HB 596 — An Act providing for a requirement for commercial establishments to disclose the use and collection of biometric identifier information and providing for a private cause of action.

PRINTER'S NO.   604

                   THE GENERAL ASSEMBLY OF PENNSYLVANIA



                       HOUSE BILL
                       No. 596
                                                 Session of
                                                   2025

     INTRODUCED BY NEILSON, RABB, SANCHEZ, GIRAL, PIELLI, HILL-EVANS,
        CIRESI, HADDOCK, FREEMAN, OTTEN, FIEDLER AND GREEN,
        FEBRUARY 12, 2025

     REFERRED TO COMMITTEE ON COMMERCE, FEBRUARY 12, 2025


                                   AN ACT
 1   Providing for a requirement for commercial establishments to
 2      disclose the use and collection of biometric identifier
 3      information and providing for a private cause of action.
 4      The General Assembly of the Commonwealth of Pennsylvania
 5   hereby enacts as follows:
 6   Section 1.   Short title.
 7      This act shall be known and may be cited as the Biometric
 8   Identifier Signage Act.
 9   Section 2.   Definitions.
10      The following words and phrases when used in this act shall
11   have the meanings given to them in this section unless the
12   context clearly indicates otherwise:
13      "Biometric identifier information."   A physiological or
14   biological characteristic that is used by or on behalf of a
15   business, singly or in combination, to identify or assist in
16   identifying an individual, including:
17          (1)   A retinal or iris scan.
18          (2)   A fingerprint or voiceprint.
 1            (3)   A scan of hand or face geometry or any other
 2      identifying characteristic.
 3      "Commercial establishment."      A retail store, restaurant,
 4   hotel, motel or place of entertainment or amusement.
 5      "Customer."     A purchaser or lessee, or a prospective
 6   purchaser or lessee, of goods or services from a business.
 7      "Financial institution."     A bank, trust company, national
 8   bank, savings bank, Federal mutual savings bank, savings and
 9   loan association, Federal savings and loan association, Federal
10   mutual savings and loan association, credit union, Federal
11   credit union, branch of a foreign banking corporation, public
12   pension fund, retirement system, securities broker, securities
13   dealer or securities firm. The term does not include a
14   commercial establishment whose primary business is the retail
15   sale of goods and services to customers and provides limited
16   financial services, including the issuance of credit cards or
17   in-store financing to customers.
18   Section 3.     Collection, use and retention of biometric
19                  identifier information.
20      (a)   Signage.--Any commercial establishment that collects,
21   retains, converts, stores or shares biometric identifier
22   information of customers must disclose the collection,
23   retention, conversion, storage or sharing, as applicable, by
24   placing a clear and conspicuous sign near all of the commercial
25   establishment's customer entrances notifying customers in plain,
26   simple language that customers' biometric identifier information
27   is being collected, retained, converted, stored or shared, as
28   applicable.
29      (b)   Form of sign.--The sign under subsection (a) shall be
30   made in a form and manner prescribed by the Attorney General by

20250HB0596PN0604                     - 2 -
 1   regulation in consultation with the Bureau of Consumer
 2   Protection.
 3      (c)   Unauthorized disclosure.--No commercial establishment
 4   may sell, lease, trade or share biometric identifier information
 5   in exchange for anything of value or otherwise profit from the
 6   transaction of biometric identifier information.
 7   Section 4.     Civil action by customer.
 8      (a)   Civil action.--A customer who is aggrieved by a
 9   violation of this act may institute a civil action on the
10   customer's behalf against an offending party. At least 30 days
11   prior to initiating an action against a commercial establishment
12   for a violation of section 3(a), the aggrieved customer shall
13   provide written notice to the commercial establishment stating
14   the customer's allegation. If, within 30 days, the commercial
15   establishment cures the violation and provides the aggrieved
16   customer an express written statement that the violation has
17   been cured and that no further violations shall occur, no action
18   may be initiated against the commercial establishment for the
19   violation. If a commercial establishment fails to cure the
20   alleged violation, the aggrieved customer may initiate an action
21   against the establishment. No prior written notice shall be
22   required for actions alleging a violation of section 3(c).
23      (b)   Recovery.--The prevailing party of a civil action under
24   subsection (a) may recover:
25            (1)   for each violation of section 3(a), damages of $500;
26            (2)   for each negligent violation of section 3(c),
27      damages of $500;
28            (3)   for each intentional or reckless violation of
29      section 3(a), damages of $5,000;
30            (4)   reasonable attorney fees and costs, including expert

20250HB0596PN0604                    - 3 -
 1      witness fees and other litigation expenses; and
 2            (5)   other relief, including an injunction, as the court
 3      may deem appropriate.
 4   Section 5.     Nonapplicability.
 5      (a)   Biometric identifier information.--Nothing in this act
 6   shall apply to the collection, storage, sharing or use of
 7   biometric identifier information by the Commonwealth or any
 8   political subdivision, including employees and agents of the
 9   Commonwealth or any political subdivision.
10      (b)   Disclosure.--The disclosure required under section 3(a)
11   shall not apply to any of the following:
12            (1)   A financial institution.
13            (2)   Biometric identifier information collected through
14      photographs or video recordings, if:
15                  (i)    the images or videos collected are not analyzed
16            by software or applications that identify, or assist in
17            the identification of, individuals based on physiological
18            or biological characteristics; and
19                  (ii)   the images or video are not shared, sold or
20            leased to third parties other than law enforcement
21            agencies.
22   Section 6.     Effective date.
23      This act shall take effect in 180 days.




20250HB0596PN0604                       - 4 -