ID Scanning Laws Updates – Q4 2022

Summary of Q4 2022 Legislation Relating to ID Scanning or Identity Verification

The 2023 legislative sessions have begun in all but a handful of states. There has been far more activity this month than in the fourth quarter of last year on the regulation of scanning technology at the point of sale for tobacco alcohol products. Only one bill was signed into law this quarter, when the Governor of Pennsylvania signed the Breach of Personal Information Notification Act. 

Data Security

In Montana two proposed bills would require the seller of tobacco products to scan a person’s government or tribal-issued identification.

Two proposed Oklahoma bills would require delivery service licensees to possess identification scanning technology or an alternative at the point of delivery of alcoholic beverages to authenticate that the recipient is 21 years of age or older. Similarly in Pennsylvania several bills seek to require the utilization of a transaction scan device to verify the age of the individual purchasing spirits or wine. 

 On November 03, 2022, Governor Wolf signed the Breach of Personal Information Notification Act. The Act provides for the notification of residents whose personal information data was or may have been disclosed due to a security system breach. Additionally, the Act provides a new permissible method of providing notice of a breach if the affected personal information consists of a username or email address in combination with a password. The Act will take effect on May 2, 2023.

Catalog of Legislative Initiatives Relating to ID Scanning or Identity Verification By State

Overview of relevant bills and statutes proposed and/or passed between July 1, 2022 and September 31, 2022.

STATE	BILL NO.	SUMMARY	STATUS
Arizona	H 2223	Would revise statutes relating to the sale of liquor processes and procedures.	House Read Second Time, 01/23/2023
Hawaii	S 1085	Would establish standards for the collection, storage, retention, and destruction of biometric identifiers and biometric information by private entities.	Introduced, 01/20/2023
Mississippi	H 73	Would prohibit certain retailers and retail establishments from using embedded technology programs in self-checkout terminals or self-service checkouts to scan information on a customer’s driver’s license.	Referred to Judiciary, 01/04/2023
Montana	H 293	Would require a seller of tobacco products to scan a person’s government or tribal-issued identification.	Fiscal Note Signed, 01/25/2023
Montana	H 300	Would require a seller of tobacco products to scan a person’s government or tribal-issued identification.	House First Reading, 01/24/2023
Nevada	A 53	Would require that a person  utilize scanning technology or other  automated, software-based system to verify that the person is 21 years of age or older. A person found to be in violation of the requirements is liable for a civil penalty of $100 for each offense.	Referred to Committee on Revenue, 12/01/2023
New York	A02045	Would require New York City identity cards to be accepted as valid written evidence of age or identification.	Referred to Cities, 01/23/2023
New York	S 365	Would enact the New York Privacy Act to require companies to disclose their methods of de-identifying personal information, to place special safeguards around data sharing and to allow consumers to obtain the names of all entities with whom their information is shared.	Referred to Consumer Protection, 01/04/2023
New York	S 1362	Would enact the Biometric Privacy Act which would require private entities in possession of biometric identifiers or biometric information to develop a written policy establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied.	Referred to Consumer Affairs and Protection, 01/17/2023
New York	S 2277	Would enact the “Digital Fairness Act” and require any entity that conducts business in New York and maintains the personal information of five hundred or more individuals to provide meaningful notice about the use of personal information.	Referred to Internet and Technology, 01/19/2023
Oklahoma	H 1707	Would require delivery service licensees to possess identification scanning software technology or a state-of-the-art alternative at the point of delivery to authenticate that the recipient is at least 21 years of age and collect the recipient’s name and date of birth to deliver alcoholic beverages from a store.	House First Reading, 02/06/2023
Oklahoma	H 2090	Would require delivery service licensees to possess identification scanning software technology or a state-of-the-art alternative at the point of delivery to authenticate that the recipient is at least 21 years of age and collect the recipient’s name and date of birth to deliver alcoholic beverages from a store.	House First Reading, 02/06/2023
Pennsylvania	S 117	Would require utilization of a transaction scan device to verify the age of an individual who is under 35 years of age at the point of sale unless presented with a valid US armed forces identification card.	Referred to Law and Justice, 01/18/2023
Pennsylvania	S 129	Would require spirit expanded permit holders to utilize a transaction scan device to verify the age of an individual who appears to be under 35 years of age at the point of sale or the point of delivery of wine.	Referred to Law and Justice, 01/19/2023
Pennsylvania	S 131	Would require spirit expanded permit holders to utilize a transaction scan device to verify the age of an individual who appears to be under 35 years of age at the point of sale or the point of delivery of wine.	Referred to Law and Justice, 01/19/2023
Pennsylvania	S 696	Amends the Breach of Personal Information Notification Act. Expanding the definition of “personal information.” Additionally, provides a new permissible method of providing notice of a breach if the affected personal information consists of a username or email address in combination with a password. Amends the act of December 22, 2005.	Approved by Governor, 11/03/2022 Effective May 2, 2023
South Carolina	S 425	Would require a retail dealer or delivery service employee to  scan and retain, or manually record or document the recipient’s name, date of birth, type of identification presented and signature.	Referred to Committee on Judiciary, 01/19/2023
Tennessee	S 339	Would enact the “Consumer Biometric Data Protection Act.”	Passed on First Consideration, 01/24/2023
Washington	H 1616	Would create a charter of people’s personal data rights.	Referred  to Civil Rights & Judiciary, 01/26/2023