On October 1, 2017, a new law will take effect in New Jersey, the Personal Information and Privacy Protection Act (“PIPPA”), which will severely restrict retailers’ ability to “scan” any customer’s “identification card”--a term defined to mean “a driver’s license,” “probationary license,” “non-driver photo identification card,” or any similar card “issued...for purposes of identification.” Merely looking at a license to verify identity or age is not covered by the new law, only “scanning” the license for the purpose of recording and retaining the data. Both the Attorney General’s Office and private consumers can sue for violations, but the window for private suits is fairly narrow.

The law begins by listing the only purposes for which a retailer may “scan” an identification card at all. They are to (1) verify the person’s identity or the authenticity of the ID card (but this cannot be done if the purchaser is buying an item for cash); (2) verify age when an item is age-restricted; (3) prevent fraud in connection with returns and exchanges if “the business uses a fraud prevention service company or system”; (4) prevent fraud in credit transactions or in connection with the opening of a credit account; (5) establish or maintain a contractual relationship; (6) meet any state or federal legal obligation; (7) transmit information to a consumer reporting agency as may be permitted by law; and (8) accomplish the goals of the Health Insurance Portability and Accountability Act.

The PIPPA then says that if a retailer scans information for one of these permitted reasons, it may only scan “the person’s name, address, date of birth, the state issuing the identification card, and identification card number.” Among the other information that may be listed on a driver’s license that the law does not permit to be “scanned” are a person’s photograph, height, weight, eye color, any restrictions on the license, and the person’s status as an organ donor. That other information may not be “scanned” at all.

If a retailer scans an identification for purposes (1) and (2)--identity and age verification--it cannot “retain” this information, even briefly. Retailers may retain information they collect for the other permitted purposes, but if they do so, they must “securely store[]” it and “promptly report[]” any breaches to the New Jersey State Police and the Attorney General’s Office pursuant to existing breach notification statutes. The statute does not put any express limitations on the length of time this information can be retained.

The PIPPA allows the Attorney General’s Office to recover a $2,500 civil penalty for a first violation and $5,000 for each subsequent violation. It also provides that “any person aggrieved by a violation of this act can bring an action in Superior Court to recover damages.” That private right of action would therefore seem to be limited in two very important respects.

First, a consumer can sue only if “aggrieved.” That same word appears in another New Jersey statute that has been in the news lately--the Truth-in-Consumer Contract, Warranty, and Notice Act (“TCCWNA”)--and we are awaiting word from the New Jersey Supreme Court in a pending TCCWNA case as to what it means. Second, the statute very clearly does not say that consumers can recover the same $2,500 penalty that the Attorney General’s Office may collect. Consumers can only sue for “damages,” which would seem to require real, out-of-pocket losses, such as those from actual identity theft. If a data breach leads to such theft, however, and if the retailer did not “securely store” the data, class action lawsuits may be possible under the new PIPPA.

The window to comply with this new statute is a short two months. Retailers doing business in New Jersey should determine the extent to which they are scanning driver’s licenses and other ID cards and ensure that their policies for doing so, and for retaining any data collected, comply with the PIPPA. If conducting similar business practices elsewhere, it’s a good idea to confirm compliance with similar laws to this New Jersey law in other states.

Read This Before Scanning A Driver’s License In New Jersey