Section 1030.9 Mobile Driver's Licenses and Identification Cards

TITLE 92: TRANSPORTATION

CHAPTER II: SECRETARY OF STATE

PART 1030 ISSUANCE OF LICENSES

SECTION 1030.9 MOBILE DRIVER'S LICENSES AND IDENTIFICATION CARDS

Section 1030.9

Mobile Driver's

Licenses and Identification Cards

a)         A

person who holds a current, valid physical Illinois driver's license may apply

for a mobile driver's license.  A person who holds a current, valid physical

Illinois identification card, including an Illinois person with a disability

identification card, may apply for a mobile identification card.

b)         A

mobile credential may be added to a digital wallet of participating digital

wallet providers.

c)         Applicants

for a mobile credential must download or access the digital wallet software

application of the participating digital wallet provider compatible with the

applicant's mobile device.  Applicants will be guided through a series of steps

to complete their application which may include taking a selfie and taking a

photo of the front and back of the applicant's physical credential and which

shall include the minimum privacy and security requirements of the digital

wallet provider.  The photos shall be encrypted and electronically transmitted

to the Department by the digital wallet provider.

d)         Mobile

credentials shall comply with the device retrieval model outlined in ISO/IEC

standard 18013-5 as incorporated by reference in subsection (s).  Mobile

credentials shall be implemented by the Department and the digital wallet

provider with protections to maximize unlinkability of presentations of relying

parties, by minimizing the sharing of static or long-lived data, which is data

that remains constant and does not change frequently or is accessible for

extended periods of time.

e)         The

Department will compare the photos it receives from the applicant against the

data provided and photograph taken for the issuance of the physical

credential

e unlinkability of presentations of relying

parties, by minimizing the sharing of static or long-lived data, which is data

that remains constant and does not change frequently or is accessible for

extended periods of time.

e)         The

Department will compare the photos it receives from the applicant against the

data provided and photograph taken for the issuance of the physical

credential.  If validated, the application for a mobile credential is approved,

and the mobile credential is automatically added to the digital wallet.

f)         Denial

of a mobile credential.

1)         If

the selfie or photographs of the physical credential submitted cannot be

verified with the photograph taken and data provided when the physical

credential was issued, the application for a mobile credential will be denied.

Reasons that data or a photograph may not verify include, but are not limited

to, blurry photos, photos that do not include the entire front and back of the

physical credential, damage to the physical credential, and alteration of the

physical card after issuance including any data on the face of the card or in

the barcode.

2)         Upon

denial, the applicant may re-submit their data and photo.

g)         Upon

notification by the Department, the digital wallet will notify the applicant of

the Department's decision to approve or deny a mobile credential.

h)         After

approval, mobile credential data resides on the applicant's mobile device and

in the Department's driver's license and identification card database.  No

information regarding usage of a mobile credential, such as when or where it

was used, shall be shared with or stored by the Department, the digital wallet

provider, a relying party, or a mobile credential reader or verifier

application.  A transaction log of usage exists solely on the applicant's

mobile device and is not accessible by anyone other than the holder of the

mobile credential unless the holder shares the log

f a mobile credential, such as when or where it

was used, shall be shared with or stored by the Department, the digital wallet

provider, a relying party, or a mobile credential reader or verifier

application.  A transaction log of usage exists solely on the applicant's

mobile device and is not accessible by anyone other than the holder of the

mobile credential unless the holder shares the log.  The transaction log shall

contain the data requested and data transmitted, and as available, the relying

party, retention and purpose.  A holder of a mobile credential may clear their

transaction log at their discretion.

i)          Holders

of a mobile credential shall carry their physical credential so long as

required by law. (See 15 ILCS 335/4(i)(l); 15 ILCS 335/4(i)(3); and 15 ILCS

335/4(j))

j)          Use

of mobile credentials

1)         A

mobile credential may be used wherever it is accepted by a relying party.

2)         A

physical credential shall be accepted wherever a mobile credential is accepted.

k)         A

mobile credential may be accessed using biometrics such as fingerprint or face

identification, or by PIN, pattern or password, as allowed by the digital

wallet provider.  If biometrics are used to access a mobile credential, the

biometrics must be stored locally, on the mobile credential holder's mobile

device.

l)

A

relying party may request only the mobile credential data necessary to complete

the transaction for which data is being requested.

[15 ILCS 335/4(g)(3)]  Mobile

credential data shall only be transmitted to a relying party if the holder of

the credential data provides consent to release the credential to the relying

party.  Data shall be transmitted to the relying party electronically through a

reader or verifier application and shall not require the mobile credential

holder to physically surrender the mobile device

sted.

[15 ILCS 335/4(g)(3)]  Mobile

credential data shall only be transmitted to a relying party if the holder of

the credential data provides consent to release the credential to the relying

party.  Data shall be transmitted to the relying party electronically through a

reader or verifier application and shall not require the mobile credential

holder to physically surrender the mobile device.

m)        Upon

cancellation, suspension or revocation of a physical driver's license, mobile

driver's license, physical identification card, or mobile identification card

by the Department, the Department shall update the respective mobile credential.

A mobile credential will be unlinked from the physical credential if fraud

occurred when the mobile credential was provisioned.

n)         The

Department will push an update to the address on a mobile credential when the

holder of the mobile credential changes their address in-person at a Driver

Services facility or via the Secretary of State website.

o)         A

mobile credential, a mobile credential reader, a mobile credential verifier

application, the Department, and a relying party shall not access any other

data on the mobile credential holder's mobile device.

p)         A

mobile credential may be provisioned on a maximum of one phone and one smart

watch at any given time.

q)         A

mobile credential holder may delete the credential from their digital wallet at

any time without approval by the Department.  Deletion shall not affect the

validity of the physical credential

not access any other

data on the mobile credential holder's mobile device.

p)         A

mobile credential may be provisioned on a maximum of one phone and one smart

watch at any given time.

q)         A

mobile credential holder may delete the credential from their digital wallet at

any time without approval by the Department.  Deletion shall not affect the

validity of the physical credential.

r)

When

information is obtained from a driver's license or an identification card

including a mobile driver's license or mobile identification card,

to

identify or prove the age of the holder of the license or identification card,

or in the course of a commercial transaction, that information may be used only

for purposes of identification of the individual or for completing the

commercial transaction in which the information was obtained, including all

subsequent payment, processing, collection, and other related actions.

Information

obtained from a mobile credential shall only be retained by the relying party

for the time it takes to complete the transaction for which the information was

obtained or as otherwise required by law.

Information obtained from a

driver's license or identification card,

including a mobile driver's

license or mobile identification card,

may not be used for purposes

unrelated to the transaction in which it was obtained, including, but not

limited to, commercial solicitations.  Information obtained from a driver's

license or identification card,

including a mobile driver's license or

mobile identification card,

to identify the holder of the license, or in the

course of a commercial transaction, may not be sold, leased, or otherwise

provided to any third party.

[15 ILCS 335/14D(a) and 625 ILCS 5/6-117.1(a)]

d, including, but not

limited to, commercial solicitations.  Information obtained from a driver's

license or identification card,

including a mobile driver's license or

mobile identification card,

to identify the holder of the license, or in the

course of a commercial transaction, may not be sold, leased, or otherwise

provided to any third party.

[15 ILCS 335/14D(a) and 625 ILCS 5/6-117.1(a)].

An

individual whose driver's license or identification card information,

including

mobile driver's license or mobile identification card data,

has been used in

violation of

15 ILCS 335/14D(a) and 625 ILCS 5/6-117.1(a),

has a cause

of action against the person who violates

those statutes. [15 ILCS

335/14D(c) and 625 ILCS 5/6-117.1(b)]

s)         This

Section corporates and adopts by reference the "International Organization

for Standardization (ISO) and the International Electrotechnical Commission

(IEC) Standard 18013-5" (2021). Available from ISO Copyright Office, CP

401, Ch. De Blandonnet 8, Ch-1214 Vernier, Geneva, Switzerland. (No later

amendments or additions).