Skip to main content Skip to office menu Skip to footer
Capital IconMinnesota Legislature

HF 2532

as introduced - 93rd Legislature (2023 - 2024) Posted on 03/02/2023 02:13pm

KEY: stricken = removed, old language.
underscored = added, new language.

Current Version - as introduced

Line numbers 1.1 1.2 1.3 1.4 1.5
1.6 1.7 1.8 1.9 1.10 1.11 1.12 1.13 1.14 1.15 1.16 1.17 1.18 1.19 1.20 1.21 1.22 1.23 2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 2.9 2.10 2.11 2.12 2.13 2.14 2.15 2.16 2.17 2.18 2.19 2.20 2.21 2.22 2.23 2.24 2.25 2.26 2.27 2.28 2.29 2.30 2.31 2.32 3.1 3.2 3.3 3.4 3.5 3.6 3.7 3.8 3.9 3.10 3.11 3.12 3.13 3.14 3.15 3.16 3.17 3.18 3.19 3.20 3.21 3.22 3.23 3.24 3.25 3.26 3.27 3.28 3.29 3.30 3.31 4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.8 4.9 4.10 4.11 4.12

A bill for an act
relating to private data; establishing standards for biometric privacy; establishing
a right of action; proposing coding for new law in Minnesota Statutes, chapter
325E.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

Section 1.

new text begin [325E.80] BIOMETRIC PRIVACY.
new text end

new text begin Subdivision 1. new text end

new text begin Definitions. new text end

new text begin (a) For purposes of this section, the terms in this subdivision
have the meanings given.
new text end

new text begin (b) "Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or scan of
hand or face geometry. Biometric identifiers shall not include writing samples, written
signatures, photographs, human biological samples used for valid scientific testing or
screening, demographic data, tattoo descriptions, or physical descriptions such as height,
weight, hair color, or eye color. Biometric identifiers shall not include anatomical gifts as
defined in section 525A.02 or blood or serum stored on behalf of recipients or potential
recipients of living or cadaveric transplants and obtained or stored by a federally designated
organ procurement agency. Biometric identifiers do not include information captured from
a patient in a health care setting or information collected, used, or stored for health care
treatment, payment, or operations under the federal Health Insurance Portability and
Accountability Act of 1996. Biometric identifiers do not include an X-ray, roentgen process,
computed tomography, magnetic resonance imaging, positron-emission tomography scan,
mammography, or other image or film of the human anatomy used to diagnose, prognose,
or treat an illness or other medical condition or to further validate scientific testing or
screening.
new text end

new text begin (c) "Biometric information" means any information, regardless of how it is captured,
converted, stored, or shared, based on an individual's biometric identifier used to identify
an individual. Biometric information shall not include information derived from items or
procedures excluded under the definition of biometric identifiers.
new text end

new text begin (d) "Confidential and sensitive information" means personal information that can be
used to uniquely identify an individual or an individual's account or property which shall
include, but shall not be limited to, a genetic marker, genetic testing information, a unique
identifier number to locate an account or property, an account number, a personal
identification number, a pass code, a driver's license number, or a social security number.
new text end

new text begin (e) "Private entity" means any individual, partnership, corporation, limited liability
company, association, or other group, however organized. A private entity shall not include
a state or local government agency or any court in the state, a clerk of the court, or a judge
or justice of the court.
new text end

new text begin (f) "Written release" means informed written consent or, in the context of employment,
a release executed by an employee as a condition of employment.
new text end

new text begin Subd. 2. new text end

new text begin Retention; collection; disclosure; destruction. new text end

new text begin (a) A private entity in possession
of biometric identifiers or biometric information must develop a written policy, made
available to the public, establishing a retention schedule and guidelines for permanently
destroying biometric identifiers and biometric information when the initial purpose for
collecting or obtaining such identifiers or information has been satisfied or within three
years of the individual's last interaction with the private entity, whichever occurs first.
Absent a valid warrant or subpoena issued by a court, a private entity in possession of
biometric identifiers or biometric information must comply with its established retention
schedule and destruction guidelines.
new text end

new text begin (b) No private entity may collect, capture, purchase, receive through trade, or otherwise
obtain a person's or a customer's biometric identifier or biometric information, unless it
first:
new text end

new text begin (1) informs the subject or the subject's legally authorized representative in writing that
a biometric identifier or biometric information is being collected or stored;
new text end

new text begin (2) informs the subject or the subject's legally authorized representative in writing of
the specific purpose and length of term for which a biometric identifier or biometric
information is being collected, stored, and used; and
new text end

new text begin (3) receives a written release executed by the subject of the biometric identifier or
biometric information or the subject's legally authorized representative.
new text end

new text begin (c) No private entity in possession of a biometric identifier or biometric information
may sell, lease, trade, or otherwise profit from a person's or a customer's biometric identifier
or biometric information.
new text end

new text begin (d) No private entity in possession of a biometric identifier or biometric information
may disclose, redisclose, or otherwise disseminate a person's or a customer's biometric
identifier or biometric information unless:
new text end

new text begin (1) the subject of the biometric identifier or biometric information or the subject's legally
authorized representative consents to the disclosure or redisclosure;
new text end

new text begin (2) the disclosure or redisclosure completes a financial transaction requested or authorized
by the subject of the biometric identifier or the biometric information or the subject's legally
authorized representative;
new text end

new text begin (3) the disclosure or redisclosure is required by federal, state or local law or municipal
ordinance; or
new text end

new text begin (4) the disclosure is required pursuant to a valid warrant or subpoena issued by a court.
new text end

new text begin (e) A private entity in possession of a biometric identifier or biometric information shall:
new text end

new text begin (1) store, transmit, and protect from disclosure all biometric identifiers and biometric
information using the reasonable standard of care within the private entity's industry; and
new text end

new text begin (2) store, transmit, and protect from disclosure all biometric identifiers and biometric
information in a manner that is the same as or more protective than the manner in which
the private entity stores, transmits, and protects other confidential and sensitive information.
new text end

new text begin Subd. 3. new text end

new text begin Right of action. new text end

new text begin Any person aggrieved by a violation of this section shall have
a right of action in district court against an offending party. A prevailing party may recover
for each violation:
new text end

new text begin (1) against a private entity that negligently violates a provision of this section, liquidated
damages of $1,000 or actual damages, whichever is greater;
new text end

new text begin (2) against a private entity that intentionally or recklessly violates a provision of this
section, liquidated damages of $5,000 or actual damages, whichever is greater;
new text end

new text begin (3) reasonable attorneys' fees and costs, including expert witness fees and other litigation
expenses; and
new text end

new text begin (4) other relief, including an injunction, as the court may deem appropriate.
new text end

new text begin Subd. 4. new text end

new text begin Construction with other laws. new text end

new text begin (a) Nothing in this section shall be construed
to impact the admission or discovery of biometric identifiers and biometric information in
any action of any kind in any court, or before any tribunal, board, agency, or person.
new text end

new text begin (b) Nothing in this section shall be construed to conflict with the federal Health Insurance
Portability and Accountability Act of 1996.
new text end

new text begin (c) Nothing in this section shall be deemed to apply in any manner to a financial institution
or an affiliate of a financial institution that is subject to Title V of the federal
Gramm-Leach-Bliley Act of 1999.
new text end

new text begin (d) Nothing in this section shall be construed to apply to a contractor, subcontractor, or
agent of a state agency or local government when working for that state agency or local
government.
new text end