United States: Developments In Biometric Information Privacy Laws

In 2008, Illinois became the first state to enact a Biometric Information Privacy Act (BIPA). BIPA regulates "the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information" (i.e., fingerprints, iris scans, voiceprints). It prohibits private parties from collecting biometric identifiers and generating individual "profile" information derived from biometric identifiers without first notifying the individuals whose information is being collected, obtaining their consent, and making specific disclosures to them. The statute also requires private parties to publish detailed information regarding their data retention and destruction policies, and prohibits them from selling collected biometric identifiers.

Since Illinois enacted BIPA, four other states have adopted legislation modeled on BIPA—Arkansas, California, Texas, and Washington. See  Ark. Code § 4-110-104, Cal. Civ. Code § 1798.100, Tex. Bus. & Com. Code § 503.001, Wash. Rev. Code § 19.375.020. Twenty-seven other states have BIPA-modeled legislation pending as of June 2021:

Only five states—Georgia, Kansas, Michigan, Missouri, and South Dakota—do not have existing or pending legislation regulating biometric information privacy. The remaining states address biometric privacy through existing personal information or privacy statutes and/or pending legislation that is not modeled after BIPA:

Enforcement of Biometric Information Privacy Laws

Of the five states that have enacted biometric privacy legislation, only two allow for a private right of action: Illinois and California. However, recent decisions addressing Illinois' BIPA provide little clarity and instead are indicative of just how underdeveloped the BIPA legal landscape remains and how many legal questions can be expected to continue surfacing in future litigation (covered separately here). California's biometric privacy law does not begin to apply to employees' biometric information until January 1, 2022. Therefore, employers should be cognizant of how they process employees' personal information and should keep an eye out for further developments and case law interpreting the statute in the years to come.

In addition, of the 27 states with BIPA-modeled legislation pending, only five states—Connecticut, Indiana, Minnesota, Montana and Utah—do not propose a private cause of action, thereby increasing the likelihood of future biometric privacy litigation. Assuming the legislation in those states allowing for a private right of action is enacted, we should expect to see a significant uptick in cases interpreting those statutes. Some of those states' proposed legislation would allow for the recovery of treble damages (Alaska, North Carolina, Washington) and attorneys' fees (Alaska, Kentucky, North Carolina, Washington). Indeed, a closer look at Washington's proposed legislation illustrates the broad reach of pending biometric privacy legislation and potential for significant liability to businesses. Notably, a violation of the statute would "constitute a rebuttable presumption of harm to that individual" and would allow courts to award liquidated "damages of $10,000 per violation or actual damages, whichever is greater," and punitive damages. 2021 WA H.B. No. 1433. In addition, the Washington statute mandates an award of attorneys' fees to prevailing plaintiffs. Id.  ("courts shall award reasonable attorneys' fees and costs to any prevailing plaintiff.") (emphasis added).

Takeaways

Given the ongoing development of biometric privacy legislation and the potential exposure to punitive damages and award of attorneys' fees, the best practical advice available to any employer or business leveraging technology to identify employees or facilitate customer transactions remains to engage counsel to explore proactive risk management strategies, rather than ending up on the reactive side of allegations of BIPA violations.

Footnotes

1 Action postponed indefinitely; New Mexico has incorporated biometric information into existing personal information protection statute, which is not modeled after BIPA. See  NMSA 1978, §§ 57-12C-1 et seq.

2 This legislation expands the remedies available under Washington's current BIPA-modeled statute.