Can a Texas bank scan the magnetic stripe on a customer's driver's license to verify identity?

Plain-English summary

A House committee chair (following up on his predecessor's request) asked the Attorney General whether a bank could use the information encoded on the magnetic stripe of a Texas driver's license. The concern came from banks: the recently enacted USA Patriot Act of 2001, especially its anti-money-laundering title (title 3, the International Money Laundering Abatement and Anti-Terrorism Financing Act of 2001), imposed new customer-identification and due-diligence duties, and bankers wondered whether complying with those federal duties amounted to a "governmental purpose" that would let them read the magnetic stripe despite Texas law.

The Attorney General concluded the answer was no on both points. Section 521.126 of the Transportation Code bars putting more than the printed information and a physical description on a license in electronically readable form, requires that the magnetic stripe information be used only for "law enforcement and governmental purposes," and makes unauthorized use a Class A misdemeanor. A prior opinion (JC-0337) had read that to mean only law enforcement and governmental personnel may use the data. The Legislature later created one narrow exception, in Alcoholic Beverage Code section 109.61, allowing access to enforce the alcoholic-beverage laws (for example, to check ages), and the Department of Public Safety's rule reflects that single carve-out. A bill in the same legislative session (Senate Bill 293) would have added an affirmative defense for bank employees capturing the information for financial transactions or to comply with federal or state law, but it was not enacted. So bank personnel remained outside the permitted users.

On preemption, the opinion worked through the Patriot Act and concluded it did not displace section 521.126. The Act does not expressly require financial institutions to be able to read state driver's-license magnetic stripes. Its section 312 due-diligence requirements (for private banking and foreign correspondent accounts) and section 326 customer-identification requirements call for banks to verify identity and guard against money laundering, but neither the statute nor the then-proposed regulations required banks to present or verify driver's licenses, much less to read their magnetic stripes. Because a bank could satisfy the federal duties by other means, it was not "impossible" to comply with both federal and Texas law, and Texas law did not stand as an obstacle to the federal objectives, so there was no conflict preemption under the Supremacy Clause. The opinion did note one caveat: the Treasury Secretary had not yet issued the section 326 regulations, and if future regulations required banks to access such electronically readable information, those regulations might preempt section 521.126. At the time, though, no such regulations existed.

Currency note

This opinion was issued in 2002. Subsequent statutory amendments, court decisions, or later Attorney General opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here. The opinion itself flagged that federal Treasury regulations under the Patriot Act were still pending and could change the preemption picture, and those federal customer-identification rules were in fact finalized after this opinion issued.

What the opinion meant for those who asked

The committee and the Legislature (what the opinion held): The opinion held that, as the law then stood, section 521.126 still barred bank access to driver's-license magnetic stripe data, the only statutory exception being for alcoholic-beverage enforcement, and that the Legislature had declined (in Senate Bill 293) to add a banking exception.

Banks and financial institutions (what the opinion held): The opinion held that bank personnel were not authorized to read the magnetic stripe, and that the Patriot Act's identity-verification and due-diligence duties did not require or authorize them to do so, because those duties could be met by other means.

The Department of Public Safety (what the opinion held): The opinion held that DPS's rule correctly limited magnetic stripe access to law enforcement and governmental agency personnel, subject only to the alcoholic-beverage carve-out.

Common questions

Could a Texas bank scan a driver's license magnetic stripe to verify a customer in 2002?
Under this opinion, no. Section 521.126 of the Transportation Code limited that data to law enforcement and governmental purposes, and bank personnel were not within the exception.

Didn't the USA Patriot Act require banks to verify customer identity?
It required identity verification and anti-money-laundering due diligence, but the opinion concluded it did not require reading driver's-license magnetic stripes specifically. Banks could comply by other means.

What was the only exception to the Texas restriction?
Alcoholic Beverage Code section 109.61 allowed access to enforce the alcoholic-beverage laws, such as checking ages. The Legislature considered but did not pass a banking exception (Senate Bill 293).

Could that change later?
The opinion said yes, potentially. If the U.S. Treasury issued regulations under section 326 of the Patriot Act that required banks to access this electronically readable information, those regulations might preempt section 521.126. None existed when the opinion issued.

Background and statutory framework

Section 521.126 of the Transportation Code prohibits placing more than the printed information and a physical description in electronically readable form on a license, requires the magnetic stripe information to be used only for law enforcement and governmental purposes, and makes unauthorized use a Class A misdemeanor. Tex. Transp. Code Ann. § 521.126 (Vernon Supp. 2002). Attorney General Opinion JC-0337 (2001) read the provision to limit use to law enforcement and governmental personnel. The Legislature created one exception in Alcoholic Beverage Code section 109.61, allowing access to comply with the alcoholic-beverage laws, reflected in the Department of Public Safety's rule. Tex. Alco. Bev. Code Ann. § 109.61(a) (Vernon Supp. 2002); 37 Tex. Admin. Code § 15.47(b) (2002). Senate Bill 293, which would have added a financial-institution affirmative defense, was not enacted.

The USA Patriot Act of 2001 imposes anti-money-laundering due-diligence requirements (section 312) and customer-identification requirements (section 326), implemented through Treasury regulations at 31 C.F.R. part 103. USA Patriot Act of 2001, Pub. L. No. 107-56, 115 Stat. 272, §§ 302(a)(2), 302(b)(11), 312, 326. Under the Supremacy Clause, a state law is preempted if it conflicts with federal law, including where compliance with both is impossible or where state law obstructs federal objectives, but federal law does not displace a state's historic police powers absent a clear and manifest congressional purpose. U.S. Const. art. VI, cl. 2; Hyundai Motor Co. v. Alvarado, 974 S.W.2d 1, 4 (Tex. 1998). The opinion concluded the Patriot Act neither expressly required banks to read driver's-license magnetic stripes nor made it impossible to comply with both bodies of law, so section 521.126 was not preempted, subject to the possibility of future section 326 regulations.

Citations

Statutes and federal authorities:

• Tex. Transp. Code Ann. § 521.126 (Vernon Supp. 2002)
• Tex. Alco. Bev. Code Ann. § 109.61(a) (Vernon Supp. 2002)
• 37 Tex. Admin. Code § 15.47(b) (2002)
• USA Patriot Act of 2001, Pub. L. No. 107-56, 115 Stat. 272 (§§ 302(a)(2), 302(b)(11), 312, 326)
• U.S. Const. art. VI, cl. 2
• 31 C.F.R. pt. 103

Cases:

• Hyundai Motor Co. v. Alvarado, 974 S.W.2d 1, 4 (Tex. 1998)

Prior Attorney General materials referenced: Tex. Att'y Gen. Op. Nos. JC-0499 (2002), JC-0423 (2001), JC-0337 (2001).

Source

• Landing page: https://www.texasattorneygeneral.gov/opinions/john-cornyn/jc-0540
• Original PDF: https://www.texasattorneygeneral.gov/sites/default/files/opinion-files/opinion/2002/jc0540.pdf

Original opinion text

Best-effort transcription from the official PDF. Minor extraction artifacts were corrected; the linked PDF is authoritative.

OFFICE OF THE ATTORNEY GENERAL - STATE OF TEXAS
JOHN CORNYN

August 7, 2002

The Honorable Burt Solomons Opinion No. JC-0540
Interim Chair, House Committee on
Financial Institutions Re: Whether a bank may use information
Texas House of Representatives contained in the magnetic stripe of a driver's
P.O. Box 2910 license (RQ-0514-JC)
Austin, Texas 78768-2910

Dear Representative Solomons:

Your predecessor asked this office for an interpretation of section 521.126 of the Transportation Code, which restricts the use of the magnetic stripe information on a Texas driver's license to law enforcement and governmental purposes.[1] He suggested that the recent enactment of the USA Patriot Act of 2001 (the "Act"), Public Law 107-56, and in particular of title 3 of that Act, the International Money Laundering Abatement and Anti-Terrorism Financing Act of 2001, might require a reconsideration of the conclusion of Attorney General Opinion No. JC-0337 (2001) that "[magnetic stripe information] may be used only by law enforcement and other governmental officials." See Tex. Att'y Gen. Op. No. JC-0337 (2001) at 1. While that interpretation of section 521.126 has been partially overruled by an amendment to the Alcoholic Beverage Code, see TEX. ALCO. BEV. CODE § 109.61 (Vernon Supp. 2002); Tex. Att'y Gen. Op. Nos. JC-0423 (2001), JC-0499 (2002), the "general prohibition against use of driver's license magnetic strips in the Transportation Code," remains in full force and effect. Tex. Att'y Gen. Op. No. JC-0499 at 9. Section 521.126 does not permit bank personnel to use magnetic stripe information. See TEX. TRANSP. CODE ANN. § 521.126 (Vernon Supp. 2002). By its terms, the Act does not preempt section 521.126. See USA Patriot Act of 2001, Pub. L. No. 107-56, 115 Stat. 272. So far as we have determined, relevant federal regulations under section 326 of the Act, concerning means of identifying customers of financial institutions, have not yet been proposed or published by the United States Secretary of the Treasury as the Act mandates. See id. § 326(a)(1). Due diligence requirements have been proposed under section 312 of the Act; but nothing in those requirements would preempt section 521.126 of the Transportation Code. See id. § 312(b)(1). It is possible that future federal regulations under section 326 might preempt Texas law. However, at this time they do not do so.

Section 521.126 of the Transportation Code reads:

(a) The department [of Public Safety] may not include any information on a driver's license, commercial driver's license, or identification certificate in an electronically readable form other than the information printed on the license and a physical description of the licensee.

(b) The department shall take necessary steps to ensure that the information is used only for law enforcement and governmental purposes.

(c) Unauthorized use of the information is a Class A misdemeanor.

TEX. TRANSP. CODE ANN. § 521.126 (Vernon Supp. 2002) (emphasis added).

This office first interpreted this provision in Texas Attorney General Opinion No. JC-0337 (2001). In that opinion, we were asked to consider who might use such magnetic stripe information and for what purpose. The particular basis for the opinion request was a proposed rule by which the Department of Public Safety would have restricted the use of magnetic stripe information to "law enforcement and governmental agency personnel acting in their official capacity." See Tex. Att'y Gen. Op. No. JC-0337 (2001) at 2. Attorney General Opinion No. JC-0337, based largely on the legislative history of the provision, concluded that the Department of Public Safety's interpretation of the statute was correct. See id. at 5.

The Seventy-seventh Legislature modified the result of Attorney General Opinion No. JC-0337 for the specific purposes of the Alcoholic Beverage Code by the adoption of Alcoholic Beverage Code section 109.61, which provides in relevant part:

(a) A person may access electronically readable information on a driver's license, commercial driver's license, or identification certificate for the purpose of complying with this code or a rule of the [Alcoholic Beverage] commission, including for the purpose of preventing the person from committing an offense under this code.

TEX. ALCO. BEV. CODE ANN. § 109.61(a) (Vernon Supp. 2002). See also Tex. Att'y Gen. Op. Nos. JC-0499 (2002) (state law does not permit private clubs to use or retain electronically readable information to obtain member's driver's license numbers for purpose of creating and maintaining membership lists); JC-0423 (2001) (use of magnetic stripe information to prevent under-age drinking does not violate federal Driver's Privacy Protection Act).

"Consistent with this statutory scheme," Tex. Att'y Gen. Op. No. JC-0499 (2002) at 8, the Department of Public Safety has restricted access to magnetic stripe information by rule:

Except for purposes of complying with the Texas Alcoholic Beverage Code or a rule adopted by the Texas Alcoholic Beverage Commission, . . . only law enforcement and government agency personnel acting in their official capacity can utilize the information provided in this format.

37 TEX. ADMIN. CODE § 15.47(b) (2002). The only exception to the prohibition against private access to electronically readable driver's license information thus has to do with the enforcement of laws and rules regarding alcoholic beverages. Neither section 521.126 nor the Department of Public Safety's rule would permit access to such information by the personnel of private financial institutions.

A bill considered by the Seventy-seventh Legislature, Senate Bill 293, would have limited the scope of section 521.126 by making it an affirmative defense to prosecution under section 521.126 that a person accessing the electronically readable information was an officer or employee of a financial institution transcribing information in the course of a financial transaction, or capturing and maintaining that information in order to comply with federal or state law. However, Senate Bill 293 was not enacted by the legislature. Subject only to the limited exception afforded by section 109.61 of the Alcoholic Beverage Code, section 521.126's prohibition on the use of the information encoded on the magnetic stripe for any but "law enforcement and governmental purposes" by law enforcement and governmental personnel remains in effect.

A letter sent to the attention of your predecessor by the Independent Bankers Association of Texas, however, suggests that a governmental purpose may be presented by the USA Patriot Act of 2001, and in particular by title 3 of the Act, the International Money Laundering Abatement and Anti-Terrorism Financing Act of 2001. See Attachment to Request Letter, supra note 1, at 1-3. Passed by the Congress in response to the attacks on the United States perpetrated on September 11, 2001, the Act is intended to provide new methods to combat the perils of international terrorism.[2]

Title 3 of the Act finds that "money laundering, and the defects in financial transparency on which money launderers rely, are critical to the financing of global terrorism and the provision of funds for terrorist attacks." USA Patriot Act of 2001 § 302(a)(2). Accordingly, it seeks "to ensure that all appropriate elements of the financial services industry are subject to appropriate requirements to report potential money laundering transactions to proper authorities, and that jurisdictional disputes do not hinder examination of compliance by financial institutions with relevant reporting requirements." Id. § 302(b)(11).

Among the new requirements of title 3 of the Act are expanded due diligence requirements for private banking and correspondent bank accounts involving foreign persons and institutions under section 312, and minimum standards for the identification of persons applying to open accounts with financial institutions under section 326. Section 312(a) requires financial institutions that establish, maintain, administer, or manage private banking accounts or correspondent accounts for foreign nationals and banks to "establish appropriate, specific, and, where necessary, enhanced, due diligence policies, procedures, and controls that are reasonably designed to detect and report instances of money laundering through those accounts." Id. § 312(a)(1). Subparagraph (a)(2)(B) of section 312 requires banks that maintain correspondent accounts for offshore banks, or banks licensed in countries judged either by the United States to be uncooperative in efforts against money laundering or by the Secretary of the Treasury to warrant special measures because of such concerns, to take enhanced due diligence measures. See id. § 312(a)(2)(B). Such procedures require, among other things, that the financial institution take reasonable steps to ascertain the ownership of the foreign bank, to conduct enhanced scrutiny of the account to guard against money laundering, and to find out to which other banks the foreign bank itself may provide correspondent accounts. See id. Further, subparagraph (a)(3) requires the financial institution to take steps to ascertain the identity of the nominal and beneficial owners of private banking accounts held by foreign nationals so as to guard against money laundering, and to conduct "enhanced scrutiny" of such accounts maintained by senior foreign political officials, their family members, and close associates. See id. § 312(a)(3).

Proposed regulations to implement section 312 were published in the Federal Register by the United States Department of the Treasury and the Financial Crimes Enforcement Network on May 30, 2002. See Due Diligence Anti-Money Laundering Programs for Certain Foreign Accounts, 67 Fed. Reg. 37,736-44 (proposed May 30, 2002) (to be codified at 31 C.F.R. pt. 103). Under the proposed regulations, which if adopted will become in relevant part 31 C.F.R. §§ 103.175-.178, financial institutions are required to maintain due diligence programs for correspondent accounts maintained for foreign financial institutions, including "policies, procedures, and controls that are reasonably designed" to allow a financial institution to detect and report money laundering through those accounts. See Prop. 31 C.F.R. § 103.176(a). The proposed regulations further require, in certain instances, documentation of any other foreign banks for which the foreign bank in question itself maintains correspondent accounts and the identification of the foreign bank's owners. See id. § 103.176(b). They also require financial institutions to take reasonable steps to ascertain the identity of nominal or beneficial owners of the private banking accounts of foreign nationals, to ascertain whether such nominal or beneficial owners include senior foreign political figures, and to take reasonable steps, in such instances, "to detect and report transactions that may involve the proceeds of foreign corruption." Id. § 103.178(c)(2). It should be noted that, while both section 312 of the Act and the proposed implementing regulations speak of the necessity for banks to exercise due diligence in the identification of certain persons or entities, neither the statute nor the proposed rules require the presentation or, more significantly, the verification by the bank of driver's licenses for the purpose of such identification, whether through electronically readable information or by any other means.

Section 326 of the Act focuses on requirements of verification of identity. See USA Patriot Act of 2001 § 326. It requires the Secretary of the Treasury to prescribe regulations that will set minimum standards for financial institutions with respect to customer identification in connection with the opening of an account, including reasonable procedures for verifying the identity of any person seeking to open an account, maintaining records of the information used for that purpose, and consulting information provided by any government agency that might identify such a person as a known or suspected terrorist. See id. § 326(a). We are unaware at the time of this writing of any proposed regulations implementing section 326.

The Constitution and laws of the United States are "the supreme Law of the Land . . . any Thing in the Constitution or Laws of any State to the Contrary notwithstanding." U.S. CONST. art. VI, cl. 2 (the "Supremacy Clause"). As the Texas Supreme Court explained the preemptive effect of federal law under the Supremacy Clause in 1998:

A state law is preempted and "without effect" if it conflicts with federal law. A federal law may expressly preempt state law. Additionally, preemption may be implied if the scope of the statute indicates that Congress intended federal law to occupy the field exclusively or when state law actually conflicts with federal law. A state law presents an actual conflict with federal law when "it is impossible for a private party to comply with both state and federal requirements" or where state law "stands as an obstacle to the accomplishment and execution of the full purposes and objectives of Congress."

Hyundai Motor Co. v. Alvarado, 974 S.W.2d 1, 4 (Tex. 1998) (citations omitted). Federal law, however, does not supersede a state's "historic police powers . . . unless that [is] the clear and manifest purpose of Congress." Id. at 5 (citations omitted).

Nothing in the USA Patriot Act of 2001 of which we are aware expressly requires financial institutions to have the power to access electronically readable information from state-issued driver's licenses. Nor would it be impossible for financial institutions in the exercise even of heightened due diligence to acquire the information about their customers required by title 3 of the Act by means other than such access, although it is certainly possible that such access would be of use to them. If the Secretary of the Treasury were to promulgate regulations implementing section 326 of the Act that required banks to have access to such electronically readable information, then such regulations, which the Secretary is authorized to promulgate under the Act, might preempt section 521.126 of the Transportation Code. However, there are at the present time no such regulations.

SUMMARY

Section 521.126 of the Texas Transportation Code does not permit financial institutions to access magnetic stripe information on Texas driver's licenses. The restrictions on access to magnetic stripe information on Texas driver's licenses under section 521.126 of the Texas Transportation Code are not preempted by the USA Patriot Act of 2001, Pub. L. No. 107-56.

Very truly yours,

JOHN CORNYN
Attorney General of Texas

HOWARD G. BALDWIN, JR.
First Assistant Attorney General

NANCY FULLER
Deputy Attorney General - General Counsel

SUSAN DENMON GUSKY
Chair, Opinion Committee

James E. Tourtelott
Assistant Attorney General, Opinion Committee

[1] Letter from Honorable Kip Averitt, Chair, Committee on Financial Institutions, Texas House of Representatives, to Honorable John Cornyn, Texas Attorney General (Feb. 19, 2002) (on file with Opinion Committee) [hereinafter Request Letter]; Letter from Christopher L. Williston, President and CEO, Independent Bankers Association of Texas, to Honorable Kip Averitt, Chair, Committee on Financial Institutions, Texas House of Representatives (Jan. 7, 2002) (on file with Opinion Committee) [hereinafter Attachment to Request Letter].

[2] Press Release, The Department of the Treasury, Office of Public Affairs, Remarks on the Patriot Act of Treasury Under Secretary for Enforcement Jimmy Gurule Before the Bankers Association for Finance and Trade (Mar. 12, 2002), available at http://www.ustreas.gov/press/releases/po1082.htm (last visited May 24, 2002).