Processes biometric data, in District of Columbia

D.C. Code §§ 28-3851 to 28-3853 (Title 28, Chapter 38, Subchapter II) · Read the law's page

• If your business conducts business in the District of Columbia and discovers a breach of the security of a system containing a District resident's personal information, notify each affected resident in the most expedient time possible and without unreasonable delay.
• Personal information covered by this duty includes biometric data generated by automatic measurements of biological characteristics, such as a fingerprint, voice print, genetic print, or retina or iris image, when used to authenticate identity.
• If the breach affects 50 or more District residents, also give written notice to the Office of the Attorney General for the District of Columbia, no later than when you notify residents.
• Notifying more than 1,000 people also requires notifying the nationwide consumer reporting agencies of the timing, distribution, and content of the notices.
• A violation of this notification duty is enforced as an unfair or deceptive trade practice and can be brought by a consumer, but recovery for this specific violation is limited to actual damages rather than the treble-damages-or-$1,500-per-violation floor available for other consumer protection violations.
• Information that is lawfully made available to the general public from government records is not personal information for purposes of this duty.

D.C. Code § [28-3852.01] (Title 28, Chapter 38, Subchapter II, "Security requirements," added by the Security Breach Protection Amendment Act of 2020, D.C. Law 23-98, § 2(a)(5), 67 DCR 3923) · Read the law's page

• This binds any person or entity that owns, licenses, maintains, handles, or otherwise possesses the personal information of an individual residing in the District of Columbia; a person or entity already subject to and in compliance with the security-procedure requirements of the Gramm-Leach-Bliley Act, HIPAA, or the HITECH Act is deemed to comply.
• Implement and maintain reasonable security safeguards, including procedures and practices appropriate to the nature of the personal information you hold and to your own nature and size.
• If you disclose a District resident's personal information to a nonaffiliated third-party service provider, require by written agreement that the third party implement and maintain its own reasonable security procedures and practices over that information.
• When destroying records that contain personal information of your consumers, employees or former employees, including computerized or electronic records and devices, take reasonable steps to protect against unauthorized access to or use of the information, considering the sensitivity of the records, your own nature and size, the costs and benefits of different destruction methods, and available technology.
• A violation is enforced as an unfair or deceptive trade practice: the Attorney General may sue for injunctive relief and a civil penalty of up to $5,000 for a first violation and up to $10,000 for each subsequent violation, and a consumer may bring a private action in which the damages are actual damages, excluding pain and suffering, rather than the treble-damages-or-$1,500-per-violation floor available for most other violations of the Consumer Protection Procedures Act; attorney's fees, punitive damages and an injunction remain available.

DC Bill B26-0667, 26th Council (introduced April 20, 2026)

• This measure is in committee and binds nobody yet; what follows is what it would require if it is enacted in this form.
• Do not use algorithmic surveillance-based price discrimination, an unfair or deceptive trade practice.
• Do not use personal data collected through electronic surveillance, including sensors, device tracking, or biometric monitoring, to charge individual consumers different prices.