Creates the "Enhanced Personal Privacy Act"

HB 3537 creates new rules for private companies handling biometric data like fingerprints, facial scans, or voiceprints. It requires companies to get customer consent (which can be implied through actions like using a service) before collecting or using this data for commercial purposes (not security, employment, or healthcare), store it securely, and destroy it within one year or after the customer's last interaction. The law excludes healthcare data protected by federal HIPAA, financial data under the Gramm-Leach-Bliley Act, and biometric data used for employment or security purposes. Companies must follow reasonable security standards for this data but cannot be sued for violations under this law.