DMV defends Real‑ID state‑to‑state upload and DXP modernization amid sharp privacy concerns

DMV officials told the Senate Budget Subcommittee No. 5 that California must implement the state‑to‑state (S2S) verification system as part of REAL‑ID compliance and that the DMV is working to complete live testing and a go‑live timetable that aligns with agreed federal and AMBA timelines.

Lee Scott, DMV chief budget officer, and Director Steve Gordon said S2S is a federal compliance requirement tied to the REAL‑ID Act of 2005 and that California has signed agreements to participate; they described plans for live testing, data deduplication efforts and onboarding to avoid backlogs. Scott said the vehicle registration phase of DXP is on track for completion by year end and that both S2S and DXP are intended to improve service delivery and preserve Californians’ access to air travel and federal facilities.

Committee members pressed DMV on who governs AMBA (the American Association of Motor Vehicle Administrators’ S2S operator), whether federal agencies will have access to S2S data, why the system architecture uses the last five digits of Social Security numbers and how AB‑60 (federally non‑compliant) cards will be treated. DMV said AMBA is member‑driven, not a governing authority over states, that S2S is intended for state‑to‑state pointer/deduplication functions and that contractual and audit rights with AMBA exist; DMV said data are encrypted in transit and at rest and that states can trigger alerts for atypical request patterns.

Members and public commenters — including the Electronic Frontier Foundation, the Identity Project and civil‑rights and immigrant‑rights groups — urged the committee not to move forward without clearer public notice and stronger guardrails. Public commenters highlighted risks that Social Security digits and driver history data could be exposed to federal agencies or to states with different privacy protections, and asked whether the attorney general and other state privacy and enforcement authorities had been fully briefed.

DMV testified the decision to include last‑five digits followed member‑driven architecture to reduce duplicates and manual deduplication costs, and that California has urged AMBA to reduce reliance on Social Security numbers where feasible. DMV said it expects a substantial deduplication effort as California enters the S2S system — other states saw roughly a 10% manual failure rate — and that the department anticipates adding dedicated staff in the hundreds over the first one to two years to manage the process.

On DXP modernization, LAO said the project did not present immediate programmatic concerns and is essential to replace 60‑year‑old legacy systems, but urged continued legislative oversight because the project has experienced large cost growth and delays; DMV attributed cost growth to market inflation, pandemic effects and the high risk premium vendors attach to long‑unknown legacy systems and said the agency is moving to smaller modular procurements to reduce risk.

Ending: The committee asked DMV to follow up with more detailed answers, engage the Attorney General’s office on privacy safeguards, and provide continued progress updates while balancing the compliance deadline and public privacy concerns.