SECTION 59.1-443.3. (Effective until January 1, 2021) Scanning information from driver's license or identification card; retention, sale, or dissemination of information  

A. No merchant may scan the machine-readable zone of a Department of Motor Vehicles-issued identification card or driver's license, except for the following purposes:

1. To verify authenticity of the identification card or driver's license or to verify the identity of the individual if the individual requests a service pursuant to a membership or a service agreement, pays for goods or services with a method other than cash, returns an item, or requests a refund or an exchange;

2. To verify the individual's age when providing age-restricted goods or services to the individual if there is a reasonable doubt of the individual having reached 18 years of age or older;

3. To prevent fraud or other criminal activity if the individual returns an item or requests a refund or an exchange and the merchant uses a fraud prevention service company or system. Information collected by scanning an individual's identification card or driver's license pursuant to this subdivision shall be limited to the individual's name, address, date of birth, and driver's license number or identification card number;

4. To comply with a requirement imposed on the merchant by state or federal law;

5. To provide to a check services company regulated by the federal Fair Credit Reporting Act, (15 U.S.C. § 1681 et seq.), that receives information obtained from an individual's identification card or driver's license to administer or enforce a transaction or to prevent fraud or other criminal activity; or

6. To complete a transaction permitted under the Gramm-Leach-Bliley Act, (15 U.S.C. § 6801 et seq.), or the federal Fair Credit Reporting Act, (15 U.S.C. § 1681 et seq.).

B. No merchant shall retain any information obtained from a scan of the machine-readable zone of an individual's identification card or driver's license except as permitted in subdivision A 1, 3, 4, 5, or 6. The merchant shall destroy the retained information when the purpose for which it was provided and retained under this section has been satisfied.

C. No merchant shall sell or disseminate to a third party any information obtained from a scan of the machine-readable zone of an individual's identification card or driver's license for any marketing, advertising, or promotional purpose. This subsection shall not prohibit a merchant from disseminating to a third party any such information for a purpose described in subdivision A 3, 4, 5, or 6.

D. Any waiver of a provision of this section is contrary to public policy and is void and unenforceable.

2014, cc. 789 , 789 ; 2020, c. 789 .