CSO — REAL ID may be more than just a real pain: It may have serious privacy implications as well.

The 2005 act was passed in response to the 9/11 Commission's recommendation that the government better ensure the validity of U.S. IDs. Real ID would require states to save digital copies of source documents such as birth certificates for driver's licenses and require states to share information in their driver’s license databases.

In theory, the new ID cards, which would include digital photographs and personal information in a machine-readable chip, would better verify the identity of people carrying the cards. But the legislation has raised the eyebrows of privacy advocates. In addition to the prohibitively expensive cost of implementation (estimates range between $11 billion and $23 billion) and the lack of compliance guidelines from the Department of Homeland Security, detractors argue that the creation of a national database poses inherent security risks, such as identity theft and counterfeiting. In May, 43 privacy, civil rights and consumer organizations launched a campaign to raise awareness and stop Real ID.

"There are 245 million identification cardholders nationwide. If you're linking 50 states together and providing multiple access points to multiple DMVs, that's a huge security risk," says Melissa Ngo, director of the Identification and Surveillance Project at the Electronic Privacy Information Center (EPIC). Furthermore, the current guidelines do not establish how the data would be secured. "There are background check requirements for the DMV workers who will be accessing the data, but the information itself is unprotected," says Ngo. "It's fundamentally flawed."

After the December 2009 compliance deadline, federal agencies will not accept licenses or ID cards from people unless the issuing state is meeting Real ID requirements. Noncomplying ID will not be valid for residents who want to fly on a plane or open a bank account. "It's not really voluntary because there are immediate punishments for not complying," says Ngo.

DHS pushed back the original implementation deadline by two years in response to criticism about the cost and lack of guidance from the federal government. In the meantime, states have to prove their intent to comply with the act. Maine, Idaho, Arkansas, Washington state and Montana have already rejected participation. Other states, including California, are planning and preparing.

Bernard Soriano, CIO at the California Department of Motor Vehicles, says his team has already started working on integrating verification systems (such as Systematic Alien Verification for Entitlements and Social Security Online Verification), upgrading equipment and adding storage capacity to computer systems in order to retain documents related to Real ID. Although the requirement doesn't come as a surprise to Soriano, he says that doesn't mean compliance isn't a daunting task. However, states don't have to feel completely helpless.

A Gartner report released in March outlines recommendations for states to prepare for Real ID: implement integrated document scanning, authentication and storage systems; develop privacy protections to prevent personally identifiable information from being exchanged between jurisdictions; and collaborate with other states to develop "pointer-type" systems to determine whether an individual already possesses an ID from another jurisdiction.

Additional reporting by Grant Gross of IDG News Service.