Republicans on the House Energy and Commerce Committee have introduced the SECURE Data Act, a comprehensive federal privacy bill that would establish nationwide rules governing how companies collect, use, and protect personal data – including biometric information such as fingerprints, facial scans, and voiceprints.
The legislation, drafted by the committee’s Privacy Working Group, would preempt the current patchwork of state consumer privacy laws and replace them with a single federal standard. Under the bill, biometric data is classified as sensitive information requiring heightened protections, and companies would need to obtain explicit affirmative consent before collecting or processing it.
The SECURE Data Act would grant consumers a suite of enforceable rights over their personal data, including the ability to access, correct, delete, and port their information. Consumers would also gain the right to opt out of targeted advertising and data sales. Controllers and processors would face data minimization requirements, enhanced transparency and disclosure obligations, and mandatory data security standards.
Children’s data receives additional protection under the bill. Personal data belonging to anyone under 16 would be classified as sensitive, requiring verified parental consent before processing – expanding the age threshold three years beyond the 13-year mark currently set by the Children’s Online Privacy Protection Act.
U.S. states have been advancing their own facial recognition and biometric privacy laws in the absence of federal regulation, creating significant compliance complexity for companies operating across state lines. Illinois’s Biometric Information Privacy Act alone has generated hundreds of lawsuits against companies collecting fingerprints and facial geometry. The SECURE Data Act would resolve that fragmentation by establishing uniform national requirements for biometric and personal data handling.
Enforcement would rest primarily with the Federal Trade Commission, with violations treated as unfair or deceptive practices under Section 5 of the FTC Act. State attorneys general could also bring actions for injunctive relief and monetary remedies, subject to notice and coordination provisions with federal authorities. The bill does not include a private right of action, a provision Democratic lawmakers have consistently sought in previous privacy proposals including the American Data Privacy and Protection Act.
The bill next moves to the House Energy and Commerce Subcommittee on Commerce, Manufacturing, and Trade for markup.
Sources: Mayer Brown, The Hill
–
By Cass Kennedy
