Biometric identifier notice, consent, and retention schedule

Description

A written program governing how a product captures, stores, uses, and destroys biometric identifiers (fingerprints, voiceprints, face geometry, iris and retina scans). The state biometric statutes share a common skeleton even where their enforcement teeth differ: notice before capture, consent (or in Washington an opt-out mechanism), a use limitation tied to the original purpose, a no-sale default, reasonable-care storage, and a destruction schedule keyed to when the collection purpose expires. Texas CUBI puts a one-year outer bound on retention after the purpose lapses; Illinois BIPA pairs the same skeleton with a private right of action and per-violation statutory damages, which is why the Illinois exposure is litigation-driven while Texas and Washington exposure is attorney-general-driven. The control is the policy plus the implementing data flows: a consent capture step wired ahead of any biometric enrollment, a retention timer that triggers destruction, and an audit record showing both. The mistake that recurs is treating a feature as non-biometric because it processes a photo rather than a template; voiceprints and records of face geometry derived from media are squarely in scope under several of these statutes.

Required by (3 regulations)

• Texas CUBI

  Requires notice and consent before capturing a biometric identifier for a commercial purpose, a no-sale default, reasonable-care storage, and destruction within a reasonable time but not later than the first anniversary of the date the collection purpose expires.

  Capture or Use of Biometric Identifier Act (CUBI), Tex. Bus. & Com. Code § 503.001; effective 2009-09-01

  Source →

• Washington Biometric Privacy

  Prohibits enrolling a biometric identifier in a database for a commercial purpose without first giving notice, obtaining consent, or providing a mechanism to prevent subsequent commercial use; imposes use-limitation and reasonable-care storage duties.

  Washington Biometric Identifiers Act, Chapter 19.375 RCW (HB 1493, 2017); effective 2017-07-23

  Source →

• BIPA

  Requires a written, publicly available retention-and-destruction schedule and informed written consent before collecting biometric identifiers or biometric information; carries a private right of action with per-violation statutory damages.

  Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/15

Evidence formats

• written biometric data policy covering notice, consent, retention, and destruction
• consent capture records timestamped ahead of biometric enrollment
• retention-and-destruction schedule with purpose-expiry triggers
• data-flow map identifying every biometric capture surface in the product