1 Colo. Code Regs. § 204-30-14

Current through Register Vol. 47, No. 11, June 10, 2024

Rule 1 CCR 204-30-14 - VENDOR CONTRACTS FOR THE BULK ELECTRONIC TRANSFER OF DEPARTMENT RECORDS

Authority

This rule is promulgated in accordance with the State Administrative Procedures Act, section 24-4-101 et seq., C.R.S. and adopted pursuant to the authority in sections 24-72-204, 24-72-102, 24-74-103, 24-74-105, 24-74-106, 42-1-204, and 42-1-206 (3.7) C.R.S.

Scope and Purpose

A. This rule governs annual contracts between the department and vendors and the department and primary users for the purpose of establishing, regulating, and maintaining the bulk electronic transfer of Records and Information.

B. This rule does not apply to any federal, state, or local governmental agency that receives Records and/or Information directly from the department.

1.0Definitions

"Colorado Drives ("DRIVES")" means the information technology system defined in section 42-1-102 (16.5), C.R.S.

"Personal Identifying Information" ("PII") is defined in section 24-74-102(1), C.R.S.

"Primary User" means a person or entity having access to DRIVES through the Third-Party Access Portal.

"Records and/or Information" means all files, updated files, or portions thereof, including PII, that the department is permitted by law to release through a bulk electronic transfer to the approved Vendor.

"State Agency" is a state agency as defined in section 24-74-102(3), C.R.S.

"Sub-Vendor" means any person or entity who enters into an agreement with the approved DMV Vendor to receive Records and/or Information through a sub-contract.

"Third Party" is defined in section 24-74-102(5), C.R.S.

"Vendor" is defined in section 42-1-102 (112.5), C.R.S.

2.0Contract Requirements

A. The department will not transfer Information to a vendor or primary user unless the Vendor or Primary User has executed a contract with the department in accordance with section 42-1-206 (3.7), C.R.S. and signed a Third-Party Entity/Organization Certification for Access PII through a database or automated network form.

B. A contract between the department and a Vendor shall provide that the Vendor agrees not to transfer Records or Information to a Sub-Vendor unless the Sub-Vendor has completed and the Vendor has approved a Requestor Release and Affidavit of Intended Use (DR 2489) and a Bulk Records and/or Crash Data Search/Transfer Application (DR 2523), in which the Sub-Vendor has agreed that it will not use PII in a manner prohibited by law.

C. The department may grant a Primary User access to Records or Information only if the Primary User has signed a Third Party Individual Certification For Access To PII through a database or automated network form within the last calendar year, certifying that it will not use PII for the purpose of investigating for, participating in, cooperating with, or assisting Federal Immigration Enforcement, and that it will not disclose personal identifying information obtained from the department to individuals or entities engaged in investigating for, participating in, cooperating with, or assisting in Federal immigration in a manner prohibited by law.

REQUIRED: Per § 24-74-105 C.R.S., I agree that the third party will not USE or DISCLOSE personal identifying information obtained from the database or automated network for the purpose of investigating for, participating in, cooperating with, or assisting in Federal Immigration Enforcement, including enforcement of civil immigration laws and 8 U.S.C SEC. 1325 or 1326, unless required by Federal or State Law or to comply with the attached court-issued subpoena, wan-ant, or order. [] Yes [] No

1 CCR 204-30-14

37 CR 20, October 25,2014, effective 11/14/2014

38 CR 11, June 10, 2015, effective 6/30/2015

38 CR 12, June 25, 2015, effective 7/15/2015

38 CR 17, September 10, 2015, effective 9/30/2015

39 CR 01, January 10, 2016, effective 1/30/2016

39 CR 14, July 25, 2016, effective 8/14/2016

39 CR 15, August 10, 2016, effective 8/30/2016

39 CR 16, August 25, 2016, effective 9/14/2016

39 CR 19, October 10, 2016, effective 10/30/2016

39 CR 24, December 25, 2016, effective 1/30/2017

40 CR 20, October 25, 2017, effective 11/14/2017

40 CR 24, December 25, 2017, effective 1/14/2018

41 CR 08, April 25, 2018, effective 5/15/2018

41 CR 11, June 10, 2018, effective 6/30/2018

41 CR 17, September 10, 2018, effective 9/30/2018

41 CR 23, December 10, 2018, effective 12/30/2018

42 CR 06, March 25, 2019, effective 4/14/2019

42 CR 24, December 25, 2019, effective 1/14/2020

43 CR 12, June 25, 2020, effective 5/22/2020

43 CR 12, June 25, 2020, effective 7/16/2020

43 CR 19, October 10, 2020, effective 9/17/2020

43 CR 18, September 25, 2020, effective 10/15/2020

43 CR 23, December 10, 2020, effective 11/4/2020

43 CR 20, October 25, 2020, effective 11/15/2020

43 CR 22, November 25, 2020, effective 12/16/2020

43 CR 23, December 10, 2020, effective 12/30/2020

44 CR 01, January 10, 2021, effective 1/30/2021

44 CR 03, February 10, 2021, effective 3/2/2021

44 CR 15, August 10, 2021, effective 8/31/2021

44 CR 22, November 25, 2021, effective 12/15/2021

45 CR 05, March 10, 2022, effective 3/30/2022

45 CR 24, December 25, 2022, effective 1/14/2023

46 CR 01, January 10, 2023, effective 1/30/2023

45 CR 22, November 25, 2022, effective 1/31/2023

46 CR 05, March 10, 2023, effective 4/3/2023