SSB 3085 (LSB 5870XC (4) 91)

SENATE FILE _____ 

BY  (PROPOSED COMMITTEE ON TECHNOLOGY BILL BY CHAIRPERSON McCLINTOCK)

A BILL FOR

An Act relating to private entity requirements concerning biometric data, and providing civil penalties.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA:

    Section 1.  NEW SECTION.  554J.1  Definitions.
   1.  “Biometric data” means any information about or based on an individual’s biometric identifier.
   2.  a.  “Biometric identifier” means an individual’s retina, iris, fingerprint, voice, hand, facial geometry, or other physical feature that is described by all of the following:
   (1)  The feature is inherently tied to a specific individual.
   (2)  The feature is considered permanent, difficult to replicate, and remains relatively stable over time.
   (3)  The feature is unique enough to identify a person with a high degree of accuracy.
   b.  “Biometric identifier” does not include any of the following:
   (1)  Writing samples, written signatures, and similar products.
   (2)  Photographs.
   (3)  Biological samples used for scientific testing or screening.
   (4)  Demographic data.
   (5)  Physical descriptions including but not limited to tattoo descriptions, height, weight, eye color, and hair color.
   (6)  Information gained from an individual’s health care treatment, including but not limited to biological samples taken from an individual.
   (7)  A biometric scan, mammography, X ray, roentgen process, computed tomography, magnetic resonance imaging, positron emission tomography scan, or other image or film of the human anatomy used to diagnose, prognose, or treat an illness or medical condition, or used for scientific testing or screening.
   3.  “Department” means the department of inspections, appeals, and licensing.
   4.  “Private entity” means any nongovernmental entity or group.
   5.  “Subject” means an individual to whom particular biometric data pertains.
    Sec. 2.  NEW SECTION.  554J.2  Biometric data.
   1.  a.  A private entity in possession of biometric data shall develop a written policy to establish a schedule for how long the private entity will retain biometric data before the private entity destroys the biometric data.
   b.  A written policy shall be available to the public.
   c.  A private entity shall not retain biometric data for more than three years after the subject of the biometric data last interacts with the private entity or until the purposes for which the biometric data was collected have been accomplished, whichever is longer.
   2.  A private entity shall not collect, capture, purchase, or otherwise obtain an individual’s biometric data unless, prior to receiving the biometric data, the private entity does all of the following:
   a.  Informs the subject of the biometric data, or the subject’s legal representative, in writing, that the private entity intends to collect the subject’s biometric data.
   b.  Informs the subject of the biometric data, or the subject’s legal representative, in writing, of the purposes and length of time for which the private entity intends to retain the biometric data.
   3.  A private entity shall not sell, lease, trade, or otherwise profit from an individual’s biometric data.
   4.  A private entity shall store, transmit, and protect biometric data using reasonable methods that are widely accepted within the private entity’s industry and are equivalent to, or more protective than, the manner in which the private entity protects passwords and other information that can be used to provide access to an individual’s account or property.
    Sec. 3.  NEW SECTION.  554J.3  Limitations.
   This chapter shall not apply to an employer that uses an employee’s biometric data solely within the scope of the employee’s employment.
    Sec. 4.  NEW SECTION.  554J.4  Enforcement —— penalties —— rules.
   1.  The department shall enforce this chapter and may seek injunctive relief for a violation of this chapter.
   2.  The department shall establish electronic means for an individual to report a violation of this chapter.
   3.  If a private entity in violation of this chapter has not previously violated this chapter, the department shall send notice to the private entity informing the private entity of the violation and allowing the private entity thirty calendar days to cure the violation.
   4.  A private entity that violates this chapter is subject to the following civil penalties:
   a.  One thousand dollars for a first violation.
   b.  Five thousand dollars for a second violation, regardless of whether the private entity cured a first violation within the time allowed under subsection 3.
   c.  Ten thousand dollars for a third or subsequent violation.
   5.  Civil penalties collected under this section shall be deposited into the general fund of the state.
   6.  The department shall adopt rules pursuant to chapter 17A to implement and enforce this chapter.
    Sec. 5.  NEW SECTION.  554J.5  Interpretation.
   1.  This chapter shall not be construed to affect the admission or discovery of biometric data in a court action or in an administrative action under chapter 17A.
   2.  This chapter shall not be construed to affect a contractor, subcontractor, or agent of a government entity while the contractor, subcontractor, or agent is acting in the capacity for which the government entity employed or contracted the contractor, subcontractor, or agent.
   3.  This chapter shall not be construed to create a private right of action.
EXPLANATION
The inclusion of this explanation does not constitute agreement with

the explanation’s substance by the members of the general assembly.
   This bill relates to private entity requirements concerning biometric data.
   The bill defines “biometric data” as any information about or based on an individual’s biometric identifier.
   The bill defines “biometric identifier” as an individual’s retina, iris, fingerprint, voice, hand, facial geometry, or other physical feature that is inherently tied to a specific individual; is considered permanent, difficult to replicate, and remains relatively stable over time; and is unique enough to identify a person with a high degree of accuracy. The bill lists several instances of what is not included within the definition of “biometric identifier”.
   The bill also defines “department”, “private entity”, and “subject”.
   The bill requires each private entity in possession of biometric data to develop a written policy to establish a schedule for how long the private entity will retain biometric data before the private entity destroys the biometric data. The written policy must be available to the public, and the private entity cannot retain biometric data for more than three years after the subject of the biometric data last interacts with the private entity or until the purposes for which the biometric data was collected have been accomplished, whichever is longer.
   The bill prohibits a private entity from collecting, capturing, purchasing, or otherwise obtaining an individual’s biometric data unless, prior to receiving the biometric data, the private entity informs the subject of the biometric data, or the subject’s legal representative, in writing, that the private entity intends to collect the subject’s biometric data, and for what purposes and length of time the private entity intends to retain the biometric data.
   The bill prohibits a private entity from selling, leasing, trading, or otherwise profiting from an individual’s biometric data.
   The bill requires a private entity to store, transmit, and protect biometric data using reasonable methods that are widely accepted within the private entity’s industry and are equivalent to, or more protective than, the manner in which the private entity protects passwords and other information that can be used to provide access to an individual’s account or property.
   The bill does not apply to an employer that uses an employee’s biometric data solely within the scope of the employee’s employment.
   The bill requires the department of inspections, appeals, and licensing (DIAL) to enforce the bill and seek injunctive relief for a violation of the bill.
   The bill requires DIAL to establish electronic means for an individual to report a violation of the bill.
   If a private entity in violation of the bill has not previously violated the bill, the bill requires DIAL to send notice to the private entity to inform the private entity of the violation and allow the private entity 30 calendar days to cure the violation.
   A private entity that violates the bill is subject to a $1,000 civil penalty for a first violation; a $5,000 civil penalty for a second violation, regardless of whether the private entity cured a first violation; and a $10,000 civil penalty for a third or subsequent violation. Collected civil penalties shall be deposited into the general fund of the state.
   The bill shall not be construed to affect the admission or discovery of biometric data in a court action or in an administrative action under Code chapter 17A; to affect a contractor, subcontractor, or agent of a government entity while the contractor, subcontractor, or agent is acting in the capacity for which the government entity employed or contracted the contractor, subcontractor, or agent; or to create a private right of action.