1. (1) A person may not enroll a biometric identifier in a database for a commercial purpose, without first providing notice, obtaining consent, or providing a mechanism to prevent the subsequent use of a biometric identifier for a commercial purpose.
2. (2) Notice is a disclosure, that is not considered affirmative consent, that is given through a procedure reasonably designed to be readily available to affected individuals. The exact notice and type of consent required to achieve compliance with subsection (1) of this section is context-dependent.

3. (3) Unless consent has been obtained from the individual, a person who has enrolled an individual's biometric identifier may not sell, lease, or otherwise disclose the biometric identifier to another person for a commercial purpose unless the disclosure:

   1. (a) Is consistent with subsections (1), (2), and (4) of this section;
   2. (b) Is necessary to provide a product or service subscribed to, requested, or expressly authorized by the individual;
   3. (c) Is necessary to effect, administer, enforce, or complete a financial transaction that the individual requested, initiated, or authorized, and the third party to whom the biometric identifier is disclosed maintains confidentiality of the biometric identifier and does not further disclose the biometric identifier except as otherwise permitted under this subsection (3);
   4. (d) Is required or expressly authorized by a federal or state statute, or court order;
   5. (e) Is made to a third party who contractually promises that the biometric identifier will not be further disclosed and will not be enrolled in a database for a commercial purpose inconsistent with the notice and consent described in this subsection (3) and subsections (1) and (2) of this section; or
   6. (f) Is made to prepare for litigation or to respond to or participate in judicial process.

4. (4) A person who knowingly possesses a biometric identifier of an individual that has been enrolled for a commercial purpose:

   1. (a) Must take reasonable care to guard against unauthorized access to and acquisition of biometric identifiers that are in the possession or under the control of the person; and

   2. (b) May retain the biometric identifier no longer than is reasonably necessary to:

      1. (i) Comply with a court order, statute, or public records retention schedule specified under federal, state, or local law;
      2. (ii) Protect against or prevent actual or potential fraud, criminal activity, claims, security threats, or liability; and
      3. (iii) Provide the services for which the biometric identifier was enrolled.
5. (5) A person who enrolls a biometric identifier of an individual for a commercial purpose or obtains a biometric identifier of an individual from a third party for a commercial purpose pursuant to this section may not use or disclose it in a manner that is materially inconsistent with the terms under which the biometric identifier was originally provided without obtaining consent for the new terms of use or disclosure.
6. (6) The limitations on disclosure and retention of biometric identifiers provided in this section do not apply to disclosure or retention of biometric identifiers that have been unenrolled.
7. (7) Nothing in this section requires an entity to provide notice and obtain consent to collect, capture, or enroll a biometric identifier and store it in a biometric system, or otherwise, in furtherance of a security purpose.

[ 2017 c 299 s 2.]