Relating to private entity requirements concerning biometric data, and providing civil penalties

_____ the explanation’s substance by the members of the general assembly. This bill relates to private entity requirements concerning biometric data. The bill defines “biometric data” as any information about or based on an individual’s biometric identifier. The bill defines “biometric identifier” as an individual’s retina, iris, fingerprint, voice, hand, facial geometry, or other physical feature that is inherently tied to a specific individual; is considered permanent, difficult to replicate, and remains relatively stable over time; and is unique enough to identify a person with a high degree of accuracy. The bill lists several instances of what is not included within the definition of “biometric identifier”. The bill also defines “department”, “private entity”, and “subject”. The bill requires each private entity in possession of biometric data to develop a written policy to establish a schedule for how long the private entity will retain biometric data before the private entity destroys the biometric data. The written policy must be available to the public, and the private entity cannot retain biometric data for more than three years after the subject of the biometric data last interacts with the private entity or until the purposes for which the biometric data was collected have been accomplished, whichever is longer. The bill prohibits a private entity from collecting, capturing, purchasing, or otherwise obtaining an individual’s biometric data unless, prior to receiving the biometric data, the private entity informs the subject of the biometric data, or the subject’s legal representative, in writing, that the private entity intends to collect the subject’s biometric data, and for what purposes and length of time the private entity intends to retain the biometric data. _____ data. The bill requires a private entity to store, transmit, and protect biometric data using reasonable methods that are widely accepted within the private entity’s industry and are equivalent to, or more protective than, the manner in which the private entity protects passwords and other information that can be used to provide access to an individual’s account or property. The bill does not apply to an employer that uses an employee’s biometric data solely within the scope of the employee’s employment. The bill requires the department of inspections, appeals, and licensing (DIAL) to enforce the bill and seek injunctive relief for a violation of the bill. The bill requires DIAL to establish electronic means for an individual to report a violation of the bill. If a private entity in violation of the bill has not previously violated the bill, the bill requires DIAL to send notice to the private entity to inform the private entity of the violation and allow the private entity 30 calendar days to cure the violation. A private entity that violates the bill is subject to a $1,000 civil penalty for a first violation; a $5,000 civil penalty for a second violation, regardless of whether the private entity cured a first violation; and a $10,000 civil penalty for a third or subsequent violation. Collected civil penalties shall be deposited into the general fund of the state. _____ right of action.