1 of 1
SENATE DOCKET, NO. 2204 FILED ON: 1/17/2025
SENATE . . . . . . . . . . . . . . No. 43
The Commonwealth of Massachusetts
_________________
PRESENTED BY:
Mark C. Montigny
_________________
To the Honorable Senate and House of Representatives of the Commonwealth of Massachusetts in General
Court assembled:
The undersigned legislators and/or citizens respectfully petition for the adoption of the accompanying bill:
An Act to protect personal biometric data.
_______________
PETITION OF:
NAME:DISTRICT/ADDRESS :Mark C. MontignySecond Bristol and Plymouth 1 of 6
SENATE DOCKET, NO. 2204 FILED ON: 1/17/2025
SENATE . . . . . . . . . . . . . . No. 43
By Mr. Montigny, a petition (accompanied by bill, Senate, No. 43) of Mark C. Montigny for
legislation to protect personal biometric data. Advanced Information Technology, the Internet
and Cybersecurity.
[SIMILAR MATTER FILED IN PREVIOUS SESSION
SEE SENATE, NO. 195 OF 2023-2024.]
The Commonwealth of Massachusetts
_______________
In the One Hundred and Ninety-Fourth General Court
(2025-2026)
_______________
An Act to protect personal biometric data.
Be it enacted by the Senate and House of Representatives in General Court assembled, and by the authority
of the same, as follows:
1 The General Laws, as appearing in the 2022 Official Edition, are hereby amended by
2inserting after chapter 93L the following chapter:-
3 Chapter 93M. Biometric Information Privacy Act.
4 Section 1. Definitions.
5 As used in this chapter, the following words shall, unless the context clearly requires
6otherwise, have the following meanings:
7 "Biometric identifier" means a physiological or biological characteristic that is used by or
8on behalf of a private entity, singly or in combination, to identify, or assist in identifying, an
9individual, including, but not limited to a retina or iris scan, fingerprint, voiceprint, pattern of 2 of 6
10gait or movement, or scan of hand or face geometry. Biometric identifiers do not include writing
11samples, written signatures, photographs, human biological samples used for valid scientific
12testing or screening, demographic data, tattoo descriptions, or physical descriptions such as
13height, weight, hair color, or eye color. Biometric identifiers do not include donated organs or
14tissues or blood or serum stored on behalf of recipients or potential recipients of living or
15cadaveric transplants and obtained or stored by a federally designated organ procurement
16agency. Biometric identifiers do not include information captured from a patient in a health care
17setting or information collected, used, or stored for health care treatment, payment, or operations
18under the federal Health Insurance Portability and Accountability Act of 1996. Biometric
19identifiers do not include an X-ray, roentgen process, computed tomography, MRI, PET scan,
20mammography, or other image or film of the human anatomy used to diagnose, prognose, or
21treat an illness or other medical condition or to further validate scientific testing or screening.
22 "Biometric information" means any information, regardless of how it is captured,
23converted, stored, or shared, based on an individual's biometric identifier used to identify an
24individual. Biometric information does not include information derived from items or procedures
25excluded under the definition of biometric identifiers.
26 "Commercial Establishment" means a place of entertainment, a retail store, or a food and
27drink establishment.
28 "Confidential and sensitive information" means personal information that can be used to
29uniquely identify an individual or an individual's account or property. Examples of confidential
30and sensitive information include, but are not limited to, a genetic marker, genetic testing 3 of 6
31information, a unique identifier number to locate an account or property, an account number, a
32PIN number, a pass code, a driver's license number, or a social security number.
33 "Private entity" means any individual, partnership, corporation, limited liability company,
34association, or other group, however organized.
35 "Written consent " means informed written consent.
36 Section 2. Collection, Retention, Destruction, and Disclosure of Biometric Information.
37 (a) A private entity in possession of biometric identifiers or biometric information must
38develop a written policy, made available to the person from whom biometric information is to be
39collected or was collected, establishing a retention schedule and guidelines for permanently
40destroying biometric identifiers and biometric information when the initial purpose for collecting
41or obtaining such identifiers or information has been satisfied or within 1 year of the individual's
42last interaction with the private entity, whichever occurs first. Absent a valid order, warrant, or
43subpoena issued by a court of competent jurisdiction or a local or federal governmental agency, a
44private entity in possession of biometric identifiers or biometric information must comply with
45its established retention schedule and destruction guidelines.
46 (b) No private entity may collect, capture, purchase, receive through trade, or otherwise
47obtain a person's or a customer's biometric identifier or biometric information, unless it first:
48 (1) informs the subject or the subject's legally authorized representative in writing that a
49biometric identifier or biometric information is being collected or stored; 4 of 6
50 (2) informs the subject or the subject's legally authorized representative in writing of the
51specific purpose and length of term for which a biometric identifier or biometric information is
52being collected, stored, and used; and
53 (3) receives written consent executed by the subject of the biometric identifier or
54biometric information or the subject's legally authorized representative. Written consent may be
55obtained by electronic means.
56 (c) No private entity in possession of a biometric identifier or biometric information may
57sell, lease, trade, or otherwise profit from a person's or a customer's biometric identifier or
58biometric information.
59 (d) No private entity in possession of a biometric identifier or biometric information may
60disclose, redisclose, or otherwise disseminate a person's or a customer's biometric identifier or
61biometric information unless:
62 (1) the subject of the biometric identifier or biometric information or the subject's legally
63authorized representative provides written consent to the disclosure or redisclosure;
64 (2) the disclosure or redisclosure completes a financial transaction requested or
65authorized by the subject of the biometric identifier or the biometric information or the subject's
66legally authorized representative;
67 (3) the disclosure or redisclosure is required by state or federal law or municipal
68ordinance; or
69 (4) the disclosure is required pursuant to a valid warrant or subpoena issued by a court of
70competent jurisdiction. 5 of 6
71 (e) A private entity in possession of a biometric identifier or biometric information shall:
72 (1) store, transmit, and protect from disclosure all biometric identifiers and biometric
73information using the reasonable standard of care within the private entity's industry; and
74 (2) store, transmit, and protect from disclosure all biometric identifiers and biometric
75information in a manner that is the same as or more protective than the manner in which the
76private entity stores, transmits, and protects other confidential and sensitive information.
77 (f) No commercial establishment shall use a person's or a customer's biometric identifier
78or biometric information to identify them.
79 Section 3. Right of Action.
80 (a) Any person aggrieved by a violation of this chapter shall have a cause of action
81pursuant to the procedures set forth in chapter 93A. Damages pursuant to any said action shall
82be no less than $5,000 per violation or actual damages suffered, whichever is greater, or up to
83three but not less than two times such amount if the court finds that the violation was a willful or
84knowing act. Damages may also include attorneys’ fees and costs.
85 (b) The attorney general may bring an action in the name of the commonwealth pursuant
86to the procedures set forth in chapter 93A upon any violation or suspected violation of this
87chapter. Damages pursuant to any said action shall be no less than $5,000 per violation or actual
88damages suffered, whichever is greater, or up to three but not less than two times such amount if
89the court finds that the violation was a willful or knowing act.
90 Section 4. Construction. 6 of 6
91 (a) Nothing in this chapter shall be construed to impact the admission or discovery of
92biometric identifiers and biometric information in any action of any kind in any court, or before
93any tribunal, board, or agency.
94 (b) Nothing in this chapter shall be construed to conflict with the federal Health Insurance
95Portability and Accountability Act of 1996 and the rules promulgated under said Act.