Amends TCA Title 47; Title 50 and Title 61.

This bill enacts the "Consumer Biometric Data Protection Act," which prohibits a private entity from collecting, capturing, purchasing, receiving through trade, or otherwise obtaining an individual's biometric identifier ("identifier") or biometric information ("information"), unless the entity first does the following:<br /> <br /> (1) Informs the individual, or the individual's representative, in writing that the identifier or information is being collected or stored, and the specific purpose and length of time for which the identifier or information is being collected, stored, and used; and<br /> <br /> (2) Receives informed written consent or, in the context of employment, a release executed by an employee as a condition of employment, from the individual, or the individual's representative, to collect, capture, purchase, receive through trade, or otherwise obtain the identifier or information.<br /> <br /> This bill also prohibits an entity in possession of an identifier or information from selling, leasing, trading, or otherwise profiting from such identifier or information; or disclosing, redisclosing, or otherwise disseminating an identifier or information, unless the following occurs:<br /> <br /> (1) The individual to which the identifier or information belongs, or the individual's representative, consents to the disclosure, redisclosure, or other form of dissemination;<br /> <br /> (2) The disclosure, redisclosure, or other dissemination is necessary to complete a financial transaction requested or authorized by the individual to which the identifier or information belongs, or the individual's representative;<br /> <br /> (3) The disclosure, redisclosure, or other dissemination is required by state or federal law or municipal ordinance; or<br /> <br /> (4) The disclosure, redisclosure, or other dissemination is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.<br /> <br /> This bill requires an entity in possession of an identifier or information to do the following:<br /> <br /> (1) To store, transmit, and protect from disclosure identifiers and information using the reasonable standard of care within the entity's industry, and in a manner that is at least as protective as the manner in which the entity stores, transmits, and protects other confidential and sensitive information as long as the manner in which the entity stores, transmits, and protects other confidential and sensitive information conforms to standards that are at least as stringent as the standard described in this provision;<br /> <br /> (2) To develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying identifiers and information when the initial purpose for collecting or obtaining the identifiers or information has been satisfied, or within three years of the individual's last interaction with the entity, whichever occurs first;<br /> <br /> (3) Comply with its established retention schedule and destruction guidelines;<br /> <br /> (4) For an entity operating before or on January 1, 2024, to develop and make available to the public the written policy required in (2) by January 1, 2024; and<br /> <br /> (5) For an entity incorporated or otherwise created after January 1, 2024, to develop and make available to the public the written policy required in (2) within 90 days of incorporation or creation.<br /> <br /> However, this bill clarifies that the requirements in (2) and (3) do not require an entity to comply with its established retention schedule and destruction guidelines if the entity has received, or anticipates that it will receive, a valid warrant or subpoena issued by a court that requires the entity to maintain the identifiers or information.<br /> <br /> REMEDIES<br /> <br /> This bill authorizes an individual affected by a violation to bring a private cause of action against an entity that the individual believes violated this bill. Additionally, a violation of this bill constitutes a violation of the Tennessee Consumer Protection Act of 1977, and subjects the violating person to the penalties and remedies as provided in that Act, in addition to the penalties and remedies in this bill.<br /> <br /> If a court finds that an entity violated this bill, then the court is authorized to award the following to the prevailing party for each violation:<br /> <br /> (1) For a negligent violation, liquidated damages of $1,000, or actual damages, whichever is greater;<br /> <br /> (2) For a reckless or willful violation, liquidated damages of $5,000, or actual damages, whichever is greater;<br /> <br /> (3) Court costs and reasonable attorneys' fees, including expert witness fees; and<br /> <br /> (4) Other relief, including an injunction, as the court may deem appropriate.<br /> <br /> For purposes of determining how many violations an entity has committed, this bill requires a court to consider the following:<br /> <br /> (1) Each instance of an entity collecting, capturing, purchasing, receiving through trade, or otherwise obtaining an identifier or information constitutes a separate violation;<br /> <br /> (2) Each instance of an entity selling, leasing, trading, or otherwise profiting from an identifier or information constitutes a separate violation;<br /> <br /> (3) Each instance of an entity disclosing or redisclosing, or otherwise disseminating an identifier or information without consent constitutes a separate violation;<br /> <br /> (4) Each instance of an entity failing to store, transmit, and protect from disclosure identifiers and information using the reasonable standard of care within the entity's industry, or in a manner that is at least as protective as the manner in which the entity stores, transmits, and protects other confidential and sensitive information, constitutes a separate violation; and<br /> <br /> (5) Each day of an entity failing to develop and comply with a written policy establishing a retention schedule and guidelines for permanently destroying identifiers and information constitutes a separate violation.<br /> <br /> APPLICABILITY<br /> <br /> This bill does not affect, or otherwise prevent, the admission or discovery of an identifier or information in an action in a court, tribunal, board, or agency. Additionally, this bill does not apply in conflict with the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), or rules promulgated pursuant to HIPAA.<br /> <br /> This bill also does not apply to the following situations:<br /> <br /> (1) To a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act of 1999, or rules promulgated pursuant to the act; or<br /> <br /> (2) To a contractor, subcontractor, or agent of a municipality, public corporation, body politic, authority, district, metropolitan government, county, agency, department, or board of the aforementioned entities, or another form of local government, including this state, when the contractor, subcontractor, or agent is working for that entity.<br /> <br /> This bill applies to conduct occurring on or after January 1, 2024.<br />