Section 503.001 - Capture or Use of Biometric Identifier(a) In this section, "biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.(b) A person may not capture a biometric identifier of an individual for a commercial purpose unless the person: (1) informs the individual before capturing the biometric identifier; and(2) receives the individual's consent to capture the biometric identifier.(c) A person who possesses a biometric identifier of an individual that is captured for a commercial purpose:(1) may not sell, lease, or otherwise disclose the biometric identifier to another person unless: (A) the individual consents to the disclosure for identification purposes in the event of the individual's disappearance or death;(B) the disclosure completes a financial transaction that the individual requested or authorized;(C) the disclosure is required or permitted by a federal statute or by a state statute other than Chapter 552, Government Code; or(D) the disclosure is made by or to a law enforcement agency for a law enforcement purpose in response to a warrant;(2) shall store, transmit, and protect from disclosure the biometric identifier using reasonable care and in a manner that is the same as or more protective than the manner in which the person stores, transmits, and protects any other confidential information the person possesses; and(3) shall destroy the biometric identifier within a reasonable time, but not later than the first anniversary of the date the purpose for collecting the identifier expires, except as provided by Subsection (c-1).(c-1) If a biometric identifier of an individual captured for a commercial purpose is used in connection with an instrument or document that is required by another law to be maintained for a period longer than the period prescribed by Subsection (c)(3), the person who possesses the biometric identifier shall destroy the biometric identifier within a reasonable time, but not later than the first anniversary of the date the instrument or document is no longer required to be maintained by law.(c-2) If a biometric identifier captured for a commercial purpose has been collected for security purposes by an employer, the purpose for collecting the identifier under Subsection (c)(3) is presumed to expire on termination of the employment relationship.(d) A person who violates this section is subject to a civil penalty of not more than $25,000 for each violation. The attorney general may bring an action to recover the civil penalty.(e) This section does not apply to voiceprint data retained by a financial institution or an affiliate of a financial institution, as those terms are defined by 15 U.S.C. Section 6809.Tex. Bus. and Comm. Code § 503.001
Amended by Acts 2017, Texas Acts of the 85th Leg. - Regular Session, ch. 913,Sec. 1, eff. 9/1/2017.Amended By Acts 2009, 81st Leg., R.S., Ch. 1163, Sec. 1, eff. 9/1/2009.Added by Acts 2007, 80th Leg., R.S., Ch. 885, Sec. 2.01, eff. 4/1/2009.