...

Hawaii ID Scanning Laws & Regulations

Hawaii sample ID

Can you scan IDs in Hawaii?

Hawaii has enacted a statute to regulate a business’s practice of scanning IDs as well as retaining and selling of information obtained through scanning IDs.

There are some instances in which merchants are required to record information related to identity, such as pawnbrokers and secondhand dealers. ID scanning can improve the ease and accuracy of record keeping in these scenarios.

Overview of Hawaii ID Scanning Laws

A business may scan a Hawaii identification card or driver’s license (collectively, “IDs”) only under one of the following circumstances: 

  1. Verifying authenticity of IDs or identity of the individual, if the individual (a) pays for goods or services with a method other than cash, (b) returns an item, or (c) requests a refund or an exchange;
  2. Verifying the individual’s age when providing age-restricted goods or services;
  3. Preventing fraud or other criminal activity, if the individual returns an item or requests a refund or an exchange and the business uses a fraud prevention service company or system*;
  4. Establishing or maintaining a contractual relationship*;
  5. As required by state or federal law;
  6. Transmitting information to a consume reporting agency, financial institution, or debt collector as permitted by the federal Fair Credit Reporting Act, Gramm-Leach-Bliley Act, or Fair Debt Collection Practices Act;
  7. Recording, retaining, or transmitting by a covered entity subject to the medical privacy and security rules under the Health Insurance Portability and Accountability Act of 1996 (a.k.a. “HIPAA”). 

 *Information collected must be limited to the (a) name, (b) address, (c) date of birth, and (d) driver’s license number or identification card number.

Retention of Data From An ID Scan in Hawaii

Information collected can be retained only as permitted in (3) through (7).

Sale of Data From An ID Scan in Hawaii

Information collected can be sold or disseminated only as permitted in (3) through (7). 

Waivers Of ID Scanning Provisions in Hawaii

A waiver of any of the provisions of this statute is specifically prohibited. 

Loyalty Enrollment Using ID Scanning in Hawaii

Under the statute, a business is likely allowed to scan the ID of a consumer enrolling in the business’s loyalty program under (4) as long as the information collected and retained is limited to the name, address, date of birth, and ID number. 

Credit Applications Using ID Scanning in Hawaii

Under the statute, a business is likely allowed to scan the ID of a consumer applying for a (private label) credit card under (4) and (6). 

A business is likely allowed to scan the ID of a consumer requesting a refund under (1).  Under (3), to the extent the business uses a fraud prevention service company or system, the business is likely allowed to retain personal information collected from the scanning for the purposes of preventing fraud or other criminal activity as long as such information is limited to the name, address, date of birth, and ID number.

ID Scanning for Customer Pickup in Hawaii

A business is not likely allowed to scan the ID of a consumer wishing to pick up purchased merchandise for the sole purpose of verifying the identity of the consumer.  As currently in effect, the statute allows a business to scan a consumer’s ID to verify the identity of the consumer if the consumer pays with a method other than cash, returns an item, or requests a refund or an exchange.  Moreover, the “fraud or other criminal activity” exception applies when the consumer is returning an item or requesting a refund or an exchange.  Under the current version of the statute, the business may have to limit its options to visually inspecting the ID without scanning it.    

ID Scanning For Access Control in Hawaii

As currently enacted, the statute does not appear to allow businesses to scan the ID of, for instance, a truck driver delivering goods to distribution centers.  One way to implement a scanning system at distribution centers while complying with the statute may be issuing and scanning the business’s own internal identification card that is not an official “Hawaii identification card or driver’s license.”

Does Hawaii offer affirmative defense for ID scanning?

There is no reference to affirmative defense for ID scanning in any Hawaii state laws.

Hawaii Statute [§487J-6] Unlawful use of Hawaii identification card or driver’s license. 

(a) No business may scan the machine-readable zone of an individual’s identification card or driver’s license, except for the following purposes:

(1) To verify authenticity of the identification card or driver’s license or to verify the identity of the individual if the individual pays for goods or services with a method other than cash, returns an item, or requests a refund or an exchange;

(2) To verify the individual’s age when providing age-restricted goods or services to the individual if there is a reasonable doubt of the individual having reached the minimum age required for purchasing the age-restricted goods or services;

(3) To prevent fraud or other criminal activity if the individual returns an item or requests a refund or an exchange and the business uses a fraud prevention service company or system. Information collected by scanning an individual’s identification card or driver’s license pursuant to this subsection shall be limited to the following information from the individual:

(A) Name;

(B) Address;

(C) Date of birth; and

(D) Driver’s license number or identification card number;

(4) To establish or maintain a contractual relationship. Information collected by scanning the individual’s identification card or driver’s license pursuant to this subsection shall be limited to the following information from the individual:

(A) Name;

(B) Address;

(C) Date of birth; and

(D) Driver’s license number or identification card number;

(5) To record, retain, or transmit information as required by state or federal law;

(6) To transmit information to a consumer reporting agency, financial institution, or debt collector to be used as permitted by the federal Fair Credit Reporting Act, Gramm-Leach-Bliley Act, or the Fair Debt Collection Practices Act; and

(7) To record, retain, or transmit information by a covered entity governed by the medical privacy and security rules issued by the federal Department of Health and Human Services, parts 160 and 164 of title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996.

(b) No business shall retain any information obtained pursuant to subsection (a), except as permitted in subsections (a)(3) through (7).

(c) No business shall sell or disseminate to a third party any information obtained under this section for any purpose, including marketing, advertising, or promotional activities, except as permitted in subsections (a)(3) through (7).

(d) A business covered under this section shall make reasonable efforts, through systems testing and other means, to ensure that the requirements of this chapter are met.

(e) Any waiver of a provision of this section is contrary to public policy and is void and unenforceable.

(f) For purposes of this section:

“Consumer reporting agency” shall have the same meaning as in the federal Fair Credit Reporting Act, title 15 United States Code section 1681a(f).

“Covered entity” shall have the same meaning as in the security rules issued by the federal Department of Health and Human Services, parts 160 and 164 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and [Accountability] Act of 1996.

“Debt collector” shall have the same meaning as in the federal Fair Debt Collection Practices Act, title 15 United States Code section 1692a.

Hawaii Senate Bill 669. Relating to Cannabis

Would decriminalize recreational cannabis. The Hawai’i Cannabis Regulatory Authority would not be allowed to require a consumer purchasing cannabis for personal use to provide a retail cannabis store or dual use cannabis dispensary with personal information other than government issued identification to determine the consumer’s age. A retail cannabis store or dual use cannabis dispensary would not be required to acquire and record personal information about consumers purchasing cannabis for personal use.

 Accordingly, the purpose of this Act is to:

     (1)  Establish regulations for the cultivation, manufacture, sale, and personal use of small amounts of cannabis;

     (2)  Decriminalize and regulate small amounts of cannabis for personal use;

     (3)  Establish taxes for cannabis sales; and

     (4)  Reduce unregulated and illicit sales of cannabis by unlicensed entities and establish penalties.

Hawaii Senate Bill 1085. Relating to Biometric Information Privacy

Carried over to 2024 Regular Session, 12/11/2023

Biometric data can be used to facilitate transactions and screenings where identity verification is important. However the legislature believes that it is in the interest of public safety to ensure that a person’s biometric identifiers are properly safeguarded. Each private entity in possession of a biometric identifier or biometric information shall store, transmit, and protect from disclosure all biometric identifiers and biometric information.

Hawaii Statute  §487N-2  Notice of security breach.

(a)  Any business that owns or licenses personal information of residents of Hawaii, any business that conducts business in Hawaii that owns or licenses personal information in any form (whether computerized, paper, or otherwise), or any government agency that collects personal information for specific government purposes shall provide notice to the affected person that there has been a security breach following discovery or notification of the breach.  The disclosure notification shall be made without unreasonable delay, consistent with the legitimate needs of law enforcement as provided in subsection (c) of this section, and consistent with any measures necessary to determine sufficient contact information, determine the scope of the breach, and restore the reasonable integrity, security, and confidentiality of the data system.

Hawaii Senate Bill 2607. Relating to Student Data Management

Governor signed on 05/02/2016. Effective upon approval.

“Covered information” means personally identifiable information or material, or information that is linked to personally identifiable information or material, in any media or format that is not publically available and is:

  1. Created by or provided to an operator by a student, or the student’s parent or legal guardian, in the course of the student’s, parent’s, or legal guardian’s use of the operator’s site, service, or application for K-12 school purposes;
  2. Created by or provided to an operator by an employee or agent of a K-12 school or complex for K-12 school purposes; or
  3. Gathered by an operator through the operation of its site, service, or application for K-12 school purposes and personally identifies a student, including information in the student’s educational record or electronic mail, first and last name, home address, telephone number, electronic mail address, or other information that allows physical or online contact, discipline records, test results, special education data, juvenile dependency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, student identifiers, search activity, photos, voice recordings, or geolocation information.

§302A – Prohibited activity; permitted disclosures and uses; limitations.  (a)  An operator shall not knowingly do any of the following:

     (1)  Engage in targeted advertising on the operator’s site, service, or application; or target advertising on any other site, service, or application, if the targeting of the advertising is based on any information, including covered information and persistent unique identifiers that the operator has acquired because of the use of that operator’s site, service, or application for K-12 school purposes;

     (2)  Use information, including persistent unique identifiers, created or gathered by the operator’s site, service, or application, to amass a profile about a student except in furtherance of K-12 school purposes.  As used in this section, “amass a profile” does not include the collection and retention of account information that remains under the control of the student, the student’s parent or guardian, or a K‑12 school;

     (3)  Sell or rent a student’s information, including covered information.  This paragraph does not apply to the purchase, merger, or other type of acquisition of an operator by another entity if the operator or successor entity complies with this section regarding previously acquired student information; or

     (4)  Except as otherwise provided in subsection (c), disclose covered information unless the disclosure is made for the following purposes:

  • In furtherance of the K-12 school purpose of the site, service, or application, if the recipient of the covered information disclosed under this subsection does not further disclose the information unless done to allow or improve operability and functionality of the operator’s site, service, or application;
  • To ensure legal and regulatory compliance or protect against liability;
  • To respond to or participate in the judicial process;
  • To protect the safety or integrity of users of the site or others or the security of the site, service, or application;
  • For a school, educational, or employment purpose requested by the student or the student’s parent or guardian; provided that the information is not used or further disclosed for any other purpose; or
  • To provide to a third party, if the operator contractually prohibits the third party from using any covered information for any purpose other than providing the contracted service to or on behalf of the operator, prohibits the third party from disclosing any covered information provided by the operator with subsequent third parties, and requires the third party to implement and maintain reasonable security procedures and practices.

Nothing in this section shall prohibit the operator’s use of information for the purposes of maintaining, developing, supporting, improving, or diagnosing the operator’s site, service, or application.

Hawaii Law Chapter 486M: Pawnbrokers & Secondhand Dealers

Record of transactions.  Every dealer, or the agent, employee, or representative of the dealer shall, immediately upon receipt of any article, record the following information, on a form authorized by the chief of police in each county:

  1.   The name and address of the dealer;
  2. The name, residence address, date of birth, and the age of the person from whom the article was received;
  3. The date and time the article was received by the dealer;
  4. The signature of the person from whom the article was received;
  5. The Hawaii [driver’s] license number, or if the person does not possess a Hawaii [driver’s] license, the number of and description of any government issued identification which bears a photograph of the person from whom the article was received;
  6. A complete and accurate description of the article received, including all markings, names, initials, and inscriptions;
  7. A reasonable estimate of the fineness and weights of the precious and semiprecious metals and precious and semiprecious gems received; and
  8. The price paid by the dealer for each article.

Upon request and at the discretion of the chief of police of each county, copies of all completed forms required by this section shall be surrendered, mailed, or electronically inputted and transmitted via modem or by facsimile transmittal to the chief of police or to the chief of police’s authorized representative.  The method of submittal to the chief of police shall be at the option of being a dealer.