Right of action written into Washington, Maine biometric privacy bills

In biometric America, there are two kinds of states – those that have enacted privacy laws and those that have not. Of the states with laws – notably Illinois — the differentiator is whether people have a right to sue over infractions.

Two bits of legislation in the news, a state of Washington health data bill and another in Maine, both squarely address the right to action.

The Washington law gives residents a right to sue over biometric privacy infractions as would the bill being considered across the nation in Maine. But businesses that are most vocal on the topic do not want the right of action to become the norm.

They want to restrict court actions to state attorneys general, who are elected, accept campaign contributions and who work with a budget set by other elected officials. (The right to action in biometric cases has been a news topic going back at least to 2012.)

Washington’s House Bill 1155-2023-24, currently waiting to be signed by the governor, is called the My Health My Data Act. It puts curbs on how personal health information can be gathered and how it can be used.

It passed by solid but not unassailable votes, especially considering that Amazon and Microsoft are based in the state.

But the tally also highlights some ambivalence raised not just by the bill’s right of action but by the power the bill gives to Washington State judges to triple damages and legal feels decided in a lawsuit.

In Illinois, originator of the landmark Biometric Information Privacy Act, there is a right of action and plaintiffs can ask for damages for every time an iris, face or finger is scanned. While the Washington bill is focused on health data, BIPA addresses virtually all private-sector biometric data collection.

(Plans are afoot to defang BIPA. It is safe to expect right of action and damage limits to come under sustained fire from business groups.)

The state of Texas has a privacy law in place, but it does not allow residents to sue. That has been reserved for the state attorney’s office.

Representatives in Maine, which is to Europe what Washington is to Asia, are taking another run at biometric privacy. Like BIPA, House bill LD 1705 puts much emphasis on getting the express consent of residents before collecting or using their data.

Provisions on how collected data is managed track closely with BIPA and have raised few objections.

But business owners’ opposition to a right of action defeated a similar bill last year, according to trade publication StateScoop. That right is in the new bill, too

Article Topics

biometric data  |  biometrics  |  data privacy  |  data protection  |  legislation  |  Maine  |  United States  |  Washington