IN AN effort to cut down on underage drinking and smoking, many bars, clubs, and restaurants have begun to use devices that scan driver's licenses. In addition to verifying the age of the driver's license holder, the scanner also picks up all of the information in the magnetic stripe found on the backs of most driver's licenses. The obvious benefit is that underage drinking and smoking is curtailed, but that benefit comes at a price. Here is another case where technology has outpaced the law, and the casualty is privacy.

Secondary Uses

Many businesses have legitimate reasons, as well as legal responsibilities to ensure that customers are over a certain age before they can purchase restricted items or get into certain venues. The problem occurs when businesses start making secondary uses of the information contained in the magnetic stripe on the back of some driver's licenses. The most typical of secondary uses is marketing purposes.

The kind of information typically stored in the magnetic stripe includes most everything found on the front of the driver’s license: name, address, gender, height, weight, whether you wear corrective lenses, age, etc. In some cases, where states collect other information, such as social security numbers, that information may or may not be included as well. California, for example, collects social security numbers, but CA law specifically prohibits collection of social security numbers via magnetic stripe.

Personal information collected from driver's licenses can be kept in databases and then used for marketing purposes. For example, you may go to a club on Saturday night because that's a special night where they play goth/industrial music. One innocuous possibility is that you'd start getting marketing materials in the mail – perhaps giving you discounts to go to the club on some other night, or giving you information on music by some of the artists who appeared on Saturday's playlist. Just as likely would be a situation where the list of everyone who showed up on Saturday night was sold to other marketers without their knowledge or consent. Profiling and discrimination is likely – for example, those in desirable zip codes may receive better offers than those who live in less desirable locations. A worst case scenario would be that a person may be at increased risk for identity theft – driver's licenses are "breeder" documents and often form the basis for false IDs.

Another problem is that clubs, restaurants, and other retailers make it very difficult for patrons to say, "No, you can't swipe my card." Typically the business will condition the service on the ability for the business to swipe the card – and in most places there is no legal recourse for patrons.

Beth Givens of the Privacy Rights Clearinghouse states, "We've received complaints from individuals who have had their driver's license taken from them, without their permission, and the merchant then swiping the magstripe through a reader and retaining the data that's on the driver's license."

At the very least, patrons should be able to prevent companies from selling or sharing their personal information. Better yet, businesses should not be allowed to retain this type of personal information.

Legislative fixes

Washington state does not have magnetic stripes on the back, at least the older ones don't. Washington also doesn’t yet have a law on the books prohibiting business use of this type of information.

California, which does have magstripes on the backs of driver’s licenses, has introduced a bill that would prohibit businesses from collecting personal information in this way. Assembly Bill 224 would prohibit retailers from requiring individuals to allow their cards to be swiped, and it also prohibits them from storing, sharing, or storing the information that they get from the license.

An analysis of the bill in California (see link at bottom) shows another dubious practice: "Despite the many visual anti-fraud features of the California driver's license, it is believed that the magnetic stripe is more difficult to counterfeit than the front of the card. Companies marketing magnetic stripe readers also promote the use of this technology to create store "club" or "loyalty" programs. Rather than issuing a separate "club card," businesses using these readers can scan the driver's license to collect consumer identification information and track store purchases." In fact, "companies promoting this technology often tout the system's capacity for "data mining" and building mailing lists."

The weakness in the bill is that there is no enforcement mechanism or penalty for those who ignore the law, but it is a step in the right direction.

What you can do

Write your state and federal legislators and tell them that you’d like to see your privacy protected by law.

Refuse to allow people to "swipe" your card.