A bill

 

TO AMEND THE SOUTH CAROLINA CODE OF LAWS BY ADDING ARTICLE 29 TO TITLE 1, CHAPTER 1, SO AS TO DEFINE A "DIGITAL FORM OF IDENTIFICATION", AND PROVIDE THAT A PUBLIC ENTITY IS NOT AUTHORIZED TO USE SUCH FORMS OF IDENTIFICATION; BY ADDING SECTION 56-1-560, SO AS TO DEFINE "MOBILE DRIVER'S LICENSE", AND PROVIDE THAT A PERSON IS NOT REQUIRED TO OBTAIN A MOBILE DRIVER'S LICENSE; AND BY ADDING SECTION 39-1-100, SO AS TO ALLOW A PRIVATE ENTITY TO USE A DIGITAL FORM OF IDENTIFICATION WHEN INTERACTING WITH A PERSON, TO PROVIDE THAT FOR THE PROTECTION OF PERSONAL DATA, AND TO PROVIDE CIRCUMSTANCES WHEN A PERSON MAY BRING A CAUSE OF ACTION IN A COURT OF COMPETENT JURISDICTION.

 

Be it enacted by the General Assembly of the State of South Carolina:

 

SECTION 1.  Chapter 1, Title 1 of the S.C. Code is amended by adding:

 

Article 29

 

Digital Forms of Identification

 

    Section 1-1-1810.  (A) As used in this section:

       (1) "Digital form of identification" means any name or number that may be used, alone or in conjunction with any other information, to identify a specific individual, including any of the following:

           (a) name, Social Security number, date of birth, official state or government issued driver's license or identification number, alien registration number, government passport number, employer or taxpayer identification number;

           (b) unique biometric data, such as fingerprint, voice print, retina or iris image, or other unique physical representation;

           (c) unique electronic identification number, address, or routing code; or

           (d) telecommunication identifying information or access device.

       (2) "Minor" means any person under eighteen years of age.

       (3) "Parent" means a biological, foster, or adoptive parent, a stepparent, or a legal guardian.

       (4) "Personal data" means any information relating to an identifiable natural person.

       (5) "Place of public accommodation" means the same as that term is defined in Section 45-9-10.

       (6) "Public entity" means the State of South Carolina, any department, division, board, commission, or other instrumentality of the State, and any political subdivision of the State, including any school district or public institution of higher education.

    (B) A public entity shall not require any person to obtain or maintain any digital form of identification.

    (C) A public entity may offer the use of a digital form of identification when interacting with any person provided the person is not required to obtain or use such digital form of identification and a physical form of identification is offered and can be used in lieu of the digital form of identification.

    (D)(1) A person who has agreed to use a digital form of identification shall be permitted, upon request, to view, correct, remove, destroy, or restrict the usage of all personal data associated with the person's own identification.

       (2) A person who has authorized the usage of any personal data associated with the person's digital form of identification. A person requires written consent for each purpose.

       (3) Personal data of any person only may be collected by a public entity for the purpose stated by the public entity and only upon the consent of each individual person, or in the case of a minor, only upon consent of a parent of the minor.

       (4) Personal data of any person shall not be sold or transferred to any public or private entity without the consent of the person. Requires written consent and the dollar amount information is sold for and must be listed if the company that purchased information has the right to sell it to another company without authorization.

    (E)(1) A public entity shall not, with respect to any individual person, take any action or refuse to take any action based solely on the personal data of a person.

       (2) A digital form of identification shall not be required by a public entity to enter any place of public accommodation.

    (F) Any person may bring a cause of action in a court of competent jurisdiction if the person alleges that a public entity has violated this section. A public entity found by a court to have violated this section shall be liable to the person affected for not more than one hundred fifty thousand dollars per occurrence.

    (G) This section shall not be construed to prohibit any public entity from complying with any lawful request from a law enforcement agency with respect to any person's personal data.

 

SECTION 2.  Article 1, Chapter 1, Title 56 of the S.C. Code is amended by adding:

 

    Section 56-1-560.  (A)(1) No person is required to obtain a mobile driver's license.

       (2) A driver's license, including a mobile driver's license, shall not be linked with any automated license plate reader in this State without the written consent of such person to whom the driver's license belongs.

    (B) For purposes of this section, the term "mobile driver's license" means a data file that:

       (1) is available on a mobile device that has connectivity to the internet through an application that allows the mobile device to download the data file from the Department of Motor Vehicles;

       (2) contains all of the same data elements visible on the face and back of the driver's license issued by the Department of Motor Vehicles; and

       (3) displays the current status of the driver's license.

 

SECTION 3.  Chapter 1, Title 39 of the S.C. Code is amended by adding:

 

    Section 39-1-100.  (A) As used in this section:

       (1) "Digital form of identification" means any name or number that may be used, alone or in conjunction with any other information, to identify a specific individual, including any of the following:

           (a) name, Social Security number, date of birth, official state or government issued driver's license or identification number, alien registration number, government passport number, employer or taxpayer identification number;

           (b) unique biometric data, such as fingerprint, voice print, retina or iris image, or other unique physical representation;

           (c) unique electronic identification number, address, or routing code; or

           (d) telecommunication identifying information or access device.

       (2) "Personal data" means any information relating to an identifiable natural person.

       (3) "Private entity" means any for profit or not-for-profit organization, association, corporation, partnership, joint venture, limited partnership, limited liability partnership, limited liability company, or other entity or business association, including all wholly owned subsidiaries, majority-owned subsidiaries, parent companies, or affiliates of those entities or business associations.

    (B)(1) A private entity may offer the use of a digital form of identification when interacting with any person. A person who has agreed to use a digital form of identification when interacting with a private entity must be permitted, upon request, to view, correct, remove, destroy, or restrict the usage of all personal data associated with the person's own digital form of identification associated with the private entity.

       (2) A person who has authorized the usage by a private entity of any personal data associated with the person's digital form of identification for one purpose is not deemed authorization for any other purpose. Written consent must be given by the person for each purpose.

       (3) Personal data of any person may only be collected by a private entity for the purpose stated by the private entity and only upon the consent of each individual person.

       (4) Personal data of any person shall not be sold or transferred to any public or private entity without the consent of the person.

    (C) A private entity shall not, with respect to any individual person, take any action or refuse to take any action based solely on the personal data of a person.

    (D) Any person may bring a cause of action in a court of competent jurisdiction if the person alleges that a business entity has violated this section. A business entity found by a court to have violated this section must be liable to the affected person for not more than one hundred fifty thousand dollars per occurrence.

    (E) This section must not be construed to prohibit any business entity from complying with any lawful request from a law enforcement agency with respect to any person's personal data.

 

SECTION 4.  This act takes effect upon approval by the Governor.

----XX----