A bill for an act relating to private entity requirements concerning biometric data, and providing civil penalties.
This bill creates a new Iowa Code chapter regulating how private entities handle biometric data. It defines biometric data and biometric identifiers to include things like fingerprints, voice, hand, and facial geometry, while excluding items such as photographs, demographic data, physical descriptions, and certain medical imaging or health-care-related information. The bill requires covered private entities to adopt a public written retention policy and limits retention of biometric data to no more than three years after the individual’s last interaction with the entity, or until the collection purpose is completed, whichever is longer.
Before collecting biometric data, a private entity must give written notice to the individual or the individual’s legal representative explaining that it intends to collect the data and stating the purposes and retention period. The bill also prohibits private entities from selling, leasing, trading, or otherwise profiting from biometric data, and requires them to store, transmit, and protect it using reasonable industry-standard safeguards comparable to protections used for passwords and account-access information. It excludes employers using employee biometric data solely within the scope of employment, and it does not create a private right of action.
The bill would add a new regulatory framework in Iowa for nongovernmental entities that collect or possess biometric data, placing new notice, retention, security, and anti-commercialization obligations on businesses and other private organizations. Enforcement would be assigned to the Department of Inspections, Appeals, and Licensing, which could seek injunctive relief, accept electronic complaints, issue a 30-day cure notice for a first violation, and impose civil penalties of $1,000, $5,000, or $10,000 for repeated violations. Penalties would be deposited into the state general fund. The bill would also limit its reach by excluding certain government contractors acting in their contracted capacity and by preserving existing court and administrative discovery rules for biometric data.
Based on the bill text and the absence of recorded committee debate or votes, the measure appears to be a policy-driven privacy and consumer-protection proposal rather than a controversial partisan measure in the available record. Its structure suggests an effort to balance privacy protections with business compliance flexibility through a cure period for first violations and the absence of a private lawsuit remedy. The lack of transcripts or voting history means there is no documented public sentiment in the provided materials beyond the bill’s formal protective approach toward biometric privacy.
The main points of potential contention are likely to be the scope of the restrictions on private businesses, especially the ban on selling, leasing, trading, or otherwise profiting from biometric data, and the compliance burden created by notice, retention, and security requirements. Businesses that use biometric systems for authentication, access control, or customer identification may view the retention limits and public policy requirement as operationally burdensome. On the other hand, privacy advocates would likely favor the bill’s restrictions and enforcement tools, while some may object that it does not provide a private right of action, relying instead on agency enforcement and civil penalties.