Idaho law limits use of digital ID, bans compelled adoption

Idaho Governor Brad Little has signed into law Senate Bill 1299, which limits how public entities can use digital identification while stopping short of some of the stronger remedies included in the bill’s original version.

The result is a law that still places meaningful limits on mandatory digital ID and related device access, but with enforcement mechanisms that are more restrained than what lawmakers first proposed. The act takes effect July 1.

The new law adds a new section to Idaho code defining digital identification as an electronic credential issued by a public entity and stored or displayed on a personal electronic device to establish a person’s identity, age, or legal status.

It defines “public entity” broadly to include the state, agencies, political subdivisions, and contractors acting on the state’s behalf.

At the heart of the measure is a ban on compelled use. Public entities may not require anyone to obtain, maintain, present, or use digital identification, and they may not deny, delay, condition or reduce any service, benefit, license, employment, education, or access because a person refuses or is unable to use it.

The law also states that physical, non-digital identification authorized under Idaho law remains valid for all governmental purposes.

The statute also includes device privacy protections. A public entity may not require a person to surrender, unlock, or relinquish control of a personal electronic device for identity verification, and presenting digital identification does not constitute consent to search or access any other contents of the device.

It further limits digital identification to immediate identity verification and bars public entities from tracking individuals, retaining identity data beyond a transaction, or using digital identification as a universal or shared credential across agencies.

But the final law is narrower on remedies than the introduced bill. The original version said information incidentally observed on a device could not be used to establish probable cause or justification for further search or seizure, and it allowed statutory damages of $500 to $2,500 per violation along with civil penalties of up to $5,000 for knowing violations after notice and an opportunity to cure.

A Senate amendment stripped those provisions out. In their place, the final law gives the Idaho attorney general authority to enforce the statute after written notice and a 15-day cure period.

If a violation is not cured, the attorney general may seek injunctive relief in district court.

Aggrieved individuals may still bring actions for declaratory or injunctive relief, and prevailing plaintiffs may recover attorney’s fees and costs, but the specific statutory damages and civil penalty provisions from the introduced bill are gone.

The amendment also says no public employee is personally liable for actions taken within the scope of employment.

Article Topics

biometrics  |  data privacy  |  digital ID  |  Idaho  |  legislation  |  United States