National Biometric Information Privacy Act of 2020

II 116TH CONGRESS 2D SESSION S. 4400 To regulate the collection, retention, disclosure, and destruction of biometric information, and for other purposes. IN THE SENATE OF THE UNITED STATES AUGUST 3, 2020 Mr. MERKLEY (for himself and Mr. SANDERS) introduced the following bill; which was read twice and referred to the Committee on the Judiciary A BILL To regulate the collection, retention, disclosure, and destruction of biometric information, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘National Biometric 4 Information Privacy Act of 2020’’. 5 SEC. 2. DEFINITIONS. 6 In this Act: 7 (1) BIOMETRIC IDENTIFIER.—The term ‘‘bio- 8 metric identifier’’— 9 (A) includes— 10 VerDate Sep 11 2014 03:45 Aug 21, 2020 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S4400.IS S4400 kjohnson on DSK79L0C42PROD with BILLS 2 •S 4400 IS (i) a retina or iris scan; 1 (ii) a voiceprint; 2 (iii) a faceprint (including any face- 3 print derived from a photograph); 4 (iv) fingerprints or palm prints; and 5 (v) any other uniquely identifying in- 6 formation based on the characteristics of 7 an individual’s gait or other immutable 8 characteristic of an individual; 9 (B) does not include writing samples, writ- 10 ten signatures, photographs, human biological 11 samples used for valid scientific testing or 12 screening, demographic data, tattoo descrip- 13 tions, or physical descriptions such as height, 14 weight, hair color, or eye color; 15 (C) does not include donated organs, tis- 16 sues, or parts or blood or serum stored on be- 17 half of recipients or potential recipients of living 18 or cadaveric transplants and obtained or stored 19 by a federally designated organ procurement 20 agency; 21 (D) does not include information captured 22 from a patient in a health care setting for a 23 medical purpose or information collected, used, 24 or stored for health care treatment, payment, or 25 VerDate Sep 11 2014 00:29 Aug 26, 2020 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S4400.IS S4400 kjohnson on DSK79L0C42PROD with BILLS 3 •S 4400 IS operations under the Health Insurance Port- 1 ability and Accountability Act of 1996 (Public 2 Law 104–191); and 3 (E) does not include an x ray, roentgen 4 process, computed tomography, MRI, PET 5 scan, mammography, or other image or film of 6 the human anatomy used to diagnose, prognose, 7 or treat an illness or other medical condition or 8 to further validate scientific testing or screen- 9 ing. 10 (2) CONFIDENTIAL AND SENSITIVE INFORMA- 11 TION.—The term ‘‘confidential and sensitive infor- 12 mation’’— 13 (A) means personal information that can 14 be used to uniquely identify an individual or an 15 individual’s account or property; and 16 (B) includes genetic markers, genetic test- 17 ing information, unique identifier numbers to 18 locate accounts or property, account numbers, 19 personal identification numbers, pass codes, 20 driver’s license numbers, or Social Security 21 numbers. 22 (3) PRIVATE ENTITY.—The term ‘‘private enti- 23 ty’’— 24 VerDate Sep 11 2014 03:45 Aug 21, 2020 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S4400.IS S4400 kjohnson on DSK79L0C42PROD with BILLS 4 •S 4400 IS (A) means any individual, partnership, cor- 1 poration, limited liability company, association, 2 or other group, however organized; and 3 (B) does not include any Federal, State, or 4 local government agency or academic institu- 5 tion. 6 (4) WRITTEN RELEASE.—The term ‘‘written re- 7 lease’’ means— 8 (A) specific, discrete, freely given, unam- 9 biguous, and informed written consent given by 10 an individual who is not under any duress or 11 undue influence of an entity or third party at 12 the time such consent is given; or 13 (B) in the context of employment, a release 14 executed by an employee as a condition of em- 15 ployment. 16 SEC. 3. COLLECTION, RETENTION, DISCLOSURE, AND DE- 17 STRUCTION OF BIOMETRIC INFORMATION. 18 (a) WRITTEN POLICY.— 19 (1) IN GENERAL.—Not later than 60 days after 20 the date of the enactment of this Act, any private 21 entity in possession of biometric identifiers or bio- 22 metric information concerning an individual shall de- 23 velop and make available to the public a written pol- 24 icy establishing a retention schedule and guidelines 25 VerDate Sep 11 2014 03:45 Aug 21, 2020 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S4400.IS S4400 kjohnson on DSK79L0C42PROD with BILLS 5 •S 4400 IS for permanently destroying such biometric identifiers 1 and biometric information not later than the earlier 2 of— 3 (A) the date on which the initial purpose 4 for collecting or obtaining such identifiers or in- 5 formation has been satisfied, if the individual 6 from whom the biometric information was col- 7 lected— 8 (i) freely consented to the original 9 purpose for such collection; and 10 (ii) could have declined such collection 11 without consequence; or 12 (B) 1 year after the individual’s last inten- 13 tional interaction with the private entity. 14 (2) COMPLIANCE.—Absent a valid warrant or 15 subpoena issued by a court of competent jurisdic- 16 tion, a private entity in possession of biometric iden- 17 tifiers or biometric information shall comply with the 18 retention schedule and destruction guidelines estab- 19 lished pursuant to paragraph (1). 20 (b) LIMITATIONS.— 21 (1) IN GENERAL.—A private entity may not col- 22 lect, capture, purchase, receive through trade, or 23 otherwise obtain a person’s or a customer’s biomet- 24 ric identifier or biometric information unless— 25 VerDate Sep 11 2014 03:45 Aug 21, 2020 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S4400.IS S4400 kjohnson on DSK79L0C42PROD with BILLS 6 •S 4400 IS (A) the entity requires the identifier or in- 1 formation— 2 (i) to provide a service for the person 3 or customer; or 4 (ii) for another valid business purpose 5 specified in the written policy published 6 pursuant to section 3; and 7 (B) the entity first— 8 (i) informs the person or customer, or 9 his or her legally authorized representative, 10 in writing— 11 (I) that such biometric identifier 12 or biometric information is being col- 13 lected or stored; and 14 (II) of the specific purpose and 15 length of term for which a biometric 16 identifier or biometric information is 17 being collected, stored, and used; and 18 (ii) receives a written release executed 19 by the subject of the biometric identifier or 20 biometric information or by the subject’s 21 legally authorized representative. 22 (2) WRITTEN RELEASE.—A written release 23 under paragraph (1)(B)— 24 VerDate Sep 11 2014 03:45 Aug 21, 2020 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S4400.IS S4400 kjohnson on DSK79L0C42PROD with BILLS 7 •S 4400 IS (A) may not be sought through, as a part 1 of, or otherwise combined with any other con- 2 sent or permission seeking instrument or func- 3 tion; 4 (B) may not be combined with an employ- 5 ment contract; and 6 (C) if it involves a minor, may only be ob- 7 tained through the minor’s parent or guardian. 8 (c) PROHIBITED ACTS.—A private entity in posses- 9 sion of a biometric identifier or biometric information may 10 not sell, lease, trade, use for advertising purposes, or oth- 11 erwise profit from a person’s or a customer’s biometric 12 identifier or biometric information. 13 (d) DISCLOSURE.—A private entity in possession of 14 a biometric identifier or the biometric information of a 15 person, including a consumer, job applicant, employee, 16 former employee, or contractor, may not disclose, redis- 17 close, sell, lease, trade, use for advertising purposes, other- 18 wise disseminate, or profit from such biometric identifier 19 or biometric information unless— 20 (1) the subject of the biometric identifier or bio- 21 metric information, or the subject’s legally author- 22 ized representative, provides a written release to 23 such specified action immediately prior to such dis- 24 closure or redisclosure, including a description of— 25 VerDate Sep 11 2014 03:45 Aug 21, 2020 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S4400.IS S4400 kjohnson on DSK79L0C42PROD with BILLS 8 •S 4400 IS (A) the data that will be disclosed; 1 (B) the reason for such disclosure; and 2 (C) the recipients of such data; 3 (2) the disclosure or redisclosure completes a fi- 4 nancial transaction requested or authorized by the 5 subject of the biometric identifier or the biometric 6 information or the subject’s legally authorized rep- 7 resentative; or 8 (3) the disclosure or redisclosure— 9 (A) is required by Federal, State, or mu- 10 nicipal law; or 11 (B) is required pursuant to a valid warrant 12 or subpoena issued by a court of competent ju- 13 risdiction. 14 (e) CONDITIONS.—A private entity in possession of 15 a biometric identifier or biometric information shall store, 16 transmit, and protect from disclosure all biometric identi- 17 fiers and biometric information— 18 (1) using the reasonable standard of care within 19 the private entity’s industry; and 20 (2) in a manner that is the same as, or more 21 protective than, the manner in which the private en- 22 tity stores, transmits, and protects other confidential 23 and sensitive information. 24 VerDate Sep 11 2014 00:29 Aug 26, 2020 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S4400.IS S4400 kjohnson on DSK79L0C42PROD with BILLS 9 •S 4400 IS (f) RIGHT TO KNOW.—Any business that collects, 1 uses, shares, or sells biometric identifiers or biometric in- 2 formation, upon the request of an individual, shall dis- 3 close, free of charge, any such information relating to such 4 individual collected during the preceding 12-month period, 5 including— 6 (1) the categories of personal information; 7 (2) specific pieces of personal information; 8 (3) the categories of sources from which the 9 business collected personal information; 10 (4) the purposes for which the business uses the 11 personal information; 12 (5) the categories of third parties with whom 13 the business shares the personal information; and 14 (6) the categories of information that the busi- 15 ness sells or discloses to third parties. 16 SEC. 4. CAUSE OF ACTION. 17 (a) IN GENERAL.—Any individual aggrieved by a vio- 18 lation of section 3 may bring a civil action in a court of 19 competent jurisdiction against a private entity that alleg- 20 edly committed such violation. Any such violation con- 21 stitutes an injury-in-fact and a harm to any affected indi- 22 vidual. 23 (b) ADMISSIBILITY.—Except in a judicial investiga- 24 tion or proceeding alleging a violation of section 3, infor- 25 VerDate Sep 11 2014 00:29 Aug 26, 2020 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S4400.IS S4400 kjohnson on DSK79L0C42PROD with BILLS 10 •S 4400 IS mation obtained in violation of section 3 is not admissible 1 by the Federal Government in any criminal, civil, adminis- 2 trative, or other investigation or proceeding. 3 (c) RIGHT TO SUE.—An individual described in sub- 4 section (a) may institute legal proceedings against a pri- 5 vate entity alleged to have violated section 3 for the relief 6 described in subsection (e) in any court of competent juris- 7 diction. 8 (d) ENFORCEMENT BY STATE ATTORNEYS GEN- 9 ERAL.—The chief law enforcement officer of a State, or 10 any other State officer authorized by law to bring actions 11 on behalf of the residents of a State, may bring a civil 12 action, as parens patriae, on behalf of the residents of 13 such State in an appropriate district court of the United 14 States to enforce this Act if the chief law enforcement offi- 15 cer or other State officer has reason to believe that the 16 interests of the residents of the State have been or are 17 being threatened or adversely affected by a violation of 18 section 3. 19 (e) FORMS OF RELIEF.— 20 (1) IN GENERAL.—A plaintiff bringing a civil 21 action under this section may recover— 22 (A)(i) for the negligent violations of any 23 provision of section 3, the greater of— 24 VerDate Sep 11 2014 03:45 Aug 21, 2020 Jkt 099200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S4400.IS S4400 kjohnson on DSK79L0C42PROD with BILLS 11 •S 4400 IS (I) $1,000 in liquidated damages per 1 violation; or 2 (II) the actual damages suffered by 3 the plaintiff; or 4 (ii) for the intentional or reckless violation 5 of any provision of section 3, the sum of— 6 (I) the actual damages suffered by the 7 plaintiff; and 8 (II) any punitive damages awarded by 9 the court, which shall be limited to $5,000 10 per violation; 11 (B) reasonable attorneys’ fees and costs, 12 including expert witness fees and other litiga- 13 tion expenses; and 14 (C) other relief, including an injunction, as 15 the court may deem appropriate. 16 (2) SPECIFIC PERFORMANCE.—A court may re- 17 quire a private entity to permanently destroy the bi- 18 ometric identifiers, biometric information, or con- 19 fidential and sensitive information of a plaintiff 20 under this section. 21 SEC. 5. RULES OF CONSTRUCTION. 22 Nothing in this Act may be construed— 23 (1) to impact the admission or discovery of bio- 24 metric identifiers and biometric information in any 25 VerDate Sep 11 2014 03:45 Aug 21, 2020 Jkt 099200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S4400.IS S4400 kjohnson on DSK79L0C42PROD with BILLS 12 •S 4400 IS action of any kind in any court, or before any tri- 1 bunal, board, agency, or person; 2 (2) to conflict with the Health Insurance Port- 3 ability and Accountability Act of 1996 (Public Law 4 104–191); 5 (3) to conflict with title V of the Federal 6 Gramm-Leach-Bliley Act (15 U.S.C. 6801 et seq.); 7 (4) to apply to a contractor, subcontractor, or 8 agent of a Federal, State, or local government agen- 9 cy in the course of employment with such agency; or 10 (5) to preempt or supersede any Federal, State, 11 or local law that imposes a more stringent limitation 12 than the limitations described in section 3. 13 Æ VerDate Sep 11 2014 03:45 Aug 21, 2020 Jkt 099200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6301 E:\BILLS\S4400.IS S4400 kjohnson on DSK79L0C42PROD with BILLS