Biometric privacy and surveillance laws by state

SB 118: Alabama Justice Information Commission; collection, dissemination, and use of biometric identifiers by certain entities provided for; Alabama Background Check Service established, types, uses, and fees for certain background checks for noncriminal justice purposes authorized; Alabama Rap Back Program established, penalties provided for; existing law relating to release of criminal history information repealed

Arresting agencies must obtain fingerprints, palm prints, mugshots, and descriptive information from arrested individuals and provide them to ALEA. Law enforcement and correctional agencies must report dispositions within 30 days when persons are released without charge or cleared. ALEA must establish the Alabama Background Check Service and may establish the Alabama Rap Back Program.

SB 446: To amend the automatic license plate reader system act; and to provide for the use of automatic license plate readers by private landowners, private leaseholder, and commercial businesses.

Private landowners, private leaseholders, and commercial businesses may use automatic license plate readers to promote public safety, deter crime, and monitor access to private property, but must not preserve captured plate data for more than sixty days and must not sell, trade, or exchange such data for commercial purposes.

HB 1148: To create the arkansas privacy act; and to address certain images captured by unmanned aircraft systems.

AB 1331: Workplace surveillance.

Employers must not use workplace surveillance tools to monitor workers in bathrooms, locker rooms, changing areas, or lactation spaces. Employers must not use audio surveillance in employee-only breakrooms or cafeterias. Workers have the right to leave behind surveillance tools on their person when entering these areas, employee-only breakrooms, public bathrooms, or during off-duty hours, unless required by law to remain available.

AB 1883: Workplace surveillance tools.

An employer shall not use a workplace surveillance tool to prevent compliance with laws, infer protected activity, make inferences about emotional state or gait, or collect neural data. An employer shall not use facial recognition technology to make inferences about a worker for firing, deactivation, or disciplinary purposes. An employer shall not use a workplace surveillance tool to infer a worker's protected status.

AB 45: Privacy: health data: location and research.

Persons must not collect, use, disclose, sell, share, or retain personal information of natural persons physically located at or within a precise geolocation of a family planning center, except as necessary to perform requested services or goods. Persons must not geofence entities providing in-person health care services in California to identify, track, collect information from, or send notifications or advertisements to persons seeking or providing health care services.

SB 25-143: Extend Prohibition on School Facial Recognition

Schools and school contractors must not process biometric identifiers without obtaining opt-in consent on a stand-alone form that specifies collection, use, and retention. Schools must retain biometric identifiers no longer than eighteen months. Schools using facial recognition for safety must disable the system immediately after identifying the individual and develop policies designating authorized personnel.

SB 472: An act concerning the electronic surveillance of employees.

Employers must give prior written notice to employees about electronic monitoring types and specific locations before monitoring occurs, except when the employer has reasonable grounds to believe employees are engaged in illegal conduct, violate legal rights, or create hostile workplace environments. Employers must provide new hires with a plain language statement about prohibited activities that may be monitored without notice.

SB 439: An act concerning electronic surveillance devices and systems and self-service kiosks in employee lounges.

Employers must not operate electronic surveillance devices or systems in employee lounges, restrooms, or locker rooms. Exception: employers may operate surveillance in lounges if a self-service kiosk is present, provided the system records no audio and only records the kiosk area.

SB 397: An act concerning democracy and government accountability and the use and retention of data derived from automated license plate reader systems.

Peace officers must not wear facial coverings or personal disguises while performing law enforcement duties except for specified health, safety, or undercover purposes. Peace officers must be clearly identified by badge and name tag on their uniform. Peace officers cannot detain, arrest, or take individuals into custody based on civil offenses in protected areas, state facilities, or municipal facilities without a judicial warrant.

SB 888: Relating to consumer protection.

An operator of a smart household security device shall not share user data with a law enforcement agency unless the user provides written consent or the agency provides a judicial warrant. An operator shall not require user consent to data sharing as a condition of device use and must clearly inform users that refusing consent will not terminate their ability to use the device.

HB 1231: Relating to traffic safety.

The State and any county shall not use facial recognition software with any photo red light imaging detector system, automated speed enforcement system, or other camera monitoring an outdoor public space. The State highway safety and modernization council shall recommend twenty-five dangerous intersections for photo red light imaging detector systems, and the safe routes to school advisory committee shall recommend twenty-five dangerous school zones for automated speed enforcement systems.

S 1180: TRANSPORTATION – Amends and adds to existing law to establish provisions regarding the use of automated license plate readers and their data and to provide for vehicles equipped with front license plate mounting brackets.

Agencies may use automated license plate readers only for law enforcement purposes (felony or misdemeanor investigation, traffic accidents, missing or endangered persons), traffic flow analysis, or both. Agencies shall limit data access to authorized personnel, implement access controls, conduct mandatory training, log all data access with user identity and purpose, and conduct semiannual audits.

HB 58: AN ACT relating to privacy protection.

Individuals, entities, partnerships, corporations, associations, and public agencies must not deploy or maintain automated license plate readers except for parking regulation, secured area access control, public safety and crime deterrence, law enforcement purposes, or toll collection. Captured license plate data must not be preserved beyond ninety days unless retained as evidence or subject to subpoena. Law enforcement agencies must adopt written policies governing ALPR use and conduct audits every ninety days.

HB 236: Peace Orders and Criminal Harassment - Intentional Visual Surveillance

A person may not conduct visual surveillance of an area of another's residence where the other has a reasonable expectation of privacy with intent to harass, alarm, or annoy, after receiving a reasonable warning to stop, and without a legal purpose. A petitioner may seek a peace order against a respondent who has conducted such intentional visual surveillance.

HB 516: Motor Vehicles - Automated Enforcement Programs - Privacy Protections

Agencies operating automated enforcement programs must deny public inspection of recorded images except as specified. Agencies may not access or use recorded images without a warrant, subpoena, or court order unless for appropriate traffic enforcement or law enforcement purposes. Agencies must immediately destroy images not constituting evidence of violations and retain violation evidence only up to 6 months or until conclusion of related proceedings. Agencies must adopt procedures for authorized personnel access, audit processes, personnel screening, secure storage, and image destruction.

SB 381: Motor Vehicles - Automated Enforcement Programs - Privacy Protections

Agencies operating automated enforcement programs must deny public inspection of recorded images except for persons cited, their attorneys, and in investigations of civil liability. Agencies may not access or use recorded images without warrant, subpoena, or court order unless for appropriate traffic enforcement purposes. Agencies must immediately destroy images not constituting violations and retain violation evidence for up to 6 months or until adjudication concludes, whichever is earlier, but no longer than 5 years. Automated enforcement systems may not use facial recognition technology.

SB 92: Peace Orders and Criminal Harassment - Intentional Visual Surveillance

A person may not conduct visual surveillance of an area of another's residence where the other has a reasonable expectation of privacy with intent to harass, alarm, or annoy, after receiving a reasonable warning to stop, and without a legal purpose. A petitioner may seek a peace order against a respondent who has conducted such intentional visual surveillance.

SB 163: Generally revise privacy laws related to biometric, genetic, and neural data

Entities that collect genetic or neurotechnology data must obtain express consent from consumers before collection, use, or disclosure; provide privacy notices; implement security programs; and allow consumers to access, delete, and revoke consent for their data. Entities may not disclose such data to insurers or employers without express consent. Government agencies may not search consumer DNA or neurotechnology databases without a search warrant or investigative subpoena.

SB 1516: Relating to public safety; and declaring an emergency.

Law enforcement agencies must establish and publish policies for automated license plate recognition systems before deployment, including security requirements, training, retention limits, and hot list accuracy standards. Agencies may use ALPR systems only for specified law enforcement purposes: identifying vehicles used in crimes, violations, or associated with outstanding warrants or missing persons; identifying uninsured or unregistered vehicles; regulating parking; or controlling secured area access. Captured license plate data unrelated to court proceedings or investigations must be retained no more than 30 days. Vendors must provide monthly and quarterly audits to agencies, which must publish audit results within two days.

HB 2008: Relating to consumer protection.

HB 1316: Driver Licenses - As enacted, prohibits the use of digital driver licenses and digital photo identification licenses for voter identification purposes; regulates the use, retention, and disclosure of data submitted by persons participating in the digital driver license system, including biometric identifiers; prohibits geolocation data from being collected for purposes of the digital driver license system; revises other provisions related to driver licenses. - Amends TCA Section 2-7-112 and Title 55, Chapter 50.

The department and entities contracting with the department must not collect geolocation data for the digital driver license system. They must destroy biometric identifiers within three calendar days and retain other data no longer than three calendar days. Digital driver licenses must not be accepted for voter identification purposes.

SB 183: Surveillance Camera Amendments

A law enforcement officer, or an individual acting on behalf of a law enforcement officer, may not tamper with, change the viewing direction of, or disable a person's surveillance camera on the person's private property, except with the person's permission, a court order, or under exigent circumstances or safety risks if the officer notifies the person within 24 hours or obtains a court order.

S 71: An act relating to consumer data privacy and online surveillance

Controllers must limit personal data collection to what is reasonably necessary, establish data security practices, and provide consumers rights to access, correct, delete, and port their data. Controllers must obtain consent before selling consumer health data and cannot use geofences within 1,750 feet of health care facilities to track consumers.

SB 338: Consumer Data Protection Act; data controller responsibilities, precise geolocation data.

SB 84: Photo speed monitoring devices, etc.; placement and operation, civil penalty, report.

State and local law-enforcement agencies may place and operate photo speed monitoring devices in school crossing zones and highway work zones where workers are present, and at high-risk intersection segments. Agencies may also operate pedestrian crossing violation monitoring systems and stop sign violation monitoring systems in school crossing zones and highway work zones. Agencies must place at least two conspicuous signs within 1,000 feet of monitored zones, with one being a speed display sign for photo speed devices. Agencies must report annually to the Department of State Police on violations prosecuted, successful prosecutions, operating costs, and civil penalties collected.

HB 55: Noise abatement monitoring systems; local authorities to place and operate, civil penalties.

Local governing bodies in Planning Districts 8, 9, or 15 may place and operate noise abatement monitoring systems to record exhaust system violations exceeding 95 A-weighted decibels or violating local ordinances. Vehicle operators found liable must pay civil penalties not exceeding $100. Localities must post system locations online and annually report violations and penalties collected.

HB 971: College student-athletes; biometric data, protections and limitations.

Institutions must not disclose enrolled student-athletes' biometric data to outside individuals or entities without prior written consent. No individual or entity may make possession, use, ownership of, or rights to student-athlete biometric data a condition of any contract for name, image, or likeness rights without separate prior written consent.

HB 2724: Automatic license plate recognition systems; use, reports, penalty.

Law-enforcement agencies must use automatic license plate recognition systems only for active criminal investigations, missing or endangered persons, human trafficking investigations, or to receive notifications about specific categories of persons or vehicles. Agencies must purge system data after 30 days unless part of ongoing proceedings, maintain audit trails, establish governing policies, and report annually to the Department of State Police.

HB 2725: Surveillance technology; reporting by state/local law-enforcement agencies & sheriff's departments.

All state and local law-enforcement agencies and sheriff's departments must provide to the Department an annual list by November 1 of each year of all surveillance technologies used, accessed, or procured during the previous fiscal year, including technologies owned by the agency and those accessed from other entities.