Consumer Data Protection Act; definition of "biometric data"; consent required for processing.

Plain English Breakdown

The official source material does not provide specific details on how the bill follows federal rules for children's privacy, only that it adheres to the Children's Online Privacy Protection Act (COPPA) in certain cases.

Consumer Data Protection Act; Biometric Data Consent

This law requires companies to get permission from people before using their biometric data like facial information.

What This Bill Does

• Defines 'facial data' as information about a person's face that can be used to identify them, including photos or videos.
• Requires businesses to ask for permission from consumers before using their biometric data like facial images or eye scans.

Who It Names or Affects

• Consumers whose biometric data is collected by companies.
• Companies that collect and use biometric data.

Terms To Know

Biometric Data

Information about a person's physical characteristics, like facial features or eye patterns, used to identify them.

Controller

A company that decides how and why biometric data is collected and processed.

Limits and Unknowns

• Does not apply to airlines regulated by the Federal Aviation Act.
• Certain national security, health care, or other federal agreements can delay enforcement of this law.

Official Summary Text

Consumer Data Protection Act; definition of "biometric data"; consent required for processing biometric data.
Provides that, under the Consumer Data Protection Act, no consumer, controller, processor, or affiliate of the controller or processor shall process biometric data, defined separately in the bill, concerning an individual without obtaining the individual's consent, or, in the case of the processing of biometric data concerning a known child, without processing such data in accordance with the federal Children's Online Privacy Protection Act.

Current Bill Text

HOUSE BILL NO. 654

AMENDMENT IN THE NATURE OF A SUBSTITUTE

(Proposed by the House Committee on Communications, Technology and Innovation

on ________________)

(Patron Prior to Substitute--Delegate Maldonado)

A BILL to amend the Code of Virginia by adding a section numbered
59.1-577.2
, relating to Consumer Data Protection Act; consent required for processing certain biometric data.

Be it enacted by the General Assembly of Virginia:

1. That the Code of Virginia is amended by adding a section numbered
59.1-577.2
as follows:

§

59.1-577.2
.
Consent required for processing
certain
biometric data
.

A. For purposes of this section
,
"
f
acial
data" means

data
generated by automatic measurements of an individual's
face that are used to identify a specific individual, including
facial mapping, facial geometry, or facial template
technologies.

"
Facial
data" includes data generated from a physical or digital photograph
or a video

recording
.

B.
No
controller, processor, or affiliate of the controller or processor
shall process

facial
data
or
data related to eye retinas or irises
concerning a
consumer
without obtaining the

consumer
's consent
, or, in the case of the processing of
such

data concerning a known child, without processing such data in accordance with the federal Children's Online Privacy Protection Act (15 U.S.C. § 6501 et seq.).

C. In addition to the
exemptions
described in §
59.1-576
, this section shall not apply to
an air carrier, as defined and regulated under the Federal Aviation Act
of 1958
(49 U.S.C.
§

401
01 et s
eq.)
,
as amended
. No provision of this section that is expressly preempted by a federal act or agreement governing
national security
, health care, or otherwise
shall be enforced or imposed until the termination of such act or agreement
.