ID Scanning Laws Updates – Q1 2022

Summary of Q1 2022 Legislation Relating to ID Scanning or Identity Verification

As the middle of 2022 approaches, many state legislatures have concluded their 2021 sessions while others continue to be active. Bills relating to data privacy were introduced in several states.

A Maryland bill that would prohibit a person from using a scanning device to scan or swipe an identification card or driver’s license to obtain personal information was scheduled for a hearing. 

In Hawaii, a bill that would establish the Hawaii Consumer Privacy Act was referred to the Committees Working Group. The Act specifies various consumer rights with respect to the collection of personal information by businesses. 

On March 24, 2022, Utah became the fourth state to enact the Consumer Privacy Act. The Act provides a consumer the right to confirm processing of and have access to their personal data. Additionally, the consumer has the option to opt out of the processing of their personal data if it is being processed for targeted advertising or sale.

Catalog of Legislative Initiatives Relating to ID Scanning or Identity Verification By State

Overview of relevant bills and statutes proposed and/or passed between Jan 1, 2022 and March 31, 2022.

State	bill NO.	summary	status (apr 2022)
Florida	H 0199	Would require licensed gun dealers to present his or her driver’s license or social security card and federal firearms license to the seller or transferor of an assault weapon or large-capacity magazine for inspection at the time of purchase or transfer; would require the Department of Law Enforcement to maintain a file of all certificates of transfer at its headquarters.	Died in Criminal Justice & Public Safety Subcommittee, 03/14/2022
Georgia	S 332	Relating to selling and other trade practices, to provide for certain disclosures by third-party high-volume sellers of consumer products on online marketplaces.	Senate Sent to Governor, 04/07/2022
Hawaii	H 2051	Would establish the Hawaii consumer privacy act. Specifies various consumer rights with respect to the collection of personal information by businesses. Outlines the obligations on businesses with respect to the collection, disclosure, sharing, and selling of consumer personal information. Specifies the requirements for administration and enforcement by the department, including adoption of rules.	Referred to the House Higher Education and Technology and Finance Committees, 02/02/2022
Hawaii	S 2032	Would establish the Hawaii Genetic Information Privacy Act. Requires direct-to-consumer genetic testing companies to adhere to certain requirements pertaining to the collection, use, and disclosure of genetic data.  Deems any violation as an unfair or deceptive trade practice subject to associated penalties.	House Conferees Appointed, 04/20/2022
Hawaii	S 2292	Would modernize  the definition of “personal information” for the purposes of notifying affected persons of data and security breaches.	Passed Second Reading, 03/18/2022
Illinois	H 4692	Would provide that if the biometric identifier or biometric information is collected or captured for the same repeated process, the private entity is only required to inform the subject or receive consent during the initial collection.	Added Chief Co-Sponsor, 04/07/2022
Illinois	S 3782	Would amend the Biometric Privacy Information Act.  Allows a private entity to collect, capture, or otherwise obtain a person’s biometric identifier or biometric information without satisfying other specified requirements if they meet certain conditions.	Added Chief Co-Sponsor, 03/09/2022
Illinois	S 3874	Would waive certain requirements for collecting, capturing, or otherwise obtaining a person’s biometric identifier or biometric information under certain circumstances relating to security purposes.	Added Chief Co-Sponsor, 03/10/2022
Illinois	S 3939	Would modify the exemptions from inspection and copying public records concerning cybersecurity vulnerabilities.	Passed Both Houses, 04/01/2022
Iowa	S 3053	Would require liquor licensees to keep a record of the identification label of each keg of beer sold with the name and address of the purchaser and the number of the purchaser’s driver’s license.	Subcommittee Recommends Passage, 02/10/2022
Kansas	H 2731	Would require online marketplaces to obtain certain information from, and to require the disclosure of certain information by, third parties that sell products on their platforms.	Committee on Commerce, Labor and Economic Development Recommends Bill Passage, 03/18/2022
Louisiana	S 305	Would provide for the disclosure of certain information on websites and online services.	Referred to  Committee on Commerce, 04/18/2022
Maryland	H 259	Would regulate the use of biometric identifiers by private entities, including requiring certain private entities in possession of biometric identifiers to develop a policy for such use, made available to the public.	Referred to Finance, 03/21/2022
Maryland	S 712	Would prohibit a person from using a scanning device to scan or swipe an identification card or a driver’s license of an individual to obtain the personal information of the individual.	Hearing scheduled for 03/16/2022
Massachusetts	H 142	Would establish the   Massachusetts Information Privacy Act.	New draft introduced, 03/03/2022
Massachusetts	S 46	Would establish the   Massachusetts Information Privacy Act.	Accompanied a new draft, 02/14/2022
Mississippi	H 1376	Would provide penalties for the improper use of personal information.	Died in committee, 03/01/2022
Mississippi	S 2330	Would create the Mississippi Consumer Data Privacy Act, would allow consumers to request that businesses disclose certain information.	Died in committee, 02/01/2022
New Hampshire	S 311	Relates to access to drivers’ license information for legitimate business purposes. Would allow the scanning, recording, and retaining or storing of information obtained from any driver’s license or nondriver’s identification card provided that such practice was expressly disclosed to the holder.	S 311
New York	A 00680	Would enact the NY privacy act to require companies to disclose their methods of de-identifying personal information, to place special safeguards around data sharing, and to allow consumers to obtain the names of all entities with whom their information is shared.	Recommitted to Consumer Affairs and Protection, 01/07/2022
New York	S 3586	Would establish the “It’s Your Data Act” for the purposes of providing protections and transparency in the collection, use, retention, and sharing of personal information.	Advanced to Third Reading, 03/02/2022
New York	S 06701	Would enact the NY privacy act to require companies to disclose their methods of de-identifying personal information, to place special safeguards around data sharing and to allow consumers to obtain the names of all entities with whom their information is shared.	Committed to Internet and Technology, 02/08/2022
Pennsylvania	H 1594	Would  provide online marketplaces to inform consumers regarding the collection, verification and disclosure of information.	First Consideration, 04/13/2022
Pennsylvania	S 895	Would  require online marketplaces to inform consumers regarding  the collection, verification, and  disclosure of information.	First Consideration, 04/13/2022
Utah	S 227	Enacts the Consumer Privacy Act.  Grants a consumer the right to confirm processing of their personal data  and to have access to that data. Additionally, the consumer has the option to opt out of the processing of their personal data if it is being processed for targeted advertising or sale. Amends Code Section 13-2-1Enacts Code Sections 13-61-101 through 13-61-404	Signed by the Governor, 03/24/2022 Effective Date 12/31/2023
Virginia	S 393	Would provide for the requirements that a controller that has obtained personal data about a consumer from a third party must meet in order to be deemed in compliance with a consumer’s request to delete such data.	Vetoed by Governor, 04/11/2022