Five states considering bills to restrict biometrics use
23 February, 2017
category: Biometrics, Corporate
If legislators in at least five states don’t see the biometric light at the end of tunnel, they may join Illinois by passing restrictive regulation that impacts how organizations can use biometrics.
In Illinois, the state’s Biometric Information Privacy Act (BIPA) prohibits companies from using biometrics without obtaining prior written consent and outlining types, duration and more during use. As covered in SecureIDNews in recent months (Tanning Salon to pay $1.5 million, Ruling in favor of video game maker) numerous cases have been and are being heard in various courts.
The regulation makes it worrisome for national or international entities considering rollout of biometric programs – whether for authentication, convenience or entertainment. This is because the prospect of deploying such a service everywhere except Illinois is costly and impractical.
In the next year, a handful of other states may join Illinois. According to a report in the National Law Review, Alaska, Connecticut, Montana, New Hampshire and Washington have pending legislation.
Three of the bills – Alaska’s HB 72, Montana’s HB 518 and New Hampshire’s HB 523 – are similar in scope to the Illinois BIPA. Like Illinois, they also allow for individuals to take legal action against companies they feel have violated the law.
This right to pursue private action is at the root of the problem as some plaintiff’s attorneys in Illinois are eagerly filing suits against companies – from tanning salons to video game makers and social media companies – that utilize biometrics. New regulations, especially those covering new technologies, typically have large gray areas so violation is often easy to claim and hard to defend.
Texas has law a similar law but it does not allow for private lawsuits to be filed against companies. Washington’s HB 1493 seems to be more closely aligned to Texas in this sense.
Connecticut’s HB 5522 takes a different approach, focusing only on the use of facial recognition for marketing purposes.
The National Law Review articles author, Jeffrey Neuburger a Partner at Proskauer, cautions that, “entities may have to consider changes to their notice and consent practices, or decide to not collect or store biometric data at all.”
