FIRSTREGULARSESSION
HOUSEBILLNO.1225
102NDGENERALASSEMBLY
INTRODUCEDBYREPRESENTATIVELOVASCO.
2614H.01I DANARADEMANMILLER,ChiefClerk
ANACT
Toamendchapter1,RSMo,byaddingtheretosixnewsectionsrelatingtothebiometric
informationprivacyact.
BeitenactedbytheGeneralAssemblyofthestateofMissouri,asfollows:
SectionA.Chapter1,RSMo,isamendedbyaddingtheretosixnewsections,tobe
2knownassections1.561,1.563,1.566,1.567,1.569,and1.572,toreadasfollows:
1.561.Sections1.561to1.572shallbeknownandmaybecitedasthe"Biometric
2InformationPrivacyAct".
1.563.Asusedinsections1.561to1.572,thefollowingtermsmean:
2 (1)"Biometricidentifier",aretinaoririsscan,fingerprint,voiceprint,orscanof
3handorfacegeometryoranyotherbiologicalcharacteristicthatcanbeusedto
4uniquelyidentifyanindividual."Biometricidentifier"doesnotinclude:
5 (a)Writingsamples;writtensignatures;aphotographorvideo,exceptdata
6generated,captured,orcollectedfromthebiologicalcharacteristicsofapersondepicted
7inaphotographorvideo;humanbiologicalsamplesusedforvalidscientifictestingor
8screening;demographicdata;tattoodescriptions;orphysicaldescriptionssuchas
9height,weight,haircolor,oreyecolor;
10 (b)Anydonatedorgan,tissue,orpart,asthosetermsaredefinedundersection
11194.210,orbloodorserumstoredonbehalfofrecipientsorpotentialrecipientsofliving
12orcadaverictransplantsandobtainedorstoredbyafederallydesignatedorgan
13procurementagency;
14 (c)Informationcapturedfromapatientinahealthcaresettingorinformation
15collected,used,orstoredforhealthcaretreatment,payment,oroperationsunderthe
EXPLANATION—Matterenclosedinbold-facedbrackets[thus] intheabovebillisnotenactedandis
intendedtobeomittedfromthelaw.Matterinbold-facetypeintheabovebillisproposedlanguage. 16federalHealthInsurancePortabilityandAccountabilityActof1996,Pub.L.104-191;
17or
18 (d)AnX-ray,roentgenprocess,computedtomography,MRI,PETscan,
19mammography,orotherimageorfilmofthehumananatomyusedtodiagnose,
20prognose,ortreatanillnessorothermedicalconditionortofurthervalidatescientific
21testingorscreening;
22 (2)"Biometricinformation",anyinformation,regardlessofhowitiscaptured,
23converted,stored,orshared,thatisbasedonanindividual'sbiometricidentifierand
24usedtoidentifyanindividual."Biometricinformation"doesnotincludeinformation
25derivedfromitemsorproceduresexcludedunderthedefinitionofbiometricidentifiers;
26 (3)"Confidentialandsensitiveinformation",personalinformationthatcanbe
27usedtouniquelyidentifyanindividualoranindividual'saccountorproperty.
28Examplesof"confidentialandsensitiveinformation"include,butarenotlimitedto,a
29geneticmarker,genetictestinginformation,auniqueidentifiernumbertolocatean
30accountorproperty,anaccountnumber,aPINnumber,apasscode,adriver'slicense
31number,oraSocialSecuritynumber;
32 (4)"Privateentity",anyindividualactinginacommercialcontext,partnership,
33corporation,limitedliabilitycompany,association,orothergrouphoweverorganized.
34"Privateentity"doesnotincludeastateorlocalgovernmentagency."Privateentity"
35doesnotincludeanycourtofMissouri,aclerkofthecourt,orajudgeorjusticethereof;
36 (5)"Writtenrelease",informedwrittenconsent,includingwrittenconsent
37providedbyelectronicmeans.Avalidwrittenreleaseshallnotbesecuredthrougha
38generalreleaseoruseragreement.Inthecontextofemployment,awrittenrelease:
39 (a)Shallbeusedonlytosecureconsenttocollectandusebiometricidentifiers
40forthepurposesof:
41 a.Permittingaccesstosecurephysicallocationsandsecureelectronichardware
42andsoftwareapplicationswithoutretainingdatathatallowsforemployeelocation
43trackingorthetrackingofhowlonganemployeespendsusingahardwareorsoftware
44application;or
45 b.Recordingthecommencementandconclusionofanemployee'sfullworkday
46andmealorrestbreaksinexcessofthirtyminutes;and
47 (b)Maybesecuredintheformofawrittenreleaseexecutedbyanemployeeasa
48conditionofemployment.
1.566.1.Anyprivateentityinpossessionofbiometricidentifiersorbiometric
2informationshalldevelopawrittenpolicy,madeavailabletothepublic,establishinga
3retentionscheduleandguidelinesforpermanentlydestroyingbiometricidentifiersand
4biometricinformationwhentheinitialpurposeforcollectingorobtainingsuch
HB1225 2 5identifiersorinformationhasbeensatisfiedorwithinoneyearoftheindividual'slast
6interactionwiththeprivateentity,whicheveroccursfirst.Absentavalidwarrant
7issuedbyacourtofcompetentjurisdiction,aprivateentityinpossessionofbiometric
8identifiersorbiometricinformationshallcomplywithitsestablishedretentionschedule
9anddestructionguidelines.
10 2.Noprivateentityshallcollect,capture,purchase,receivethroughtrade,or
11otherwiseobtainaperson'soracustomer'sbiometricidentifierorbiometric
12informationunlessitfirst:
13 (1)Informsthepersonorcustomer,ortheperson'sorcustomer'slegally
14authorizedrepresentative,inwritingthatabiometricidentifierorbiometric
15informationisbeingcollectedorstored;
16 (2)Informsthepersonorcustomer,ortheperson'sorcustomer'slegally
17authorizedrepresentative,ofthespecificpurposeandlengthoftermforwhicha
18biometricidentifierorbiometricinformationisbeingcollected,stored,andused;and
19 (3)Receivesawrittenreleaseexecutedbythepersonorcustomer,orthe
20person'sorcustomer'slegallyauthorizedrepresentative.
21 3.(1)AnyentityorindividualrequiredtocomplywiththefederalHealth
22InsurancePortabilityandAccountabilityAct,Pub.L.No.104-191,shalltreatbiometric
23identifiersandbiometricinformationasindividuallyidentifiablehealthinformationand
24uniquehealthidentifiersprotectedunderthatactandtherulespromulgated
25thereunder.
26 (2)Noprivateentityinpossessionofabiometricidentifierorbiometric
27informationshallsell,lease,ortradeaperson'soracustomer'sbiometricidentifieror
28biometricinformation.
29 4.Noprivateentityinpossessionofabiometricidentifierorbiometric
30informationshalldisclose,redisclose,orotherwisedisseminateaperson'sora
31customer'sbiometricidentifierorbiometricinformationunless:
32 (1)Thepersonorcustomer,ortheperson'sorcustomer'slegallyauthorized
33representative,provideswrittenreleasetothedisclosureorredisclosure;
34 (2)Thedisclosureorredisclosurecompletesafinancialtransactionrequestedor
35authorizedbythepersonorcustomer,ortheperson'sorcustomer'slegallyauthorized
36representative;
37 (3)Thedisclosureorredisclosureisrequiredbystatelaw,federallaw,or
38municipalordinance;or
39 (4)Thedisclosureisrequiredpursuanttoavalidwarrantissuedbyacourtof
40competentjurisdiction.
HB1225 3 41 5.Aprivateentityinpossessionofabiometricidentifierorbiometric
42informationshall:
43 (1)Store,transmit,andprotectfromdisclosureallbiometricidentifiersand
44biometricinformationusingthereasonablestandardofcarewithintheprivateentity's
45industry;and
46 (2)Store,transmit,andprotectfromdisclosureallbiometricidentifiersand
47biometricinformationinamannerthatisthesameasormoreprotectivethanthe
48mannerinwhichtheprivateentitystores,transmits,andprotectsotherconfidentialand
49sensitiveinformation.
1.567.Aprivateentityshallnot:
2 (1)Conditiontheprovisionofagoodorserviceonthecollection,use,disclosure,
3transfer,sale,retention,orprocessingofabiometricidentifierunlessthebiometric
4identifierisstrictlynecessarytoprovidethegoodorservice;or
5 (2)Chargedifferentpricesorratesforgoodsorservicesorprovideadifferent
6levelofqualityofagoodorservicetoanyindividualwhoexercisestheindividual's
7rightsundersections1.561to1.572.
1.569.Anypersonaggrievedbyaviolationofsections1.561to1.572shallhavea
2rightofactioninastatecircuitcourtorasasupplementalclaiminfederaldistrictcourt
3againstanoffendingpartyincluding,butnotlimitedto,aclassactionbroughtpursuant
4totherulesoftheMissourisupremecourt.Thecourtshallawardallattorney'sfeesand
5costs,includingexpertwitnessfeesandotherlitigationexpenses,totheprevailing
6plaintiff.Aprevailingplaintiffmayrecoverforeachviolation:
7 (1)Againstaprivateentitythatnegligentlyviolatesaprovisionofsections1.561
8to1.572,liquidateddamagesofonethousanddollarsoractualdamages,whicheveris
9greater;
10 (2)Againstaprivateentitythatintentionallyorrecklesslyviolatesaprovisionof
11sections1.561to1.572,liquidateddamagesoffivethousanddollarsoractualdamages,
12whicheverisgreater;and
13 (3)Otherrelief,includinganinjunction,asthestateorfederalcourtmaydeem
14appropriate.
1.572.1.Nothinginsections1.561to1.572shallbeconstruedtoimpactthe
2admissionordiscoveryofbiometricidentifiersandbiometricinformationinanyaction
3ofanykindinanycourt,orbeforeanytribunal,board,agency,orperson.
4 2.Nothinginsections1.561to1.572shallbeconstruedtoconflictwithsection
5334.097orwiththefederalHealthInsurancePortabilityandAccountabilityActof1996,
6Pub.L.104-191,ortherulespromulgatedthereunder.
HB1225 4 7 3.Nothinginsections1.561to1.572shallbedeemedtoapplyinanymannertoa
8financialinstitutionoranaffiliateofafinancialinstitutionthatissubjecttoTitleVof
9thefederalGramm-Leach-BlileyActof1999,Pub.L.106-102,andtherules
10promulgatedthereunder.
11 4.Nothinginsections1.561to1.572shallbeconstruedtoapplytoacontractor,
12subcontractor,oragentofastateagencyorlocalunitofgovernmentwhenworkingfor
13thatstateagencyorlocalunitofgovernment.
âś”
HB1225 5