclosure Act,
Neb. Rev. Stat.
§
60-2910.
A cyber security audit shall be conducted within four months of the approval of
the application for information unless the recipient provided the Department
with information showing that the recipient has a current detailed information
security plan and is currently certified by an independent cyber security
analyst. The recipient shall provide the Department with its biennial
certification by an independent cyber security analyst or a copy of the cyber
security audit report.
004.08D Any personal information contained in
a motor vehicle record that is made part of a court file or otherwise becomes
part of a judicial record of a court shall be considered a public record and
re-disclosure shall be at the discretion of the court.
004.08E An authorized recipient of personal
information is required to overlay and update all previously acquired personal
information when it receives updated transmissions from the Department. Upon
completion of such overlay, the data having been overlaid shall not be
redisclosed for any purpose except as follows:
004.08E1 Any audits to be
performed.
004.08E2 For use in
connection with a civil, criminal, administrative or arbitral proceeding in any
federal, state or local court.
004.08E3 As specifically required by federal
or state law, including manufacturer recalls.
004.08E4 Records of any disclosure of
overlaid data under subsections
004.08E1, 2 and 3
above shall be kept for five years pursuant to section
004.08C1.
004.08F Failure of the requestor
to comply with the requirements of these sections shall be grounds for
termination of any contract.