                                 CODE OF VIRGINIA

SCANNING INFORMATION FROM DRIVER&#8217;S LICENSE OR OTHER DOCUMENT; RETENTION,
SALE, OR DISSEMINATION OF INFORMATION (§ 59.1-443.3)

A. No merchant may scan the machine-readable zone of a driver&#8217;s license or
other document issued by the Department of Motor Vehicles under Chapter 3 (§
46.2-300 et seq.) of Title 46.2 or the comparable law of another jurisdiction,
except for the following purposes:

   1. To verify authenticity of the driver&#8217;s license or other document or
   to verify the identity of the individual if the individual requests a service
   pursuant to a membership or a service agreement, pays for goods or services
   with a method other than cash, returns an item, or requests a refund or an
   exchange;

   2. To verify the individual&#8217;s age when providing age-restricted goods or
   services to the individual if there is a reasonable doubt of the individual
   having reached 18 years of age or older;

   3. To prevent fraud or other criminal activity if the individual returns an
   item or requests a refund or an exchange and the merchant uses a fraud
   prevention service company or system. Information collected by scanning an
   individual&#8217;s driver&#8217;s license or other document pursuant to this
   subdivision shall be limited to the individual&#8217;s name, address, and date
   of birth and the number of the driver&#8217;s license or other document;

   4. To comply with a requirement imposed on the merchant by the laws of the
   Commonwealth or federal law;

   5. To provide to a check services company regulated by the federal Fair Credit
   Reporting Act, (15 U.S.C. &#xA7; 1681 et seq.), that receives information
   obtained from an individual&#8217;s driver&#8217;s license or other document
   to administer or enforce a transaction or to prevent fraud or other criminal
   activity; or

   6. To complete a transaction permitted under the federal Gramm-Leach-Bliley
   Act, (15 U.S.C. &#xA7; 6801 et seq.), or the federal Fair Credit Reporting
   Act, (15 U.S.C. &#xA7; 1681 et seq.).

B. No merchant shall retain any information obtained from a scan of the
machine-readable zone of an individual&#8217;s driver&#8217;s license or other
document except as permitted in subdivision A 1, 3, 4, 5, or 6. The merchant
shall destroy the retained information when the purpose for which it was
provided and retained under this section has been satisfied.

C. No merchant shall sell or disseminate to a third party any information
obtained from a scan of the machine-readable zone of an individual&#8217;s
driver&#8217;s license or other document for any marketing, advertising, or
promotional purpose. This subsection shall not prohibit a merchant from
disseminating to a third party any such information for a purpose described in
subdivision A 3, 4, 5, or 6.

D. Any waiver of a provision of this section is contrary to public policy and is
void and unenforceable.

HISTORY: 2014, cc. 789, 795; 2020, cc. 542, 1227, 1246.