HB 4423

relating to the collection, possession, or use of biometric
identifiers and biometric information.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
SECTION 1.  Chapter 560, Government Code, is amended to read
CHAPTER 560.  BIOMETRIC IDENTIFIER AND BIOMETRIC INFORMATION
Sec. 560.001.  DEFINITIONS.  In this chapter:
(1)  "Biometric identifier" means a retina or iris
scan, palm or vascular vein, heartbeat, fingerprint, voiceprint,
key strokes, signature, gait, or record or scan of hand or face
geometry.  Biometric identifier does not include a digital or
physical photograph, an audio or video recording, or any data
generated from a digital or physical photograph, or an audio or
video recording, unless the photograph, recording, or data is
generated to identify a specific individual.
(2)  "Biometric information" means any information,
regardless of how it is captured, converted, stored, or shared,
based on an individual's biometric identifier used to identify an
individual.  Biometric information does not include information
derived from items or procedures excluded under the definition of
(3)  "Governmental body" has the meaning assigned by
Section 552.003, except that the term includes each entity within
or created by the judicial branch of state government.
Sec. 560.002.  DISCLOSURE OF BIOMETRIC IDENTIFIER OR
BIOMETRIC INFORMATION.  A governmental body that possesses a
biometric identifier or biometric information of an individual:
(1)  may not sell, lease, or otherwise disclose the biometric
identifier to another person unless:
(A)  the individual consents to the disclosure;
(B)  the disclosure is required or permitted by a
federal statute or by a state statute other than Chapter 552; or
(C)  the disclosure is made by or to a law enforcement
agency for a law enforcement purpose; and
(2)  shall store, transmit, and protect from disclosure the
biometric identifier or biometric information using reasonable
care and in a manner that is the same as or more protective than the
manner in which the governmental body stores, transmits, and
protects its other confidential information.
Sec. 560.003.  APPLICATION OF CHAPTER 552.  A biometric
identifier or biometric information in the possession of a
governmental body is exempt from disclosure under Chapter 552.
SECTION 2.  The heading to Chapter 503, Business and
Commerce Code, is amended to read as follows:
CHAPTER 503.  BIOMETRIC IDENTIFIERS AND BIOMETRIC INFORMATION
SECTION 3.  Chapter 503, Business and Commerce Code, is
amended by adding Section 503.0001 to read as follows:
Sec. 503.0001.  DEFINITIONS.  In this chapter:
(1)  "Biometric identifier" has the meaning assigned by
Section 560.001, Government Code.
(2)  "Biometric information" has the meaning assigned
by Section 560.001, Government Code.
SECTION 3.  Section 503.001, Business and Commerce
Code, is amended to read as follows:
Sec. 503.001.  CAPTURE OR USE OF BIOMETRIC IDENTIFIER OR
BIOMETRIC INFORMATION.  (a)  [In this section, "biometric
identifier" means a retina or iris scan, fingerprint, voiceprint,
or record of hand or face geometry.
(b)]  A person may not capture a biometric identifier or
biometric information of an individual for a commercial purpose
(1)  informs the individual before capturing the
biometric identifier or biometric information; and
(2)  receives the individual's consent to capture the
biometric identifier or biometric information.
(b)[(c)]  A person who possesses a biometric identifier or
biometric information of an individual that is captured for a
(1)  may not sell, lease, or otherwise disclose the
biometric identifier or biometric information to another person
(A)  the individual consents to the disclosure for
identification purposes in the event of the individual's
(B)  the disclosure completes a financial
transaction that the individual requested or authorized;
(C)  the disclosure is required or permitted by a
federal statute or by a state statute other than Chapter 552,
(D)  the disclosure is made by or to a law
enforcement agency for a law enforcement purpose in response to a
(2)  shall store, transmit, and protect from disclosure
the biometric identifier or biometric information using reasonable
care and in a manner that is the same as or more protective than the
manner in which the person stores, transmits, and protects any
other confidential information the person possesses; and
(3)  shall destroy the biometric identifier or
biometric information within a reasonable time, but not later than
the first anniversary of the date the purpose for collecting the
identifier or information expires, except as provided by Subsection
(c)[(c-1)]  If a biometric identifier or biometric
information of an individual captured for a commercial purpose is
used in connection with an instrument or document that is required
by another law to be maintained for a period longer than the period
prescribed by Subsection (b)(3) [(c)(3)], the person who possesses
the biometric identifier or biometric information shall destroy the
biometric identifier or biometric information within a reasonable
time, but not later than the first anniversary of the date the
instrument or document is no longer required to be maintained by
(c-1)[(c-2)]  If a biometric identifier or biometric
information captured or collected for a commercial purpose has been
collected for security purposes by an employer, the purpose for
collecting the identifier or information under Subsection (c)(3) is
presumed to expire on termination of the employment relationship.
(d)  A person who violates this section is to a civil penalty
of not more than $25,000 for each violation. The attorney general
may bring an action to recover the civil penalty.
(e)  This section does not apply to voiceprint data retained
by a financial institution or an affiliate of a financial
institution, as those terms are defined by 15 U.S.C. Section 6809.
SECTION 4.  This Act takes effect immediately if it receives
a vote of two-thirds of all the members elected to each house, as
provided by Section 39, Article III, Texas Constitution.  If this
Act does not receive the vote necessary for immediate effect, this
Act takes effect September 1, 2025.