An Act To Regulate the Use of Biometric Identifiers
Maine Legislature, Session 130, LD 1945
Committee: Judiciary
Sponsors: O'NEIL, BAILEY, ANDREWS, FAULKINGHAM, HICKMAN, MAXMIN

Legislative Document
No. 1945
H.P. 1450
House of Representatives, January 26, 2022
An Act To Regulate the Use of Biometric Identifiers
Approved for introduction by a majority of the Legislative Council pursuant to Joint Rule 
203.
Reference to the Committee on Judiciary suggested and ordered printed.
ROBERT B. HUNT
Clerk
Presented by Representative O'NEIL of Saco.
Cosponsored by Senator BAILEY of York and
Representatives: ANDREWS of Paris, FAULKINGHAM of Winter Harbor, Senators: 
HICKMAN of Kennebec, MAXMIN of Lincoln.
Be it enacted by the People of the State of Maine as follows:
Sec. 1.  10 MRSA c. 1057 is enacted to read:
CHAPTER 1057
PRIVACY OF PERSONAL INFORMATION
§9601.  Definitions
As used in this chapter, unless the context otherwise indicates, the following terms 
have the following meanings.
1. Affirmative written consent. "Affirmative written consent" means:
A. A specific, unambiguous and informed written consent given by an individual who 
is not under duress or undue influence at the time the consent is given; or
B. In the context of employment, a release signed by an employee as a condition of 
employment.
2. Biometric identifier.  "Biometric identifier" means information generated by 
measurements of an individual's unique biological characteristics, including imagery of the 
iris, retina, fingerprint, face or hand, that can be used to identify that individual.  "Biometric 
identifier" does not include:
A. A writing sample or written signature;
B. A photograph or video, except for measurable biological characteristics that can be 
generated or captured from a photograph or video;
C. A biological sample used for valid scientific testing or screening;
D.  Demographic information;
E. A tattoo description or a physical description, such as height, weight, hair color or 
eye color;
F.  A donated organ, tissue or other body part, blood or serum stored on behalf of a 
recipient or potential recipient of a living or cadaveric transplant and obtained or stored 
by a federally designated organ procurement organization;
G. Information captured from a patient in a health care setting or information collected, 
used or stored for health care treatment, payment or operations under the federal Health 
Insurance Portability and Accountability Act of 1996, Public Law 104-191; or
H. An x-ray, computed tomography, magnetic resonance imaging, positron emission 
tomography, mammography or other image or film of the human anatomy used to 
diagnose or treat an illness or other medical condition or to further validate scientific 
testing or screening.
3.  Personal information.  "Personal information" means information that identifies, 
relates to, describes, is reasonably capable of being associated with or could reasonably be 
linked, directly or indirectly, with a particular individual, household or electronic device.
4.  Private entity.  "Private entity" means an individual, partnership, corporation, 
limited liability company, association or other group, however organized, that conducts 
business.  "Private entity" does not include a state or local government agency, court, judge, 
justice or clerk of the court.
5. Processor.  "Processor" means a private entity that collects, processes, stores or 
otherwise uses biometric identifiers on behalf of another private entity.
§9602.  Applicability
1. Processors. A processor is not required to comply with the requirements of this 
chapter with respect to the biometric identifiers that the processor stores, processes or 
otherwise uses under an agreement with another private entity with which the processor is 
not affiliated through common ownership.  A processor is required to comply with the 
requirements of this chapter with respect to the biometric identifiers that the processor 
collects, stores, processes or uses that are not covered by an agreement with another private 
entity with which the processor is not affiliated through common ownership.
2. General exceptions. This chapter does not apply to:
A.  The admission or discovery of a biometric identifier in any action of any kind in 
any court or before any government tribunal, board or agency;
B.  A requirement under the federal Health Insurance Portability and Accountability 
Act of 1996, Public Law 104-191 and applicable regulations; or
C.  A contractor, subcontractor or agent of a state agency or local unit of government 
when working for that state agency or local unit of government.
§9603.  Biometric identifier policy requirements
1. Development of policy. Except as provided by subsection 3, a private entity in 
possession of biometric identifiers shall develop and make available to the public a written 
policy that establishes a retention schedule and guidelines for permanently destroying a 
biometric identifier of an individual on the earlier of:
A. The date on which the initial purpose for obtaining the biometric identifier has been 
satisfied; or
B. One year after the individual's last intentional interaction with the private entity in 
possession of the biometric identifier.
2. Adherence to policy. A private entity shall comply with the policy developed by 
the private entity under subsection 1, except for an action taken in response to a valid 
warrant or subpoena issued by a court of competent jurisdiction.
3. Exception.  A private entity is not required to make available to the public a written 
policy that:
A. Applies only to the employees of the private entity; and
B. Is used solely within the private entity for the operation of the private entity.
4.  Violation.  A violation of this section is a violation of the Maine Unfair Trade 
Practices Act.
§9604.  Storage, transmission and protection
1. Standards.  A private entity that collects or possesses a biometric identifier shall 
store, transmit and protect from disclosure that biometric identifier in a manner that is:
A. Consistent with the reasonable standard of care used in the private entity's industry; 
and
B. As protective or more protective than the manner in which the private entity stores, 
transmits and protects from disclosure other confidential and sensitive information.
2. Confidential and sensitive information.  For purposes of this section, "confidential 
and sensitive information" means personal information that can be used to identify an 
individual or an individual's account or property, including:
A. Genetic testing information;
B. A unique or personal identification number;
C. An account number;
D. A pass code; 
E. A driver's license number; and
F.  A social security number.
§9605.  Required disclosure
1. Disclosure required. On the request of an individual, a private entity that collects 
or possesses a biometric identifier shall disclose to that individual, free of charge, any 
biometric identifier associated with that individual and the information required by 
subsection 2. 
2. Required information. The information disclosed as required by subsection 1 must 
include all the relevant information for the period of 12 months before the biometric 
identifier was collected by or entered into the possession of the private entity, including:
A. The type of biometric identifier;
B. All personal information related to the biometric identifier;
C. The types of sources from which the private entity obtained the biometric identifier 
and personal information linked to the biometric identifier;
D. The use of the biometric identifier and personal information linked to the biometric 
identifier;
E. The type of 3rd party with which the private entity has shared the biometric 
identifier; and
F. The type of personal information linked to the biometric identifier that the private 
entity has disclosed to a 3rd party.
3.  Violation.  A violation of this section is a violation of the Maine Unfair Trade 
Practices Act.
§9606.  Prohibitions
1. Collection or dissemination without consent. A private entity may not collect, 
purchase, receive through trade or otherwise obtain, use, disclose, transfer or otherwise 
disseminate an individual's biometric identifier unless the private entity first:
A. Informs the individual in writing that a biometric identifier is being collected, 
purchased, received through trade or otherwise obtained, used, disclosed, transferred 
or otherwise disseminated;
B.  Informs the individual in writing of the specific purpose and length of time for 
which a biometric identifier is being collected, purchased, received through trade or 
otherwise obtained, used, disclosed, transferred or otherwise disseminated; and 
C.  Receives affirmative written consent from the individual.
This subsection does not apply to a disclosure of a biometric identifier if the disclosure 
completes a financial transaction requested or authorized by the individual, is required by 
state or federal law or municipal ordinance or is required pursuant to a valid warrant or 
subpoena issued by a court of competent jurisdiction.
2. Sale, lease or trade without consent. A private entity that is not acting as a 
processor and that collects a biometric identifier may not sell, lease, trade or otherwise 
profit from that biometric identifier unless the individual to whom the biometric identifier 
pertains has provided affirmative written consent for the sale, lease, trade or other activity.
3. Discrimination. A private entity may not:
A. Condition a sale of goods or the provision of a service on the collection, use, 
disclosure, transfer, sale or processing of a biometric identifier unless the use of a 
biometric identifier is strictly necessary to the sale of the goods or the provision of the 
service;
B. Charge a different price or rate for goods or the provision of a service to a customer 
that does not provide affirmative written consent to providing a biometric identifier; or
C. Provide a different quality of goods or a service to a customer that does not provide 
affirmative written consent to providing a biometric identifier.
4. Processors. A processor may not perform an action related to a biometric identifier 
unless:
A. The processor has received affirmative written consent from the individual to whom 
the biometric identifier pertains to perform the action; and
B. The action falls within the terms and conditions of an agreement between the 
processor and the private entity that owns or controls the biometric identifier.
5.  Violation.  A violation of this section is a violation of the Maine Unfair Trade 
Practices Act.
§9607.  Private right of action 
1.  Action for violation.  An individual aggrieved by a violation of this chapter may 
bring an action against an offending private entity.  If the individual prevails in the action, 
the individual is entitled to:
A.  For a violation of this chapter:
(1)  As a result of negligence, actual damages or $1,000 per violation, whichever 
is greater; or
(2)  As a result of recklessness or intentional misconduct, actual damages or $5,000 
per violation, whichever is greater;
B.  Reasonable attorney's fees and court costs, including expert witness fees and other 
litigation expenses; and
C.  Other relief, including injunctive or equitable relief, as the court determines 
appropriate.
SUMMARY
This bill provides for an individual's privacy regarding the collection and use of 
biometric identifiers of the individual and personal information connected to the biometric 
identifiers.  The bill requires a written release from an individual before a private entity 
may obtain or use biometric identifiers and requires the private entity to establish a policy 
for retention and destruction of the identifiers.  The bill provides for a private right of action 
for an aggrieved individual who has had biometric identifiers obtained or used in violation 
of the new provisions.  The bill also provides that violations of provisions related to 
biometric identifiers constitute violations of the Maine Unfair Trade Practices Act.