Establishes the "Biometric Information Privacy Act"

HB 407, the "Biometric Information Privacy Act," requires private companies (not government agencies) to obtain explicit written consent before collecting or using biometric data like fingerprints, facial scans, or voiceprints. It mandates that companies clearly explain why they’re collecting the data, how long they’ll keep it, and prohibits selling or sharing this information without permission. Companies must securely store biometric data (using standards for other sensitive data) and destroy it after the initial purpose is met or within one year. The law excludes health data covered by HIPAA, medical images, and government-related uses, and allows individuals to sue for violations with penalties up to $1,000 per incident.