Wal-Mart's Wine Kiosk Move Raises An Oak Barrel Full Of Legal Nightmares

Attorney Mark D. Rasch is the former head of the U.S. Justice Department's computer crime unit and today serves as Director of Cybersecurity and Privacy Consulting at CSC in Virginia.

With Wal-Mart now pushing wine kiosks on its customers, thanks to a favorable decision by the Pennsylvania Liquor Control Board, retailers that had been only casually thinking about it are preparing to move into the space. As a retail lawyer, I say, "Wait!"

Of the hundreds of types of kiosks out there today, none has anywhere near the legal liability issues that a wine kiosk does. Just a few of the issues include: age verification, determining whether the customer is already intoxicated, drunk-driving issues (what happens if in-store video captures someone buying and drinking wine and then the parking lot cameras see him driving away?) and records retention, along with some deliciously arcane laws involving alcohol sales in some states.

Wal-Mart's initial move will include 23 Pennsylvania stores, using the state's own self-serve wine kiosks. These kiosks have had mixed results, with some wine enthusiasts pushing back against the machines. But those are not legal issues and, believe me, these machines offer enough such issues to keep entire law firms gainfully employed.

Several legal issues relate to the sale of alcohol in the United States—whether by Joe the bartender, the liquor store, the grocery store, the retail outlet, the vending machine or, for that matter, the average suburban dad. Generally, these can be broken down into: (1) licensing, (2) liability for drunks and (3) legal age. How these issues shake out when it comes to booze kiosks depends, to a great extent, on how the program is implemented.

In every U.S. jurisdiction, to sell alcohol, you have to have an appropriate authorization from the state. And in this sense, I mean the state as in the State of New York, the State of New Jersey, the State of California, etc. In some jurisdictions, like the Commonwealths of Pennsylvania, Massachusetts and Virginia, for example, most alcohol sales are reserved for state-operated stores that are run by state employees, with taxes and revenues (including profits) from the sales going to the state.

In most other jurisdictions, the entity selling the alcohol must have an appropriate license from the state, with fees and liquor taxes going to the state. The licensing laws are frequently different for hard liquor (distilled spirits) than for beer or beer and wine. They also differ if alcoholic drinks are sold by the bottle or by the glass, and whether food is served or not. Suffice it to say, liquor sales laws are complicated.

In Pennsylvania, the only state where such kiosks are currently operating, only the commonwealth is permitted to distribute wine and spirits through a state-run store. Typically, the commonwealth will lease a storefront and use state employees to sell wine and spirits. The kiosk operates as a mini state store.

Although customers think they are going to Wal-Mart or Wegmans or the corner grocery store to pick up a bottle of Chardonnay, they are really going to a state-operated robo-store. The state leases the floor space from the retailer, the vending-machine manufacturer is paid a fee, and the state and the vending-machine manufacturer are responsible for running and maintaining the virtual store.

In other jurisdictions, your mileage may vary. If the law is interpreted to require the retailer to have a liquor-distribution license to keep the kiosk in the store, then the retailer might just as well sell the wine or spirits directly. Kiosks provide little advantage beyond customer convenience (assuming the machines work properly—those in Pennsylvania failed in December and had to be shut down.)So, who sells the alcohol in these jurisdictions? The retailer? The vending-machine manufacturer? Someone else? As previously stated, in Pennsylvania, it is the commonwealth.

Unlike normal retail situations, where the retailer buys (or sometimes leases) the refrigerated unit, owns the inventory (sometimes on consignment) and makes the sale for profit, these kiosks fundamentally change the nature of the sales relationship. In states such as Pennsylvania, where only the state can sell wine, the retailer can increase foot traffic and provide a service to customers (possibly drunk customers) with a kiosk. In other states, the retailer might reduce the regulatory burden on getting a liquor-distribution license if state law considers the kiosk a licensed store in an of itself. Which is it? We don't know yet.

Virtually every state has what is called a dram shop law that imposes civil and sometimes criminal liability for anyone who sells (and sometimes just distributes) alcohol to a person who is intoxicated. The standards vary widely by state, with some states (like Pennsylvania) allowing any party injured to sue the purveyor of potables. Thus, a drunk who buys liquor from the kiosk and then injures himself in a car accident could actually sue the seller—in this case, probably the Commonwealth of Pennsylvania. That is one of the reasons it is critically important to determine who, as a matter of law, is the seller of the alcohol in the robotic situation.

The machines themselves have mechanisms to prevent sales to intoxicated persons. The machines in use in Pennsylvania require the purchaser to insert a valid driver's license and a valid and matching credit card, and then to blow into a breathalyzer before a purchase can be made. The machine records the customer's name and driver's license information, if the sale goes through. The level of sobriety is set at a very low level—0.02 blood alcohol content (BAC). Thus, buying a Chardonnay after tasting a Chardonnay is probably difficult.

Under the Pennsylvania scheme, a live human being (a state employee) is supposed to view each and every transaction from a remote camera in Harrisburg and determine that the purchaser is, in fact, the person who presented the driver's license, that he matches the photo and, presumably, that he doesn't look drunk—at least not on closed-circuit TV.

This scheme requires the collection and transmission of a host of personal information. Although the kiosks themselves are advertised as PCI compliant, the PCI standards do not anticipate the transmission of real-time digital video or the collection, transmission, matching and authentication of driver's license data. If any of these data streams is hacked, it creates not only privacy but security issues. Again, it is important to determine who has responsibility for securing these data streams.

As you can imagine, if a person buys alcohol from a machine and gets into an accident that kills someone, the family of the deceased will ask the dumbest question you can ask a lawyer. "Can I sue?" Of course you can. But who would you sue under the dram shop acts? Who "sold" the alcohol? Who "served" the intoxicated person? All of these issues must be worked out. Short answer, we don't know yet.

Related to the issue of liability is the fact that every state has both civil and criminal law prohibiting the sale of alcohol to minors—generally defined as persons under the age of 21. The age verification scheme in the kiosk is similar in many ways to the one employed in most liquor stores: ID (a driver's license) is asked for (or demanded), and then someone looks at the picture and determines whether the person in the picture is the same as the person in the store.But in the store, you get a much better idea of the age of a person than you do on TV. You might also see the pair of 15 year olds hanging around outside the store waiting to take possession of the alcohol the purchaser just bought. So who has the responsibility for verifying age, and who has the criminal liability if it isn't done? It is, of course, the "seller." And who is the "seller" in this transaction? Stop me if you have heard this before—we don't know.

Another issue for robo-bartenders is one of records retention: by law, by policy and as a practical matter. Of course, certain records relating to the transaction have to be created and stored; the credit-card verification process, for example. Those records have to be maintained under PCI rules and under contracts with the financial institutions to validate the fact of, and the amount of, the transaction in question (the machines don't take cash.)

But what about the other information: the video stream, the breathalyzer data, the calibration of the breathalyzer, the driver's license data, the license verification information, the link showing that the purchaser's license was actually checked, the log records of refusals to show that a transaction was refused (and the reason for the refusal)? Are such records retained? Are they subject to discovery? Are they subject to grand jury subpoena? Can the police access such records?

Under the Pennsylvania scheme, the only records that are presumably kept are the PCI records related to the transaction, and logs of refusals. But I doubt that this is actually the case. The manufacturer must keep records relating to the maintenance of the kiosk and the embedded breathalyzer to show that it was working. If the state motor vehicle office verifies that the license is valid (as opposed to merely reading the barcode on the back of the license), then a record of this check may be kept, too.

All of these things are important, because of potential liability to the merchant. Imagine if a customer walks into the local Wal-Mart (captured on video) and tries to buy a bottle of wine but is refused because his BAC is 0.1—well above the legal limit. The disgruntled and intoxicated customer now staggers to the parking lot, where he runs over an elderly couple (also captured on video).

The store might be deemed to have known—or reasonably should have known—that the driver was drunk. A jury might determine that the store should have done something to stop him (even though it didn't serve him). And what if a person is arrested in the parking lot for DUI and wants to subpoena the records of the robo-vendor to show that he successfully bought alcohol, thereby creating a prima facia case that he was not drunk? Do these records exist?

Unlike a human being, a kiosk cannot exercise judgment. It cannot (unless programmed to) confiscate the fake ID used by an underage college student. It cannot determine if the consumer is acting "weird" or dangerous. It cannot report to the police a criminal attempt to purchase alcohol unlawfully. It can only dispense its contents under circumstances where it is programmed to do so. So that kiosk in your store can be programmed to be a licensed liquor store or a mini police precinct. It may be more trouble than it is worth.

If you disagree with me, I'll see you in court, buddy. If you agree with me, however, I would love to hear from you.