302.170.  Federal REAL ID Act, compliance with — definitions — retention of documents — inapplicability, when — issuance of compliant licenses and ID cards, procedure — biometric data restrictions — privacy — violations, civil damages and criminal penalties — data retention. — 1.  As used in this section, the following terms shall mean:

  (1)  "Biometric data" shall include, but not be limited to, the following:

  (a)  Voice data used for comparing live speech with a previously created speech model of a person's voice;

  (b)  Iris recognition data containing color or texture patterns or codes;

  (c)  Retinal scans, reading through the pupil to measure blood vessels lining the retina;

  (d)  Fingerprint, palm prints, hand geometry, measure of any and all characteristics of biometric information, including shape and length of fingertips, or recording ridge pattern or fingertip characteristics;

  (e)  Characteristic gait or walk;

  (f)  DNA;

  (g)  Keystroke dynamic, measuring pressure applied to key pads or other digital receiving devices;

  (2)  "Commercial purposes" shall not include data used or compiled solely to be used for, or obtained or compiled solely for purposes expressly allowed under Missouri law or the federal Drivers Privacy Protection Act;

  (3)  "Source documents", original or certified copies, where applicable, of documents presented by an applicant as required under 6 CFR Part 37 to the department of revenue to apply for a driver's license or nondriver's license.  Source documents shall also include any documents required for the issuance of driver's licenses or nondriver's licenses by the department of revenue under the provisions of this chapter or accompanying regulations.

  2.  Except as provided in subsection 3 of this section and as required to carry out the provisions of subsection 4 of this section, the department of revenue shall not retain copies, in any format, of source documents presented by individuals applying for or holding driver's licenses or nondriver's licenses or use technology to capture digital images of source documents so that the images are capable of being retained in electronic storage in a transferable format.

  3.  The provisions of this section shall not apply to:

  (1)  Original application forms, which may be retained but not scanned except as provided in this section;

  (2)  Test score documents issued by state highway patrol driver examiners and Missouri commercial third-party tester examiners;

  (3)  Documents demonstrating lawful presence of any applicant who is not a citizen of the United States, including documents demonstrating duration of the person's lawful presence in the United States;

  (4)  Any document required to be retained under federal motor carrier regulations in Title 49, Code of Federal Regulations, including but not limited to documents required by federal law for the issuance of a commercial driver's license and a commercial driver instruction permit;

  (5)  Documents submitted by a commercial driver's license or commercial driver's instruction permit applicant who is a Missouri resident and is a qualified current or former military service member which allow for waiver of the commercial driver's license knowledge test, skills test, or both; and

  (6)  Any other document at the request of and for the convenience of the applicant.

  4.  (1)  To the extent not prohibited under subsection 13 of this section, the department of revenue shall amend procedures for applying for a driver's license or identification card in order to comply with the goals or standards of the federal REAL ID Act of 2005, any rules or regulations promulgated under the authority granted in such Act, or any requirements adopted by the American Association of Motor Vehicle Administrators for furtherance of the Act, unless such action conflicts with Missouri law.

  (2)  The department of revenue shall issue driver's licenses or identification cards that are compliant with the federal REAL ID Act of 2005, as amended, to all applicants for driver's licenses or identification cards unless an applicant requests a driver's license or identification card that is not REAL ID compliant.  Except as provided in subsection 3 of this section and as required to carry out the provisions of this subsection, the department of revenue shall not retain the source documents of individuals applying for driver's licenses or identification cards not compliant with REAL ID.  Upon initial application for a driver's license or identification card, the department shall inform applicants of the option of being issued a REAL ID compliant driver's license or identification card or a driver's license or identification card that is not compliant with REAL ID.  The department shall inform all applicants:

  (a)  With regard to the REAL ID compliant driver's license or identification card:

  a.  Such card is valid for official state purposes and for official federal purposes as outlined in the federal REAL ID Act of 2005, as amended, such as domestic air travel and seeking access to military bases and most federal facilities;

  b.  Electronic copies of source documents will be retained by the department and destroyed after the minimum time required for digital retention by the federal REAL ID Act of 2005, as amended;

  c.  The facial image capture will only be retained by the department if the application is finished and submitted to the department; and

  d.  Any other information the department deems necessary to inform the applicant about the REAL ID compliant driver's license or identification card under the federal REAL ID Act;

  (b)  With regard to a driver's license or identification card that is not compliant with the federal REAL ID Act:

  a.  Such card is valid for official state purposes, but it is not valid for official federal purposes as outlined in the federal REAL ID Act of 2005, as amended, such as domestic air travel and seeking access to military bases and most federal facilities;

  b.  Source documents will be verified but no copies of such documents will be retained by the department unless permitted under subsection 3 of this section, except as necessary to process a request by a license or card holder or applicant;

  c.  Any other information the department deems necessary to inform the applicant about the driver's license or identification card.

  5.  The department of revenue shall not use, collect, obtain, share, or retain biometric data nor shall the department use biometric technology to produce a driver's license or nondriver's license or to uniquely identify licensees or license applicants.  This subsection shall not apply to digital images nor licensee signatures required for the issuance of driver's licenses and nondriver's licenses or for the use of software for purposes of combating fraud, or to biometric data collected from employees of the department of revenue, employees of the office of administration who provide information technology support to the department of revenue, contracted license offices, and contracted manufacturers engaged in the production, processing, or manufacture of driver's licenses or identification cards in positions which require a background check in order to be compliant with the federal REAL ID Act or any rules or regulations promulgated under the authority of such Act.  Except as otherwise provided by law, applicants' source documents and Social Security numbers shall not be stored in any database accessible by any other state or the federal government.  Such database shall contain only the data fields included on driver's licenses and nondriver identification cards compliant with the federal REAL ID Act, and the driving records of the individuals holding such driver's licenses and nondriver identification cards.

  6.  Notwithstanding any provision of this chapter that requires an applicant to provide reasonable proof of lawful presence for issuance or renewal of a noncommercial driver's license, noncommercial instruction permit, or a nondriver's license, an applicant shall not have his or her privacy rights violated in order to obtain or renew a Missouri noncommercial driver's license, noncommercial instruction permit, or a nondriver's license.

  7.  No citizen of this state shall have his or her privacy compromised by the state or agents of the state.  The state shall within reason protect the sovereignty of the citizens the state is entrusted to protect.  Any data derived from a person's application shall not be sold for commercial purposes to any other organization or any other state without the express permission of the applicant without a court order; except such information may be shared with a law enforcement agency, judge, prosecuting attorney, or officer of the court, or with another state for the limited purposes set out in section 302.600, or for the purposes set forth in section 32.091, or for conducting driver history checks in compliance with the Motor Carrier Safety Improvement Act, 49 U.S.C. Section 31309.  The state of Missouri shall protect the privacy of its citizens when handling any written, digital, or electronic data, and shall not participate in any standardized identification system using driver's and nondriver's license records except as provided in this section.

  8.  Other than to process a request by a license or card holder or applicant, no person shall knowingly access, distribute, or allow access to or distribution of any written, digital, or electronic data collected or retained under this section without the express permission of the applicant or a court order, except that such information may be shared with a law enforcement agency, judge, prosecuting attorney, or officer of the court, or with another state for the limited purposes set out in section 302.600 or for conducting driver history checks in compliance with the Motor Carrier Safety Improvement Act, 49 U.S.C. Section 31309.  A first violation of this subsection shall be a class A misdemeanor.  A second violation of this subsection shall be a class E felony.  A third or subsequent violation of this subsection shall be a class D felony.

  9.  Any person harmed or damaged by any violation of this section may bring a civil action for damages, including noneconomic and punitive damages, as well as injunctive relief, in the circuit court where that person resided at the time of the violation or in the circuit court of Cole County to recover such damages from the department of revenue and any persons participating in such violation.  Sovereign immunity shall not be available as a defense for the department of revenue in such an action.  In the event the plaintiff prevails on any count of his or her claim, the plaintiff shall be entitled to recover reasonable attorney fees from the defendants.

  10.  The department of revenue may promulgate rules necessary to implement the provisions of this section.  Any rule or portion of a rule, as that term is defined in section 536.010, that is created under the authority delegated in this section shall become effective only if it complies with and is subject to all of the provisions of chapter 536 and, if applicable, section 536.028.  This section and chapter 536 are nonseverable and if any of the powers vested with the general assembly pursuant to chapter 536 to review, to delay the effective date, or to disapprove and annul a rule are subsequently held unconstitutional, then the grant of rulemaking authority and any rule proposed or adopted after August 28, 2017, shall be invalid and void.

  11.  Biometric data, digital images, source documents, and licensee signatures, or any copies of the same, required to be collected or retained to comply with the requirements of the federal REAL ID Act of 2005 shall be digitally retained for no longer than the minimum duration required to maintain compliance, and immediately thereafter shall be securely destroyed so as to make them irretrievable.

  12.  No agency, department, or official of this state or of any political subdivision thereof shall use, collect, obtain, share, or retain radio frequency identification data from a REAL ID compliant driver's license or identification card issued by a state, nor use the same to uniquely identify any individual.

  13.  Notwithstanding any provision of law to the contrary, the department of revenue shall not amend procedures for applying for a driver's license or identification card, nor promulgate any rule or regulation, for purposes of complying with modifications made to the federal REAL ID Act of 2005 after August 28, 2017, imposing additional requirements on applications, document retention, or issuance of compliant licenses or cards, including any rules or regulations promulgated under the authority granted under the federal REAL ID Act of 2005, as amended, or any requirements adopted by the American Association of Motor Vehicle Administrators for furtherance thereof.

  14.  If the federal REAL ID Act of 2005 is modified or repealed such that driver's licenses and identification cards issued by this state that are not compliant with the federal REAL ID Act of 2005 are once again sufficient for federal identification purposes, the department shall not issue a driver's license or identification card that complies with the federal REAL ID Act of 2005 and shall securely destroy, within thirty days, any source documents retained by the department for the purpose of compliance with such Act.