Can you scan an ID in Oregon?

Oregon law governs a business’s ability to scan IDs and to retain information obtained from a scan. 

There are some instances in which merchants are required to record information related to identity, such as sale of controlled substances and scrap metal recycling. ID scanning can improve the ease and accuracy of record keeping in these scenarios.

Overview of Oregon ID Laws

An Oregon statute prohibits a business from scanning IDs except under one of the following circumstances:

1. To verify the authenticity of an ID or to verify the identity of an individual if the individual (a) pays for a good or service with a method other than cash, (b) returns an item, or (c) requests a refund.
2. To verify the individual’s age in providing age-restricted goods or services.
3. To prevent fraud or other criminal activity if an individual returns an item or requests a refund and the business uses a fraud prevention service company or system. 
4. To transmit information to a check services company for the purpose of approving checks, electronic funds transfers, or similar methods of payment. 

A business scanning under (1) and (2) above may not store, sell, or share personal information collected from the scan.  A business scanning under (3) and (4) above may store or share the following information for the purpose of preventing fraud or other criminal activity:  (i) name, (ii) address, (iii) date of birth, and (iv) ID number. 

Exceptions

A national commercial radio service provider subject to the Telephone Records and Privacy Protection Act of 2006 may scan IDs after obtaining permission from the individual.  Whether information so collected may be retained is unclear. 

A business may scan IDs for the purpose of “establishing or maintaining a contract” between the business and the individual, as long as information obtained is limited to the following:  (i) name, (ii) address, (iii) date of birth, and (iv) ID number.  Whether information so collected may be retained is unclear. 

If the individual does not want the business to scan the individual’s ID, the business may manually collect the following information:  (i) name, (ii) address, (iii) date of birth, and (iv) ID number.  Again, whether information so collected may be retained is unclear.  A business may not withhold the provision of goods or services solely because the individual requests the collection of information through manual means. 

An individual may bring action to recover actual damages or $1,000, whichever is greater, and to obtain equitable relief, as well as reasonable attorney’s fees and costs, against a business in violation of the law.  Upon finding of a willful or knowing violation, a court may increase the damages by no more than three times. 

Waiver:  A waiver is deemed contrary to public policy and is void and unenforceable. 

ID scanning for loyalty enrollment in Oregon

A business is likely allowed to scan IDs for enrolling customers in its loyalty program as it would be for “establishing or maintaining a contract,” as long as information collected is limited as set forth above.  While the statute is not entirely clear on whether the business may retain any information so collected, the business is likely allowed to retain such information as “maintaining” a contract is unlikely feasible without retaining the information. 

ID scanning for credit applications in Oregon

 Likely same analysis as above (i.e., contract exception). 

ID scanning for check acceptance in Oregon

A business is likely allowed to scan IDs for accepting checks and to retain limited information obtained from the scan for the purposes of transmitting the same to a check services company and preventing fraud or other criminal activity. 

ID scanning for refunds in Oregon

A business is likely allowed to scan IDs for issuing refunds.  To the extent the business uses a fraud prevention service company or system, it may retain limited information obtained from the scan for the purpose of preventing fraud or other criminal activity. 

ID scanning for customer pickup in Oregon

A business is not likely allowed to scan IDs of customers picking up purchased merchandise. 

ID scanning for access control in Oregon

A business is not likely allowed to scan IDs of, for instance, truck drivers delivering goods to distribution centers, unless such IDs are internal (non-governmental) IDs. 

Does Oregon offer affirmative defense for ID scanning?

Yes. Oregon provides affirmative defense for ID scanning for sale of age restricted products.

Oregon Statute 807.745 Findings regarding personal information contained in driver licenses, driver permits and identification cards

The Legislative Assembly finds that:

      (1) Oregon recognizes the importance of protecting the confidentiality and privacy of an individual’s personal information contained in driver licenses, driver permits and identification cards.

      (2) Machine-readable features found on driver licenses, driver permits and identification cards are intended to facilitate verification of age or identity, not to facilitate collection of personal information about individuals nor to facilitate the creation of private databases of transactional information associated with those individuals.

      (3) Easy access to the information found on driver licenses, driver permits and identification cards facilitates the crime of identity theft, which is a major concern in Oregon. [2009 c.546 §1]

      Note: 807.745 and 807.750 were enacted into law by the Legislative Assembly but were not added to or made a part of the Oregon Vehicle Code or any chapter or series therein by legislative action. See Preface to Oregon Revised Statutes for further explanation.

Oregon Statute 807.750 Restrictions on swiping driver licenses or identification cards.

(1) As used in this section:

      (a) “Driver license” means a license or permit issued by this state or any other jurisdiction as evidence of a grant of driving privileges.

      (b) “Identification card” means the card issued under ORS 807.400 or a comparable provision in another state.

      (c) “Personal information” means an individual’s name, address, date of birth, photograph, fingerprint, biometric data, driver license number, identification card number or any other unique personal identifier or number.

      (d) “Private entity” means any nongovernmental entity, such as a corporation, partnership, company or nonprofit organization, any other legal entity or any natural person.

      (e) “Swipe” means the act of passing a driver license or identification card through a device that is capable of deciphering, in an electronically readable format, the information electronically encoded in a magnetic strip or bar code on the driver license or identification card.

      (2) Except as provided in subsection (6) of this section, a private entity may not swipe an individual’s driver license or identification card, except for the following purposes:

      (a) To verify the authenticity of a driver license or identification card or to verify the identity of the individual if the individual pays for a good or service with a method other than cash, returns an item or requests a refund.

      (b) To verify the individual’s age when providing an age-restricted good or service to any person about whom there is any reasonable doubt of the person’s having reached 21 years of age.

      (c) To prevent fraud or other criminal activity if an individual returns an item or requests a refund and the private entity uses a fraud prevention service company or system.

      (d) To transmit information to a check services company for the purpose of approving negotiable instruments, electronic funds transfers or similar methods of payment.

      (3) A private entity that swipes an individual’s driver license or identification card under subsection (2)(a) or (b) of this section may not store, sell or share personal information collected from swiping the driver license or identification card.

      (4) A private entity that swipes an individual’s driver license or identification card under subsection (2)(c) or (d) of this section may store or share the following information collected from swiping an individual’s driver license or identification card for the purpose of preventing fraud or other criminal activity against the private entity:

• (A) Name;
• (B) Address;
• (C) Date of birth; and
• (D) Driver license number or identification card number.

      (5)(a) A person other than an entity regulated by the federal Fair Credit Reporting Act, 15 U.S.C. 1681 et seq., who receives personal information from a private entity under subsection (4) of this section may use the personal information received only to prevent fraud or other criminal activity against the private entity that provided the personal information.

      (b) A person who is regulated by the federal Fair Credit Reporting Act and who receives personal information from a private entity under subsection (4) of this section may use or provide the personal information received only to effect, administer or enforce a transaction or prevent fraud or other criminal activity, if the person provides or receives personal information under contract from the private entity.

      (6)(a) Subject to the provisions of this subsection, a private entity that is a commercial radio service provider that provides service nationally and that is subject to the Telephone Records and Privacy Protection Act of 2006 (18 U.S.C. 1039) may swipe an individual’s driver license or identification card if the entity obtains permission from the individual to swipe the individual’s driver license or identification card.

      (b) The private entity may swipe the individual’s driver license or identification card only for the purpose of establishing or maintaining a contract between the private entity and the individual. Information collected by swiping an individual’s driver license or identification card for the establishment or maintenance of a contract shall be limited to the following information from the individual:

• (A) Name;
• (B) Address;
• (C) Date of birth; and
• (D) Driver license number or identification card number.

(c) If the individual does not want the private entity to swipe the individual’s driver license or identification card, the private entity may manually collect the following information from the individual:

• (A) Name;
• (B) Address;
• (C) Date of birth; and
• (D) Driver license number or identification card number.

      (d) The private entity may not withhold the provision of goods or services solely as a result of the individual requesting the collection of the following information from the individual through manual means:

• (A) Name;
• (B) Address;
• (C) Date of birth; and
• (D) Driver license number or identification card number.

      (7) A governmental entity may swipe an individual’s driver license or identification card only if:

      (a) The individual knowingly makes the driver license or identification card available to the governmental entity;

      (b) The governmental entity lawfully confiscates the driver license or identification card;

      (c) The governmental entity is providing emergency assistance to the individual who is unconscious or otherwise unable to make the driver license or identification card available; or

      (d) A court rule requires swiping of the driver license or identification card to facilitate accurate linking of court records pertaining to the individual.

      (8) In addition to any other remedy provided by law, an individual may bring an action to recover actual damages or $1,000, whichever is greater, and to obtain equitable relief, if equitable relief is available, against an entity that swipes, stores, shares, sells or otherwise uses the individual’s personal information in violation of this section. A court shall award a prevailing plaintiff reasonable costs and attorney fees. If a court finds that a violation of this section was willful or knowing, the court may increase the amount of the award to no more than three times the amount otherwise available.

      (9) Any waiver of a provision of this section is contrary to public policy and is void and unenforceable. [2009 c.546 §2]

Oregon Statute 471.342 Acquisition and use of age verification equipment in lieu of other penalty

Upon finding that a retail licensee, as defined in ORS 471.392, or an employee of a retail licensee has sold alcoholic beverages to a minor, or has failed to properly verify identification of a person who purchased alcoholic beverages, the Oregon Liquor Control Commission may allow the licensee, in lieu of a civil penalty or denial, suspension or cancellation of the license, to acquire and use equipment designed to prevent sales of alcoholic beverages to minors.

Oregon Law 0240. Relating to Scrap Metal Purchases 

(1) Before completing a transaction, a scrap metal business engaged in business in this state shall:

(a) Create a metal property record for the transaction at the time and in the location where the transaction occurs. The record must:

(A) Be accurate and written clearly and legibly in English;

(B) Be entered onto a standardized printed form or an electronic form that is securely stored and is capable of ready retrieval and printing; and

(C) Contain all of the following information:

• (i) The signature of the individual with whom the scrap metal business conducts the transaction.
• (ii) The time, date, location and monetary amount or other value of the transaction.
• (iii) The name of the employee who conducts the transaction on behalf of the scrap metal business.
• (iv) The name and telephone number of the individual with whom the scrap metal business conducts the transaction and a street address or, if a post office box is listed on the government-issued photo identification described in sub-subparagraph
• (vi) of this subparagraph, a post office box, to which the scrap metal business will mail payment to the individual.
• (v) A description of, and the license number and issuing state shown on the license plate affixed to, the motor vehicle, if any, used to transport the individual who conducts, or the nonferrous metal property or private metal property that is the subject of, the transaction.
• (vi) A photocopy of a current, valid driver license or other government-issued photo identification belonging to the individual with whom the scrap metal business conducts the transaction.
• (vii) A photograph of, or video surveillance recording depicting, a recognizable facial image of the individual with whom the scrap metal business conducts the transaction.

Oregon House Bill 4034. Relating to the sale of ephedrine and pseudoephedrine.

(1) As used in this section, “intern,” “pharmacist,” “pharmacy” and “pharmacy technician” have the meanings given those terms in ORS 689.005.
(2) A pharmacist, intern or pharmacy technician may transfer a drug containing
pseudoephedrine or ephedrine or a salt, isomer or salt of an isomer of pseudoephedrine or ephedrine
without a prescription from a practitioner to a person who is 18 years of age or older and who provides to the pharmacist, intern or pharmacy technician the person’s valid government-issued
photo identification.
(3) Prior to the transfer of a drug described in subsection (2) of this section, a pharmacist, intern or pharmacy technician shall submit the following information to the electronic system described in subsection (6) of this section:
(a) The date and time of the transfer;
(b) The name, address and date of birth of the person to whom the transfer will be made;
(c) The form of government-issued photo identification and identification number of the person
to whom the transfer will be made;
(d) The name of the government agency that issued the photo identification