The bill establishes a mandatory framework for individuals who feel their biometric privacy has been violated. Under the updates introduced by HB3199, an individual must provide a 15-day notice to a private entity before initiating legal action, allowing the entity an opportunity to address and rectify the alleged violations. If the violation is corrected within this notice period, individuals may not pursue damages. This notice period aims to reduce frivolous lawsuits and encourage private entities to fix issues quickly, while still maintaining accountability for genuine violations of biometric privacy.
Summary
House Bill 3199 amends the Biometric Information Privacy Act (BIPA) to enhance the requirements around biometric data handling and to clarify the definition of consent. One significant change is the shift from needing a 'written release' to requiring 'written consent', which can now also be obtained electronically. This adjustment broadens the means by which entities can seek consent from individuals regarding the collection and use of their biometric identifiers such as fingerprints and facial scans.
Contention
However, this bill has also drawn criticism from privacy advocates who argue that shortening the window for taking legal action against violations of biometric privacy could undermine the protective intent of the original act. There are concerns that the requirement of prior notice may deter individuals from seeking justice, particularly if they believe that being notified could lead to unaddressed violations being covered up or remedied only superficially. Furthermore, the removal of the language allowing a prevailing party to recover for each violation is seen by some as a reduction in remedies available to victims of privacy breaches.