1. (a) In this section, "biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.

2. (b) A person may not capture a biometric identifier of an individual for a commercial purpose unless the person:

   1. (1) informs the individual before capturing the biometric identifier; and
   2. (2) receives the individual's consent to capture the biometric identifier.

3. (c) A person who possesses a biometric identifier of an individual:

   1. (1) may not sell, lease, or otherwise disclose the biometric identifier to another person unless:

      1. (A) the individual consents to the disclosure;
      2. (B) the disclosure completes a financial transaction that the individual requested or authorized;
      3. (C) the disclosure is required or permitted by a federal statute or by a state statute other than Chapter 552, Government Code; or
      4. (D) the disclosure is made by or to a law enforcement agency for a law enforcement purpose; and
   2. (2) shall store, transmit, and protect from disclosure the biometric identifier using reasonable care and in a manner that is the same as or more protective than the manner in which the person stores, transmits, and protects any other confidential information the person possesses.
4. (d) A person who violates this section is subject to a civil penalty of not more than $25,000 for each violation. The attorney general may bring an action to recover the civil penalty.

Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.