|
REFERENCE TITLE: biometric identifiers; commercial use; prohibitions |
|
State of Arizona Senate Fifty-seventh Legislature Second Regular Session 2026
|
|
SB 1717 |
|
|
|
Introduced by Senators Kuby: Alston, Diaz, Gonzales, Hatathlie, Miranda, Ortiz, Sundareshan
|
AN ACT
amending title 44, chapter 9, arizona revised statutes, by adding article 27; relating to consumer data.
(TEXT OF BILL BEGINS ON NEXT PAGE)
Be it enacted by the Legislature of the State of Arizona:
Section 1. Title 44, chapter 9, Arizona Revised Statutes, is amended by adding article 27, to read:
ARTICLE 27. consumer biometric DATA
44-1383. Definitions
In this article, unless the context otherwise requires:
1. "Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions AND recommendations.
2. "Biometric identifier" means a retina or iris scan, fingerprint, voiceprint record of hand or face geometry or unique biological pattern or characteristic.
44-1383.01. Biometric identifiers; commercial purpose; prohibited use; civil penalty
A. A person may not capture an individual'S biometric identifier for a commercial purpose unless the person does both of the following:
1. informs the individual before capturing the biometric identifier.
2. Receives the individual's consent to capture the biometric identifier.
b. For the purposes of Subsection A of this section, an individual has not been informed of and has not provided consent for the capture or storage of the individual's biometric identifier for a commercial purpose based solely on the existence of an image or other mediUM containing one or more biometric identifiers of the individual on the Internet or another publicly available source unless the image or other medium was made publicly available by the individual to whom the biometric identifiers relate.
c. A person that possesses an individual's biometric identifier that is captured for a commercial purpose:
1. may not sell, lease or otherwise disclose the biometric identifier to another person unless one of the following applies:
(a) the individual consents to the disclosure for identification purposes in the event of the individual's disappearance or death.
(b) the disclosure completes a financial transaction that the individual requested or authorized.
(c) the disclosure is required or allowed by a federal statute or by a state statute other than title 39, chapter 1.
(d) the disclosure is made by or to a law enforcement agency for a law enforcement purpose in response to a warrant.
2. shall store, transmit and protect from disclosure the biometric identifier using reasonable care in a manner that is the same as or more protective than the manner in which the person stores, transmits and protects any other confidential information the person possesses.
3. shall destroy the biometric identifier within a reasonable time but not later than the first anniversary of the date the purpose for collecting the biometric identifier expires, except as provided by Subsection D of this section.
D. If an individual's biometric identifier that is captured for a commercial purpose is used in connection with an instrument or document that is required by another law to be maintained for a period longer than the period prescribed by Subsection C, paragraph 3 of this section, the person that possesses the biometric identifier shall destroy the biometric identifier within a reasonable time but not later than the first anniversary of the date the instrument or document is no longer required to be maintained by law.
E. If an individual'S biometric identifier that is captured for a commercial purpose has been collected for security purposes by an employer, the purpose for collecting the biometric identifier under Subsection C, paragraph 3 of this section is presumed to expire on termination of the employment relationship.
F. A person THAT violates this section is subject to a civil penalty of not more than $25,000 for each violation. The attorney general may bring an action to recover the civil penalty.