SB3782 Summary

• Adds "security purpose" definition to Illinois Biometric Information Privacy Act (BIPA) to include preventing retail theft, fraud, property theft, trespass, controlling property access, and protecting persons from harm including stalking, violence, harassment, and assisting law enforcement investigations.

• Allows private entities to collect and use biometric identifiers without written consent if collected solely for security purposes, retained only as long as reasonably necessary, and the entity documents a process and timeframe for deletion.

• Maintains existing BIPA requirements for all other biometric collection: entities must provide written notice of collection, inform individuals of specific purposes and retention period, and obtain written consent before collecting biometric data.

• Preserves prohibitions on selling, leasing, or profiting from biometric information and on disclosure without consent, except when required by law, for authorized financial transactions, or pursuant to valid warrants or subpoenas.

• Requires entities possessing biometric data to maintain written retention and destruction policies available to the public and to protect all biometric information using reasonable industry standards of care.