What's happening
This bill restricts businesses from scanning, retaining, or sharing data from New York State driver's licenses or ID cards, except for specific purposes.
Why it matters
Limits on Scanning and Data Collection. The bill allows businesses to scan your driver's license or state ID only for specific reasons—such as verifying identity, age for restricted goods, preventing fraud, or fulfilling legal requirements. This means your personal information can't be collected for just any purpose, reducing unnecessary exposure.
Strict Restrictions on Data Retention and Sharing. Businesses are prohibited from retaining, selling, or sharing any information collected from your license/ID outside the explicitly allowed uses. This greatly reduces the risk of your data being used for marketing, advertising, or sold to third parties without your consent.
Enforceable Consumer Protections. Each violation can result in a civil penalty of up to $1,000, and any attempt to waive these protections is void. This creates a real deterrent against misuse of your ID information and gives consumers a legal avenue if their data is mishandled.
Alignment with Privacy Laws. The bill ties data handling rules to existing federal privacy regulations (such as HIPAA, Fair Credit Reporting Act, Gramm-Leach-Bliley Act), ensuring your information is only transmitted to entities (like banks or medical providers) as already permitted under stringent national standards.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Headline styles
Limit ID Scanning and Sharing
Plain English, a few words. Used as the page title.
Sponsors
No co-sponsors yet.
History
- Referred to consumer protection
- Referred to consumer protection
Full text
3 pagesUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
1487
2019-2020 Regular Sessions
IN SENATE
January 15, 2019
Introduced by Sen. HOYLMAN -- read twice and ordered printed, and when printed to be committed to the Committee on Consumer Protection
AN ACT to amend the general business law and the alcoholic beverage control law, in relation to the unlawful use of a New York state driver's license or identification card
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. The general business law is amended by adding a new section 399-hh to read as follows:
§ 399-hh. Unlawful use of a New York state driver's license or identification card. 1. No person, business, firm, partnership, association, or corporation, not including the state or its political subdivisions, may scan the machine-readable zone of an individual's New York state driver's license or identification card as defined in section four hundred ninety of the vehicle and traffic law, except for the following purposes:
a. to verify authenticity of the driver's license or identification card or to verify the identity of the individual if the individual pays for goods or services with a method other than cash, returns an item, or requests a refund or exchange;
b. to verify the individual's age when providing age-restricted goods or services to the individual;
c. to prevent fraud or other criminal activity if the individual returns an item or requests a refund or an exchange and the business uses a fraud prevention service company or system. Information collected by scanning an individual's driver's license or identification card pursuant to this subdivision shall be limited to the following information from the individual:
(1) name;
(2) address;
(3) date of birth; and
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD07241-01-9
S. 1487 2
(4) driver's license number or identification card number;
d. to record, retain, or transmit information as required by state or federal law;
e. to transmit information to a consumer reporting agency, financial institution, or debt collector to be used as permitted by the federal Fair Credit Reporting Act, Gramm-Leach-Bliley Act, or the Fair Debt Collection Practices Act; or
f. to record, retain, or transmit information by a covered entity governed by the medical privacy and security rules issued by the federal Department of Health and Human Services, Parts 160 and 164 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Availability Act of 1996.
2. No person, business, firm, partnership, association, or corporation, not including the state or its political subdivisions, shall retain any information obtained from scanning an individual's New York state driver's license or identification card, except as permitted in subdivision one of this section.
3. No person, business, firm, partnership, association, or corporation, not including the state or its political subdivisions, shall sell or disseminate to a third party any information obtained under this section for any purpose, including but not limited to, marketing, advertising, or promotional activities, except as permitted in subdivision one of this section.
4. A person, business, firm, partnership, association, or corporation, not including the state or its political subdivisions, covered under this section shall make reasonable efforts, through systems testing and other means, to ensure that the requirements of this section are met.
5. Any waiver of a provision of this section is contrary to public policy and is void and unenforceable.
6. Each violation of this section shall be punishable by a civil penalty of not more than one thousand dollars.
7. For the purposes of this section:
a. "Consumer reporting agency" shall have the same meaning as in the federal Fair Credit Reporting Act, title 15 United States Code section 1681a(f).
b. "Covered entity" shall have the same meaning as in the security rules issued by the federal Department of Health and Human Services, Parts 160 and 164 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Availability Act of 1996.
c. "Debt collector" shall have the same meaning as in the federal Fair Debt Collection Practices Act, title 15 United States Code section 1692a.
d. "Financial institution" shall have the same meaning as in the federal Gramm-Leach-Bliley Act, title 15 United States Code section 6809.
§ 2. Subdivision 8 of section 65-b of the alcoholic beverage control law, as added by chapter 519 of the laws of 1999, is amended to read as follows:
8. A licensee or agent or employee of such licensee shall only use the information recorded and maintained through the use of such devices for the purposes contained in paragraph (a) of subdivision seven of this section, and [shall only use such devices for the purposes contained in subdivision two of this section. No licensee or agent or employee of a licensee shall resell or disseminate the information recorded during such scan to any third person. Such prohibited resale or dissemination includes, but is not limited to, any advertising, marketing or promo-
S. 1487 3
tional activities. Notwithstanding the restrictions imposed by this subdivision, such records may be released pursuant to a court ordered subpoena or pursuant to any other statute that specifically authorizes the release of such information. Each violation of this subdivision shall be punishable by a civil penalty of not more than one thousand dollars] in accordance with and subject to the provisions of section three hundred ninety-nine-hh of the general business law.
§ 3. This act shall take effect immediately.
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Title of bill
An act to amend the general business law and the alcoholic beverage control law, in relation to the unlawful use of a New York state driv- er's license or identification card
Purpose or general idea of bill
To enact privacy protections to prevent the scanning of an individual's New York state driver's license or identification card by any entity except in certain specific circumstances, and to prevent the collection, dissemination, or sale of such information to any third party.
Summary of specific provisions
Section 1 adds a new section 399-hh to the general business law, which establishes provisions prohibiting the scanning of the machine-readable zone of an individual's New York state driver's license or identifica- tion card, except for certain purposes. Section 1 also establishes that no entity may retain information obtained from scanning an individual's driver's license or identification card or sell or disseminate such information to a third party, except for purposes expressly permitted by Section 1. It also establishes that entities covered under this section shall make reasonable efforts to ensure that the requirements of this section are met. It establishes the fine for a violation of this section to be a civil penalty of not more than one thousand dollars. It also defines "consumer reporting agency", "covered entity", "debt collector", and "financial institution".
Section 2 amends subdivision 8 of section 65-b of the alcoholic beverage control law to add a line reflecting that the penalty for violating this section is in accordance with the new section 399-hh of the general business law.
Section 3 provides that the act shall take effect immediately.
Justification
As internet access and commerce becomes more ubiquitous in our everyday lives, the issue of securing the private information of New York state citizens and protecting it from dissemination and sale to third parties has come into sharper focus. It is crucial that New York state enact laws which prevent theft and misuse of personal identifying information, particularly information contained on New York state driver's licenses and identification cards.
This legislation would prohibit any person, business, firm, partnership, association, or corporation from scanning an individual's New York state driver's license or identification card other than for certain specified purposes, including verifying the identity of an individual making a purchase with a method other than cash, verifying an individual's age when providing age-restricted goods or services, fraud prevention, or for authorized credit reporting or medical record purposes. It would also prevent these entities from retaining this personal identifying information or selling or disseminating it to any unauthorized third parties.
Prior legislative history
S.0271 of 2017-2018 (Hoylman): Died in Consumer Protection
S.94 of 2015-2016 (Hoylman): Died in Consumer Protection
S.7538 of 2014 (Hoylman): Died in Consumer Protection
Fiscal implications
None to the state.
Effective date
This act shall take effect immediately.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.