Written by Matthew Zampa
Eight[1] new state privacy proposals could change how our data is protected online. The bills cover a range of privacy issues concerning how companies use consumers’ personal information, including their biometric data.[2]
Over the past two decades, American consumers have grown increasingly concerned with the security of their personal information online.[3] The rapid adoption of biometric recognition technologies like retina scans, digital fingerprints, voice prints, and face scans has resulted in a surge of privacy and cybersecurity legislation.[4] As a result, some lawyers say it is “nearly impossible” for consumer tech companies like Google and TikTok to collect and store biometric data without breaking the law.[5]
Illinois was the first state to pass a comprehensive biometric data privacy law in 2008.[6] The Biometric Information Privacy Act (BIPA) regulates the collection, use, storage, and disposal of biometric data by private entities.[7] Since its enactment, BIPA has become known for its broad applicability. In Rosenbach v. Six Flags Entertainment Corporation, the Supreme Court of Illinois held that any person who is the subject of a violation under BIPA may bring a cause of action under the statute, even if they have not suffered separate harm. This means that consumers who have not lost money or property as a result of a company’s mishandling of their biometric data may still make a claim under the statute.[8]
The new proposals range in specificity from requiring a written biometrics retention and destruction policy to mandating that companies obtain consent from users before collecting and storing their biometric data.[9] And while Illinois is currently the only state with a biometric data privacy law with a private right to action,[10] the liability risks for mishandling biometric information will only get bigger as states enact similar legislation.
For the companies collecting the data, “millions of dollars [are] at stake.”[11] Proposals in Maryland, Mississippi, and New York could soon give consumers the power to sue companies for mishandling or refusing to report how they are using their biometric data.[12] In Illinois, BIPA has already resulted in several class action lawsuits against social media companies over the past five years. In 2020, Facebook agreed to pay $650 million for collecting users’ biometric data without their consent, representing one of the largest consumer privacy settlements in U.S. history.[13] In 2021, TikTok reached a $92 million class-action settlement agreement with users for violating state biometric data privacy laws by collecting facial recognition data without their consent.[14]
But this uptick in biometric data privacy litigation is not something to celebrate. It reflects the size of the problem. With Amazon now facing its own biometric data privacy lawsuit,[15] consumers are left with more questions than answers as to how and why their data is being used without their consent.
[1] Brenna Goth & Skye Witley, Data Privacy ‘Panoply’ Looms as States Move to Fill Federal Hole, Bloomberg Law (Jan. 19, 2023), https://www.bloomberglaw.com/bloomberglawnews/privacy-and-data-security/X8ID0VLS000000.
[2] Id.
[3] Joseph N. Pato et al., Biometric Recognition: Challenges and Opportunities 91 (2010).
[4] Goth & Witley, supra note 1.
[5] Id.
[6] The Evolution of Biometric Data Privacy Laws, Bloomberg Law (Jan. 25, 2023), https://pro.bloomberglaw.com/brief/biometric-data-privacy-laws-and-lawsuits/.
[7] Aravind Swaminathan et al., Emerging Biometric Laws: Considerations for Employers and Companies Collecting Data, LexisNexis (June 19, 2019), https://www.lexisnexis.com/community/insights/legal/practical-guidance-journal/b/pa/posts/emerging-biometric-laws-considerations-for-employers-and-companies-collecting-data.
[8] Id.
[9] Goth & Witley, supra note 1.
[10] Swaminathan et al., supra note 7.
[11] Id.
[12] Id.
[13] The Evolution of Biometric Data Privacy Laws, supra note 6.
[14] See In re TikTok, Inc. Consumer Priv. Litig., 565 F. Supp. 3d 1076 (N.D. Ill. 2021).
[15] Wyatte Grantham-Philips, Amazon Sued Over Biometric Information Collection, Tracking New York Amazon Go Stores, USA Today (Mar. 17, 2023), https://www.usatoday.com/story/tech/2023/03/17/amazon-go-lawsuit-biometric-data/11491200002/.
