South Carolina Considers Bill Restricting Collection of Biometric Data

South Carolina Considers Bill Restricting Collection of Biometric Data

Lawmakers in South Carolina have pre-filed a bill restricting businesses’ use of biometric information ahead of the 2022 legislative session. Biometric information an individual's physiological, biological, or behavioral characteristics, including the individual's deoxyribonucleic acid (DNA), that can be used, singly or in combination with each other or with other identifying data, to establish an individual's identity. Biometric information is defined in the bill to explicitly include health and exercise data.

H.B.3063 would require businesses which collect biometric information to develop a written policy made available to the public establishing a retention schedule and guidelines for destruction of the data when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within three years of the individual's last interaction with the business.

If passed, this bill would require businesses which collect biometric information to:

Inform the consumer that biometric information is being collected, as well as the specific purpose and length of time for which it is being collected, stored or used;
Obtain consent from the consumer for the collection of their biometric data;
Delete the collected biometric information upon request of the consumer;
Provide a clear and conspicuous link on the business’s website entitled “Do Not Sell My Biometric Information” to a webpage which enables a consumer to opt-out of the sale of their biometric information;
Notify all consumers of a security breach of business data within 72 hours of the business discovering the breach.

Of particular concern, H.B.3063 allows consumers to take legal action against businesses that fail to comply with these requirements. A business in violation of this act could be fined up to $1,000 for each negligent violation, or $10,000 in damages for each intentional or reckless violation. Additionally a business which fails to notify consumers of a breach is subject to a penalty of $5,000 for each consumer that was not notified.

IHRSA is monitoring this bill and will provide you with more information as it moves forward. We will update you on potential advocacy opportunities related to this bill in the future.

If you have questions about this or other legislative issues affecting the health club industry in South Carolina, please contact Jake Landry, IHRSA’s public policy assistant.