Creates the "Enhanced Personal Privacy Act"

SECOND REGULAR SESSION
HOUSE BILL NO. 3537
103RD GENERAL ASSEMBL Y
INTRODUCED BY REPRESENT A TIVE CHRIST .
7496H.02I JOSEPH ENGLER, Chief Clerk
AN ACT
T o amend chapter 1, RSMo, by adding thereto five new sections relating to the enhanced
personal privacy act.
Be it enacted by the General Assembly of the state of Missouri, as follows:
Section A. Chapter 1, RSMo, is amended by adding thereto five new sections, to be
2 known as sections 1.561, 1.563, 1.566, 1.567, and 1.572, to read as follows:
1.561. Sections 1.561 to 1.572 shall be known and may be cited as the "Enhanced
2 Personal Privacy Act".
1.563. As used in sections 1.561 to 1.572, the following terms mean:
2 (1) "Biometric identifier", data generated by automatic measur ements of an
3 individual's biological characteristics such as a reti na or iris scan, fingerprint,
4 voiceprint, or scan of hand or face geometry , or any other biological characteristic
5 that is used to uniquely identify an individual. "Biometric identifier" does not include:
6 (a) W riting samples; written signature s; a photograph or video, or data
7 generated ther efr om; human biological samples used for valid scientific testing or
8 scr eening; demographic data; tattoo descriptions; or physical descriptions such as
9 height, weight, hair color , or eye color;
10 (b) Any donated organ, tissue, or part, as those terms ar e defined under section
11 194.210, or blood or serum stor ed on behalf of recip ients or potential rec ipients of living
12 or cadaveric transplants and obtained or stor ed by a federally designated organ
13 pr ocur ement agency;
14 (c) Information captur ed fr om a patient in a health care setting or information
15 collected, used, or stored for health care tr eatment, payment, or operations under the
EXPLANA TION — Matter enclosed in bold-faced brackets [thus] in the above bill is not enacted and is
intended to be omitted from the law . Matter in bold-face type in the above bill is proposed language.
16 federal Health Insurance Portability and Accountability Act of 1996, Pub. L. 104-191;
17 or
18 (d) An X-ray , roen tgen pro cess, computed tomography , MRI, PET scan,
19 mammography , or other image or film of the human anatomy used to diagnose,
20 pr ognose, or trea t an illness or other medical condition or to further validate scientific
21 testing or scr eening;
22 (2) "Commer cial purpose", a purpose in furtherance of the sale or disclosur e to
23 a third party of a biometric identifier for the purpose of marketing goods or services
24 when such goods or services are unr elated to the initial transaction in which a private
25 entity first gains possession of an individual's biometric identifier . "Commerci al
26 purpose" does not include a security purpose or law enforcem ent purpose;
27 (3) "Confidential and sensitive information", personal information that can be
28 used to uniquely identify an individual or an individual's account or pr operty .
29 Examples of "confidential and sensitive information" include, but are not limited to, a
30 genetic marker , genetic testing information, a unique identifier number to locate an
31 account or pro perty , an account number , a PIN number , a pass code, a driver's license
32 number , or a Social Security number;
33 (4) "Consent", an individual has rea sonable access to a notice that informs the
34 person or customer , or the person's or customer's legally authorized r epresent ative,
35 that:
36 (a) A biometric identifier is being collected and stored; and
37 (b) That of the specific purpose and length of term for which a biometric
38 identifier is being collected, stored , and used, and the individual impliedly authorizes the
39 practices described in the notice thr ough action or inaction, including silence or
40 continuing to engage with the private party .
41
42 "Consent" shall not be construed to req uire affirmative consent;
43 (5) "Private entity", any individual acting in a commerci al context, partnership,
44 corporation, limited liability company , association, or other gr oup however organized.
45 "Private entity" does not include a state or local government agency . "Private entity"
46 does not include any court of Missouri, a clerk of the court, or a judge or justice ther eof;
47 (6) "Security purpose", the purpose of preve nting shoplifting, fraud, or any
48 other misapprop riation or theft of a thing of value, including tangible and intangible
49 goods, services, and other purposes in furtherance of pr otecting the security or integrity
50 of software, accounts, applications, online services, or any person.
1.566. 1. Any private entity in possession of biometric identifiers shall develop a
2 written policy establishing a r etention schedule and guidelines for permanently
HB 3537 2
3 destr oying biometric identifiers when the initial purpose for collecting or obtaining such
4 identifiers has been satisfied, or within one year of the individual's last interaction with
5 the private entity , whichever occurs first. Absent a valid warrant issued by a court of
6 competent jurisdiction, a private entity in possession of biometric identifiers shall
7 comply with its established reten tion schedule and destruction guidelines.
8 2. No private entity shall collect, capture, pur chase, recei ve thr ough trade, or
9 otherwise obtain a person's or a customer's biometric identifier for a commer cial
10 purpose unless it r eceives consent fr om the person or customer , or the person's or
11 customer's legally authorized r epresent ative.
12 3. Any entity or individual r equir ed to comply with the federal Health Insurance
13 Portability and Accountability Act, Pub. L. No. 104-191, shall tr eat biometric identifiers
14 as individually identifiable health information and unique health identifiers pro tected
15 under that act and the rules pr omulgated ther eunder .
16 4. No private entity in possession of a biometric identifier shall sell, lease, trade,
17 disclose, redisclose, or otherwise disseminate a person's or a customer's biometric
18 identifier for a commer cial purpose unless:
19 (1) The person or customer , or the person's or customer's legally authorized
20 r epresent ative pr ovides consent;
21 (2) The disclosur e completes a financial transaction requ ested or authorized by
22 the person or customer , or the person's or customer's legally authorized rep res entative;
23 (3) The disclosur e is made to a third party who contractually pr omises that the
24 biometric identifier shall not be further disclosed and shall not be r etained for a purpose
25 inconsistent with the consent under subsection 2 of this section;
26 (4) The disclosure is re quir ed by state law , federal law , or municipal ordinance;
27 or
28 (5) The disclosure is made to pr epar e for litigation, to res pond to or participate
29 in a judicial pr ocess, or is r equir ed under a court order or valid warrant issued by a
30 court of competent jurisdiction.
31 5. A private entity in possession of a biometric identifier shall:
32 (1) Store, transmit, and pr otect fr om disclosure all biometric identifiers using
33 the reas onable standard of car e within the private entity's industry; and
34 (2) Store, transmit, and protect from disclosur e all biometric identifiers in a
35 manner that is the same as or mor e protect ive than the manner in which the private
36 entity stores, transmits, and pro tects other confidential and sensitive information.
1.567. The attorney general has exclusive authority to enforce sections 1.561 to
2 1.572. A violation of sections 1.561 to 1.572 does not pro vide a basis for , nor is a
HB 3537 3
3 violation of such sections subject to, a private right of action under sections 1.561 to
4 1.572 or any other law .
1.572. 1. Nothing in sections 1.561 to 1.572 shall be construed to impact the
2 admission or discovery of biometric identifiers in any action of any kind in any court, or
3 befor e any tribunal, board, agency , or person.
4 2. Nothing in sections 1.561 to 1.572 shall be construed to conflict with section
5 334.097 or with the federal Health Insurance Portability and Accountability Act of 1996,
6 Pub. L. 104-191, or the rules pr omulgated ther eunder .
7 3. Nothing in sections 1.561 to 1.572 shall be deemed to apply in any manner to a
8 financial institution or an affiliate of a financial institution that is subject to T itle V of
9 the federal Gramm-Leach-Bliley Act of 1999, Pub. L. 106-102, and the rules
10 pr omulgated ther eunder .
11 4. Nothing in sections 1.561 to 1.572 shall be construed to apply to a contractor ,
12 subcontractor , or agent of a state agency or local unit of government when working for
13 that state agency or local unit of government.
14 5. Nothing in sections 1.561 to 1.572 shall be construed to req uire an entity to
15 pr ovide notice and obtain consent to collect, capture , pur chase, r eceive thr ough trade,
16 otherwise obtain, use, sell, lease, trade, disclose, red isclose, or otherwise disseminate a
17 biometric identifier in furtherance of a security purpose.
18 6. Nothing in sections 1.561 to 1.572 shall be construed to apply to biometric
19 identifiers collected or used by a private entity in the context of employment.
✔
HB 3537 4