Additional Bill Links PDF (with line numbers)
HOUSE BILL NO. 645
INTRODUCED BY K. SULLIVAN, J. READ, D. ZOLNIKOV
A BILL FOR AN ACT ENTITLED: "AN ACT ESTABLISHING THE MONTANA BIOMETRIC INFORMATION PRIVACY ACT; PROHIBITING A PRIVATE ENTITY FROM COLLECTING, STORING, AND USING A PERSON'S BIOMETRIC IDENTIFIER WITHOUT THE PERSON'S CONSENT; ESTABLISHING PROCEDURES AND REQUIREMENTS FOR THE SALE, DISCLOSURE, PROTECTION, AND DISPOSAL OF BIOMETRIC IDENTIFIERS; PROVIDING EXEMPTIONS; PROVIDING DEFINITIONS; ALLOWING THE ATTORNEY GENERAL TO ENFORCE THE PROVISIONS OF THE ACT; AND ESTABLISHING PENALTIES."
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MONTANA:
NEW SECTION. Section 1. Short title. [Sections 1 through 7] may be cited as the "Montana Biometric Information Privacy Act".
NEW SECTION. Section 2. Definitions. For the purposes of [sections 1 through 7], the following definitions apply:
(1) (a) "Biometric identifier" means a biologic, OR physical, or behavioral characteristic that identifies or enables THE AUTOMATED recognition of an individual, including but not limited to retina or iris scan, finger or palm print, voice recognition, hand or face geometry, facial imaging, facial recognition, gait recognition, vein recognition, identifying DNA information, or other biologic, OR physical, or behavioral identifiers when used for identification purposes. Identification purposes include use in a mathematical code or algorithmic model generated by or extracted from measurements of biometric identifiers.
(b) The term does not include the following:
(i) a written signature, demographic data, physical description, writing sample, or a tattoo description;
(ii) donated organs, tissue, blood, serum, or plasma stored on behalf of a potential recipient;
(iii) information captured from a patient in a health care setting or information collected and used for health care treatment, including an x-ray, MRI, PET scan, mammogram, or other image of the human anatomy used to diagnose, prognose, or treat an illness or other medical condition or to further validate scientific testing or screening; or
(iv) a photograph or video, unless the photograph or video is used as a source of a biometric identifier for identification purposes. A photograph or video that is used to aid a person who is blind or otherwise visually impaired is not a biometric identifier for purposes of this subsection (1).
(2) "Collect" means to capture, purchase, or acquire a person's biometric identifier.
(3) "Consent" means an affirmative, opt-in process of agreement that may include but is not limited to a person's signature or selecting or clicking a box.
(4) "Identification purposes" means the purpose of recognizing an individual or proving an individual's identity.
(5) (a) "Private entity" means any individual, partnership, corporation, limited liability corporation, association, trust, cooperative, or other group, however organized.
(b) The term does not include state or local government agencies, courts, or judges.
(6) "Retain" means to collect and store a biometric identifier in whatever form for future use as an identifier of an individual.
(7) "Security purpose" means the purpose of preventing shoplifting, theft, or fraud.
(8) "Writing" means a written communication that is clear and conspicuous in plain, easily understood language and may be in paper or electronic form.
NEW SECTION. Section 3. Collection and retention of biometric identifiers -- notification and consent. (1) Except as provided in subsection (2), a private entity may not collect, receive, obtain, or use a person's biometric identifier unless the private entity first:
(a) notifies the person in writing:
(i) that the person's biometric identifier is being collected and the specific type of biometric identifier that is being collected; and
(ii) of the specific purpose for which the biometric identifier will be used; and
(b) receives consent in writing to the collection and use of the person's biometric identifier.
(2) (a) Subsection (1) does not require a private entity to obtain a person's consent to collect a biometric identifier from the person if the biometric identifier:
(i) will not be retained but be used only to determine whether the person has provided prior consent for the collection of the biometric identifier;
(ii) is used only for a security purpose; or
(iii) is used to validate a bank transaction initiated by the person.
(b) Regardless of whether the private entity is required to obtain the person's consent to collect a biometric identifier as provided in subsection (1), the private entity shall comply with the provisions of [sections 1 through 7] if the private entity discloses, sells, transfers, distributes, licenses, or changes the use of the collected biometric identifier.
(3) If a biometric identifier is collected and stored for a security purpose by a person's employer, the purpose for the collection is presumed to expire upon the termination of the person's employment.
NEW SECTION. Section 4. Sale and disclosure of biometric identifier. A private entity that has collected, received, obtained, or is using a person's biometric identifier may not disclose, sell, transfer, distribute, license, or change the purpose of use of a person's biometric identifier unless:
(1) the private entity:
(a) notifies the person in writing:
(i) that the person's biometric identifier is being transferred or the purpose of use has changed; and
(ii) of the specific purpose for which the biometric identifier will be used; and
(b) receives consent of the person in writing;
(2) the disclosure completes a financial transaction requested or authorized by the person;
(3) the disclosure is required by state or federal law; or
(4) the disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.
NEW SECTION. Section 5. Protection and disposal of biometric identifiers. (1) A private entity that has collected, received, obtained, or is using a person's biometric identifier shall store, transmit, and protect from disclosure the biometric identifier in a manner that is the same as or more protective than the manner in which the private entity stores, transmits, and protects other confidential, sensitive, and personally identifying information.
(2) Unless prohibited by other law or court order, a private entity in possession of a person's biometric identifier shall permanently delete, destroy, or remove the person's biometric identifier within 6 months after the initial purpose for collecting or obtaining the identifier is satisfied or fulfilled or the term or duration for the collection and storage of the biometric identifier has ended.
NEW SECTION. Section 6. Exemptions. [Sections 1 through 7] do not apply:
(1) to law enforcement purposes when conducted by a government agency, including the identification of perpetrators, missing persons, trafficking victims, or human remains;
(2) to purposes authorized and conducted pursuant to state or federal law;
(3) to the retention of voices for quality assurance purposes;
(4) to third-party data storage providers or data transmitters, including internet service providers or mobile carriers, who provide for the storage or transmittal of data only; or
(4) TO THIRD-PARTY PROVIDERS, INCLUDING INTERNET, WIRELESS, AND TELECOMMUNICATIONS SERVICES PROVIDERS, DATA STORAGE PROVIDERS, OR CABLE AND VIDEO SERVICE PROVIDERS IN THEIR CAPACITY OF PROVIDING SERVICES SUCH AS HOSTING, SECURITY, TRANSMISSION, OR PROCESSING DATA ON BEHALF OF A PRIVATE ENTITY;
(5) if a person's biometric identifier is captured and stored within the person's own mobile device, computer device, or home security device where biometric identifiers are captured and stored locally within the device and the biometric identifiers do not transmit away from the device using the internet or other network; OR
(6) TO A FINANCIAL INSTITUTION OR AN AFFILIATE OF A FINANCIAL INSTITUTION THAT IS SUBJECT TO TITLE V OF THE GRAMM-LEACH-BLILEY ACT, 15 U.S.C. 6801 THROUGH 6809, OR A HEALTH CARE PROVIDER OR OTHER COVERED ENTITY SUBJECT TO THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996, 42 U.S.C. 1320D, ET SEQ.
NEW SECTION. Section 7. Enforcement -- penalty -- right to cure. (1) (a) Whenever the attorney general has reason to believe that a person or private entity has violated the provisions of [sections 1 through 7] and that proceeding would be in the public interest, the department of justice may bring an action in the name of the state or on behalf of persons residing in the state against the person or private entity to restrain by temporary or permanent injunction or temporary restraining order the use of the unlawful method, act, or practice upon giving appropriate notice to that person or private entity pursuant to 30-14-111(2).
(b) A person or private entity is in violation of [sections 1 through 7] if it fails to cure any alleged breach of [sections 1 through 7] within 30 days after receiving notice of alleged noncompliance.
(2) The provisions of 30-14-111(3) and (4) and 30-14-112 through 30-14-115 apply to [sections 1 through 7].
(3) A violation of [sections 1 through 7] is a violation of 30-14-103, and the penalties for a violation of [sections 1 through 7] are as provided in 30-14-142.
NEW SECTION. Section 8. Codification instruction. [Sections 1 through 7] are intended to be codified as an integral part of Title 30, and the provisions of Title 30 apply to [sections 1 through 7].
NEW SECTION. Section 9. Severability. If a part of [this act] is invalid, all valid parts that are severable from the invalid part remain in effect. If a part of [this act] is invalid in one or more of its applications, the part remains in effect in all valid applications that are severable from the invalid applications.
- END -
Latest Version of HB 645
(HB0645.02)
Processed for the Web on March 25, 2019 (4:49pm)
New language in a bill appears underlined, deleted material appears stricken.
Sponsor names are handwritten on introduced bills, hence do not appear on the bill until it is reprinted.
See the status of this bill for the bill's primary sponsor.
Status of this Bill | 2019 Legislature | Leg. Branch
Home
All versions of this bill (PDF
format)
Authorized print version of this bill w/line
numbers (PDF format)
[ NEW
SEARCH ]
Prepared by Montana
Legislative Services
(406) 444-3064