SB 1238 Summary

• Establishes requirements for private entities collecting biometric identifiers (retina/iris scans, fingerprints, voiceprints, hand/face geometry scans) including written notice, specific purpose disclosure, and written consent from the subject.

• Requires private entities to develop and implement written retention schedules with destruction timelines not to exceed three years after last interaction or satisfaction of collection purpose.

• Prohibits private entities from selling, leasing, trading, or profiting from biometric identifiers or information.

• Permits disclosure of biometric information only with subject consent, to complete authorized transactions, as required by law, or pursuant to valid court warrant or subpoena.

• Provides civil remedies including liquidated damages of $1,000 for negligent violations and $5,000 for intentional or reckless violations, plus attorney fees and injunctive relief; excludes financial institutions subject to Gramm-Leach-Bliley Act and state/local government contractors.