Since the passage of S. 2155, we have received many inquiries from credit unions concerning the storage and deletion of driver’s license images or personal identification cards, and how the new law impacts current policies.  Federal agencies have yet to provide guidance on the issue of when identification needs to be deleted, but in the interim, here are some principles to consider:

(b) Use Of A Driver’s License Or Personal Identification Card. —

(1) IN GENERAL.— When an individual initiates a request through an online service to open an account with a financial institution or obtain a financial product or service from a financial institution, the financial institution may record personal information from a scan of the driver’s license or personal identification card of the individual, or make a copy or receive an image of the driver’s license or personal identification card of the individual, and store or retain such information in any electronic format for the purposes described in paragraph (2).

Maine allows for the photocopying of driver’s licenses for financial transactions, but some states prohibited the practice. This provision of 2155 allows federal law to supersede any state laws that prohibit the practice and allow easier access to online banking. Keep in mind that the prohibition against copying military IDs still stands.

See relevant Maine law below:

(4)  PRINTING OR REPRODUCTION OF MOTOR VEHICLE DOCUMENT. – A person commits a Class D crime if that person prints, prepares, reproduces, sells or transfers without the written consent of the Secretary of State a paper or documentation in the form of a certificate of registration, driver’s license or any other certificate, permit, license or form used by the Secretary of State in administering this Title.  Notwithstanding this subsection, a person may photocopy without the written consent of the Secretary of State:

(A) A certificate of registration solely for record-keeping purposes [2003, c. 568, S1 (NEW).]

(B) A driver’s license solely for the proof of identification for the consummation of a financial transaction; [2003, c. 568, S1 (NEW).]

(C) A driver’s license solely to verify that a commercial driver’s license has been issued and only if the person making the photocopy is an employer; or [2003, c. 568, S1 (NEW).]

Next, the provision goes on to state:

(2) USES OF INFORMATION.— Except as required to comply with Federal bank secrecy laws (highlighted for emphasis), a financial institution may only use the information obtained under paragraph (1)—

(A) to verify the authenticity of the driver’s license or personal identification card;

(B) to verify the identity of the individual; and

(C) to comply with a legal requirement to record, retain, or transmit the personal information in connection with opening an account or obtaining a financial product or service.

There is a BSA exception here, but while copying or scanning the identification card counts as recording the information, BSA regulations do not require credit unions to make copies of identification cards. Section 31 CFR 1020.220 requires that you must “record a description of any documents that were relied on, noting the type of document, any identification number contained in the document, the place of issuance and, if any, the date of issuance and expiration date” but does not mandate copying or scanning.

(3) DELETION OF IMAGE.— A financial institution that makes a copy or receives an image of a driver’s license or personal identification card of an individual in accordance with paragraphs (1) and (2) shall, after using the image for the purposes described in paragraph (2), permanently delete—

(A) any image of the driver’s license or personal identification card, as applicable; and

(B) any copy of any such image.

This is where the confusion comes in – it is unclear whether Congress intended to mean that credit unions can keep the members ID for as long as they need for a valid purpose, such as the credit unions CIP, or whether they need to be deleted immediately. The BSA exception in (2) is awkward and it’s unclear whether it also relates to this provision.

(4) DISCLOSURE OF PERSONAL INFORMATION.— Nothing in this section shall be construed to amend, modify, or otherwise affect any State or Federal law that governs a financial institution’s disclosure and security of personal information that is not publicly available.

(c) Relation To State Law.— The provisions of this section shall preempt and supersede any State law that conflicts with a provision of this section, but only to the extent of such conflict.

This provision preempts and supersede state laws that prohibit the copying and scanning of identification cards.

Keep in mind that the purpose of the provision is to make online account opening easier.  The provision allows use of the copy of a driver’s license to comply with BSA, so there is a valid argument for maintaining the images as long as necessary to meet the BSA record retention requirements. However, since BSA does not require the retention of a copy of the license (you need only record a description of the license the license number, etc.), it may be prudent to delete the image from your records once you have used it for BSA purposes, e.g., MIP requirements.

Lastly, nothing in this outline should be construed as legal advice. Contact your credit unions legal counsel for guidance on how this provision will affect your credit union’s policies and procedures.