BILL ANALYSIS

C.S.H.B. 3186

By: McCall

Business & Industry

Committee Report (Substituted)

BACKGROUND AND PURPOSE

Biometric identifiers, including fingerprints, voiceprints, retina or iris scans, and records of hand or face geometry, are increasingly used by businesses and governmental entities to confirm the identity of an individual. However, a record of a biometric identifier can also be misused by identity thieves to impersonate the owner of the identifier in business transactions or other contexts.  

There are concerns that biometric data, like all personally indentifying information, is increasingly becoming a target of identity theft and needs to be safeguarded to protect individual privacy and prevent economic harm to both individuals and businesses. The bill will help ensure that biometric identifiers can continue to be used as a tool by law enforcement and businesses to confirm the identity of an individual accurately.  

C.S.H.B. 3186 narrows the circumstances in which a biometric identifier is authorized to be disclosed by a person in possession of an identifier and requires a biometric identifier to be destroyed within one year of the date the purpose for collecting the identifier expires.

RULEMAKING AUTHORITY

It is the committee's opinion that this bill does not expressly grant any additional rulemaking authority to a state officer, department, agency, or institution.

ANALYSIS

C.S.H.B. 3186 amends the Business & Commerce Code to specify that the prohibition against selling, leasing, or otherwise disclosing an individual's biometric identifier to another person and certain requirements relating to the storage, transmission, protection, and destruction of a biometric identifier apply to an identifier that is captured for a commercial purpose. The bill specifies in an exception to this prohibition relating to the consent of the individual for the disclosure of the biometric identifier that the consent to the disclosure is for identification purposes in the event of the individual's disappearance or death. The bill specifies that the exception to the prohibition for a disclosure made by or to a law enforcement agency for a law enforcement purpose be in response to a warrant. The bill requires a person who possesses the biometric identifier of an individual to destroy the biometric identifier within a reasonable time, but not later than the first anniversary of the date the purpose for collecting the identifier expires.

C.S.H.B. 3186 requires a person who possesses the biometric identifier of an individual used in connection with an instrument or document required by another law to be maintained for a period longer than the period specified above to destroy the identifier within a reasonable time, but not later than the first anniversary of the date the instrument or document is no longer required to be maintained by law, and specifies that the purpose of a biometric identifier collected for security purposes by an employer is presumed to expire on termination of the employment relationship. The bill requires a person who before the effective date of the bill possesses a biometric identifier that is required to be destroyed to destroy the identifier on or before October 1, 2009. 

EFFECTIVE DATE

September 1, 2009.

COMPARISON OF ORIGINAL AND SUBSTITUTE

C.S.H.B. 3186 adds a provision not in the original specifying that the prohibition against selling, leasing, or otherwise disclosing an individual's biometric identifier to another person and certain requirements relating to the storage, transmission, protection, and destruction of a biometric identifier apply to an identifier that is captured for a commercial purpose.

C.S.H.B. 3186 removes a provision in the original striking language from existing law that provides an exception to the prohibition against selling, leasing, or otherwise disclosing an individual's biometric identifier to another person if the individual consents to the disclosure.

C.S.H.B. 3186 adds a provision not in the original specifying that the exception to the prohibition relating to the consent of the individual who is the source of the biometric identifier applies if the disclosure of the identifier is for identification purposes in the event of the individual's disappearance or death.

C.S.H.B. 3186 adds a provision not in the original requiring a person who possesses the biometric identifier of an individual used in connection with an instrument or document required to be maintained for a period longer than the specified period to destroy the identifier within a reasonable time, but not later than the first anniversary of the date the instrument or document is no longer required to be maintained.

C.S.H.B. 3186 adds a provision not in the original specifying that the purpose of a biometric identifier collected for security purposes by an employer is presumed to expire on termination of the employment relationship.

C.S.H.B. 3186 differs from the original by requiring a person who before the effective date of the bill possesses, rather than currently possesses as in the original, a biometric identifier that is required to be destroyed to destroy the identifier on or before October 1, 2009.

C.S.H.B. 3186 adds a prospective clause not in the original.