SB3593 Summary

• Changes "written release" to "written consent" in the Biometric Information Privacy Act and allows consent to be obtained by electronic means.

• Requires written policies on biometric data retention and destruction to be made available to the individual whose data is collected, rather than to the public.

• Establishes a 30-day notice-and-cure period before legal action can be filed; if a private entity cures the violation within 30 days, no statutory damages may be pursued, though continued violations can result in damages for breaches of the cure statement.

• Reduces damages for negligent violations from liquidated damages of $1,000 (or actual damages, whichever is greater) to actual damages only; for willful violations, changes from $5,000 liquidated damages to actual damages plus liquidated damages up to the amount of actual damages.

• Exempts private entities whose employees are covered by collective bargaining agreements that provide different biometric information policies, and clarifies that federal agency contractors are exempt from the Act.