This bill, S.F. No. 2260, introduced in the Minnesota Senate, establishes regulations for the collection, use, and protection of biometric data. It includes the following key provisions:

1. Definitions:

   • "Biometric identifier" includes fingerprints, retina or iris scans, voiceprints, and facial geometry.
   • Excludes certain medical images, anatomical gifts, and health-related data covered by HIPAA.
   • "Biometric information" refers to data derived from biometric identifiers.
   • "Private entity" refers to businesses but excludes government agencies and courts.
   • "Written release" denotes informed, voluntary consent.

2. Rules for Collection, Use, and Destruction:

   • Private entities must have a public policy outlining data retention and require destruction of biometric data within three years or when data is no longer needed.
   • Entities must obtain written consent before collecting biometric data and notify individuals of the purpose and retention period.
   • Selling, leasing, or profiting from biometric data is prohibited.
   • Disclosure is only permitted with consent, for transactions, by legal mandate, or under a court order.
   • Entities must implement security protocols to safeguard biometric data.

3. Right of Action:

   • Individuals whose biometric privacy rights are violated can sue in court.
   • Possible damages include:
     • $1,000 or actual damages for negligent violations.
     • $5,000 or actual damages for intentional/reckless violations.
     • Attorney fees, court costs, and injunctive relief.

4. Exemptions:

   • Does not affect legal discovery/use of biometric data in court.
   • Ensures compliance with HIPAA and the Gramm-Leach-Bliley Act (financial industry).
   • Excludes government contractors handling biometric data for state or local government work.

In essence, this bill aims to enhance biometric privacy protections by requiring explicit consent, prohibiting unauthorized sales/disclosure, and enabling legal action for violations.