AZ HB2728

Prohibits enrollment of an individual's biometric identifier in a database for commercial purposes unless the person either provides a mechanism to prevent subsequent commercial use or provides notice and obtains consent from the individual.

Restricts disclosure of biometric identifiers to third parties for commercial purposes, allowing only disclosures necessary to provide requested services, complete authorized financial transactions, comply with law, or made to contractually bound third parties that won't further disclose or misuse the data.

Requires persons possessing biometric identifiers enrolled for commercial purposes to exercise reasonable care against unauthorized access and to retain identifiers no longer than necessary to comply with law, prevent fraud, or provide enrolled services.

Prohibits using or disclosing biometric identifiers in a manner materially inconsistent with original terms without obtaining individual consent or providing notice of new terms of use.

Exempts financial institutions subject to the Gramm-Leach-Bliley Act, health insurance portability and accountability activities, and law enforcement officers acting within their authority from these requirements; classifies violations as unlawful practices enforceable by the Arizona Attorney General.