BIOMETRIC IMPRESSIONS CORP.’S
BIOMETRIC DATA RETENTION AND DESTRUCTION POLICY

1. Introduction

1.1 Background

BioMetric Impressions Corp. is a licensed fingerprint vendor in the State of Illinois. Section 1240.535(c)(8) of the Illinois Administrative Code provides: “A licensed fingerprint vendor must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying identifiers and other biometric information when the initial purpose for collecting or obtaining the identifiers or information has been satisfied or after 3 years from the individual’s last interaction with the licensed fingerprint vendor, whichever occurs first. Absent a valid warrant or subpoena issued by a court of competent jurisdiction, a private entity in possession of biometric identifiers or biometric information must comply with its established retention schedule and destruction guidelines” (the “Regulation”). This Policy is made pursuant to and in accordance with the Regulation.

1.2 Definitions

The Regulation generally tracks language in the Illinois Biometric Information Privacy Act, 740 ILCS 14/1, et seq. (the “Act”). The Regulation does not define the terms “identifiers” and “biometric information,” but the Act defines the terms “biometric identifier” and “biometric information.” BioMetric Impressions therefore construes the phrase “identifiers and other biometric information” as it appears in the Regulation to be consistent with the definitions in the Act. Accordingly, whenever used within the Policy, unless otherwise clearly documented:

(1)  “Biometric data” means “biometric identifiers” and “biometric information.”

(2) “Biometric identifier” means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Biometric identifiers do not include writing samples, written signatures, photographs, human biological samples used for scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions such as height, weight, hair color, or eye color. Biometric identifiers do not include donated organs, tissues, or parts as defined in the Illinois Anatomical Gift Act or blood or serum stored on behalf of recipients or potential recipients of living or cadaveric transplants and obtained or stored by a federally designated organ procurement agency. Biometric identifiers do not include biological materials regulated under the Genetic Information Privacy Act. Biometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996. Biometric identifiers do not include an X-ray, roentgen process, computed tomography, MRI, PET scan, mammography, or other image or film of the human anatomy used to diagnose, prognose, or treat an illness or other medical condition or to further validate scientific testing or screening.

(3) “Biometric information” means any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an Biometric information does not include information derived from items or procedures excluded under the definition of biometric identifiers.

(4) “Identifiers and other biometric information” means biometric identifiers and biometric

2. Retention Policy

BioMetric Impressions retains identifiers and other biometric information, including fingerprint images, for a period of up to Forty-Five (45) days from the date of receipt, fingerprint capture or card scan date.

If a collection or transmission error results in the need for a new set of fingerprint images to be taken, a new fingerprint inquiry transaction is created with a new date of fingerprint capture, which in turn starts the 45-day retention date from the revised date of fingerprint capture

3. Permanent Destruction Policy

3.1 Electronic Documents

Upon the expiration of the retention period for given identifiers and other biometric information, BioMetric Impressions securely deletes such identifiers and other biometric information. Through that deletion process, the identifiers and other biometric information are no longer accessible and permanently destroyed on the applicable storage drive and/or server space.

3.2 Physical Documents

Some identifiers and other biometric information may be received in paper form, e.g., fingerprint cards. Those identifiers and other biometric information are converted into an electronic/digital format. Thereafter the physical documents are placed in a file for a period of up to 30 days. On or before such 30 days expires, the physical documents are placed in a secure shred bin.

4. Exceptions to Policy

Absent a valid warrant or subpoena issued by a court of competent jurisdiction or other applicable law or legal requirement, BioMetric Impressions will comply with this Policy.

5. Roles and Responsibilities

BioMetric Impressions has assigned its President to be responsible for overseeing and implementing the Policy.

6. Questions and Copies

This policy shall be available to the public and be provided upon request. Questions related to the Policy, including requests for the most recent version of the Policy, should be directed to:

Attn: President
BioMetric Impressions
188 W. Industrial Dr. Suite 101
Elmhurst, IL 60126
e-Mail: [email protected]