Last Driver-License Scanning Holdout—Nebraska—May Be About To Cave

Written by Fred J. Aun
January 14th, 2010

The only state left in the U.S. that still prohibits retailers from capturing drivers’ license numbers—Nebraska—may be about to give up its resistance. Its state Senate on Monday (Jan. 12) overwhelmingly (33-8) approved allowing the practice.

The bill still has to clear a few hurdles before it becomes law (the new vote was only a preliminary first-round vote). It has a stretch limo-sized list of restrictions. But the move is still quite important, as retailers have been using driver’s licenses for a lot more than age verification and check-cashing, including keeping a tally on customers who return too often without receipts.

Some Nebraska politicians are still resisting the license scans, citing privacy concerns. Those in the Nebraska Senate who were uncertain about the measure took some solace in an amendment that says anybody who trades or sells information gleaned from license scans is guilty of a felony. The amendment also says alcohol, lottery ticket and tobacco product merchants are allowed to store the age and license number of customers only after posting a sign at the POS explaining that they’ll be doing it. Another section puts the onus on those who program the scanning devices.

“The programmer for computer software designed to store such information shall certify to the retailer that the software is capable of storing only the information allowed by this subsection,” states the bill. “Intentional or grossly negligent programming by the programmer that allows for the storage of more than the age and identification number shall be a Class IV felony.”

Turning a careless programmer into a felon? I can just see new indemnification clauses being demanded by every programmer who is being aggressively recruited. What about shareware or freeware? Good luck tracking down which open-source programmer wrote that particular portion of a Linux program. (“Hey, Brenda, what’s the term for grossly negligent programming in Nebraska?” “An Oracle upgrade.” Rimshot.)

Currently in Nebraska, only the courts and police can scan drivers’ licenses and the information gleaned by those scans is the same as what is displayed on the front of the licenses, the AP reported. It said Beverly Neth, the director of Nebraska’s department of motor vehicles, told the State Senate it will be trusting retailers to not gather and sell information that Federal law prohibits motor vehicle agencies from releasing to the public. “You’re only supposed to store two bits of information,” she said. “But sitting in front them is a bunch of information about a person. We’re putting a lot of trust in retailers.”


4 Comments | Read Last Driver-License Scanning Holdout—Nebraska—May Be About To Cave

  1. Todd Ablowitz Says:

    Wow. It’s amazing that Nebraska is in this position. I’m not sure what Bev is thinking? Restrict usage or storage of the info? Fine. To be an outlier this long on such an obvious benefit to the people of Nebraska? That’s already shocking, but to put a target on the developers? Even worse.

  2. RSG Says:

    How is capturing ID information an “obvious benefit to the people of Nebraska”, unless the people of Nebraska actually like such things as identity theft, data breaches, and the compilation of lists containing personal information? Short of compliance for the purchase of items like alcohol, tobacco, and firearms, no personally identifiable information should be captured by a non-law enforcement entity in ANY state.

  3. James Loar Says:

    After just skimming the article I am just a little confused about what Nebraska thinks happens in the software development business. Who would write software just for NE? Obviously the applications are written to cover the requirements of the whole country; then during installation you would expect to configure what data to collect — that’s the decision of the retailer – not the software developer. Here’s the developer’s certification statement: “This software is certified to only store NE data as long as you only tick the boxes next to the data elements that are allowed by NE.” Maybe that will be burried in the EULA.

    Perhaps NE is worried that a data agressive retailer will install a floor scale and overhead height sensor in front of the cashier to validate that the driver’s license data matches the person after the card is scanned. Mmmm.

  4. George Says:

    The first time any retailer attempts to scan your license, just leave the merchandise there and don’t go back. That’s what I, and everyone I know, is doing. These mouth-breathers are going to lose all that data just like Sony, Bank of America, Sega, Citibank, Mariott, JP Morgan, and countless others have been doing.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.