SB2400 95TH GENERAL ASSEMBLY

LRB095 19768 KBJ 46142 b

95TH GENERAL ASSEMBLY
State of Illinois
2007 and 2008
SB2400

Introduced 2/14/2008, by Sen. Terry Link

SYNOPSIS AS INTRODUCED:

New Act

Creates the Biometric Information Privacy Act. Provides that a public agency or private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual's last interaction with the public agency or private entity. Provides that absent a valid warrant or subpoena, a public agency or private entity in possession of biometric identifiers or biometric information must comply with its established retention schedule and destruction guidelines. Provides that no public agency or private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information, unless it first satisfies certain conditions. Provides that these provisions do not apply to a public agency engaged in criminal investigations or prosecutions or a public agency acting pursuant to a valid warrant or subpoena. Provides that a public agency in possession of biometric identifiers or biometric information shall store, transmit, and protect from disclosure all biometric identifiers and biometric information in a manner that is the same as or more protective than the manner in which the public agency stores, transmits, and protects other confidential and sensitive information. Provides that any person aggrieved by a violation of this Act shall have a right of action in a State circuit court or as a supplemental claim in federal district court. Preempts home rule. Contains other provisions.

FISCAL NOTE ACT MAY APPLY

HOME RULE NOTE ACT MAY APPLY

A BILL FOR

AN ACT concerning health.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Biometric Information Privacy Act.

Section 5. Legislative findings; intent. The General Assembly finds all of the following:

(a) The use of biometrics is growing in the business and security screening sectors and appears to promise streamlined financial transactions and security screenings.

(b) Major national corporations have selected the City of Chicago and other locations in this State as pilot testing sites for new applications of biometric-facilitated financial transactions, including "Pay By Touch" at banks, grocery stores, gas stations, and school cafeterias.

(c) Biometrics are unlike other unique identifiers that are used to access finances or other sensitive information. For example, social security numbers, when compromised, can be changed. Biometrics, however, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.

(d) An overwhelming majority of members of the public are opposed to the use of biometrics when such information is tied to personal finances and other personal information.

(e) Despite limited State law regulating the collection, use, safeguarding, and storage of biometric information, many members of the public are deterred from partaking in biometric identifier-facilitated facility transactions.

(f) The public welfare, security, and safety will be served by regulating the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.

Section 10. Definitions. In this Act:

"Biometric identifier" means any indelible personal physical characteristic which can be used to uniquely identify an individual or pinpoint an individual at a particular place at a particular time. Examples of biometric identifiers include, but are not limited to iris or retinal scans, fingerprints, voiceprints, and records of hand or facial geometry. Biometric identifiers do not include writing samples, written signature, and photographs.

"Biometric information" means any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual.

"Confidential and sensitive information" means personal information that can be used to uniquely identify an individual or an individual's account or property include, but are not limited to a genetic marker, genetic testing information, a unique identifier number to locate an account or property, an account number, a PIN number, a pass code, a driver's license number, or a social security number.

"Legally effective written release" means informed written consent.

"Private entity" means any individual, partnership, corporation, limited liability company, association, or other group, however organized.

"Public agency" means the State of Illinois and its various subdivisions and agencies, and all units of local government, school districts, and other governmental entities.

Section 15. Retention; collection; disclosure; destruction.

(a) A public agency or private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual's last interaction with the public agency or private entity. Absent a valid warrant or subpoena issued by a court of competent jurisdiction, a public agency or private entity in possession of biometric identifiers or biometric information must comply with its established retention schedule and destruction guidelines.

(b) No public agency or private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information, unless it first:

(1) informs the subject in writing that a biometric identifier or biometric information is being collected or stored;

(2) informs the subject in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and

(3) receives a legally effective written release executed by the subject of the biometric identifier or biometric information or the subject's legally authorized representative.

(c) Subsections (a) and (b) of this Section do not apply to a public agency engaged in criminal investigations or prosecutions. Subsections (a) and (b) of this Section do not apply to a public agency acting pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.

(d) No public agency or private entity in possession of a biometric identifier or biometric information may sell, lease, trade, or otherwise profit from a person's or a customer's biometric identifier or biometric information.

(e) Nothing in subsection (d) of this Section shall be construed to prohibit or inhibit a public agency engaged in criminal investigations or prosecutions from:

(1) sharing biometric identifiers or biometric information with another public agency engaged in criminal investigations or prosecutions to further such criminal investigations or prosecutions;

(2) sharing biometric identifiers or biometric information pursuant to federal law or regulation; or

(3) sharing biometric identifiers or biometric information pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.

(f) No public agency, private entity, or person in possession of a biometric identifier or biometric information may disclose, redisclose, or otherwise disseminate a person's or a customer's biometric identifier or biometric information, unless:

(1) the subject of the biometric identifier or biometric information or the subject's legally authorized representative consents to the disclosure or redisclosure;

(2) the disclosure or redisclosure completes a financial transaction requested or authorized by the subject of the biometric identifier or the biometric information;

(3) the disclosure or redisclosure is required under federal law; and

(4) the disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.

(g) A public agency in possession of biometric identifiers or biometric information shall store, transmit, and protect from disclosure all biometric identifiers and biometric information in a manner that is the same as or more protective than the manner in which the public agency stores, transmits, and protects other confidential and sensitive information.

(h) A private entity in possession of a biometric identifier or biometric information shall:

(1) store, transmit, and protect from disclosure all biometric identifiers and biometric information using the reasonable standard of care within the private entity's industry; and

(2) store, transmit, and protect from disclosure all biometric identifiers and biometric information in a manner that is the same as or more protective than the manner in which the private entity stores, transmits, and protects other confidential and sensitive information.

(i) All information and records held by a public agency pertaining to biometric identifiers and biometric information shall be confidential and exempt from copying and inspection under the Freedom of Information Act to all except to the subject of the biometric identifier or biometric information. The subject of the biometric identifier or biometric information held by a public agency shall be permitted to copy and inspect only their own biometric identifiers and biometric information.

Section 20. Right of action.

(a) Any person aggrieved by a violation of this Act shall have a right of action in a State circuit court or as a supplemental claim in federal district court against an offending party. A prevailing party may recover for each violation:

(1) against any public agency or private entity that negligently violates a provision of this Act, liquidated damages of $1,000 or actual damages, whichever is greater;

(2) against any public agency or private entity that intentionally or recklessly violates a provision of this Act, liquidated damages of $5,000 or actual damages, whichever is greater;

(3) reasonable attorneys' fees and costs, including expert witness fees and other litigation expenses; and

(4) other relief, including an injunction, as the State or federal court may deem appropriate.

(b) For the purpose of this Act, "prevailing party" includes any party: (i) who obtains some of his or her requested relief through a judicial judgment in his or her favor; (ii) who obtains some of his or her requested relief through any settlement agreement approved by the court; or (iii) whose pursuit of a non-frivolous claim was a catalyst for a unilateral change in position by the opposing party relative to the relief sought.

Section 25. Home rule. The corporate authorities of a municipality or other unit of local government may enact ordinances, standards, rules, or regulations that protect biometric identifiers and biometric information in a manner or to an extent equal to or greater than the protection provided in this Act. This Section is a limitation on the concurrent exercise of home rule power under subsection (i) of Section 6 of Article VII of the Illinois Constitution.