,,ii #aafth ,,congress #b;d ,session ,s4 #ddjj ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,august #c1 #bjbj,mr4 ,merkley 7for himself and ,mr4 ,sanders7 introduced the following bill2 which was read twice and referred to the ,committee on the ,judiciary ,a ,,bill ,to regulate the collection1 retention1 disclosure1 and destruction of biometric information1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,national ,biometric ,information ,privacy ,act of #bjbj4 #b4 ,definitions ,in this ,act3 7#a7 ,biometric identifier ,the term biometric identifier-- 7,a7 includes-- 7i7 a retina or iris scan2 7ii7 a voiceprint2 7iii7 a faceprint 7including any faceprint derived from a photograph72 7iv7 fingerprints or palm prints2 and 7v7 any other uniquely identifying information based on the characteristics of an individual's gait or other immutable characteristic of an individual2 7,b7 does not include writing samples1 written signatures1 photographs1 human biological samples used for valid scientific testing or screening1 demographic data1 tattoo descriptions1 or physical descriptions such as height1 weight1 hair color1 or eye color2 7,c7 does not include donated organs1 tissues1 or parts or blood or serum stored on behalf of recipients or potential recipients of living or cadaveric transplants and obtained or stored by a federally designated organ procurement agency2 7,d7 does not include information captured from a patient in a health care setting for a medical purpose or information collected1 used1 or stored for health care treatment1 payment1 or operations under the ,health ,insurance ,portability and ,accountability ,act of #aiif 7,public ,law #ajd-aia72 and 7,e7 does not include an x ray1 roentgen process1 computed tomography1 ,,mri1 ,,pet scan1 mammography1 or other image or film of the human anatomy used to diagnose1 prognose1 or treat an illness or other medical condition or to further validate scientific testing or screening4 7#b7 ,confidential and sensitive information ,the term confidential and sensitive information-- 7,a7 means personal information that can be used to uniquely identify an individual or an individual's account or property2 and 7,b7 includes genetic markers1 genetic testing information1 unique identifier numbers to locate accounts or property1 account numbers1 personal identification numbers1 pass codes1 driver's license numbers1 or ,social ,security numbers4 7#c7 ,private entity ,the term private entity-- 7,a7 means any individual1 partnership1 corporation1 limited liability company1 association1 or other group1 however organized2 and 7,b7 does not include any ,federal1 ,state1 or local government agency or academic institution4 7#d7 ,written release ,the term written release means-- 7,a7 specific1 discrete1 freely given1 unambiguous1 and informed written consent given by an individual who is not under any duress or undue influence of an entity or third party at the time such consent is given2 or 7,b7 in the context of employment1 a release executed by an employee as a condition of employment4 #c4 ,collection1 retention1 disclosure1 and destruction of biometric information 7a7 ,written policy 7#a7 ,in general ,not later than #fj days after the date of the enactment of this ,act1 any private entity in possession of biometric identifiers or biometric information concerning an individual shall develop and make available to the public a written policy establishing a retention schedule and guidelines for permanently destroying such biometric identifiers and biometric information not later than the earlier of-- 7,a7 the date on which the initial purpose for collecting or obtaining such identifiers or information has been satisfied1 if the individual from whom the biometric information was collected-- 7i7 freely consented to the original purpose for such collection2 and 7ii7 could have declined such collection without consequence2 or 7,b7 #a year after the individual's last intentional interaction with the private entity4 7#b7 ,compliance ,absent a valid warrant or subpoena issued by a court of competent jurisdiction1 a private entity in possession of biometric identifiers or biometric information shall comply with the retention schedule and destruction guidelines established pursuant to paragraph 7#a74 7b7 ,limitations 7#a7 ,in general ,a private entity may not collect1 capture1 purchase1 receive through trade1 or otherwise obtain a person's or a customer's biometric identifier or biometric information unless-- 7,a7 the entity requires the identifier or information-- 7i7 to provide a service for the person or customer2 or 7ii7 for another valid business purpose specified in the written policy published pursuant to section #c2 and 7,b7 the entity first-- 7i7 informs the person or customer1 or his or her legally authorized representative1 in writing-- 7,i7 that such biometric identifier or biometric information is being collected or stored2 and 7,,ii7 of the specific purpose and length of term for which a biometric identifier or biometric information is being collected1 stored1 and used2 and 7ii7 receives a written release executed by the subject of the biometric identifier or biometric information or by the subject's legally authorized representative4 7#b7 ,written release ,a written release under paragraph 7#a77;,b7-- 7,a7 may not be sought through1 as a part of1 or otherwise combined with any other consent or permission seeking instrument or function2 7,b7 may not be combined with an employment contract2 and 7,c7 if it involves a minor1 may only be obtained through the minor's parent or guardian4 7c7 ,prohibited acts ,a private entity in possession of a biometric identifier or biometric information may not sell1 lease1 trade1 use for advertising purposes1 or otherwise profit from a person's or a customer's biometric identifier or biometric information4 7d7 ,disclosure ,a private entity in possession of a biometric identifier or the biometric information of a person1 including a consumer1 job applicant1 employee1 former employee1 or contractor1 may not disclose1 redisclose1 sell1 lease1 trade1 use for advertising purposes1 otherwise disseminate1 or profit from such biometric identifier or biometric information unless-- 7#a7 the subject of the biometric identifier or biometric information1 or the subject's legally authorized representative1 provides a written release to such specified action immediately prior to such disclosure or redisclosure1 including a description of-- 7,a7 the data that will be disclosed2 7,b7 the reason for such disclosure2 and 7,c7 the recipients of such data2 7#b7 the disclosure or redisclosure completes a financial transaction requested or authorized by the subject of the biometric identifier or the biometric information or the subject's legally authorized representative2 or 7#c7 the disclosure or redisclosure-- 7,a7 is required by ,federal1 ,state1 or municipal law2 or 7,b7 is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction4 7e7 ,conditions ,a private entity in possession of a biometric identifier or biometric information shall store1 transmit1 and protect from disclosure all biometric identifiers and biometric information-- 7#a7 using the reasonable standard of care within the private entity's industry2 and 7#b7 in a manner that is the same as1 or more protective than1 the manner in which the private entity stores1 transmits1 and protects other confidential and sensitive information4 7f7 ,right ,to know ,any business that collects1 uses1 shares1 or sells biometric identifiers or biometric information1 upon the request of an individual1 shall disclose1 free of charge1 any such information relating to such individual collected during the preceding #ab-month period1 including-- 7#a7 the categories of personal information2 7#b7 specific pieces of personal information2 7#c7 the categories of sources from which the business collected personal information2 7#d7 the purposes for which the business uses the personal information2 7#e7 the categories of third parties with whom the business shares the personal information2 and 7#f7 the categories of information that the business sells or discloses to third parties4 #d4 ,cause of action 7a7 ,in general ,any individual aggrieved by a violation of section #c may bring a civil action in a court of competent jurisdiction against a private entity that allegedly committed such violation4 ,any such violation constitutes an injury-in-fact and a harm to any affected individual4 7b7 ,admissibility ,except in a judicial investigation or proceeding alleging a violation of section #c1 information obtained in violation of section #c is not admissible by the ,federal ,government in any criminal1 civil1 administrative1 or other investigation or proceeding4 7c7 ,right to sue ,an individual described in subsection 7a7 may institute legal proceedings against a private entity alleged to have violated section #c for the relief described in subsection 7e7 in any court of competent jurisdiction4 7d7 ,enforcement by ,state attorneys general ,the chief law enforcement officer of a ,state1 or any other ,state officer authorized by law to bring actions on behalf of the residents of a ,state1 may bring a civil action1 as parens patriae1 on behalf of the residents of such ,state in an appropriate district court of the ,united ,states to enforce this ,act if the chief law enforcement officer or other ,state officer has reason to believe that the interests of the residents of the ,state have been or are being threatened or adversely affected by a violation of section #c4 7e7 ,forms of relief 7#a7 ,in general ,a plaintiff bringing a civil action under this section may recover-- 7,a7 7i7 for the negligent violations of any provision of section #c1 the greater of-- 7,i7 #a1jjj in liquidated damages per violation2 or 7,,ii7 the actual damages suffered by the plaintiff2 or 7ii7 for the intentional or reckless violation of any provision of section #c1 the sum of-- 7,i7 the actual damages suffered by the plaintiff2 and 7,,ii7 any punitive damages awarded by the court1 which shall be limited to #e1jjj per violation2 7,b7 reasonable attorneys' fees and costs1 including expert witness fees and other litigation expenses2 and 7,c7 other relief1 including an injunction1 as the court may deem appropriate4 7#b7 ,specific performance ,a court may require a private entity to permanently destroy the biometric identifiers1 biometric information1 or confidential and sensitive information of a plaintiff under this section4 #e4 ,rules of construction ,nothing in this ,act may be construed-- 7#a7 to impact the admission or discovery of biometric identifiers and biometric information in any action of any kind in any court1 or before any tribunal1 board1 agency1 or person2 7#b7 to conflict with the ,health ,insurance ,portability and ,accountability ,act of #aiif 7,public ,law #ajd-aia72 7#c7 to conflict with title ,v of the ,federal ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq472 7#d7 to apply to a contractor1 subcontractor1 or agent of a ,federal1 ,state1 or local government agency in the course of employment with such agency2 or 7#e7 to preempt or supersede any ,federal1 ,state1 or local law that imposes a more stringent limitation than the limitations described in section #c4