HB 350

Abstract

This Act will create the Biometric Privacy Protection Act and Geolocation Privacy Protection Act in Title 6 of the Delaware Code to give Delaware’s citizens important protections with respect to the collection, storage, use, and disclosure of their unique biometric information (such as fingerprints, voiceprints, and retinal and facial scans) and, with respect to their use of mobile devices, geolocation information that can identify Biometrics are biological and behavioral characteristics, such as fingerprints, voiceprints, and retinal and facial scans, that uniquely identify a person, and they are increasingly being collected from Delaware’s citizens and used for a variety of purposes, including marketing, employment, and security. Biometrics are among our most sensitive personal information, potentially more valuable to identity thieves, hackers, and marketers than even Social Security numbers, and need to be protected as such. Currently under Delaware law, biometric information can be collected without an individual’s knowledge or consent, and a person capturing or collecting biometric information is not required to identify what biometric information is being collected, why it’s being collected, or how long it will be kept. Delaware law also contains no protections for individuals to prevent their biometric information from being sold or transferred to third parties. The use of biometrics offers great promise for improving the lives of Delaware’s citizens in a variety of ways, but the sensitivity and importance of biometric information requires that there be protections for Delawareans with regard to the collection and use of their biometric information. The Biometric Privacy Protection Act will expand the legal protections available under Delaware law to individuals relating to the collection and use of their biometric identifiers and biometric information. Among its provisions, the Biometric Information Privacy Protection Act: (1) Requires persons in possession of biometric data to develop and make publicly available written retention schedules and guidelines for keeping biometric information; (2) Requires persons to provide timely, reasonable notice and obtain informed, affirmative consent before acquiring, collecting, storing, or capturing biometric data; (3) Prohibits persons from selling or profiting from an individual’s biometric data; (4) Prohibits persons from disclosing or disseminating an individual’s biometric data except under specified circumstances, which include an individual’s informed, affirmative consent to the disclosure; and (5) Requires persons in possession of biometric data to implement and maintain reasonable procedures and practices to protect the biometric data and prevent its unauthorized disclosure. Geolocation information is data that can be used to determine the precise location of smartphones and other mobile devices and, by extension, the individuals carrying them. Such information can be used to track the users carrying those devices wherever they go. Location-based applications currently can make use of geolocation information on an individual’s mobile device without explicitly informing the individual that the geolocation information is being collected, used, stored, or disclosed, why it is being collected, used, stored, or disclosed, or to whom it is being disclosed, and without obtaining the individual’s consent to the collection, use, storage, or disclosure of the geolocation information. The Geolocation Privacy Protection Act will create legal protections for Delaware’s citizens relating to the collection, use, storage, or disclosure of the geolocation information on their mobile devices, by prohibiting persons from collecting, using, storing, or disclosing such information unless they first obtain an individual’s affirmative express consent after providing the individual with clear, prominent, and accurate notice that: (1) Tells the individual that the individual’s geolocation information is being collected, used, stored, or disclosed; (2) Informs the individual of the specific purposes for which the geolocation information is being collected, used, stored, or disclosed; (3) Informs the individual of the identity of any third parties to whom the geolocation information is being disclosed; and (4) Provides the individual with a hyperlink or other easy access to the geolocation information collected, used, stored, or disclosed. Both the Biometric Information Privacy Protection Act and the Geolocation Privacy Protection Act give the Consumer Protection Unit of the Department of Justice the authority to investigate and prosecute violations. There is no private right of action under the Biometric Information Privacy Protection Act or the Geolocation Privacy Protection Act. Both the Biometric Information Privacy Protection Act or the Geolocation Privacy Protection Act provide that their provisions do not apply to certain specified persons or entities or in certain specific situations. This Act provides that it will become effective January 1 following its enactment into law.