Biometric information.

The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, establishes various rights that a consumer, as defined, has with respect to personal information, as defined, collected by a business, as defined, including the right of a person to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer's personal information. The act also provides a consumer with the right to direct a business that collects sensitive personal information about the consumer to limit its use of the consumer's sensitive personal information to certain prescribed uses, including a use that is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services. The act defines "sensitive personal information" to mean, among other things, the processing of biometric information, as defined, for the purpose of uniquely identifying a consumer. On or before September 1, 2023, this bill would require a private entity in possession of biometric information, as defined, to develop and make available to the public a written policy establishing a retention schedule and guidelines for permanently destroying the biometric information, as prescribed. The bill would require a private entity to comply with that retention schedule and those guidelines. The bill would, among other things, prohibit a private entity from disclosing biometric information unless certain criteria are met, including the disclosure completes a financial transaction requested or authorized by the subject of the biometric information or the subject's legally authorized representative. The bill would prohibit a private entity from conditioning the provision of a service on the collection, use, disclosure, transfer, sale, or processing of biometric information unless biometric information is strictly necessary to provide the service. The bill would authorize a person to bring a civil action against a private entity for violation of these provisions and to obtain certain relief, including the greater of statutory damages in an amount not less than $100 and not greater than $1,000 per day or actual damages.