1 CCR 204-25
DEPARTMENT OF REVENUE Division of Motor Vehicles VENDOR CONTRACTS FOR THE BULK ELECTRONIC TRANSFER OF DEPARTMENT RECORDS 1 CCR 204-25 [Editor’s Notes follow the text of the rules at the end of this CCR Document.] _________________________________________________________________________ Section 1. Authority Section 2. Definitions Section 3. Certification of Vendor Section 4. Scope of Vendor Contract Section 5. Requestor Release and Affidavit of Intended Use Section 6. Quarterly Download of Department Records Section 1. Authority This rule is promulgated under the authority of § § 42-1-206(3.7)(b) and 42-1-206(f), C.R.S. Section 2. Definitions “Affidavit of Intended Use” : A document indicating the requestor’s intended use of Department records. An Affidavit of Intended Use states that the requestor shall not obtain, use, resell, or transfer the information for any purpose prohibited by law (per § § 24-72-204 and 42-1-206, C.R.S.). “Bulk Record System” : The Department’s process to allow bulk electronic transfer of records to vendors who are permitted to receive such information.
“Certification” : Prior to being allowed to serve as a Vendor pursuant to contract, the Vendor is required to have its internal processes and records systems certified by the Department. “Contract” : The written agreement to be entered into between certified Vendors and the Department. “Department” : The Colorado Department of Revenue, Motor Vehicle Business Group “Master File Baseline” : Complete transfer of all records maintained by the Department and transferable pursuant to law.
“Nightly Update” The process in which the Department provides additions, deletions, and other changes to records (Master File). Updates are provided each night after the Department’s close of business, excluding weekends and holidays.
“Primary User” Entity that uses Department records for its own purposes as permitted under § 24-72- 204(7), C.R.S.
Code of Colorado Regulations 1 “Records” : The driver history, motor vehicle records, or any portion of the history and records maintained by the Department as defined under § § 42-2-121 and 42-1-206(3.7)(a), (d), C.R.S. “Statement of Confidentiality” : Statement from employee, officer, staff member, temporary employee, or subcontractor of Vendor or Sub-vendor that the confidentiality of the information contained within Department records shall be maintained at all times and that records shall not be distributed, sold or shared with any third party or used in any way except as expressly authorized by law. “Subcontractor” : An entity that provides goods and/or services to the Vendor who may have direct or indirect contact with records while providing such goods and/or services. “Sub-vendor” : A business entity that obtains records from a Vendor for purposes of distributing the records to Primary Users.
“Vendor” : Certified entity selected that serves as the Department’s representative for the distribution of records to Sub-vendors and Primary Users.
Section 3. Certification of Vendor(s)
Prior to being allowed to manage and distribute Department records, the Vendor must successfully complete a certification process. The process for the Certification shall include the following:
1. Completed Affidavit(s) of Intended Use forms received from Vendor for each intended use.
2. Statement of Confidentiality forms received from all employees, officers, staff members, temporary employees or Sub-contractors of the Vendor that may have access to Department records.
3. Verification of minimum security measures – may include onsite inspection of equipment and procedures.
4. Master File Baseline to Vendor to be verified as to the count of records received and verify the detail of the first and last record.
5. Verification that Master File Baseline and Nightly Updates from the Department can be received, organized, updated nightly, and stored by Vendor with 100% accuracy.
6. Verification of documented record sales.
Section 4. Scope of Vendor Contract Minimum requirements for contract:
1. Provision for annual fee that encompasses all direct costs of the department related to the bulk electronic transfer of records to the Vendor. This fee is due upon execution of contract.
2. The Department retains exclusive ownership of all records provided to vendor.
3. Contract to include time allowed after contract execution for vendor to complete certification process.
4. Vendor must review each request for records and approve or deny in accordance with state and federal rules and statutes.
5. All forms used by the vendor in connection with the release of Department records shall be approved by the Department prior to their use.
Code of Colorado Regulations 2 6. Contracts between Vendor and Sub-vendor must be approved by the Department prior to the distribution of records to a Sub-vendor. Copy of fully executed contract between the Vendor and Sub-vendor shall be provided to the Department.
7. Provision for Vendor to maintain security over all records provided by the Department and no confidential information shall be distributed, sold to any third party, or used in any way except as authorized by law and/or contract.
8. The Vendor shall deny access to records to any Sub-vendor or Primary User who has not returned to the Vendor a completed Affidavit of Intended Use form.
9. Provision for Vendor to maintain all records for five years including tracking what record was obtained, by whom obtained, when obtained, and for what purpose. the information will be used.
10. Provision prohibiting the Vendor from providing the entire Department database to a Sub-vendor. Vendor may only supply records that are individually identified and requested by a Sub-vendor or Primary User.
11. Vendor shall be responsible for auditing costs.
12. Provision for termination of contract for the convenience of the Department.
13. Reporting requirements to the Department from the Vendor shall include but are not limited to the following:
14. Contract shall be a no cost contract. The Department shall have no liability for payment of any Vendor costs associated with this contract.
Section 5. Requestor Release and Affidavit of Intended Use Vendors may release records to Primary Users and Sub-vendors in accordance with § 24-72-204(7), C.R.S.
Code of Colorado Regulations 3 A “Requestor Release and Affidavit of Intended Use” form shall indicate the requestor’s intended use of records and contains an affidavit that the requestor shall not obtain, use, resell, or transfer the records or any part of them for any purpose prohibited by law or contract. Prior to release of records to Primary Users and Sub-vendors, an Affidavit of Intended Use must be obtained from the requestor.
Neither the Vendor, Sub-vendor, nor Primary User of records shall commingle in any database any of the Department’s records with any other information, data, or records. All employees, officers, staff members, temporary employees, or subcontractors of Vendor or Sub-vendor shall complete a Statement of Confidentiality stating that the confidentiality of the information within Department records shall be maintained at all times and that records shall not be distributed, sold, or shared with any third party or used in any way except as expressly authorized by the Department. Section 6. Quarterly Download of Department Records The Department shall, at a minimum, transfer a “Master File Baseline” to all vendors on a quarterly basis within a calendar year.
_________________________________________________________________________ Editor’s Notes History Code of Colorado Regulations 4