Description
A private entity in possession of biometric identifiers, such as retina or iris scans, fingerprints, voiceprints, or scans of hand or face geometry, must develop a written policy available to the public establishing a retention schedule and guidelines for permanently destroying biometric identifiers and information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the entity, whichever occurs first.
An entity may not collect, capture, purchase, receive, or obtain a person’s biometric identifier or information unless it first informs the subject in writing that such identifier and information is being collected or stored, the specific purpose or length of term for which it will be collected, stored, and used, and receives a written release. An entity may also not sell, lease, trade or otherwise profit from a person’s biometric information.
An entity may not disclose biometric identifiers or information unless the individual consents to the disclosure, the disclosure completes a financial transaction requested and authorized by the individual, the disclosure is required by law or the disclosure is pursuant to a valid warrant or subpoena issued by a court. The entity must store, transmit, and protect the biometric identifiers and information from disclosure using a reasonable standard of care within the entity’s industry and in the same manner or more protective than the entity stores, transmits, and protects other confidential and sensitive information.
A person can recover $1,000 in liquidated damages for each negligent violation, $5,000 in liquidated damages for each intentional or reckless violation, or actual damages, whichever is greater. An aggrieved person can also recover attorneys’ fees and costs and other relief that the court deems appropriate.
Applicability
This law applies only to “private entities” defined as an individual, partnership, corporation, limited liability company, association, or other group, however organized, but specially excluding State and local government agencies, the courts of Illinois, and the clerks, judges, and justices thereof.