Texas 2023 - 88th Regular

Texas House Bill HB4705 Compare Versions

Version 1 (Old)

Version 2 (New)

Old	New	Differences
1	1	By: Cain H.B. No. 4705
2	2
3	3
4	4	A BILL TO BE ENTITLED
5	5	AN ACT
6	6	relating to collection and use of biometric identifiers and
7	7	biometric information.
8	8	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
9	9	SECTION 1. SHORT TITLE. This Act may be cited as the
10	10	Biometric Data Privacy Act of 2023.
11	11	SECTION 2. FINDINGS. The legislature finds that:
12	12	(1) The use of biometrics is growing in the business
13	13	and security screening sectors and appears to promise streamlined
14	14	financial transactions and security screenings.
15	15	(2) Major national corporations have selected the City
16	16	of Chicago and other locations in this State as pilot testing sites
17	17	for new applications of biometric-facilitated financial
18	18	transactions, including finger-scan technologies at grocery
19	19	stores, gas stations, and school cafeterias.
20	20	(3) Biometrics are unlike other unique identifiers
21	21	that are used to access finances or other sensitive information.
22	22	For example, social security numbers, when compromised, can be
23	23	changed. Biometrics, however, are biologically unique to the
24	24	individual; therefore, once compromised, the individual has no
25	25	recourse, is at heightened risk for identity theft, and is likely to
26	26	withdraw from biometric-facilitated transactions.
27	27	(4) An overwhelming majority of members of the public
28	28	are weary of the use of biometrics when such information is tied to
29	29	finances and other personal information.
30	30	(5) Despite limited State law regulating the
31	31	collection, use, safeguarding, and storage of biometrics, many
32	32	members of the public are deterred from partaking in biometric
33	33	identifier-facilitated transactions.
34	34	(6) The full ramifications of biometric technology are
35	35	not fully known.
36	36	(7) The public welfare, security, and safety will be
37	37	served by regulating the collection, use, safeguarding, handling,
38	38	storage, retention, and destruction of biometric identifiers and
39	39	information.
40	40	SECTION 3. Chapter 503, Business and Commerce Code, is
41	41	amended by adding Section 503.0001 to read as follows:
42	42	Sec. 503.0001. DEFINITIONS. In this chapter: (1)
43	43	"Biometric identifier" means a retina or iris scan, palm or
44	44	vascular vein, heartbeat, fingerprint, voiceprint, key strokes,
45	45	signature, gait, or record or scan of hand or face geometry.
46	46	Biometric identifier does not include a digital or physical
47	47	photograph, an audio or video recording, or any data generated from
48	48	a digital or physical photograph, or an audio or video recording,
49	49	unless the photograph, recording, or data is generated to identify
50	50	a specific individual.
51	51	(2) "Biometric information" means any information,
52	52	regardless of how it is captured, converted, stored, or shared,
53	53	based on an individual's biometric identifier used to identify an
54	54	individual. Biometric information does not include information
55	55	derived from items or procedures excluded under the definition of
56	56	biometric identifiers.
57	57	(3) "Person" means any individual, partnership,
58	58	association, corporation, or other private legal entity.
59	59	(4) "Written release" means informed written consent
60	60	or, in the context of employment, a release executed by an employee
61	61	as a condition of employment.
62	62	SECTION 4. Section 503.001, Business and Commerce Code, is
63	63	amended to read as follows:
64	64	Sec. 503.001. CAPTURE OR USE OF BIOMETRIC IDENTIFIER OR
65	65	BIOMETRIC INFORMATION. (a) [In this section, "biometric
66	66	identifier" means a retina or iris scan, fingerprint, voiceprint,
67	67	or record of hand or face geometry.]
68	68	[(b)] A person may not capture a biometric identifier or
69	69	biometric information of an individual for a commercial purpose
70	70	unless the person first:
71	71	(1) informs the individual or the individual's legally
72	72	authorized representative in writing that a [before capturing the]
73	73	biometric identifier or biometric information is being collected or
74	74	stored; [and]
75	75	(2) informs the individual or the individual's legally
76	76	authorized representative in writing of the specific purpose and
77	77	the length of term for which a biometric identifier or biometric
78	78	information is being collected, stored, and used; and
79	79	(3) receives a written release executed by the
80	80	individual['s] or the individual's legally authorized
81	81	representative [consent to capture the biometric identifier].
82	82	(b)[(c)] A person who possesses a biometric identifier or
83	83	biometric information of an individual that is captured for a
84	84	commercial purpose:
85	85	(1) may not sell, lease, trade, disclose, redisclose,
86	86	or otherwise disseminate an individual's [disclose the] biometric
87	87	identifier or biometric information to another person unless:
88	88	(A) the individual or the individual's legally
89	89	authorized representative consents to the disclosure for
90	90	identification purposes in the event of the individual's
91	91	disappearance or death;
92	92	(B) the disclosure or redisclosure completes a
93	93	financial transaction tihat the individual or the individual's
94	94	legally authorized representative requested or authorized;
95	95	(C) the disclosure is required or permitted by a
96	96	federal statute or by a state statute other than Chapter 552,
97	97	Government Code; or
98	98	(D) the disclosure is made by or to a law
99	99	enforcement agency for a law enforcement purpose in response to a
100	100	warrant or subpoena issued by a court of competent jurisdiction;
101	101	(2) shall store, transmit, and protect from disclosure
102	102	all [the] biometric identifiers or biometric information using
103	103	reasonable care and in a manner that is the same as or more
104	104	protective than the manner in which the person stores, transmits,
105	105	and protects any other confidential information the person
106	106	possesses; and
107	107	(3) shall permanently destroy the biometric
108	108	identifiers and biometric information within a reasonable time, but
109	109	not later than the first anniversary of the date the purpose for
110	110	collecting or obtaining the identifiers or information expires,
111	111	except as provided by Subsection (c) [(c-1)].
112	112	(c) [(c-1)] If a biometric identifier or biometric
113	113	information of an individual captured or collected for a commercial
114	114	purpose is used in connection with an instrument or document that is
115	115	required by another law to be maintained for a period longer than
116	116	the period prescribed by Subsection (b)(3) [(c)(3)], the person who
117	117	possesses the biometric identifier or biometric information shall
118	118	permanently destroy the biometric identifier or biometric
119	119	information within a reasonable time, but not later than the first
120	120	anniversary of the date the instrument or document is no longer
121	121	required to be maintained by law.
122	122	(c-1) [(c-2)] If a biometric identifier or biometric
123	123	information captured for a commercial purpose has been collected
124	124	for security purposes by an employer, the purpose for collecting
125	125	the identifier or information under Subsection (b)(3) [(c)(3)] is
126	126	presumed to expire on termination of the employment relationship.
127	127	(d) A person who violates this section is subject to a civil
128	128	penalty of not more than $25,000 for each violation. The attorney
129	129	general, or an individual affected by a violation of this section,
130	130	may bring an action to recover the civil penalty.
131	131	(e) This section does not apply to voiceprint data retained
132	132	by a financial institution or an affiliate of a financial
133	133	institution, as those terms are defined by 15 U.S.C. Section 6809.
134	134	SECTION 5. The change in law made by this Act to Section
135	135	503.001, Business & Commerce Code, applies only to a violation that
136	136	occurs on or after the effective date of this Act. A violation that
137	137	occurs before the effective date of this Act is governed by the law
138	138	in effect on the date the violation occurred, and the former law is
139	139	continued in effect for that purpose.
140	140	SECTION 6. This Act takes effect on September 1, 2023.