2017 Montana Legislature

Additional Bill Links     PDF (with line numbers)

HOUSE BILL NO. 518

INTRODUCED BY N. MCCONNELL

 

A BILL FOR AN ACT ENTITLED: "AN ACT ESTABLISHING THE MONTANA BIOMETRIC INFORMATION PRIVACY ACT; PROHIBITING A PRIVATE ENTITY FROM COLLECTING, STORING, AND USING A PERSON'S BIOMETRIC DATA WITHOUT A PERSON'S CONSENT; ESTABLISHING PROCEDURES AND REQUIREMENTS FOR THE SALE, DISCLOSURE, PROTECTION, AND DISPOSAL OF BIOMETRIC INFORMATION; PROVIDING EXEMPTIONS; PROVIDING DEFINITIONS; CREATING A PRIVATE RIGHT OF ACTION AND ESTABLISHING PENALTIES; AND PROVIDING AN IMMEDIATE EFFECTIVE DATE."

 

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MONTANA:

 

     NEW SECTION.  Section 1.  Short title. [Sections 1 through 7] may be cited as the "Montana Biometric Information Privacy Act".

 

     NEW SECTION.  Section 2.  Definitions. For purposes of [sections 1 through 7], the following definitions apply:

     (1) (a) "Biometric data" means a biologic or behavioral characteristic that uniquely identifies and enables automated recognition of an individual, including but not limited to retina or iris scan, finger or palm print, voice recognition, hand or face geometry, facial imaging, facial recognition, gait recognition, vein recognition, or other biologic or behavioral identifiers.

     (b) The term does not include the following:

     (i) written signature, demographic data, physical description, writing sample, tattoo description, or human biological sample used for valid scientific screening or testing;

     (ii) donated organ, tissue, blood, serum, or plasma stored on behalf of a potential recipient;

     (iii) information captured from a patient in a health care setting or information collected and used for health care treatment, including an x-ray, MRI, PET scan, mammography, or other image of the human anatomy used to diagnose, prognose, or treat an illness or other medical condition or to further validate scientific testing or screening; or

     (iv) a photograph or video, unless the photograph or video is collected, shared, or stored for use as a source of biometric data or for use as biometric information. A photograph or video that is used to aid a person who is blind or otherwise visually impaired is not biometric data for purposes of this subsection.

     (2) "Biometric information" means any information based on a person's biometric data that is collected, stored, or used to identify an individual.

     (3) (a) "Private entity" means any individual, partnership, corporation, limited liability company, association, or other group however organized.

     (b) The term does not include a state or local governmental agency or a court, clerk of court, or a judge of a court in this state.

     (4) "Writing" means a written or electronic communication that can be documented and is written in plain, easily understood language.     

 

     NEW SECTION.  Section 3.  Collection of biometric data -- notification and consent. (1) A private entity may not collect, capture, purchase, receive through trade, or otherwise obtain for use a person's biometric data or biometric information unless the private entity first:

     (a) notifies the person in writing:

     (i) that the person's biometric data is being collected;

     (ii) of the specific type of biometric data that is being collected;

     (iii) of the specific purpose for which the biometric data will be used; and

     (iv) of the length of time the biometric data will be collected, stored, and used; and

     (b) receives full consent of the person in writing to:

     (i) the collection and storage of the biometric data;

     (ii) the specific purpose for which the biometric data will be used; and

     (iii) the length of time the biometric data will be stored.

     (2) A private entity in possession of biometric data or biometric information must have a written policy, made available to the public, establishing a reasonable process for a person to revoke the person's consent.

     (3) If biometric data is collected and stored for security purposes by a person's employer, the purpose for the collection is presumed to expire upon the termination of the person's employment.

 

     NEW SECTION.  Section 4.  Sale and disclosure of biometric information. (1) (a) A private entity that possesses a person's biometric data or biometric information may not sell, lease, trade, or otherwise profit from the person's biometric information.

     (b) This subsection does not prohibit a private entity from transferring a person's biometric data or biometric information through a sale of the private entity to another party.

     (2) A private entity that possesses a person's biometric data or biometric information may not disclose, transfer, or distribute a person's biometric data or biometric information unless:

     (a) the person consents in writing to the disclosure;

     (b) the disclosure completes a financial transaction requested or authorized by the person;

     (c) the disclosure is required by state or federal law; or

     (d) the disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.

 

     NEW SECTION.  Section 5.  Protection and disposal of biometric information. (1) A private entity in possession of a person's biometric data or biometric information shall store, transmit, and protect from disclosure the biometric data or biometric information using the reasonable standard of care within the private entity's industry and in a manner that is the same as or more protective than the manner in which the private entity stores, transmits, and protects other confidential, sensitive, and personally identifying information.

     (2) Unless prohibited by other law or court order, a private entity in possession of a person's biometric data or biometric information must permanently delete, destroy, or remove the person's biometric information when the initial purpose for collecting or obtaining the information is satisfied or fulfilled or the term or duration for the collection and storage of the biometric information has ended.

 

     NEW SECTION.  Section 6.  Exemptions. [Sections 1 through 7] do not apply to the collection, retention, analysis, disclosure, or distribution of biometric data or biometric information:

     (1) for law enforcement purposes conducted by government agencies, including for the identification of perpetrators, missing persons, trafficking victims, or human remains;     

     (2) for facial images used by the department of justice to create driver's licenses or other state identification cards;

     (3) pursuant to or authorized by state or federal law; or

     (4) the retention of voices for quality assurance purposes.

 

     NEW SECTION.  Section 7.  Biometric information -- private right of action. (1) Any person aggrieved by a private entity's failure to comply with the provisions of [sections 1 through 7] may bring a civil action in a court of competent jurisdiction in this state. A prevailing party may recover:

     (a) for a private entity that purposely or knowingly violates the provisions of [sections 1 through 7], a penalty of $1,000 for each violation, except that if the violation resulted in profit or monetary gain to the private entity, a penalty of $5,000;

     (b) reasonable costs and attorney fees incurred in bringing the action; and

     (c) any other relief including an injunction or other equitable relief a court deems appropriate.

     (2) For purposes of this section, "purposely" and "knowingly" have the meaning provided in 45-2-101.

 

     NEW SECTION.  Section 8.  Codification instruction. [Sections 1 through 7] are intended to be codified as an integral part of Title 30, and the provisions of Title 30 apply to [sections 1 through 7].

 

     NEW SECTION.  Section 9.  Severability. If a part of [this act] is invalid, all valid parts that are severable from the invalid part remain in effect. If a part of [this act] is invalid in one or more of its applications, the part remains in effect in all valid applications that are severable from the invalid applications.

 

     NEW SECTION.  Section 10.  Effective date. [This act] is effective on passage and approval.

- END -

 


Latest Version of HB 518 (HB0518.01)
Processed for the Web on February 17, 2017 (6:18pm)

New language in a bill appears underlined, deleted material appears stricken.

Sponsor names are handwritten on introduced bills, hence do not appear on the bill until it is reprinted.

See the status of this bill for the bill's primary sponsor.

 Status of this Bill | 2017 Legislature | Leg. Branch Home
All versions of all bills (PDF format)
Authorized print version of this bill w/line numbers (PDF format)
[
NEW SEARCH ]

Prepared by Montana Legislative Services
(406) 444-3064