Is this a law that mandates scanning of IDs for authenticity purposes or storing that data?
The few other states I could easily find online that had a similar law typically require that retailers either don’t store the data or that they delete it within X days.
The shop might store the data or misuse it. This is already a solved problem. A privately signed identity that can be verified without transferring any of the data using a device the government provides.
But I already said government too much. This is all non-senses. Transactions should not be monitored.