TX Bus & Com Code § 503.001 (2021)
2021 Texas Statutes|Business and Commerce Code|Title 11 - Personal Identity Information|Subtitle A - Identifying Information|Chapter 503 - Biometric Identifiers|Section 503.001. Capture or Use of Biometric Identifier

Sec. 503.001.  CAPTURE OR USE OF BIOMETRIC IDENTIFIER.  (a)  In this section, "biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.(b)  A person may not capture a biometric identifier of an individual for a commercial purpose unless the person:(1)  informs the individual before capturing the biometric identifier; and(2)  receives the individual's consent to capture the biometric identifier.(c)  A person who possesses a biometric identifier of an individual that is captured for a commercial purpose:(1)  may not sell, lease, or otherwise disclose the biometric identifier to another person unless:(A)  the individual consents to the disclosure for identification purposes in the event of the individual's disappearance or death;(B)  the disclosure completes a financial transaction that the individual requested or authorized;(C)  the disclosure is required or permitted by a federal statute or by a state statute other than Chapter 552, Government Code; or(D)  the disclosure is made by or to a law enforcement agency for a law enforcement purpose in response to a warrant;(2)  shall store, transmit, and protect from disclosure the biometric identifier using reasonable care and in a manner that is the same as or more protective than the manner in which the person stores, transmits, and protects any other confidential information the person possesses; and(3)  shall destroy the biometric identifier within a reasonable time, but not later than the first anniversary of the date the purpose for collecting the identifier expires, except as provided by Subsection (c-1).(c-1)  If a biometric identifier of an individual captured for a commercial purpose is used in connection with an instrument or document that is required by another law to be maintained for a period longer than the period prescribed by Subsection (c)(3), the person who possesses the biometric identifier shall destroy the biometric identifier within a reasonable time, but not later than the first anniversary of the date the instrument or document is no longer required to be maintained by law.(c-2)  If a biometric identifier captured for a commercial purpose has been collected for security purposes by an employer, the purpose for collecting the identifier under Subsection (c)(3) is presumed to expire on termination of the employment relationship.(d)  A person who violates this section is subject to a civil penalty of not more than $25,000 for each violation.  The attorney general may bring an action to recover the civil penalty.(e)  This section does not apply to voiceprint data retained by a financial institution or an affiliate of a financial institution, as those terms are defined by 15 U.S.C. Section 6809.|Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.Amended by: Acts 2009, 81st Leg., R.S., Ch. 1163 (H.B. 3186), Sec. 1, eff. September 1, 2009.Acts 2017, 85th Leg., R.S., Ch. 913 (S.B. 1343), Sec. 1, eff. September 1, 2017.|