|
|
A BILL TO BE ENTITLED
|
|
AN ACT
|
|
|
relating to the collection and use of biometric identifiers. |
|
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS: |
|
SECTION 1. Section 503.001, Business & Commerce Code, is |
|
amended by amending Subsection (c) and adding Subsections (c-1) and |
|
(c-2) to read as follows: |
|
(c) A person who possesses a biometric identifier of an |
|
individual that is captured for a commercial purpose: |
|
(1) may not sell, lease, or otherwise disclose the |
|
biometric identifier to another person unless: |
|
(A) the individual consents to the disclosure for |
|
identification purposes in the event of the individual's |
|
disappearance or death; |
|
(B) the disclosure completes a financial |
|
transaction that the individual requested or authorized; |
|
(C) the disclosure is required or permitted by a |
|
federal statute or by a state statute other than Chapter 552, |
|
Government Code; or |
|
(D) the disclosure is made by or to a law |
|
enforcement agency for a law enforcement purpose in response to a |
|
warrant; [and] |
|
(2) shall store, transmit, and protect from disclosure |
|
the biometric identifier using reasonable care and in a manner that |
|
is the same as or more protective than the manner in which the |
|
person stores, transmits, and protects any other confidential |
|
information the person possesses; and |
|
(3) shall destroy the biometric identifier within a |
|
reasonable time, but not later than the first anniversary of the |
|
date the purpose for collecting the identifier expires, except as |
|
provided by Subsection (c-1). |
|
(c-1) If a biometric identifier of an individual is used in |
|
connection with an instrument or document that is required by |
|
another law to be maintained for a period longer than the period |
|
prescribed by Subsection (c)(3), the person who possesses the |
|
biometric identifier shall destroy the biometric identifier within |
|
a reasonable time, but not later than the first anniversary of the |
|
date the instrument or document is no longer required to be |
|
maintained by law. |
|
(c-2) If a biometric identifier has been collected for |
|
security purposes by an employer, the purpose for collecting the |
|
identifier under Subsection (c)(3) is presumed to expire on |
|
termination of the employment relationship. |
|
SECTION 2. (a) The changes in law made by this Act apply to |
|
a biometric identifier possessed by a person: |
|
(1) on or after the effective date of this Act; or |
|
(2) before the effective date of this Act, subject to |
|
Subsection (b) of this section. |
|
(b) A person who before the effective date of this Act |
|
possesses a biometric identifier that is required to be destroyed |
|
because of the changes in law made by this Act shall destroy the |
|
biometric identifier on or before October 1, 2009. |
|
SECTION 3. This Act takes effect September 1, 2009. |
|
|
|
* * * * * |