A3625 A4211 ACS 1/25/21

An Act concerning biometric surveillance systems and supplementing Title 52 of the Revised Statutes.

Be It Enacted by the Senate and General Assembly of the State of New Jersey:

1. As used in P.L. , c. (C. ) (pending before the Legislature as this bill):

“Biometric surveillance system” means any computer software system that performs remote facial recognition or other remote biometric recognition of a person without the person’s, or the person’s legally authorized representative’s, knowledge or consent.

“Facial recognition” means an automated or semi-automated process that assists in identifying a person or capturing information about a person based on the physical characteristics of the person’s face, or that logs characteristics of a person’s face, head, or body to infer emotion, associations, activities, or location of the person.

“Confidential and sensitive information” means personal information that can be used to uniquely identify a person or a person’s account or property and includes, but is not limited to, a unique identifier number to locate an account or property, an account number, a personal identification number, a passcode, a driver’s license number, or a social security number.

"DNA" means deoxyribonucleic acid.

“Law enforcement agency” means: a State, interstate, municipal, or county law enforcement agency; a law enforcement agency of an educational institution that appoints law enforcement officers pursuant to P.L.1970, c.211 (C.18A:6-4.2 et seq.); or any other department, division, bureau, commission, board, or other authority of this State or political subdivision thereof which employs law enforcement officers.

“Other remote biometric recognition” means an automated or semi-automated process that assists in identifying a person or capturing information about a person based on the characteristics of a person’s gait, voiceprint, or other immutable characteristic ascertained from a distance, or that logs these characteristics to infer emotion, associations, activities, or location of the person. “Other remote biometric recognition” shall not include any remote biometric recognition that is based on DNA, fingerprints, or palm prints from a person.

“Private entity” means any person, partnership, corporation, limited liability company, association, or other group, however organized. A private entity shall not include a public entity or any court or judge thereof.

"Public entity" means the State, any county, municipality, district, or other political subdivision thereof, and any agency, authority, or instrumentality of the foregoing; or any officer, employee, agent, contractor, or subcontractor of a public entity.

“Written release” means informed written consent or, in the context of employment, a release executed by an employee of a private entity as a condition of employment.

2. a. A public entity shall not acquire, possess, access, collect, capture, purchase, receive through trade, or otherwise obtain or use information about a person derived from the use of a biometric surveillance system.

b. Any person who suffers a violation of this section may institute proceedings for injunctive or declaratory relief in any court of competent jurisdiction to enforce this section, and the person shall be entitled to recover for each violation:

(1) against a public entity that negligently violates a provision of this section, liquidated damages of $1,000 or actual damages, whichever is greater;

(2) against a public entity that intentionally or recklessly violates a provision of this section, liquidated damages of $5,000 or actual damages, whichever is greater;

(3) reasonable attorneys’ fees and costs, including expert witness fees and other litigation expenses; and

(4) any other relief the court deems appropriate.

c. A person’s information derived from the use of a biometric surveillance system in violation of this section shall not be admissible in any criminal, civil, administrative, or other proceeding, except in a judicial proceeding alleging a violation of this section.

d. The provisions of this section shall not prohibit a law enforcement agency from:

(1) lawfully utilizing a mobile fingerprint scanning device during a detention to identify a person who does not have proof of identification provided that the information retained through the use of the device is otherwise permitted by law;

(2) accessing DNA information pursuant to the “DNA Database and Databank Act of 1994,” P.L.1994, c.136 (C.53:1-20.17 et seq.) or for any other law enforcement purpose otherwise permitted by law;

(3) accessing and utilizing fingerprint data in accordance with current law; or

(4) utilizing a lawfully installed security system that processes information derived from the use of a biometric surveillance system solely for the purpose of verifying the identity of law enforcement officers and employees of law enforcement agencies to determine whether they are permitted to access information, goods, materials, areas, or other properties under the custody of the law enforcement agency.

3. a. There is established the “Biometric Surveillance Regulation Commission,” which shall evaluate whether public entities in this State should be permitted to use biometric surveillance systems, and, if appropriate, propose recommendations for legislation, regulations, and standards governing the use of biometric surveillance systems by public entities. The commission specifically shall examine:

(1) permissible and prohibited uses of biometric surveillance systems by public entities;

(2) minimum standards for accuracy that biometric surveillance systems are required to achieve in order to be authorized for use by public entities and auditing requirements to ensure compliance with those standards;

(3) standards for the use, management, and protection of information derived from the use of biometric surveillance systems by public entities including, but not limited to, data retention, information sharing, data access, and audit trials;

(4) protections for due process, privacy, free speech and association, and racial, gender, and religious equity;

(5) training requirements for public entity personnel authorized to use biometric surveillance systems;

(6) procedures to address instances in which a person is wrongfully targeted, arrested, or interrogated based on inaccurate information derived from the use of a biometric surveillance system; and

(7) disclosure requirements for public transparency as well as discovery procedures.

b. The commission shall consist of nine members, serving ex officio, or their designees:

(1) the Superintendent of State Police;

(2) the Attorney General;

(3) the Public Defender;

(4) one county prosecutor to be appointed by the County Prosecutors Association of the State of New Jersey;

(5) the Administrative Director of the Courts;

(6) one representative of an organization that defends civil rights or promotes social justice to be appointed by the Speaker of the General Assembly;

(7) one faculty member of a university with knowledge and experience in utilizing biometric surveillance systems to be appointed by the President of the Senate;

(8) one member of the public to be appointed by the Speaker of the General Assembly; and

(9) one member of the public to be appointed by the President of the Senate.

c. The commission shall organize within 30 days of the appointment of its members. The commission shall elect a chairperson from among its members, and the chairperson shall select a secretary who need not be a member of the commission.

d. The commission may meet at the call of its chairperson at times and in the places it may deem appropriate and necessary to fulfill its duties, and may conduct public hearings at any place it shall designate.

e. The commission may request at a public hearing the appearance of officials of any State agency or political subdivision of the State and may solicit testimony of interested groups and the general public.

f. The commission shall be entitled to call to its assistance and avail itself of the services of the employees of any State, county, or municipal department, board, bureau, commission, or agency as it may require and as may be available to it for its purposes, and to employ stenographic and clerical assistance and incur traveling and other miscellaneous expenses necessary to perform its duties, within the limits of funds appropriated or otherwise made available to it for its purposes.

g. The members of the commission shall serve without compensation, but may be reimbursed for necessary expenses incurred in the performance of their duties to the extent that funds are made available for that purpose.

h. Five members of the commission shall constitute a quorum for the transaction of business.

i. The commission shall prepare and submit a report of its findings and recommendations, including legislative proposals, to the Governor and, pursuant to section 2 of P.L.1991, c.164 (C.52:14-19.1), to the Legislature, no later than 18 months after the organizational meeting of the commission. The commission shall expire upon submission of its report.

4. a. A private entity in possession of a person’s information derived from the use of a biometric surveillance system shall develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying that information when the initial purpose for collecting or obtaining the information has been satisfied or within three years of the person’s last interaction with the private entity, whichever occurs first. Unless otherwise provided in State or federal law or regulation, or in a valid warrant or subpoena issued by a court of competent jurisdiction, a private entity in possession of a person’s information derived from the use of a biometric surveillance system shall comply with its established retention schedule and destruction guidelines.

b. A private entity shall not acquire, possess, access, collect, capture, purchase, receive through trade, or otherwise obtain or use a person’s information derived from the use of a biometric surveillance system unless it first:

(1) informs the person or the person’s legally authorized representative in writing that information derived from the use of a biometric surveillance system is being collected or stored;

(2) informs the person or the person’s legally authorized representative in writing of the specific purpose and length of term for which a person’s information derived from a biometric surveillance system is being collected, stored, and used; and

(3) receives a written release executed by the person or the person’s legally authorized representative.

c. A private entity in possession of a person’s information derived from the use of biometric surveillance system shall not sell, lease, trade, or otherwise profit from that information.

d. A private entity in possession of a person’s information derived from the use of a biometric surveillance system shall not disclose, re-disclose, or otherwise disseminate that information unless:

(1) the person or the person’s legally authorized representative consents to the disclosure or re-disclosure;

(2) the disclosure or re-disclosure completes a financial transaction requested or authorized by the person or the person’s legally authorized representative;

(3) the disclosure or re-disclosure is required by State or federal law or municipal ordinance; or

(4) the disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.

e. A private entity in possession of a person’s information derived from the use of a biometric surveillance system shall store, transmit, and protect from disclosure that information:

(1) using the reasonable standard of care within the private entity’s industry; and

(2) in a manner that is the same as or more protective than the manner in which the private entity stores, transmits, and protects other confidential and sensitive information.

f. A person’s information derived from the use of a biometric surveillance system that is obtained in violation of this section shall not be admissible in any criminal, civil, administrative, or other proceeding, except in a judicial proceeding alleging a violation of this section.

5. Any person who suffers a violation of section 4 of P.L. , c. (C. ) (pending before the Legislature as this bill) may institute proceedings for injunctive or declaratory relief in any court of competent jurisdiction to enforce section 4 of P.L. , c. (C. ) (pending before the Legislature as this bill), and the person shall be entitled to recover for each violation:

a. against a private entity that negligently violates a provision of section 4 of P.L. , c. (C. ) (pending before the Legislature as this bill), liquidated damages of $1,000 or actual damages, whichever is greater;

b. against a private entity that intentionally or recklessly violates a provision of section 4 of P.L. , c. (C. ) (pending before the Legislature as this bill), liquidated damages of $5,000 or actual damages, whichever is greater;

c. reasonable attorneys’ fees and costs, including expert witness fees and other litigation expenses; and

d. other relief the court deems appropriate.

6. Nothing in P.L. , c. (C. ) (pending before the Legislature as this bill) shall apply to a financial institution or an affiliate of a financial institution that is subject to Title V of the federal “Gramm-Leach-Bliley Act,” 15 U.S.C. s.6801 et seq., and the rules and implementing regulations promulgated thereunder.

7. This act shall take effect immediately and section 3 of this act shall expire upon the submission of the commission’s report.