Bill > HB5567

This bill establishes the Biometric Information Privacy Act, which aims to regulate how private entities (businesses and organizations, but not government agencies) collect, use, store, and destroy biometric identifiers, such as fingerprints, iris scans, or facial geometry, and biometric information, which is data derived from these identifiers. The act clarifies that biometrics are unique and cannot be changed if compromised, unlike Social Security numbers, and acknowledges public concern over their use. Before collecting any biometric data, private entities must inform individuals in writing about the specific purpose and duration of collection, storage, and use, and obtain a written release from the individual. Private entities are prohibited from selling, leasing, or trading biometric data, and can only disclose it with consent, to complete a requested transaction, or if legally required by law or a court order. They must also develop a public policy for retaining and destroying this data, typically within three years of the last interaction, and protect it with a reasonable standard of care, at least as well as they protect other confidential information. Individuals harmed by violations of this act can sue for damages, including liquidated damages of $1,000 for negligence or $5,000 for intentional or reckless violations, plus attorney fees and other relief. The act also specifies that it does not affect court proceedings, federal health privacy laws (HIPAA), financial institutions covered by the Gramm-Leach-Bliley Act, or government contractors working for state or local agencies.

Health and Social Services

http://www.wvlegislature.gov/Bill_Status/Bills_history.cfm?input=5567&year=2026&sessiontype=RS&btype=bill