II 

116TH CONGRESS 

2D SESSION S. 4400 

To regulate the collection, retention, disclosure, and destruction of biometric 

information, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

AUGUST 3, 2020 

Mr. MERKLEY (for himself and Mr. SANDERS) introduced the following bill; 

which was read twice and referred to the Committee on the Judiciary 

A BILL 

To regulate the collection, retention, disclosure, and 

destruction of biometric information, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘National Biometric 

5 Information Privacy Act of 2020’’. 

6 SEC. 2. DEFINITIONS. 

7 In this Act: 

8 (1) BIOMETRIC IDENTIFIER.—The term ‘‘bio9 metric identifier’’— 

10 (A) includes— 


kjohnson on DSK79L0C42PROD with BILLS
2 

•S 4400 IS

1 (i) a retina or iris scan; 

2 (ii) a voiceprint; 

3 (iii) a faceprint (including any face4 print derived from a photograph); 

5 (iv) fingerprints or palm prints; and 

6 (v) any other uniquely identifying in7 formation based on the characteristics of 

8 an individual’s gait or other immutable 

9 characteristic of an individual; 

10 (B) does not include writing samples, writ11 ten signatures, photographs, human biological 

12 samples used for valid scientific testing or 

13 screening, demographic data, tattoo descrip14 tions, or physical descriptions such as height, 

15 weight, hair color, or eye color; 

16 (C) does not include donated organs, tis17 sues, or parts or blood or serum stored on be18 half of recipients or potential recipients of living 

19 or cadaveric transplants and obtained or stored 

20 by a federally designated organ procurement 

21 agency; 

22 (D) does not include information captured 

23 from a patient in a health care setting for a 

24 medical purpose or information collected, used, 

25 or stored for health care treatment, payment, or 


kjohnson on DSK79L0C42PROD with BILLS
3 

•S 4400 IS

1 operations under the Health Insurance Port2 ability and Accountability Act of 1996 (Public 

3 Law 104–191); and 

4 (E) does not include an x ray, roentgen 

5 process, computed tomography, MRI, PET 

6 scan, mammography, or other image or film of 

7 the human anatomy used to diagnose, prognose, 

8 or treat an illness or other medical condition or 

9 to further validate scientific testing or screen10 ing. 

11 (2) CONFIDENTIAL AND SENSITIVE INFORMA12 TION.—The term ‘‘confidential and sensitive infor13 mation’’— 

14 (A) means personal information that can 

15 be used to uniquely identify an individual or an 

16 individual’s account or property; and 

17 (B) includes genetic markers, genetic test18 ing information, unique identifier numbers to 

19 locate accounts or property, account numbers, 

20 personal identification numbers, pass codes, 

21 driver’s license numbers, or Social Security 

22 numbers. 

23 (3) PRIVATE ENTITY.—The term ‘‘private enti24 ty’’— 


kjohnson on DSK79L0C42PROD with BILLS
4 

•S 4400 IS

1 (A) means any individual, partnership, cor2 poration, limited liability company, association, 

3 or other group, however organized; and 

4 (B) does not include any Federal, State, or 

5 local government agency or academic institu6 tion. 

7 (4) WRITTEN RELEASE.—The term ‘‘written re8 lease’’ means— 

9 (A) specific, discrete, freely given, unam10 biguous, and informed written consent given by 

11 an individual who is not under any duress or 

12 undue influence of an entity or third party at 

13 the time such consent is given; or 

14 (B) in the context of employment, a release 

15 executed by an employee as a condition of em16 ployment. 

17 SEC. 3. COLLECTION, RETENTION, DISCLOSURE, AND DE18 STRUCTION OF BIOMETRIC INFORMATION. 

19 (a) WRITTEN POLICY.— 

20 (1) IN GENERAL.—Not later than 60 days after 

21 the date of the enactment of this Act, any private 

22 entity in possession of biometric identifiers or bio23 metric information concerning an individual shall de24 velop and make available to the public a written pol25 icy establishing a retention schedule and guidelines 


kjohnson on DSK79L0C42PROD with BILLS
5 

•S 4400 IS

1 for permanently destroying such biometric identifiers 

2 and biometric information not later than the earlier 

3 of— 

4 (A) the date on which the initial purpose 

5 for collecting or obtaining such identifiers or in6 formation has been satisfied, if the individual 

7 from whom the biometric information was col8 lected— 

9 (i) freely consented to the original 

10 purpose for such collection; and 

11 (ii) could have declined such collection 

12 without consequence; or 

13 (B) 1 year after the individual’s last inten14 tional interaction with the private entity. 

15 (2) COMPLIANCE.—Absent a valid warrant or 

16 subpoena issued by a court of competent jurisdic17 tion, a private entity in possession of biometric iden18 tifiers or biometric information shall comply with the 

19 retention schedule and destruction guidelines estab20 lished pursuant to paragraph (1). 

21 (b) LIMITATIONS.— 

22 (1) IN GENERAL.—A private entity may not col23 lect, capture, purchase, receive through trade, or 

24 otherwise obtain a person’s or a customer’s biomet25 ric identifier or biometric information unless— 


kjohnson on DSK79L0C42PROD with BILLS
6 

•S 4400 IS

1 (A) the entity requires the identifier or in2 formation— 

3 (i) to provide a service for the person 

4 or customer; or 

5 (ii) for another valid business purpose 

6 specified in the written policy published 

7 pursuant to section 3; and 

8 (B) the entity first— 

9 (i) informs the person or customer, or 

10 his or her legally authorized representative, 

11 in writing— 

12 (I) that such biometric identifier 

13 or biometric information is being col14 lected or stored; and 

15 (II) of the specific purpose and 

16 length of term for which a biometric 

17 identifier or biometric information is 

18 being collected, stored, and used; and 

19 (ii) receives a written release executed 

20 by the subject of the biometric identifier or 

21 biometric information or by the subject’s 

22 legally authorized representative. 

23 (2) WRITTEN RELEASE.—A written release 

24 under paragraph (1)(B)— 


kjohnson on DSK79L0C42PROD with BILLS
7 

•S 4400 IS

1 (A) may not be sought through, as a part 

2 of, or otherwise combined with any other con3 sent or permission seeking instrument or func4 tion; 

5 (B) may not be combined with an employ6 ment contract; and 

7 (C) if it involves a minor, may only be ob8 tained through the minor’s parent or guardian. 

9 (c) PROHIBITED ACTS.—A private entity in posses10 sion of a biometric identifier or biometric information may 

11 not sell, lease, trade, use for advertising purposes, or oth12 erwise profit from a person’s or a customer’s biometric 

13 identifier or biometric information. 

14 (d) DISCLOSURE.—A private entity in possession of 

15 a biometric identifier or the biometric information of a 

16 person, including a consumer, job applicant, employee, 

17 former employee, or contractor, may not disclose, redis18 close, sell, lease, trade, use for advertising purposes, other19 wise disseminate, or profit from such biometric identifier 

20 or biometric information unless— 

21 (1) the subject of the biometric identifier or bio22 metric information, or the subject’s legally author23 ized representative, provides a written release to 

24 such specified action immediately prior to such dis25 closure or redisclosure, including a description of— 


kjohnson on DSK79L0C42PROD with BILLS
8 

•S 4400 IS

1 (A) the data that will be disclosed; 

2 (B) the reason for such disclosure; and 

3 (C) the recipients of such data; 

4 (2) the disclosure or redisclosure completes a fi5 nancial transaction requested or authorized by the 

6 subject of the biometric identifier or the biometric 

7 information or the subject’s legally authorized rep8 resentative; or 

9 (3) the disclosure or redisclosure— 

10 (A) is required by Federal, State, or mu11 nicipal law; or 

12 (B) is required pursuant to a valid warrant 

13 or subpoena issued by a court of competent ju14 risdiction. 

15 (e) CONDITIONS.—A private entity in possession of 

16 a biometric identifier or biometric information shall store, 

17 transmit, and protect from disclosure all biometric identi18 fiers and biometric information— 

19 (1) using the reasonable standard of care within 

20 the private entity’s industry; and 

21 (2) in a manner that is the same as, or more 

22 protective than, the manner in which the private en23 tity stores, transmits, and protects other confidential 

24 and sensitive information. 


kjohnson on DSK79L0C42PROD with BILLS
9 

•S 4400 IS

1 (f) RIGHT TO KNOW.—Any business that collects, 

2 uses, shares, or sells biometric identifiers or biometric in3 formation, upon the request of an individual, shall dis4 close, free of charge, any such information relating to such 

5 individual collected during the preceding 12-month period, 

6 including— 

7 (1) the categories of personal information; 

8 (2) specific pieces of personal information; 

9 (3) the categories of sources from which the 

10 business collected personal information; 

11 (4) the purposes for which the business uses the 

12 personal information; 

13 (5) the categories of third parties with whom 

14 the business shares the personal information; and 

15 (6) the categories of information that the busi16 ness sells or discloses to third parties. 

17 SEC. 4. CAUSE OF ACTION. 

18 (a) IN GENERAL.—Any individual aggrieved by a vio19 lation of section 3 may bring a civil action in a court of 

20 competent jurisdiction against a private entity that alleg21 edly committed such violation. Any such violation con22 stitutes an injury-in-fact and a harm to any affected indi23 vidual. 

24 (b) ADMISSIBILITY.—Except in a judicial investiga25 tion or proceeding alleging a violation of section 3, inforVerDate Sep 11 2014 00:29 Aug 26, 2020 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S4400.IS S4400

kjohnson on DSK79L0C42PROD with BILLS
10 

•S 4400 IS

1 mation obtained in violation of section 3 is not admissible 

2 by the Federal Government in any criminal, civil, adminis3 trative, or other investigation or proceeding. 

4 (c) RIGHT TO SUE.—An individual described in sub5 section (a) may institute legal proceedings against a pri6 vate entity alleged to have violated section 3 for the relief 

7 described in subsection (e) in any court of competent juris8 diction. 

9 (d) ENFORCEMENT BY STATE ATTORNEYS GEN10 ERAL.—The chief law enforcement officer of a State, or 

11 any other State officer authorized by law to bring actions 

12 on behalf of the residents of a State, may bring a civil 

13 action, as parens patriae, on behalf of the residents of 

14 such State in an appropriate district court of the United 

15 States to enforce this Act if the chief law enforcement offi16 cer or other State officer has reason to believe that the 

17 interests of the residents of the State have been or are 

18 being threatened or adversely affected by a violation of 

19 section 3. 

20 (e) FORMS OF RELIEF.— 

21 (1) IN GENERAL.—A plaintiff bringing a civil 

22 action under this section may recover— 

23 (A)(i) for the negligent violations of any 

24 provision of section 3, the greater of— 


kjohnson on DSK79L0C42PROD with BILLS
11 

•S 4400 IS

1 (I) $1,000 in liquidated damages per 

2 violation; or 

3 (II) the actual damages suffered by 

4 the plaintiff; or 

5 (ii) for the intentional or reckless violation 

6 of any provision of section 3, the sum of— 

7 (I) the actual damages suffered by the 

8 plaintiff; and 

9 (II) any punitive damages awarded by 

10 the court, which shall be limited to $5,000 

11 per violation; 

12 (B) reasonable attorneys’ fees and costs, 

13 including expert witness fees and other litiga14 tion expenses; and 

15 (C) other relief, including an injunction, as 

16 the court may deem appropriate. 

17 (2) SPECIFIC PERFORMANCE.—A court may re18 quire a private entity to permanently destroy the bi19 ometric identifiers, biometric information, or con20 fidential and sensitive information of a plaintiff 

21 under this section. 

22 SEC. 5. RULES OF CONSTRUCTION. 

23 Nothing in this Act may be construed— 

24 (1) to impact the admission or discovery of bio25 metric identifiers and biometric information in any 


kjohnson on DSK79L0C42PROD with BILLS
12 

•S 4400 IS

1 action of any kind in any court, or before any tri2 bunal, board, agency, or person; 

3 (2) to conflict with the Health Insurance Port4 ability and Accountability Act of 1996 (Public Law 

5 104–191); 

6 (3) to conflict with title V of the Federal 

7 Gramm-Leach-Bliley Act (15 U.S.C. 6801 et seq.); 

8 (4) to apply to a contractor, subcontractor, or 

9 agent of a Federal, State, or local government agen10 cy in the course of employment with such agency; or 

11 (5) to preempt or supersede any Federal, State, 

12 or local law that imposes a more stringent limitation 

13 than the limitations described in section 3. 

Æ 


kjohnson on DSK79L0C42PROD with BILLS