Article calls on states to improve understanding to develop biometric privacy legislation

May 23, 2018, 6:44 pm EDT | Chris Burt

Categories Biometrics News | Commercial Applications

Only one-fifth of U.S. states have actively considered or passed legislation addressing the collection and management of biometric data, and the future of litigation relating to biometrics is very uncertain, according to a review of the current legal landscape published by Lexology.

In a post referring to biometric privacy as a “runaway train” and an “untameable circus,” Niya T. McCray of Bradley Arant Boult Cummings LLP describes the range of rules established so far at the state level, and calls for legislative and judicial action to match the pace of industry change.

A rash of class action suits filed under Illinois’ Biometric Information Privacy Act (BIPA) have recently garnered significant attention, but McCray points out that the limitations established “Rosenbach v. Six Flags & Great America” may slow the pace of suits.

In that case, an Appellate Court ruled that for a plaintiff to be “aggrieved” under BIPA they would have to show harm, not a mere technical violation. This distinction is at the heart of a disagreement between Facebook and District Judge James Donato, who is hearing a suit against the company, and has ruled that the company’s alleged use of biometric data could constitute harm to plaintiff’s “property interest.”

BIPA is the only state legislation that allows consumers to file suits themselves. Laws in Texas and Washington reserve the right to file suit for state Attorney Generals, though they otherwise are similar to BIPA, according to McCray. Washington’s H.B. 1493 is different in that it hinges on a definition of “enrolled” biometric identifiers, and does not apply if the capture and storage process does not meet that definition. It also includes broad exemptions for security applications of biometrics. Texas’ Capture or Use of Biometric Identifier (CUBI) legislation applies only to biometric data captured for commercial purposes.

Delaware amended a data breach notification law to include biometric data, which McCray characterizes as “a series of introductory steps” to dealing with the legal implications of biometrics. Alaska, Connecticut, Massachusetts, and New Hampshire have also considered comprehensive legislation.

“The concept of biometrics is like clay; even at this moment, it is being shaped and molded in ways that we may not comprehend for years to come,” McCray writes. “It would be remiss to discount the staying power, the convenience, and the absolute value that biometric technology now has in our everyday lives.”

Ultimately, McCray anticipates more legislation and lawsuits. Understanding and respecting the technology, she says, is the only way for the various stakeholders to eventually bring the necessary predictability and certainty to its legal standing.