HR7124-119

What This Bill Does

The Realigning Mobile Phone Biometrics for American Privacy Protection Act limits DHS mobile facial-recognition and biometric applications. Within 30 days, the Secretary of Homeland Security must develop standards and guidelines that prohibit DHS and its components from using Mobile Fortify, Mobile Identify, or successor applications except for identification at ports of entry. DHS may not share those applications with any other federal, state, local, tribal, or territorial agency. DHS must remove the applications from department and component information technology except for authorized port-of-entry use and remotely render inoperable copies downloaded on non-DHS information technology. It must immediately destroy any image, photograph, or fingerprint of a U.S. citizen captured before the standards are implemented, wherever stored, except as provided for port-of-entry use. For U.S.-citizen biometrics captured for authorized identification at ports of entry, DHS must destroy the image, photograph, or fingerprint within 12 hours.

Who Benefits and How

U.S. citizens whose biometrics were captured by DHS mobile apps, privacy advocates, civil-rights groups, state and local agencies concerned about biometric sharing, and port-of-entry travelers benefit from limits on mobile facial-recognition use, sharing, and retention. DHS privacy officers benefit from clear destruction deadlines and application-removal requirements.

Who Bears the Burden and How

DHS components, CBP officers, ICE officers, mobile-device administrators, biometric system owners, state and local agencies that received the apps, and IT security teams must remove applications, disable unauthorized copies, rewrite standards, document port-of-entry exceptions, and destroy stored U.S.-citizen images, photographs, and fingerprints within short deadlines.

Key Provisions

• Requires DHS standards within 30 days restricting Mobile Fortify, Mobile Identify, and successor applications to port-of-entry identification.
• Prohibits DHS from sharing those applications with other federal, state, local, tribal, or territorial agencies.
• Requires removal from DHS information technology except for authorized port-of-entry use.
• Requires DHS to remotely disable copies downloaded on non-DHS information technology.
• Requires immediate destruction of U.S.-citizen biometrics captured before implementation and 12-hour destruction for authorized port-of-entry captures.