Bill > S01422

This bill, titled the "Biometric Identifier Privacy Act," establishes new regulations for private entities that possess biometric identifiers or biometric information, which are defined as data generated from an individual's unique biological or behavioral characteristics (like fingerprints or facial scans) used for identification, excluding certain health, research, or demographic data. The core provisions require these private entities to create a public written policy outlining a schedule for permanently destroying biometric data once it's no longer needed for its original purpose or within three years of the individual's last interaction, whichever comes first. Before collecting or using such data, private entities must inform individuals in writing about the specific purpose and duration of collection and obtain their explicit written consent, with exceptions for employment if strictly necessary for essential job functions or business operations. The bill also prohibits private entities from selling, leasing, or trading biometric data and restricts its disclosure unless the individual consents, it's for a requested financial transaction, legally required, or under a court order. The Attorney General is empowered to enforce these provisions through investigations, lawsuits, and civil penalties of up to $20,000 per violation, and individuals can also bring civil actions for damages, attorneys' fees, and other relief.