ASSEMBLY, No. 2448
STATE OF NEW JERSEY
210th LEGISLATURE
INTRODUCED JUNE 13, 2002
Sponsored by:
Assemblywoman JOAN M. QUIGLEY
District 32 (Bergen and Hudson)
SYNOPSIS
Creates the "Biometric Identifier Privacy Act."
CURRENT VERSION OF TEXT
As introduced.
An Act concerning biometric identifiers and supplementing Title 2A of the New Jersey Statutes.
Be It Enacted by the Senate and General Assembly of the State of New Jersey:
1. This act shall be known and may be cited as the "Biometric Identifier Privacy Act."
2. As used in this act:
"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of a hand or a face geometry.
"Governmental entity" means the State, any agency, authority, or employee thereof, or any political subdivision of the State, including but not limited to any county, municipality, or school district, or any agency, authority, or employee thereof.
3. a. Notwithstanding any other provision of law to the contrary, no person shall obtain a biometric identifier of an individual, for the purpose of commercial advantage, without authorization of the individual.
b. A person who possesses a biometric identifier of an individual shall not sell, lease, or otherwise disclose the biometric identifier to another person unless:
(1) the individual consents to the sale, lease or disclosure;
(2) the sale, lease or disclosure completes a financial transaction requested or authorized by the individual;
(3) the sale, lease or disclosure is required or permitted by federal or State law; or
(4) the sale, lease or disclosure is made by or to a law enforcement agency for a law enforcement purpose.
c. A person who possesses a biometric identifier of an individual shall store, transmit, and protect from disclosure the biometric identifier using reasonable care and in a manner that is the same as or more protective than the manner in which the person stores, transmits, and protects other confidential information.
d. A person aggrieved by a violation of this section may bring an action in the Superior Court to enjoin further violation and to recover for the actual damage sustained by reasons of such violation, including costs and reasonable attorneys fees.
e. Any person who violates any provision of this section shall be liable for a civil penalty of not more than $25,000 for each violation. Any such penalty shall be enforced and collected in accordance with "The Penalty Enforcement Law of 1999," P.L.1999, c.274 (C.2A:58-10 et seq.). Any action to collect or enforce any such penalty shall be brought in the Superior Court by the Attorney General or county prosecutor.
4. a. A governmental entity that possesses a biometric identifier of an individual shall not sell, lease, or otherwise disclose the biometric identifier to another person unless:
(1) the individual consents to the sale, lease or disclosure;
(2) the sale, lease or disclosure is required or permitted by a federal or State law; or
(3) the sale, lease or disclosure is made by or to a law enforcement agency for a law enforcement purpose.
b. A governmental entity that possesses a biometric identifier of an individual shall store, transmit, and protect from disclosure the biometric identifier using reasonable care and in a manner that is the same as or more protective than the manner in which the governmental entity stores, transmits, and protects other confidential information.
c. A governmental entity that possesses a biometric identifier of an individual shall establish a reasonable procedure under which an individual is entitled to have the governmental entity correct information about the individual that is possessed by the governmental entity and that is incorrect. The procedure shall not unduly burden an individual using the procedure.
d. A person aggrieved by a violation of this section may bring an action in the Superior Court, to enjoin further violation and to recover the actual damage sustained by reasons of such violation, including costs and reasonable attorneys fees.
e. Information compiled pursuant to this section shall not be subject to disclosure pursuant to P.L.1963, c. 73 (C.47:1A-1 et seq.) as amended and supplemented.
5. This act shall take effect immediately.
STATEMENT
This bill, the "Biometric Identifier Privacy Act," provides guidelines for the use and distribution of biometric identifiers and establishes civil penalties for the misuse of the information.
A biometric identifier is a retina or iris scan, fingerprint, voiceprint, or record of a hand or a face geometry. Biometrics technology is a noninvasive method of using computer technology to provide automatic identification or identity verification or authentication of individuals. The technology acquires an image of a physical feature which is then applied to the algorithm to produce a "template." This "template" is then encrypted for data transmission and storage. This stored "template" can then be stored and compared against the live "template" when necessary. This technology is being used for criminal identification as well as in airport security systems, border clearances and for transaction verifications in internet businesses. It is the sponsor's intent to protect the users of this technology by insuring that this data is not obtained, disclosed, misused or released without an individual's authorization.
Under the provisions of the bill a person cannot obtain another individual's biometric identifier information, for the purpose of commercial advantage, without authorization from that individual. The bill prohibits a person who possesses a biometric identifier of another individual from selling, leasing, or otherwise disclosing this information unless: the individual consents to the sale, lease or disclosure; the sale, lease or disclosure completes a financial transaction requested or authorized by the individual; the sale, lease or disclosure is required or permitted by federal or State law; or the sale, lease or disclosure is made by or to a law enforcement agency for a law enforcement purpose. A person who possesses a biometric identifier of an individual would be required to store, transmit, and protect from disclosure the biometric identifier using reasonable care and in a manner that is the same as or more protective than the manner in which that person stores, transmits, and protects other confidential information. The bill provides that any person who violates the provisions of the act would be liable for a civil penalty of not more than $25,000 for each violation. The Attorney General or county prosecutor would bring the action to collect or enforce the penalty in Superior Court. Furthermore, the bill provides that any person who has been aggrieved by a violation of the act may bring an action in the Superior Court, to enjoin further violation and to recover the actual damage sustained by reasons of such violation, including costs and reasonable attorneys fees.
In addition, the bill prohibits any governmental entity which possesses a biometric identifier of an individual from selling, leasing, or otherwise disclosing the biometric identifier to another person unless: the individual consents to the sale, lease or disclosure; the sale, lease or disclosure is required or permitted by a federal or State law; or the sale, lease or disclosure is made by or to a law enforcement agency for a law enforcement purpose. A governmental entity that possesses a biometric identifier of an individual would be required to store, transmit, and protect from disclosure the biometric identifier using reasonable care and in a manner that is the same as or more protective than the manner in which the governmental entity stores, transmits, and protects its other confidential information. The bill also requires the governmental entity to establish a reasonable procedure under which an individual is entitled to have the governmental entity correct information about the individual that is possessed by the governmental entity and that is incorrect. The procedure cannot be unduly burdensome.