An Act providing for a requirement for commercial establishments to disclose the use and collection of biometric identifier information and providing for a private cause of action.

PRINTER'S NO. 604
THE GENERAL ASSEMBLY OF PENNSYLVANIA
HOUSE BILL
No. 596
Session of
2025
INTRODUCED BY NEILSON, RABB, SANCHEZ, GIRAL, PIELLI, HILL-EVANS,
CIRESI, HADDOCK, FREEMAN, OTTEN, FIEDLER AND GREEN,
FEBRUARY 12, 2025
REFERRED TO COMMITTEE ON COMMERCE, FEBRUARY 12, 2025
AN ACT
Providing for a requirement for commercial establishments to
disclose the use and collection of biometric identifier
information and providing for a private cause of action.
The General Assembly of the Commonwealth of Pennsylvania
hereby enacts as follows:
Section 1. Short title.
This act shall be known and may be cited as the Biometric
Identifier Signage Act.
Section 2. Definitions.
The following words and phrases when used in this act shall
have the meanings given to them in this section unless the
context clearly indicates otherwise:
"Biometric identifier information." A physiological or
biological characteristic that is used by or on behalf of a
business, singly or in combination, to identify or assist in
identifying an individual, including:
(1) A retinal or iris scan.
(2) A fingerprint or voiceprint.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
(3) A scan of hand or face geometry or any other
identifying characteristic.
"Commercial establishment." A retail store, restaurant,
hotel, motel or place of entertainment or amusement.
"Customer." A purchaser or lessee, or a prospective
purchaser or lessee, of goods or services from a business.
"Financial institution." A bank, trust company, national
bank, savings bank, Federal mutual savings bank, savings and
loan association, Federal savings and loan association, Federal
mutual savings and loan association, credit union, Federal
credit union, branch of a foreign banking corporation, public
pension fund, retirement system, securities broker, securities
dealer or securities firm. The term does not include a
commercial establishment whose primary business is the retail
sale of goods and services to customers and provides limited
financial services, including the issuance of credit cards or
in-store financing to customers.
Section 3. Collection, use and retention of biometric
identifier information.
(a) Signage.--Any commercial establishment that collects,
retains, converts, stores or shares biometric identifier
information of customers must disclose the collection,
retention, conversion, storage or sharing, as applicable, by
placing a clear and conspicuous sign near all of the commercial
establishment's customer entrances notifying customers in plain,
simple language that customers' biometric identifier information
is being collected, retained, converted, stored or shared, as
applicable.
(b) Form of sign.--The sign under subsection (a) shall be
made in a form and manner prescribed by the Attorney General by
20250HB0596PN0604 - 2 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
regulation in consultation with the Bureau of Consumer
Protection.
(c) Unauthorized disclosure.--No commercial establishment
may sell, lease, trade or share biometric identifier information
in exchange for anything of value or otherwise profit from the
transaction of biometric identifier information.
Section 4. Civil action by customer.
(a) Civil action.--A customer who is aggrieved by a
violation of this act may institute a civil action on the
customer's behalf against an offending party. At least 30 days
prior to initiating an action against a commercial establishment
for a violation of section 3(a), the aggrieved customer shall
provide written notice to the commercial establishment stating
the customer's allegation. If, within 30 days, the commercial
establishment cures the violation and provides the aggrieved
customer an express written statement that the violation has
been cured and that no further violations shall occur, no action
may be initiated against the commercial establishment for the
violation. If a commercial establishment fails to cure the
alleged violation, the aggrieved customer may initiate an action
against the establishment. No prior written notice shall be
required for actions alleging a violation of section 3(c).
(b) Recovery.--The prevailing party of a civil action under
subsection (a) may recover:
(1) for each violation of section 3(a), damages of $500;
(2) for each negligent violation of section 3(c),
damages of $500;
(3) for each intentional or reckless violation of
section 3(a), damages of $5,000;
(4) reasonable attorney fees and costs, including expert
20250HB0596PN0604 - 3 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
witness fees and other litigation expenses; and
(5) other relief, including an injunction, as the court
may deem appropriate.
Section 5. Nonapplicability.
(a) Biometric identifier information.--Nothing in this act
shall apply to the collection, storage, sharing or use of
biometric identifier information by the Commonwealth or any
political subdivision, including employees and agents of the
Commonwealth or any political subdivision.
(b) Disclosure.--The disclosure required under section 3(a)
shall not apply to any of the following:
(1) A financial institution.
(2) Biometric identifier information collected through
photographs or video recordings, if:
(i) the images or videos collected are not analyzed
by software or applications that identify, or assist in
the identification of, individuals based on physiological
or biological characteristics; and
(ii) the images or video are not shared, sold or
leased to third parties other than law enforcement
agencies.
Section 6. Effective date.
This act shall take effect in 180 days.
20250HB0596PN0604 - 4 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23