February 02, 2017
Hotel keeping copies of driver's license and debit card for 3 months
Dear Consumer Ed:
I stayed at a hotel in Georgia that required that I provide them with my driver’s license and debit card. It made me feel uncomfortable because I’m concerned my information will be compromised. The manager said they will keep a copy of my license and debit card for three months and then shred them. Is that legal? If it is, it shouldn’t be.
Consumer Ed says:
While it is not illegal for hotels to request and hold a copy of this information for a period of time, Georgia law does place limits on what information businesses can collect and requires that businesses take every reasonable action to ensure that no unauthorized person will have access to your personal information. The Federal Trade Commission also recommends to businesses that they keep sensitive data in their system only as long as they have a business reason to have it. Once that business need is over, they must properly dispose of it.
When you pay by check, debit, or credit card, some businesses often need more information about you so they can be assured of receiving payment. Businesses, like hotels or rental car companies that seek prepayment authorization for consumers, may request information as a means of assuring payment to the merchant and making sure consumers don’t spend more than they have. However, there are limitations to the information they can collect, as set forth by the Georgia Fair Business Practices Act.
A business may not:
- Imprint or copy your credit or debit card number as a condition of a purchase by check; or
- Require your personal or business telephone number when you make a purchase by credit or debit card, except as noted below.
A business may:
- Request your driver’s license number for check or credit card purchases;
- Ask to see your credit or debit card as a form of identification when you pay with a check;
- Record the type of credit card and expiration date on your check;
- Record a credit card number and expiration date, if the credit card company has agreed to guarantee checks as a special service to its cardholders;
- Record your address and telephone number when you pay by check; and
- Record your address and telephone number when you pay by credit or debit card for shipping, installment, delivery or a special order.
The Federal Trade Commission suggests that, if businesses decide that they must keep information for business reasons or to comply with the law, businesses should develop a written records retention policy to identify what information must be kept, how to secure it, how long to keep it, and how to dispose of it securely when you no longer need it. So, if you are concerned about the hotel keeping your records on file for three months, you may want to reach out to the hotel regarding its record retention policies or even request that the hotel destroy any copies of your personal information once it has completed the authorization process and they no longer need it for business reasons or to comply with the law.
Remember, if you believe that you might be a victim of identity theft, you should report this to the police and request that the national credit bureaus place a fraud alert on your credit reports. You should also notify banks and creditors involved of questionable charges or accounts, keep records of all telephone calls and follow up in writing with credit bureaus, banks, and creditors. Additional information about protecting yourself from identity theft can be found here.