Skip to Content
April 14, 2026 Clouds | 75°F
The 194th General Court of the Commonwealth of Massachusetts

Bill S.43 194th (Current)

An Act to protect personal biometric data

By Mr. Montigny, a petition (accompanied by bill, Senate, No. 43) of Mark C. Montigny for legislation to protect personal biometric data. Advanced Information Technology, the Internet and Cybersecurity.

View Text Print Preview Download PDF

Bill Information

Presenter:
Mark C. Montigny
Status:
Referred to Senate Committee on Ways and Means
Special Attachments:
Committee - Senate member votes

personal biometric data

- Requires a private entity in possession of biometric information or identifiers (e.g. retina or iris scan, fingerprint, voiceprint, pattern of gait or movement, or scan of hand or face geometry) to develop a written policy that sets out a retention schedule and guidelines for the destruction of said information after the initial purpose of collection of the information, or one year, whichever occurs first - Prior to the collection of biometric identifiers or information, a private entity must: o Inform the subject that the information is being collected or stored o Inform the subject of the purpose and duration for which the information is being collected, stored, and used o Obtain the subject’s consent by written or electronic means - Bans a private entity from selling a subject’s biometric identifiers or biometric information - Prohibits a private entity from disclosing a subject’s biometric identifier or information unless: o The subject provides written consent to the disclosure o The disclosure completes a financial transaction that is requested by the subject o The disclosure is required by federal, state, or local law o The disclosure is required under a valid warrant or subpoena issued by a court of competent jurisdiction - Requires that a private entity in possession of biometric information or identifiers must: o Store, transmit and protect the information from disclosure using a reasonable standard of care within the applicable industry o Treat the information in a manner that is at least as protective as the manner in which the private entity treats other confidential and sensitive information - Prohibits a commercial establishment from using a person’s biometric identifier or information to identify them - Creates a private right of action for a person to bring a cause of action under the procedures of the consumer protection law, Chapter 93A - Sets a floor for damages of at least $5,000 per violation or actual damages, whichever is greater. For violations which are found to be willful or knowing, damages are increased up to three times but not less than two times the amount. An individual may also recover attorney’s fees and costs as damages - Empowers the Attorney General to bring an action in the name of the Commonwealth under chapter 93A to enforce this chapter, with damages of at least $5,000 per violation or actual damages, whichever is greater. For violations which are found to be willful or knowing, damages are increased up to three times but not less than two times the amount - Clarifies that the chapter does not prohibit the admission or discovery of biometric information or identifiers in any court, tribunal, board or agency; and that nothing in the chapter will be construed to conflict with the Health Insurance Portability and Accountability Act of 1996 and the rules promulgated under HIPAA
* The bill summary was created by the Primary Sponsor of the bill; no committee of the General Court certifies the accuracy of its contents.

The information contained in this website is for general information purposes only. The General Court provides this information as a public service and while we endeavor to keep the data accurate and current to the best of our ability, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information contained on the website for any purpose. Any reliance you place on such information is therefore strictly at your own risk.