HCS CSSB 98(HSS) - Biometric Information

• Requires clear notification and written consent before collecting biometric information, specifying the purpose and retention period.

• Prohibits disclosure, transfer, or distribution of biometric information except to contractors or for identity authentication, limited to the original collection purpose.

• Bans sale of biometric information except when a contractor sells its business to another entity, allowing transfer of biometric data to the buyer.

• Requires collectors to destroy biometric information within 120 days of no longer needing it and notify contractors within 30 days of the original purpose ceasing.

• Establishes civil liability of up to $5,000 per violation, or up to $100,000 if the violation resulted in profit or monetary gain; exempts law enforcement, state-authorized uses, Department of Administration facial images for driver licenses and ID cards, and photographs not used in biometric systems.