Bill > A06031

This bill, titled the "Biometric Identifier Privacy Act," establishes new regulations for private entities that possess biometric identifiers or biometric information, which are defined as data generated from an individual's biological or behavioral characteristics (like fingerprints or voiceprints) used to identify them, excluding certain health, research, or descriptive data. The act mandates that these private entities must create and publicly share a written policy outlining a schedule for permanently destroying this sensitive data once it's no longer needed for its original purpose or within three years of the individual's last interaction, whichever comes first. Before collecting any biometric data, private entities must inform individuals in writing about the specific purpose and duration of its collection and use, and obtain their explicit written consent, except in limited employment situations where it's strictly necessary for essential job functions or business operations. Furthermore, private entities are prohibited from selling, leasing, or trading biometric data, and can only disclose it with the individual's consent, to complete a requested financial transaction, as required by law, or under a court order. The Attorney General is empowered to enforce these provisions, with violations potentially leading to civil penalties and individuals being able to bring civil actions for damages, including attorneys' fees, and class actions for systemic violations.