The New Jersey legislature recently passed a bill that places restrictions on retailers’ ability to collect and use personal information gleaned from driver’s licenses.  The bill, known as the Personal Information and Privacy Protection Act, is intended to give consumers more control and security over their personal information.  A copy of the bill can be found here.

Under the new legislation, retailers can scan a driver’s license or identification card only for seven specific purposes:

(1)    to verify the authenticity of the identification card or to verify the     identity of the person if the person pays for goods or services with a method other than cash, returns an item, or requests a refund or an exchange;

(2)    to verify the persons age when providing age-restricted goods or services to the person;

(3)    to prevent fraud or other criminal activity if the person returns an item or requests a refund or an exchange and the business uses a fraud prevention service company or system;

(4)    to establish or maintain a contractual relationship;

(5)    to record, retain, or transmit information as required by state or federal law;

(6)    to transmit information to a consumer reporting agency, financial institution, or debt collector to be used as permitted by the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, and the Fair Debt Collection Practices Act; or

(7)    to record, retain, or transmit information by a covered entity governed by the medical privacy and security rules under the Health Insurance Portability and Accountability Act (“HIPAA”).

If a driver’s license or identification card is scanned, the retailer can only collect the person’s name, address, date of birth, state of issuance, and identification card number.  The retailer must also securely store any retained information and not disclose it to any third party.

The Act establishes a civil penalty of $2,500 for an initial violation and $5,000 for any subsequent violation.

It is important to note that the Act is limited to retail establishments only and has no impact on any other uses of driver’s license information.