IL_BIPA_BIOMETRIC_001

rules/regulations/us/il_bipa_biometric.yaml

Citation

740 ILCS 14/15(a): A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual's last interaction with the private entity, whichever occurs first. 740 ILCS 14/15(b): No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information, unless it first: (1) informs the subject or the subject's legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored; (2) informs the subject or the subject's legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and (3) receives a written release executed by the subject of the biometric identifier or biometric information or the subject's legally authorized representative. 740 ILCS 14/15(c): No private entity in possession of a biometric identifier or biometric information may sell, lease, trade, or otherwise profit from a person's or a customer's biometric identifier or biometric information.

Condition

Prohibits private entities from collecting, capturing, or otherwise obtaining biometric identifiers or biometric information without first obtaining informed written consent. Requires written retention and destruction policies. Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/15.

Layer 1 detects

collect (and words that begin with it), then biometric, fingerprint, retina, iris, voiceprint, face geometry or facial recognition, then data, identifier or information, then without or lacking, then consent, written release, authorization or notice; biometric, fingerprint or facial recognition data, identifier or information, then collected, captured, obtained or stored, then without or lacking, then consent, written consent, written release or notification; sell, trade, lease or profit from (and words that begin with them, so sells and traded but not trading), then biometric, fingerprint or facial, then data, identifier or information; the bare phrases no consent, no written release, no retention policy or no destruction policy (optionally no biometric consent), about biometrics or not, with "no" as a word of its own; fail, failing, failure or failed, then to inform, notify, obtain consent or provide notice about, before, for or regarding biometric; and scan, capture or record (and words that begin with them, so captured but not capturing), then face, fingerprint, iris, retina or voice, then without or lacking, then consent, permission or notice. The words follow each other with nothing in between. It matches wording, not meaning: it misses the practice told in other words ("Roll out the face-scan check-in at the Springfield stores on Monday; skip the consent form, it slows the line."; "Sell the facial recognition data to the ad network" has "recognition" between "facial" and "data"), and it fires on a policy that rules the practice out ("Our handbook states we never sell biometric data and we publish our destruction schedule online."). It applies to an end user in Illinois (US-IL) and to a US-wide check, not to another state. Whether a text does the practice is judged in Layer 2.

Condition type

regex; semantic condition in the file, not run by the engine

Status in the file

approved