House Bill 467 Summary

• Establishes the "Biometric Identifiers Privacy Act" requiring private entities to develop written policies for retaining and destroying biometric identifiers, with destruction required within 30 days of verified deletion requests, one year after last interaction, or when initial collection purpose is satisfied.

• Prohibits private entities from collecting biometric identifiers without first informing individuals in writing of the collection, purpose, duration, and obtaining written consent; prohibits selling, leasing, or trading biometric identifiers.

• Requires private entities with over $10,000,000 in annual revenue to disclose to individuals upon request their collected biometric identifiers and related usage information including collection sources, purposes, and third parties with whom data is shared.

• Allows individuals to bring civil actions for violations, recovering $1,000 per negligent violation or $5,000 per intentional/reckless violation (whichever is greater), plus attorney fees; authorizes the Attorney General to bring enforcement actions.

• Exempts government agencies, contractors working for government entities, healthcare information covered under HIPAA, financial information under the Gramm-Leach-Bliley Act, and information used for scientific research or organ procurement.