HB2259 Summary

• Adds "security purpose" definition to Illinois Biometric Information Privacy Act, including preventing retail theft, fraud, property trespass, controlling access, protecting persons from harm (stalking, violence, harassment), and assisting law enforcement investigations.

• Allows private entities to collect biometric identifiers and information for security purposes without obtaining written consent if they use it only for security purposes, retain it no longer than necessary, and document a deletion process and timeline.

• Requires private entities possessing biometric data to develop a written retention and destruction policy, and destroy data when its original purpose is satisfied or within 3 years of last interaction, whichever comes first.

• Maintains existing protections prohibiting private entities from selling, leasing, or profiting from biometric information, and restricting disclosure except with consent, to complete authorized transactions, by legal requirement, or with court warrant or subpoena.

• Requires private entities to store and protect biometric information using reasonable industry standards and in a manner at least as protective as other confidential and sensitive information they maintain.