Prohibits a person from enrolling a biometric identifier of an individual in a database for a commercial purpose without providing clear and conspicuous notice and obtaining the individual's affirmative consent.