CHAPTER 503. BIOMETRIC IDENTIFIERS - Texas Statutes

BUSINESS AND COMMERCE CODE

TITLE 11. PERSONAL IDENTITY INFORMATION

SUBTITLE A. IDENTIFYING INFORMATION

CHAPTER 503. BIOMETRIC IDENTIFIERS

Sec. 503.001. CAPTURE OR USE OF BIOMETRIC IDENTIFIER. (a) In

this section, "biometric identifier" means a retina or iris scan,

fingerprint, voiceprint, or record of hand or face geometry.

(b) A person may not capture a biometric identifier of an

individual for a commercial purpose unless the person:

(1) informs the individual before capturing the biometric

identifier; and

(2) receives the individual's consent to capture the biometric

identifier.

(c) A person who possesses a biometric identifier of an

individual that is captured for a commercial purpose:

(1) may not sell, lease, or otherwise disclose the biometric

identifier to another person unless:

(A) the individual consents to the disclosure for identification

purposes in the event of the individual's disappearance or death;

(B) the disclosure completes a financial transaction that the

individual requested or authorized;

(C) the disclosure is required or permitted by a federal statute

or by a state statute other than Chapter 552, Government Code; or

(D) the disclosure is made by or to a law enforcement agency for

a law enforcement purpose in response to a warrant;

(2) shall store, transmit, and protect from disclosure the

biometric identifier using reasonable care and in a manner that

is the same as or more protective than the manner in which the

person stores, transmits, and protects any other confidential

information the person possesses; and

(3) shall destroy the biometric identifier within a reasonable

time, but not later than the first anniversary of the date the

purpose for collecting the identifier expires, except as provided

by Subsection (c-1).

(c-1) If a biometric identifier of an individual captured for a

commercial purpose is used in connection with an instrument or

document that is required by another law to be maintained for a

period longer than the period prescribed by Subsection (c)(3),

the person who possesses the biometric identifier shall destroy

the biometric identifier within a reasonable time, but not later

than the first anniversary of the date the instrument or document

is no longer required to be maintained by law.

(c-2) If a biometric identifier captured for a commercial

purpose has been collected for security purposes by an employer,

the purpose for collecting the identifier under Subsection (c)(3)

is presumed to expire on termination of the employment

relationship.

(d) A person who violates this section is subject to a civil

penalty of not more than $25,000 for each violation. The

attorney general may bring an action to recover the civil

penalty.

Added by Acts 2007, 80th Leg., R.S., Ch.

885, Sec. 2.01, eff. April 1, 2009.

Amended by:

Acts 2009, 81st Leg., R.S., Ch.

1163, Sec. 1, eff. September 1, 2009.