Biometric Information Privacy Act

HB 5567, the Biometric Information Privacy Act, requires private businesses (like retailers or tech companies) to create written policies for securely storing and permanently destroying customers' biometric data - such as fingerprints, facial scans, or voiceprints - within three years of the last interaction or when the data's purpose is fulfilled. It explicitly excludes health-related biometric data (covered under federal HIPAA) and common identifiers like Social Security numbers. The bill mandates that businesses obtain written consent before collecting biometric information and provides individuals with a legal right to sue if their data is mishandled. This law directly affects private entities using biometrics for identification, aiming to prevent irreversible identity theft risks by regulating how such sensitive data is managed.