ID Capture: Do’s and Don’t’s

For such a small amount of space, your drivers’ license contains a lot of info: your name and address, your license number, plenty of details about what you look like, and even some medical info.

Years ago, many states began making all of the information contained on drivers licenses available via the magnetic strip on the back of the ID card. The idea was to make it easier for law enforcement officials to get the information they needed more quickly and reliably.

However, software programs have also taken advantage of this strip, and of other digital technology, to make it easy to grab and store all the information on a driver’s license.

There are many reasons that businesses and organizations want this information, as we’ll discuss next. However, license scanning is primarily used for security purposes as an easy way to verify someone’s identity or keep a record of their visit.

As convenient as ID scanning may be for some purposes, it also presents a set of challenges and pitfalls that aren’t immediately obvious to owners and managers.

Here’s more about the do’s and don’ts of ID capture for your business.

The Need for Identity Verification

If you work for an organization that has special security and compliance needs, you know firsthand that making sure people are who they claim isn’t always easy.

Managers of restaurants and convenience stores have long struggled to verify customers’ ages for regulated purchases such as alcohol or tobacco. Security managers for manufacturing facilities also have a vested interest in visitor identity verification, and must comply with legal regulations that restrict access to their facilities. Medical clinics may need to verify patients’ identities, too, to ensure their insurance coverage. Even schools deal with identification challenges as they work to verify the parents and guardians of their students.

For all of these types of organizations, identity verification has often boiled down to checking IDs. However, ID checks aren’t foolproof.

People can use fake IDs and stolen IDs, for one. It can also be difficult to maintain consistency around which circumstances call for an ID verification. (When there are no records to show that identities have been verified consistently, it can lead to compliance issues, fines, and administrative headaches.)

Using software with a driver’s license scanner can solve some of these problems. Scans can quickly determine whether an ID is authentic. It can also make it easy for users to see the cardholder’s age. Some verification software even comes with facial recognition technology that can quickly assess whether the cardholder is the same person pictured on the ID card.

Privacy and Compliance

As we mentioned, driver’s licenses contain a lot of personal information. Attempting to collect all of that information from the people who pass through your facility can feel like a violation of privacy.

And in some cases, collecting the info may actually be against the law, such as in the case of the General Data Privacy Regulation (GDPR) in Europe. (For more on how the GDPR affects visitor management, click here to read our full article on the topic.)

The GDPR stipulates, among other things, that organizations must get people’s consent to collect and use any of their personal data — and that they can withdraw that consent at any time. Perhaps most importantly as it pertains to ID capture, though, the law requires that organizations be able to demonstrate a “legitimate interest” for all of the personal information they collect.

That’s a bit of an oversimplification, and, of course, you should consult a legal expert for more details. However, it’s safe to assume that each time you capture all the information from a driver’s license, you’re likely handling a bunch of very sensitive information that serves no legitimate business interest.

If you’re operating in Europe or are working with European citizens, the law applies to your operations directly. But you should still pay attention to these regulations even if they don’t apply to you yet. The GDPR represents general best practices when it comes to respecting privacy, regardless of your location. And it’s not unreasonable to expect that other, similar regulations might be coming to your jurisdiction soon.

In fact, some states in the U.S., such as Hawaii, have already begun to regulate how companies can handle the information collected from drivers’ licenses, and under which circumstances those licenses can be scanned by businesses.

Trust and Relationships

Even if your ID scans are completely legal and you can provide a legitimate interest for all of the information collected, there are other downsides to scanning ID cards. Namely, demanding an ID can inconvenience visitors and even make them uncomfortable.

They know that their ID cards contain a lot of sensitive information, and they know how quickly and easily digital information can be stolen and shared. Damage from a data breach is permanent.

Handing that card over for you to copy requires a degree of trust, and that trust may not have been established yet.

Plus, there’s real value in a pleasant, simple check-in or purchase process at your organization or business. A good check-in sets a visit up for success or paves the way for a loyal customer relationship. ID scans can add anxiety to the experience, plus a bit of inconvenience, especially if they weren’t expecting to present their IDs in this context.

How to Do ID Capture Right

For most companies, ID capture presents more of a risk than a benefit. If you’re just using the ID scanning as a shortcut to verify age or identity, manual checks are still very effective and don’t have the same privacy risks. If you need a record of who has been on site, there are safer and simpler alternatives, such as keeping temporary records of visitor’s email addresses and phone numbers, or even taking a photo of the visitor.

For most companies, ID capture presents more of a risk than a benefit. Click To Tweet

However, some companies’ with unique or specialized security needs might truly require an ID scan, and visitors may not balk at handing over a photo ID in those situations.

If you do choose to capture IDs, here are a few best practices.

• Choose a software that doesn’t keep a record of the license info. The information should only be shown to verify someone’s identity, and storing it isn’t necessary. Even with plenty of security precautions, the risk of a breach is always present, and the damages from such a breach could be catastrophic.
• If you must keep ID copies on record, invest heavily in your security efforts. For more on how to do that, check out our articles How Business Security Pays for Itself and 3 Ways Cyber Threats and Business Security Will Change in 2019.
• Make sure your data handling policies are clear to all employees. A good document management policy can specify how sensitive data should be handled, including which types of information are OK to store and when that information should eventually be deleted or destroyed.

Finally, if you’re looking for a simpler and more secure way to check visitors in, we invite you to try The Receptionist. Our visitor management software has been rated on Capterra and G2 Crowd as one of the very best in the industry. The Receptionist makes it easy to welcome visitors and keep relevant data while also prioritizing visitor privacy.

You can even try it for free for 14 days.