HB4423 - Relating to the collection, possession, or use of biometric identifiers and biometric information.

      By: Cain H.B. No. 4423       A BILL TO BE ENTITLED   AN ACT   relating to the collection, possession, or use of biometric   identifiers and biometric information.          BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:          SECTION 1.  Chapter 560, Government Code, is amended to read   as follows:   CHAPTER 560.  BIOMETRIC IDENTIFIER AND BIOMETRIC INFORMATION          Sec. 560.001.  DEFINITIONS.  In this chapter:                (1)  "Biometric identifier" means a retina or iris   scan, palm or vascular vein, heartbeat, fingerprint, voiceprint,   key strokes, signature, gait, or record or scan of hand or face   geometry.   Biometric identifier does not include a digital or   physical photograph, an audio or video recording, or any data   generated from a digital or physical photograph, or an audio or   video recording, unless the photograph, recording, or data is   generated to identify a specific individual.                (2)   "Biometric information" means any information,   regardless of how it is captured, converted, stored, or shared,   based on an individual's biometric identifier used to identify an   individual.   Biometric information does not include information   derived from items or procedures excluded under the definition of   biometric identifiers.                 (3)   "Governmental body" has the meaning assigned by   Section 552.003, except that the term includes each entity within   or created by the judicial branch of state government.          Sec. 560.002.  DISCLOSURE OF BIOMETRIC IDENTIFIER OR   BIOMETRIC INFORMATION .  A governmental body that possesses a   biometric identifier or biometric information of an individual:          (1)  may not sell, lease, or otherwise disclose the biometric   identifier to another person unless:                (A)  the individual consents to the disclosure;                (B)  the disclosure is required or permitted by a   federal statute or by a state statute other than Chapter 552; or                (C)  the disclosure is made by or to a law enforcement   agency for a law enforcement purpose; and          (2)  shall store, transmit, and protect from disclosure the   biometric identifier or biometric information using reasonable   care and in a manner that is the same as or more protective than the   manner in which the governmental body stores, transmits, and   protects its other confidential information.          Sec. 560.003.  APPLICATION OF CHAPTER 552. A biometric   identifier or biometric information in the possession of a   governmental body is exempt from disclosure under Chapter 552.          SECTION 2.  The heading to Chapter 503, Business and   Commerce Code, is amended to read as follows:   CHAPTER 503.  BIOMETRIC IDENTIFIERS AND BIOMETRIC INFORMATION          SECTION 3.  Chapter 503, Business and Commerce Code, is   amended by adding Section 503.0001 to read as follows:           Sec. 503.0001.  DEFINITIONS. In this chapter:                 (1)     "Biometric identifier" has the meaning assigned by   Section 560.001, Government Code.                 (2)     "Biometric information" has the meaning assigned   by Section 560.001, Government Code.                SECTION 3.  Section 503.001, Business and Commerce   Code, is amended to read as follows:          Sec. 503.001.  CAPTURE OR USE OF BIOMETRIC IDENTIFIER OR   BIOMETRIC INFORMATION .  (a)  [ In this section, "biometric   identifier" means a retina or iris scan, fingerprint, voiceprint,   or record of hand or face geometry.           (b) ]  A person may not capture a biometric identifier or   biometric information of an individual for a commercial purpose   unless the person:                (1)  informs the individual before capturing the   biometric identifier or biometric information ; and                (2)  receives the individual's consent to capture the   biometric identifier or biometric information .           (b) [ (c) ]  A person who possesses a biometric identifier or   biometric information of an individual that is captured for a   commercial purpose:                (1)  may not sell, lease, or otherwise disclose the   biometric identifier or biometric information to another person   unless:                      (A)  the individual consents to the disclosure for   identification purposes in the event of the individual's   disappearance or death;                      (B)  the disclosure completes a financial   transaction that the individual requested or authorized;                      (C)  the disclosure is required or permitted by a   federal statute or by a state statute other than Chapter 552,   Government Code; or                      (D)  the disclosure is made by or to a law   enforcement agency for a law enforcement purpose in response to a   warrant;                (2)  shall store, transmit, and protect from disclosure   the biometric identifier or biometric information using reasonable   care and in a manner that is the same as or more protective than the   manner in which the person stores, transmits, and protects any   other confidential information the person possesses; and                (3)  shall destroy the biometric identifier or   biometric information within a reasonable time, but not later than   the first anniversary of the date the purpose for collecting the   identifier or information expires, except as provided by Subsection   (c-1).           (c) [ (c-1) ]  If a biometric identifier or biometric   information of an individual captured for a commercial purpose is   used in connection with an instrument or document that is required   by another law to be maintained for a period longer than the period   prescribed by Subsection (b)(3) [ (c)(3) ], the person who possesses   the biometric identifier or biometric information shall destroy the   biometric identifier or biometric information within a reasonable   time, but not later than the first anniversary of the date the   instrument or document is no longer required to be maintained by   law.           (c-1) [ (c-2) ]  If a biometric identifier or biometric   information captured or collected for a commercial purpose has been   collected for security purposes by an employer, the purpose for   collecting the identifier or information under Subsection (c)(3) is   presumed to expire on termination of the employment relationship.          (d)  A person who violates this section is to a civil penalty   of not more than $25,000 for each violation. The attorney general   may bring an action to recover the civil penalty.          (e)  This section does not apply to voiceprint data retained   by a financial institution or an affiliate of a financial   institution, as those terms are defined by 15 U.S.C. Section 6809.          SECTION 4.  This Act takes effect immediately if it receives   a vote of two-thirds of all the members elected to each house, as   provided by Section 39, Article III, Texas Constitution.  If this   Act does not receive the vote necessary for immediate effect, this   Act takes effect September 1, 2025.