A bill for an act relating to private entity requirements concerning biometric data, and providing civil penalties.

This Iowa bill (SSB 3085) regulates how private businesses handle biometric data - such as fingerprints, facial scans, or voice recordings - of individuals. It requires private entities to create public retention policies (capping data storage at 3 years), obtain written consent before collecting data, and prohibit selling or profiting from such data. Businesses must also secure biometric data using industry-standard protections equivalent to those for passwords. The law excludes employer use of employee biometric data and imposes escalating civil penalties: $1,000 for a first violation, up to $10,000 for repeated violations.