National Biometric Information Privacy Act of 2020
The source supplies the latest action, but no lifecycle stage.
Latest action (3 Aug 2020): Read twice and referred to the Committee on the Judiciary.
What this bill does
**S. 4400 — National Biometric Information Privacy Act of 2020**
This bill would set federal rules governing how private companies collect, store, share, and dispose of biometric information, such as fingerprints, iris or retina scans, voiceprints, and faceprints. Companies possessing such data would have to publish a written policy setting a retention schedule and timeline for destroying it—generally within one year after an individual's last interaction with the company or once the original purpose for collecting it is fulfilled. Before collecting biometric data, companies would need to inform individuals in writing and obtain a separate, specific written consent, and they would be barred from selling, leasing, or profiting from such data, or disclosing it, except in limited circumstances such as legal requirements or authorized financial transactions. Companies would also have to protect biometric data at least as carefully as other sensitive personal information and let individuals request information about what data has been collected about them.
The law would apply to private businesses but exempt government agencies, academic institutions, and health-related data covered under HIPAA. Individuals whose rights are violated could sue for damages, and state attorneys general could also bring enforcement actions on behalf of residents.
The bill was introduced by Senator Jeff Merkley (D-OR), with Senator Bernie Sanders as a cosponsor, on August 3, 2020, and referred to the Senate Judiciary Committee. It did not receive a vote before the end of the 116th Congress, so it did not become law.
Plain-English summary generated by Bill100 AI from the official record. Always verify against the source below.
Official summary
National Biometric Information Privacy Act of 2020
This bill requires a private entity that obtains an individual's biometric identifier or biometric information to take specified actions to maintain and ensure the privacy and security of such biometric data.
Specifically, a private entity in possession of biometric data must develop a written policy establishing a retention schedule and guidelines for destroying such data on the earlier of (1) the date on which the initial purpose for collecting the data has been satisfied, or (2) one year after an individual's last intentional interaction with the entity.
A private entity may not obtain an individual's biometric data unless (1) the entity requires the data to provide a service or for a valid business purpose, and (2) the entity informs the individual in writing of the collection and its purpose and receives a written release. Further, a private entity in possession of such data may not sell, lease, or otherwise profit from the data. A private entity must store, transmit, and protect from disclosure all biometric data in its possession in a manner that is the same as, or more protective than, the manner in which the entity treats other confidential and sensitive information. Upon request, the entity must disclose to an individual such data relating to the individual collected during the preceding 12 months.
Further, the bill establishes a private right of action for any individual aggrieved by a violation of the bill's provisions.
Timeline
3 Aug 2020
Read twice and referred to the Committee on the Judiciary.
Common questions
- What does S. 4400 do?
- **S. 4400 — National Biometric Information Privacy Act of 2020** This bill would set federal rules governing how private companies collect, store, share, and dispose of biometric information, such as fingerprints, iris or retina scans, voiceprints, and faceprints. Companies possessing such data would have to publish a written policy setting a retention schedule and timeline for destroying it—generally within one year after an individual's last interaction with the company or once the original purpose for collecting it is fulfilled. Before collecting biometric data, companies would need to inform individuals in writing and obtain a separate, specific written consent, and they would be barred from selling, leasing, or profiting from such data, or disclosing it, except in limited circumstances such as legal requirements or authorized financial transactions. Companies would also have to protect biometric data at least as carefully as other sensitive personal information and let individuals request information about what data has been collected about them. The law would apply to private businesses but exempt government agencies, academic institutions, and health-related data covered under HIPAA. Individuals whose rights are violated could sue for damages, and state attorneys general could also bring enforcement actions on behalf of residents. The bill was introduced by Senator Jeff Merkley (D-OR), with Senator Bernie Sanders as a cosponsor, on August 3, 2020, and referred to the Senate Judiciary Committee. It did not receive a vote before the end of the 116th Congress, so it did not become law.
- Has S. 4400 become law?
- The source does not supply a confirmed lifecycle stage for S. 4400. Check the latest action and official source below.
- Who sponsored S. 4400?
- S. 4400 was sponsored by Sen. Merkley, Jeff [D-OR] (D-OR), with 1 cosponsor.
- What's the latest action on S. 4400?
- Read twice and referred to the Committee on the Judiciary. (3 Aug 2020).
Related bills in Commerce
Critical Infrastructure Manufacturing Feasibility Act
Cybersecurity for Small Businesses Act of 2026
Ensuring SBA Implementation of GAO Recommendations Act of 2026
SCORE for Small Business Act of 2026
More bills from Sen. Merkley, Jeff [D-OR]
Car Privacy Rights Act of 2026
Honoring Fallen Wildland Firefighters Act of 2026
Stop Corrupt Gratuities Act
American Promise Mortgage Act
Bill100 mirrors the public U.S. legislative record from Congress.gov and GovTrack and adds plain-English AI summaries. It is an information tool, not legal, compliance or lobbying advice, and it is not affiliated with the U.S. Congress or any government agency. AI summaries can simplify or omit detail — every bill links to the official source; verify there before you rely on it.