Regulating the use of biometric data by private entities, including by requiring certain private entities in possession of biometric data to develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanent destruction of biometric data; prohibiting an entity that collects biometric data from selling, leasing, or trading an individual's biometric data; authorizing an individual alleging a violation of the Act to bring a civil action against the offending private entity; etc.