Bill > S2950

This bill, known as the "Personal Information and Privacy Protection Act," restricts how retail establishments can collect and use personal information obtained by scanning identification cards. An "identification card" includes driver's licenses and similar state-issued IDs, and "scan" refers to using an electronic device to read the information from a barcode or other machine-readable section of the card. Retailers can only scan an ID to verify its authenticity or the customer's identity when making non-cash payments, returns, or exchanges; to confirm age for restricted goods or services; to prevent fraud in returns or exchanges if using a fraud prevention system; to establish or maintain a contractual relationship; to comply with state or federal law; to share information with consumer reporting agencies or financial institutions as allowed by federal laws like the Fair Credit Reporting Act; or to record information as a covered entity under HIPAA. The information collected must be limited to name, address, date of birth, and ID number. Retailers are prohibited from keeping information collected solely for verification of authenticity or identity in non-cash transactions, returns, or exchanges, and any retained information for other permitted purposes must be securely stored and reported in case of a breach. Furthermore, retailers cannot sell or share this information with third parties for marketing purposes, except as specifically allowed by the bill. Violators face civil penalties of $2,500 for a first offense and $5,000 for subsequent offenses, and individuals harmed by a violation can sue for damages.