Biometric Data Retention and Destruction Policy
1. PURPOSE
This Policy establishes procedures for the collection, use, retention, storage, and destruction of biometric identifiers and biometric information to ensure compliance with applicable laws, including Illinois Biometric Information Privacy Act (740 ILCS 14/1 et seq.) (“BIPA”).
2. Scope
This Policy applies to all biometric data collected, captured, or otherwise obtained by Amerisure Mutual Insurance Company (“Amerisure”) in connection with Amerisure employees.
3. Definitions
We collect several types of information during the course of underwriting, administering an insurance policy, handling a claim, or otherwise utilizing this website and Amerisure’s services, Amerisure may collect certain information by which you may be personally identified.
Biometric Identifier includes, but is not limited to:
Biometric Information means any information derived from a biometric identifier used to identify an individual.
- Retina or iris scans
- Fingerprints
- Voiceprints
- Hand or face geometry
4. policy statement
Amerisure will:
- Collect and use biometric data only for legitimate business purposes
- Provide notice and/or obtain written consent prior to collection where required
- Retain biometric data only as long as necessary to fulfill the purpose for which it was collected
- Implement reasonable safeguards to protect biometric data
- Permanently destroy biometric data in accordance with this Policy and applicable law
5. Retention schedule
5.1 General Rule (BIPA-Compliant Standard)
Biometric identifiers and biometric information will be retained only until the earliest of:
- The initial purpose for collection has been satisfied; or
- Three (3) years after the individual’s last interaction with Amerisure
This standard is designed to comply with Illinois BIPA requirements.
6. Data Destruction Requirements
Biometric data must be permanently destroyed when retention requirements are met.
6.1 Approved Destruction Methods
- Secure deletion from all electronic systems and backups
- Cryptographic erasure where applicable
- Physical destruction (if stored in physical form)
6.2 Timing
Destruction must occur:
- Promptly after the retention period expires, and
- No later than reasonably necessary to comply with applicable law
7. Notice and Consent (BIPA-Specific Compliance)
Prior to collecting biometric data, Amerisure shall:
- Provide written notice informing the individual of:
- The specific biometric data being collected
- The purpose and length of term for which it will be used and stored
- Obtain a written release (consent) from the individual
- Prohibit collection unless these requirements are satisfied
8. Disclosure and Third-Party Sharing
Amerisure shall not:
- Sell, lease, trade, or otherwise profit from biometric data
- Disclose biometric data to third parties except:
- With the individual’s consent
- To complete the specific purpose of collection
- As required by law, subpoena, or warrant
All authorized third parties must:
- Enter into written agreements requiring compliance with this Policy and applicable laws
- Maintain equivalent safeguards
9. Data Security Measures
Amerisure will use a reasonable standard of care—consistent with or exceeding industry standards—to safeguard biometric data, including:
- Encryption at rest and in transit
- Access controls and authentication requirements
- Data minimization practices
- Monitoring for unauthorized access
10. Accountability and Governance
- Designated information technology staff will oversee implementation of this Policy
- Regular audits will be conducted to ensure compliance
11. Individual Rights
Where required by law, individuals may:
- Request information about their biometric data
- Request deletion (subject to legal exceptions)
- Withdraw consent (which may impact services or employment conditions)
Requests should be directed to: corplegal@amerisure.com
12. Policy Publication (BIPA Requirement)
This Policy will be made publicly available, including publication on the Amerisure’s website, as required under BIPA.
13. Legal Disclaimer
This Policy is intended as a general framework and does not constitute legal advice.
