BOISE - Legislation that would make unauthorized biometric data sales illegal got a thumbs-up from the House State Affairs Committee Tuesday.

One vote shy of unanimous, the bill sponsored by Rep. Ed Morse was dispatched to the House floor from State Affairs.

Morse, R-Hayden, said the bill was written to set appropriate privacy standards with its proposed prohibition on the sale of individual biometric information obtained by companies and requires permission in any case to share customers' personal information with other companies.

“There's a lot of information out there, and technology really is ahead of the privacy laws,” Morse said. “This is a piece of legislation that is intended to begin to level the playing field for the protection of people's privacy.”

“I think this is a wonderful start in an area that's very tricky and very scary,” said Rep. Kelley Packer, R-McCammon, who made motion to advance House Bill 511.

Biometrics uses electronic devices to record bodily features such as the retina, iris, or voice, and can be used for identification purposes. The bill defines “Biometric identifier” as “a retina or iris scan, fingerprint, palm print, voiceprint, or scan of hand or face geometry, digitized facial recognition data or human DNA.”

According to Morse, unwary shoppers may sometimes be recorded with biometric technology while using bank cards that also contain their personal information.

“We want to make sure that people are adequately protected,” Morse said. “We have technology that has been developed that, somebody can take an iris scan, or a digitized facial scan of me when I go through a checkout stand. And, what happens with that when I link it with a bankcard transaction and it gets aggregated in a database? And there's absolutely no restriction on where that information goes from that company to other companies.”

Morse said he wants to regulate what companies do with the personal information they may obtain from consumers. Some companies will sell the personal information obtained through biometrics, he said.

“Some private businesses are obtaining, analyzing, and transferring private biometric information,” the bill's statement of purpose reads in part. “This bill require safeguards for data that is collected by requiring written notice to the subject, and obtaining written consent to collect such data.”

Rep. Gayle Batt, R-Wilder, asked Morse for examples of private entities that gather biometric data.

“Some pawn shops and check-cashing places when you go to do a transaction there, and including some lenders, require a fingerprint,” Morse said. “They'll link that with a financial, or a contractual transaction at the same time. So, they have a fingerprint and they have your identity and/or your identification.

“Now, how long they retain that, what they do with it, who they may sell it to, who they may trade it to, is something that current laws do not reach,” he added.

Morse noted the legislation regulating private transactions doesn't apply to medical records and government records.

If the legislation becomes law, what would be the penalties for violations?

“Against a private entity that negligently violates a provision of this act, liquidated damages of $1,000 or actual damages, whichever is greater,” the bill reads. “Against a private entity that intentionally or recklessly violates a provision of this act, liquidated damages of $5,000 or actual damages, whichever is greater.”