Colorado debates giving consumers biometric rights, including to sue vendors

A Colorado state representative is pushing a bill he introduced last month that would give people more control over their biometric data, including a private right of action.

Rep. Alex Valdez (D) appeared on a local TV news program to generate public support House Bill 21-1244, which he introduced in March. (Colorado’s Senate has its own biometrics bill, 21-190.)

The House proposal would limit how the businesses and government agencies collect and store biometric data, including information gained through scans of retinas, irises, voices, faces, fingers and palms. It would also include biometric data collected from photos, according to the Thomson Reuters legal analysis unit Westlaw.

It has been assigned to the House’s business affairs and labor committee.

Westlaw found that the bill is based on Illinois’ Biometric Information Privacy Act (BIPA), including a right of private action, which means giving people the right to sue those violating the proposed law.

A growing but still small number of states are considering biometric legislation, but to date, only one other has approved a right to sue — Illinois in its information privacy act.

Businesses could not collect the data unless they tell consumers what is being collected, get their consent and alert them to their right to revoke that consent. Violating the act would be an unfair or deceptive trade practice.

Government agencies would have a more difficult path in trying to use biometric data. They would need the state legislature to pass a law expressly authorizing them to acquire, possess or use biometric identifiers or a biometric surveillance system.

An agency could not sell, release or disclose information obtained that it has gathered from a biometric surveillance system unless a court, state or federal directive requires it; or if the subject of the data consents in writing.

The same would go for an agency wanting to receive third-party biometric data. That stipulation might put indiscriminate algorithmic face-matchers like Clearview AI off limits for state government.

The Colorado Senate legislation creates personal rights to data privacy except that which is governed by state and federal law, specified activities and employment records. The state’s attorney general and district attorneys would enforce the law.

State residents under the bill would have the right to opt out of having their personal data processed. They also would have the right to access, correct and delete their data, and to get a portable copy of the data.

Sens. Robert Rodriguez (D) and Paul Lundeen (R) are co-sponsors of the bill.

Article Topics

biometric data  |  biometrics  |  Colorado  |  data collection  |  data protection  |  data storage  |  legislation  |  privacy  |  regulation