WEST virginia legislature
2020 regular session
Senate Bill 260
By Senators Ihlenfeld and Baldwin
10, 2020; referred
to the Committee on Economic Development; and then to the Committee on the Judiciary]
A BILL to amend the Code of West Virginia, 1931, as amended, by adding thereto a new section, designated §46A-2A-102a, relating to the collection and use of personal information by retail establishments for certain purposes.
Be it enacted by the Legislature of West Virginia:
ARTICLE 2A. BREACH OF SECURITY OF CONSUMER INFORMATION.
46A-2A-102a. Collection and use of personal information by retail establishments for certain purposes.
(a) For the purposes of this section:
Identification card means a drivers license, a graduated license, or a nondriver photo identification card issued pursuant to §17B-2-1 et seq. of this code, or any similar card issued by another state or the District of Columbia for purposes of identification or permitting its holder to operate a motor vehicle.
Scan means to access the barcode or any other machine-readable section of a person’s identification card with an electronic device capable of deciphering, in an electronically readable format, information electronically encoded on the identification card.
(b) A retail establishment may scan a person’s identification card only:
(1) To verify the authenticity of the identification card or to verify the identity of the person if the person pays for goods or services with a method other than cash, returns an item, or requests a refund or an exchange;
(2) To verify the person’s age when providing age-restricted goods or services to the person;
(3) To prevent fraud or other criminal activity if the person returns an item or requests a refund or an exchange and the business uses a fraud prevention service company or system;
(4) To establish or maintain a contractual relationship;
(5) To record, retain, or transmit information as required by state or federal law;
(6) To transmit information to a consumer reporting agency, financial institution, or debt collector to be used as permitted by the federal Fair Credit Reporting Act, 15 U.S.C. §1681 et seq., Gramm-Leach-Bliley Act, 15 U.S.C. §6801 et seq., and the Fair Debt Collection Practices Act 15 U.S.C. §1692 et seq.; and
(7) To record, retain, or transmit information by a covered entity governed by the medical privacy and security rules pursuant to Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the “Health Insurance Portability and Accountability Act of 1996,” Pub.L.104-191.
(c) Information collected by scanning a person’s identification card pursuant to subsection (b) of this section is limited to the person’s name, address, date of birth, the state issuing the identification card, and identification card number.
(d)(1) No retail establishment may retain information obtained pursuant to subdivisions (1) and (2), subsection (b) of this section.
(2) Any information retained by a retail establishment pursuant to subdivisions (3) through (7), subsection (b) of this section shall be securely stored, and any breach of the security of the information shall be promptly reported to the West Virginia State Police and any affected person, in accordance with §46A-2A-102 of this code.
(3) No retail establishment may sell or disseminate to a third party any information obtained pursuant to this section for any purpose, including marketing, advertising, or promotional activities, except dissemination as permitted by subdivisions (3) through (7), subsection (b) of this section: Provided, That that nothing in this subsection prevents an automated return fraud system from issuing a reward coupon to a loyal customer.
NOTE: The purpose of this bill is to restrict collection and use of personal information collected from identification cards by retail establishments.
Strike-throughs indicate language that would be stricken from a heading or the present law, and underscoring indicates new language that would be added.