HB1211 — Changes to Existing Law | SD Legislature Tracker

NEW SECTION added to Chapter 34-20

G: The department shall produce a digital registry identification card with features to ensure that: (1) Use of the digital registry identification card does not require handing over one's electronic device to any other person; (2) Any remote access to the digital registry identification card requires the express, affirmative, real-time consent of the cardholder for each piece of information being requested and is limited to information that is provided on a printed, hard copy registry identification card; (3) The digital registry identification card, as well as any mobile application required for the digital registry identification card, does not contain or collect any information that is not necessary for the functioning of the digital registry identification card or mobile application; (4) No part of the system or technology involved in a digital registry identification card and utilized by the department will disclose any data regarding a cardholder's presentation of the digital registry identification card to law enforcement or to a dispensary; (5) A digital registry identification card, as well as any mobile application required for the digital registry identification card, is encrypted and protected to the highest reasonable security standards that are broadly available, such that information cannot be intercepted while being transmitted from the department; (6) Any data exchanged between the department and the provider of any electronic device, and between any electronic device and the provider of that electronic device, is limited to the data necessary for a digital registry identification card; (7) A digital registry identification card provides for selective disclosure and allows attribute authentication, including proof of certification status; and (8) Any contract between the department and another entity concerning digital registry identification cards prohibits the use, sharing, sale, and disclosure of any information obtained and provides that, upon the termination or expiration of the contract, the entity shall delete any data collected or generated in the activities of the contract. 31 The department shall provide for the issuance of digital registry identification cards 32 in such a manner as to detect and prevent the alteration, duplication, counterfeiting, 33 photographing, forging, or other modification of the digital registry identification card. 34