HB 2478 Summary

• Establishes requirements for enrolling individuals' biometric identifiers (fingerprints, voiceprints, retina, iris, etc.) in databases for commercial purposes, requiring either a mechanism to prevent commercial use or notice plus consent from the individual.

• Prohibits selling, leasing, or disclosing biometric identifiers to third parties for commercial purposes without consent, with exceptions for providing requested services, completing authorized financial transactions, court orders, and litigation preparation.

• Requires persons possessing enrolled biometric identifiers to take reasonable care against unauthorized access and limits retention to only what is reasonably necessary for legal compliance, fraud prevention, or providing enrolled services.

• Prohibits use or disclosure of biometric identifiers in ways materially inconsistent with original terms without obtaining new consent from the individual.

• Exempts financial institutions subject to Gramm-Leach-Bliley Act, health insurance activities under HIPAA, and law enforcement activities from these requirements; violations are treated as unlawful practices subject to Attorney General enforcement.