HB 328 Summary

• Requires clear notification and written consent before collecting biometric data (fingerprints, iris images, voice, etc.) for use in automated biometric systems, with disclosure of specific purposes and retention length.

• Prohibits disclosure, transfer, or distribution of biometric information except to contractors or for identity authentication, and restricts sale of biometric information except during business transfers.

• Requires biometric data to be destroyed within 120 days after no longer needed for original purpose, with secure storage during retention using encryption or equivalent methods.

• Regulates collection and use of geolocation information from mobile applications, requiring written notice and express consent from individuals before private persons can collect, use, store, or disclose location data.

• Creates civil action rights with penalties of $1,000 per biometric violation (or $5,000 if violation resulted in profit) and $1,000 liquidated damages for geolocation violations, classifying violations as unfair trade practices.