S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   3164
 
                        2023-2024 Regular Sessions
 
                             I N  S E N A T E
 
                             January 30, 2023
                                ___________
 
 Introduced  by Sen. HOYLMAN-SIGAL -- read twice and ordered printed, and
   when printed to be committed to the Committee on Consumer Protection
 
 AN ACT to amend the general business  law  and  the  alcoholic  beverage
   control law, in relation to the unlawful use of a New York state driv-
   er's license or identification card

   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. The general business law is amended by adding a new section
 399-rr to read as follows:
   § 399-RR. UNLAWFUL USE OF A NEW YORK STATE DRIVER'S LICENSE  OR  IDEN-
 TIFICATION CARD. 1. NO PERSON, BUSINESS, FIRM, PARTNERSHIP, ASSOCIATION,
 OR  CORPORATION,  NOT INCLUDING THE STATE OR ITS POLITICAL SUBDIVISIONS,
 MAY SCAN THE MACHINE-READABLE ZONE OF AN  INDIVIDUAL'S  NEW  YORK  STATE
 DRIVER'S  LICENSE  OR  IDENTIFICATION  CARD  AS  DEFINED IN SECTION FOUR
 HUNDRED NINETY OF THE VEHICLE AND TRAFFIC LAW, EXCEPT FOR THE  FOLLOWING
 PURPOSES:
   A.  TO  VERIFY  AUTHENTICITY OF THE DRIVER'S LICENSE OR IDENTIFICATION
 CARD OR TO VERIFY THE IDENTITY OF THE INDIVIDUAL IF THE INDIVIDUAL  PAYS
 FOR GOODS OR SERVICES WITH A METHOD OTHER THAN CASH, RETURNS AN ITEM, OR
 REQUESTS A REFUND OR EXCHANGE;
   B.  TO VERIFY THE INDIVIDUAL'S AGE WHEN PROVIDING AGE-RESTRICTED GOODS
 OR SERVICES TO THE INDIVIDUAL;
   C. TO PREVENT FRAUD OR  OTHER  CRIMINAL  ACTIVITY  IF  THE  INDIVIDUAL
 RETURNS  AN  ITEM  OR  REQUESTS A REFUND OR AN EXCHANGE AND THE BUSINESS
 USES A FRAUD PREVENTION SERVICE COMPANY OR SYSTEM. INFORMATION COLLECTED
 BY SCANNING AN INDIVIDUAL'S  DRIVER'S  LICENSE  OR  IDENTIFICATION  CARD
 PURSUANT  TO THIS SUBDIVISION SHALL BE LIMITED TO THE FOLLOWING INFORMA-
 TION FROM THE INDIVIDUAL:
   (1) NAME;
   (2) ADDRESS;
   (3) DATE OF BIRTH; AND
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD07811-01-3
              

 S. 3164                             2
 
   (4) DRIVER'S LICENSE NUMBER OR IDENTIFICATION CARD NUMBER;
   D.  TO RECORD, RETAIN, OR TRANSMIT INFORMATION AS REQUIRED BY STATE OR
 FEDERAL LAW;
   E. TO TRANSMIT INFORMATION TO A CONSUMER REPORTING  AGENCY,  FINANCIAL
 INSTITUTION,  OR  DEBT  COLLECTOR TO BE USED AS PERMITTED BY THE FEDERAL
 FAIR CREDIT REPORTING ACT, GRAMM-LEACH-BLILEY  ACT,  OR  THE  FAIR  DEBT
 COLLECTION PRACTICES ACT; OR
   F.  TO  RECORD,  RETAIN,  OR  TRANSMIT INFORMATION BY A COVERED ENTITY
 GOVERNED BY THE MEDICAL PRIVACY AND SECURITY RULES ISSUED BY THE FEDERAL
 DEPARTMENT OF HEALTH AND HUMAN SERVICES, PARTS 160 AND 164 OF  THE  CODE
 OF  FEDERAL  REGULATIONS,  ESTABLISHED  PURSUANT TO THE HEALTH INSURANCE
 PORTABILITY AND AVAILABILITY ACT OF 1996.
   2. NO PERSON, BUSINESS,  FIRM,  PARTNERSHIP,  ASSOCIATION,  OR  CORPO-
 RATION,  NOT  INCLUDING  THE  STATE OR ITS POLITICAL SUBDIVISIONS, SHALL
 RETAIN ANY INFORMATION OBTAINED FROM SCANNING AN INDIVIDUAL'S  NEW  YORK
 STATE  DRIVER'S  LICENSE  OR IDENTIFICATION CARD, EXCEPT AS PERMITTED IN
 SUBDIVISION ONE OF THIS SECTION.
   3. NO PERSON, BUSINESS,  FIRM,  PARTNERSHIP,  ASSOCIATION,  OR  CORPO-
 RATION,  NOT  INCLUDING  THE  STATE OR ITS POLITICAL SUBDIVISIONS, SHALL
 SELL OR DISSEMINATE TO A THIRD PARTY ANY INFORMATION OBTAINED UNDER THIS
 SECTION FOR ANY PURPOSE, INCLUDING BUT NOT LIMITED TO, MARKETING, ADVER-
 TISING, OR PROMOTIONAL ACTIVITIES, EXCEPT AS  PERMITTED  IN  SUBDIVISION
 ONE OF THIS SECTION.
   4. A PERSON, BUSINESS, FIRM, PARTNERSHIP, ASSOCIATION, OR CORPORATION,
 NOT  INCLUDING  THE  STATE  OR ITS POLITICAL SUBDIVISIONS, COVERED UNDER
 THIS SECTION SHALL MAKE REASONABLE EFFORTS, THROUGH SYSTEMS TESTING  AND
 OTHER MEANS, TO ENSURE THAT THE REQUIREMENTS OF THIS SECTION ARE MET.
   5.  ANY  WAIVER  OF  A PROVISION OF THIS SECTION IS CONTRARY TO PUBLIC
 POLICY AND IS VOID AND UNENFORCEABLE.
   6. EACH VIOLATION OF THIS SECTION  SHALL  BE  PUNISHABLE  BY  A  CIVIL
 PENALTY OF NOT MORE THAN ONE THOUSAND DOLLARS.
   7. FOR THE PURPOSES OF THIS SECTION:
   A.  "CONSUMER  REPORTING AGENCY" SHALL HAVE THE SAME MEANING AS IN THE
 FEDERAL FAIR CREDIT REPORTING ACT, TITLE 15 UNITED STATES  CODE  SECTION
 1681A(F).
   B.  "COVERED  ENTITY"  SHALL  HAVE THE SAME MEANING AS IN THE SECURITY
 RULES ISSUED BY THE FEDERAL DEPARTMENT OF  HEALTH  AND  HUMAN  SERVICES,
 PARTS 160 AND 164 OF THE CODE OF FEDERAL REGULATIONS, ESTABLISHED PURSU-
 ANT TO THE HEALTH INSURANCE PORTABILITY AND AVAILABILITY ACT OF 1996.
   C. "DEBT COLLECTOR" SHALL HAVE THE SAME MEANING AS IN THE FEDERAL FAIR
 DEBT  COLLECTION  PRACTICES  ACT,  TITLE  15  UNITED STATES CODE SECTION
 1692A.
   D. "FINANCIAL INSTITUTION" SHALL HAVE  THE  SAME  MEANING  AS  IN  THE
 FEDERAL  GRAMM-LEACH-BLILEY  ACT,  TITLE  15  UNITED STATES CODE SECTION
 6809.
   § 2. Subdivision 8 of section 65-b of the alcoholic  beverage  control
 law,  as added by chapter 519 of the laws of 1999, is amended to read as
 follows:
   8. A licensee or agent or employee of such licensee shall only use the
 information recorded and maintained through the use of such devices  for
 the  purposes  contained  in  paragraph (a) of subdivision seven of this
 section, and [shall only use such devices for the purposes contained  in
 subdivision  two  of this section. No licensee or agent or employee of a
 licensee shall resell or disseminate  the  information  recorded  during
 such  scan  to any third person. Such prohibited resale or dissemination
 includes, but is not limited to, any advertising,  marketing  or  promo-
 S. 3164                             3

 tional  activities.  Notwithstanding  the  restrictions  imposed by this
 subdivision, such records may be released pursuant to  a  court  ordered
 subpoena  or  pursuant to any other statute that specifically authorizes
 the  release  of  such  information.  Each violation of this subdivision
 shall be punishable by a civil penalty of not  more  than  one  thousand
 dollars]  IN  ACCORDANCE  WITH  AND SUBJECT TO THE PROVISIONS OF SECTION
 THREE HUNDRED NINETY-NINE-RR OF THE GENERAL BUSINESS LAW.
   § 3. This act shall take effect immediately.