txt

HB 72: "An Act relating to biometric information."

00                              HOUSE BILL NO. 72                                                                          
01 "An Act relating to biometric information."                                                                             
02 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF ALASKA:                                                                
03    * Section 1. AS 18.13 is amended by adding new sections to read:                                                   
04                      Article 2. Biometric Information.                                                                
05            Sec. 18.13.200. Biometric data collection. (a) A person may not collect for                              
06       use in a biometric system the biometric data of an individual who is not the collector                            
07       unless the collector first                                                                                        
08                 (1)  notifies the individual in a clear manner                                                          
09                      (A)  that the biometric data is being collected for use in a                                       
10            biometric system;                                                                                            
11                      (B)  of the specific purpose for which the biometric information                                   
12            will be used; and                                                                                            
13                      (C)  of the length of time the biometric information will be kept;                                 
14            and                                                                                                          
15                 (2)  receives, in a written, electronic, or other form by which the                                     
01       consent can be documented, the individual's full consent to                                                       
02                      (A)  the collection of the biometric data for use in a biometric                                   
03            system;                                                                                                      
04                      (B)  the specific purpose for which the biometric information                                      
05            will be used; and                                                                                            
06                      (C)  the length of time the biometric information will be kept.                                    
07            (b)  An individual may revoke or amend the individual's consent provided                                     
08       under (a) of this section at any time after the original purpose for which the consent                            
09       was given ceases to exist.                                                                                        
10 Sec. 18.13.210. Disclosure of biometric information. (a) A collector and a                                            
11 contractor may not disclose, transfer, or distribute the biometric information of another                               
12 individual, except to its contractor or to a person to authenticate the identity of the                                 
13       individual providing the biometric information.                                                                   
14 (b)  A disclosure, transfer, or distribution under (a) of this section may be made                                      
15       only for the original purpose for which the biometric information was to be used.                                 
16 Sec. 18.13.220. Sale of biometric information. A person may not sell                                                  
17 biometric information, except that a contractor may sell the contractor's business to                                   
18       another person and transfer the biometric information to the buyer.                                               
19 Sec. 18.13.230. Disposal. (a) When a collector no longer needs an individual's                                        
20 biometric information for the original purpose for which the biometric information                                      
21 was to be used, the collector and the contractor, if any, shall, within 120 days and                                    
22 unless prohibited by other law, a regulation, or a court order, remove the individual's                                 
23 biometric information from all databases and storage systems and destroy the                                            
24       biometric information.                                                                                            
25 (b)  Within 60 days after determining that the collector no longer needs an                                             
26 individual's biometric information for the original purpose for which the biometric                                     
27 information was to be used, the collector shall notify the contractor, if any, that the                                 
28 collector is to remove the individual's biometric information from all databases and                                    
29       storage systems and destroy the biometric information.                                                            
30 Sec. 18.13.240. Use of biometric information. A collector may use biometric                                           
31 information for a fraud prevention purpose in addition to the original purpose for                                      
01       which the biometric information was to be used.                                                                   
02 Sec. 18.13.250. Storage of biometric information. A collector and a                                                   
03 contractor shall store an individual's biometric information in a secure manner, which                                  
04 may include encryption or another appropriate method, to ensure that the identity of                                    
05       the individual who provided the biometric information is protected.                                               
06 Sec. 18.13.260. Right of action. An individual may bring a civil action against                                       
07 a person who intentionally violates AS 18.13.200 - 18.13.290. A person who                                              
08 intentionally violates AS 18.13.200 - 18.13.290 is liable to the individual for a penalty                               
09 of $1,000, except that, if the violation resulted in profit or monetary gain to the person,                             
10 the penalty is $5,000. In this subsection, "intentionally" has the meaning given in                                     
11       AS 11.81.900.                                                                                                     
12            Sec. 18.13.270. Exemptions. (a) AS 18.13.200 - 18.13.290 do not apply to the                               
13                 (1)  collection, retention, analysis, disclosure, or distribution of                                    
14 (A)  biometric information for a law enforcement purpose,                                                               
15 including the identification of perpetrators, the investigation of crimes, the                                          
16 identification of missing or unidentified persons, or the identification of human                                       
17            remains;                                                                                                     
18 (B)  biometric information when authorized by state or federal                                                          
19            law;                                                                                                         
20 (C)  facial images by the Department of Administration for                                                              
21 drivers' licenses issued under AS 28.15, for state identification cards issued                                          
22 under AS 18.65.310, for administering AS 28.15, or for administering                                                    
23            AS 18.65.310; or                                                                                             
24 (D)  a photograph, unless the photograph is collected for use in                                                        
25            a biometric system; or                                                                                       
26                 (2)  retention of voices recorded for quality assurance purposes.                                       
27            Sec. 18.13.290. Definitions. In AS 18.13.200 - 18.13.290,                                                  
28 (1)  "biometric data" means fingerprints, handprints, voices, iris                                                      
29 images, retinal images, vein scans, hand geometry, finger geometry, or other physical                                   
30       characteristics of an individual;                                                                                 
31 (2)  "biometric information" means biometric data used in a biometric                                                   
01       system;                                                                                                           
02                 (3)  "biometric system" means an automated system that                                                  
03                      (A)  captures biometric data from an individual's biometric                                        
04            information;                                                                                                 
05                      (B)  extracts and processes the biometric data captured under                                      
06            (A) of this paragraph;                                                                                       
07                      (C)  stores the biometric data extracted under (B) of this                                         
08            paragraph;                                                                                                   
09                      (D)  compares the biometric data extracted under (B) of this                                       
10 paragraph with biometric data from the individual stored for use in future                                              
11            recognition of the individual; and                                                                           
12 (E)  determines how well the extracted and stored biometric                                                             
13 data match when compared under (D) of this paragraph and indicates whether                                              
14            an identification or verification of identity has been achieved;                                             
15 (4)  "collector" means a person who collects the biometric information                                                  
16       of another individual;                                                                                            
17                 (5)  "contractor" means a person                                                                        
18 (A)  who contracts with a collector to store the biometric                                                              
19            information collected by the collector; or                                                                   
20 (B)  to whom the contractor sells the contractor's business and                                                         
21            transfers the biometric information;                                                                         
22 (6)  "original purpose" means the specific purpose stated for the use of                                                
23       biometric information under AS 18.13.200(a)(1)(B);                                                                
24                 (7)  "person" includes                                                                                  
25 (A)  a corporation, company, partnership, firm, association,                                                            
26            organization, business trust, or society;                                                                    
27                      (B)  an individual;                                                                                
28 (C)  an agency of the executive, judicial, or legislative branch of                                                     
29            state government;                                                                                            
30                      (D)  a municipality or an agency of a municipality.                                                
31    * Sec. 2. The uncodified law of the State of Alaska is amended by adding a new section to                          
01 read:                                                                                                                   
02       REVISOR'S INSTRUCTION. Wherever "this chapter" appears in AS 18.13.010 -                                          
03 18.13.100, the revisor of statutes shall substitute "AS 18.13.010 - 18.13.100."