WHAT THIS BILL REGULATES · 1 REQUIREMENT TYPE
How Is This Bill Enforced
Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.
Subd. 1 For purposes of this section, "biometric dataBiometric data"biometric data" means an image, description, or recording of a face, facial features, a retina, an iris, a fingerprint, a voiceprint, hand geometry, or face geometry that may be used, singly or in combination with each other or other information, to identify an individual.Minn. Stat. § 325M.40, Subd. 1" means an image, description, or recording of a face, facial features, a retina, an iris, a fingerprint, a voiceprint, hand geometry, or face geometry that may be used, singly or in combination with each other or other information, to identify an individual.
Subdivision 1 defines biometric data broadly to include images, descriptions, or recordings of facial features, retinas, irises, fingerprints, voiceprints, hand geometry, and face geometry that may be used — individually or in combination with other information — to identify an individual. This definition is the threshold scope provision for the entire section.
Subd. 2 1 A person is prohibited from collecting biometric dataBiometric data"biometric data" means an image, description, or recording of a face, facial features, a retina, an iris, a fingerprint, a voiceprint, hand geometry, or face geometry that may be used, singly or in combination with each other or other information, to identify an individual.Minn. Stat. § 325M.40, Subd. 1 from an individual unless the person receives the individual's consent to collect the biometric dataBiometric data"biometric data" means an image, description, or recording of a face, facial features, a retina, an iris, a fingerprint, a voiceprint, hand geometry, or face geometry that may be used, singly or in combination with each other or other information, to identify an individual.Minn. Stat. § 325M.40, Subd. 1 before the collection occurs.
Subdivision 2 imposes the bill's core consent-before-collection requirement. Any person is prohibited from collecting biometric data from an individual unless the person receives the individual's consent before the collection occurs. The obligation applies broadly to any person — not limited to a defined category of covered entity — and requires affirmative consent prior to any collection event.
Subd. 3(1) 2 A person who obtains biometric dataBiometric data"biometric data" means an image, description, or recording of a face, facial features, a retina, an iris, a fingerprint, a voiceprint, hand geometry, or face geometry that may be used, singly or in combination with each other or other information, to identify an individual.Minn. Stat. § 325M.40, Subd. 1: (1) must not sell, lease, or otherwise disclose the biometric dataBiometric data"biometric data" means an image, description, or recording of a face, facial features, a retina, an iris, a fingerprint, a voiceprint, hand geometry, or face geometry that may be used, singly or in combination with each other or other information, to identify an individual.Minn. Stat. § 325M.40, Subd. 1 to another person unless: (i) the individual consents to the disclosure for identification purposes in the event of the individual's disappearance or death; (ii) the disclosure completes a financial transaction that the individual requested or authorized; (iii) the disclosure is required or permitted by a federal or state law; or (iv) the disclosure is made by or to a law enforcement agency for a law enforcement purpose in response to a warrant;
Subd. 3(2) 3 must store, transmit, and protect from disclosure the biometric dataBiometric data"biometric data" means an image, description, or recording of a face, facial features, a retina, an iris, a fingerprint, a voiceprint, hand geometry, or face geometry that may be used, singly or in combination with each other or other information, to identify an individual.Minn. Stat. § 325M.40, Subd. 1 using reasonable care and in a manner that is at least as or more protective than the manner in which the person stores, transmits, and protects other confidential information the person possesses; and
Subd. 3(3) 4 must delete and destroy the biometric dataBiometric data"biometric data" means an image, description, or recording of a face, facial features, a retina, an iris, a fingerprint, a voiceprint, hand geometry, or face geometry that may be used, singly or in combination with each other or other information, to identify an individual.Minn. Stat. § 325M.40, Subd. 1 within a reasonable time, but no later than one year from the date the purpose for collecting the data expires, unless the data is maintained pursuant to a federal or state law that requires a longer retention period, in which case the biometric dataBiometric data"biometric data" means an image, description, or recording of a face, facial features, a retina, an iris, a fingerprint, a voiceprint, hand geometry, or face geometry that may be used, singly or in combination with each other or other information, to identify an individual.Minn. Stat. § 325M.40, Subd. 1 must be destroyed within a reasonable time frame but no later than one year from the date that the state or federal law retention period expires. If an employer collects an employee's biometric dataBiometric data"biometric data" means an image, description, or recording of a face, facial features, a retina, an iris, a fingerprint, a voiceprint, hand geometry, or face geometry that may be used, singly or in combination with each other or other information, to identify an individual.Minn. Stat. § 325M.40, Subd. 1 for security purposes, the purpose for collecting the data expires upon termination of the employment relationship.
Subdivision 3 imposes three distinct obligations on any person who obtains biometric data: (1) a prohibition on sale, lease, or disclosure except under four narrow exceptions; (2) a reasonable-care security safeguard requirement; and (3) a mandatory deletion and destruction requirement within one year of purpose expiration, with a specific rule that employer-collected security biometric data must be destroyed within one year of employment termination.
The disclosure exceptions are narrowly drawn: individual consent for disappearance/death identification, completing a financial transaction the individual requested, disclosure required or permitted by law, and warrant-based law enforcement disclosure.
Subd. 4 A person who violates this section is subject to a civil penalty of not more than $25,000 for each violation. The attorney general may bring an action to recover the civil penalty.
Subdivision 4 establishes the enforcement mechanism: a civil penalty of up to $25,000 per violation, recoverable exclusively by the attorney general. Unlike Illinois BIPA, the bill creates no private right of action. This is attorney-general-only enforcement.
Subd. 5 This section does not apply to voiceprint data retained by a financial institution or an affiliate of a financial institution, as those terms are defined by United States Code, title 15, section 6809.
Subdivision 5 carves out voiceprint data retained by financial institutions or their affiliates, as defined under 15 U.S.C. § 6809, from the entire section's coverage. This exemption is narrow — it applies only to voiceprint data (not other biometric categories) and only when retained by entities meeting the Gramm-Leach-Bliley Act's financial institution definition.