Alabama Data Breach Notification Act

Restaurant and Hospitality Client Alert - ID Scanner Data Breach

M. Jansen Voss is investigating a possible data breach at IDScan.net that may have affected bar and restaurant clients. IDScan.net provides hardware and software for ID scanning and age verification. Many bars and restaurants nationwide use the service, including those in Alabama. The IDScan.net data breach may have exposed over 150 million driver's license scans.

For more information see:

• FBI Probes Service

• Notification of Data Security Incident

Alabama Data Breach Notification Act

If you use IDScan.net for ID scanning at your bar or restaurant and have received a notice from IDScan of potential unauthorized access to your customers’ driver’s licenses, the Alabama Data Breach Notification Act (Ala. Code § 8-38-1 through 8-38-12) may require you to notify these customers. A notice under the Alabama Data Breach Notification Act must include, at a minimum: (1) the date, estimated date, or estimated date range of the breach; (2) a description of the sensitive personally identifying information acquired; (3) a general description of actions taken to restore security and confidentiality; (4) a general description of steps the individual can take to protect against identity theft; and (5) contact information for your business and for IDScan. Notices must be mailed to the individual’s last known address or sent by email to the email address on file. Substitute notices (via the bar’s website and print/broadcast media) are permitted in certain circumstances. If the number of affected individuals exceeds 1,000, the bar must also provide written notice to the Alabama Attorney General, including a synopsis of the breach events, the approximate number of affected Alabama individuals, any free breach-related services being offered with instructions, and contact information for the bar’s designated employee or agent.

Timing is critical. All individual notifications must be made “as expeditiously as possible and without unreasonable delay,” but in no event later than 45 days from the date the bar or restaurant receives notice from the third-party vendor of a breach, or from its own determination that a breach occurred and is reasonably likely to cause substantial harm. The same 45-day deadline applies to Attorney General notification when required.

As a "third-party agent" under the Act, IDScan.net must cooperate with the bar or restaurant and provide any information it possesses so the bar or restaurant can comply with its notice obligation.

What action should a bar or restaurant take if it receives notice of a potential breach from IDScan?

1. Engage legal counsel.
2. Confirm breach details with IDScan.
3. Notify affected customers within 45 days.
4. Notify the Alabama Attorney General if more than 1,000 customers must be notified.

Do you really need to retain the customer's driver's license information?

If you use ID scanning software (IDScan or any other provider), understand exactly what you are collecting and what the provider retains. The provider generally allows the bar or restaurant to select which, if any, data is retained and for how long. Consider whether you really need to retain driver's license information at all. If you decide it is in your interest to retain information, retain the minimum necessary. For example, consider retaining customers' names and ZIP codes rather than dates of birth, addresses, photos, and license numbers.

M. Jansen Voss helps clients avoid problems and resolves issues both inside and outside the courtroom. He represents a diverse range of businesses, government entities, and professionals in high-stakes, complex personal injury and wrongful death lawsuits. Jansen's clients include international, national, and large regional corporations across the Southeast.

About Christian & Small

Christian & Small LLP serves a diverse client base across Alabama, the Southeast, and nationwide, including individuals, closely held businesses, and Fortune 500 companies. By pairing highly experienced lawyers with clients’ specific needs, Christian & Small delivers innovative, effective, and efficient solutions tailored to each client. With offices in Birmingham and Mobile, Alabama, and Jackson, Mississippi, Christian & Small specializes in litigation and business law and is a member of the International Society of Primerus Law Firms. Our corporate social responsibility initiatives focus on education, and diversity remains one of Christian & Small’s core values.

No representation is made that the quality of legal services to be performed is greater than the quality of legal services performed by other lawyers.