Tagging Trouble: Forays into the Regulation of Biometric Data

We leave breadcrumbs of biometric information scattered around our daily lives, which may be collected and used by private entities, often without our knowledge or consent. The sound of your voice when you call your bank’s customer service line. The fingerprint you scan to unlock your cell phone. Your smiling face in a photograph posted to your favorite social networking site.

These are examples of biometric data – measurements of your physical presence that can be used to identify you remotely. Biometric measures are becoming much more important as data becomes digitized and as we need to authenticate ourselves in more remote applications and circumstances.

For years, the collection and use of individuals’ biometric information has been nearly unregulated. Granted, unique biometric identifiers, like fingerprints, are typically included in the category of personal information covered by many states’ privacy laws, but proponents of more stringent legislation surrounding the collection of biometric data believe that such information should be protected in its own right, and not treated the same as one’s driver’s license number.

No federal law currently exists to require businesses to take particular actions in the collection and use of biometric data. There are a handful of laws regulating the collection and use of biometric identifiers in specific situations, like when the data belongs to students or is used in connection with driver’s licenses.  For example:

• The Family Educational Rights and Privacy Act requires written permission from parents or students to release information, including biometric information, from a student’s record except under certain circumstances.
• California law prohibits operators of websites geared towards K-12 school purposes from selling students’ biometric data and restricts their use. Delaware has a similar law.
• Colorado law prohibits its Department of Education from collecting student biometric information unless required by state or federal law. Arizona, Illinois, Wisconsin, Louisiana and Kansas laws prohibit schools from collecting student information (including biometric identifiers) without parental or student consent. Florida law prohibits schools from collecting, obtaining, or retaining any biometric information of a student or a parent or sibling of the student. In North Carolina and West Virginia, student biometric data may not be kept in the student data system.
• There are numerous laws concerning the use of biometric information in connection with driver’s licenses and the like.  Missouri, Maine and New Hampshire laws prevent state agencies from collecting or storing individuals’ biometric data in connection with ID cards or licenses.

Recently, both Illinois and Texas have enacted laws regulating private entities’ collection and use of biometric information and similar legislation has been introduced in a handful of other states.   

The Illinois’ Biometric Information Privacy Act, 740 ILCS 14 et seq. (“BIPA”), creates a right of private action against businesses that fail to satisfy BIPA’s requirements with respect to the collection and use of biometric information. As other legislatures look to protect biometric information, BIPA’s requirements may become widespread. 

How Your Business Can Comply with BIPA

1. Have a written policy. BIPA requires business in possession of biometric data to develop a written policy, which sets forth a retention schedule for the information (no longer than 3 years from the individual’s last interaction with the business) and guidelines for destroying the data.
2. Consent is required. Businesses may not collect or receive biometric information without: (A) informing the individual in writing of the collection; (B) indicating the purposes for collection and the time period for which it will be stored or used; and (C) receiving a written release from the individual. Consent is required for disclosure of the biometric data as well and can only be for the purpose of completing a financial transaction for the subject.
3. Do not sell the data. A business cannot sell or otherwise profit from biometric data it collects or possesses.
4. Protect the data. A business must protect biometric data in the same manner as it would other confidential and sensitive information in its possession.

Class action lawsuits based on BIPA were recently filed against Facebook and Shutterfly. Three related lawsuits, Licata v. Facebook Inc., 1:15-cv-04022 (N.D. Ill. May 5, 2015), Patel v. Facebook Inc., 1:15-cv- 04265 (N.D. Ill. May 14, 2015), and Pezen v. Facebook Inc., 1:15-cv-03484 (N.D. Ill. Apr. 21, 2015) all allege that Facebook violated BIPA with its photograph tagging suggestion feature, which captures and stores facial features, without subjects’ consent, to enable users to “tag” their friends in photographs.  Similarly, in Norberg v. Shutterfly, Inc., 1:15-cv-05351 (N.D. Ill. June 17, 2015), the plaintiff claims that Shutterfly’s creation, collection, and storage of millions of “face templates” from individuals whose images appear in photographs submitted to Shutterfly, many of whom are not Shutterfly users, is a violation of BIPA.

Though these lawsuits are limited to affected Illinois residents, we expect to see similar lawsuits in other states that enact legislation modeled after BIPA.  In addition, we anticipate class action suits will be filed against businesses outside of the social networking sphere in the months to come.

Contact Information

To learn just how vulnerable your company is to these claims or how you may enforce your rights against a business in violation of BIPA, please contact Ted Claypoole.

Womble Carlyle client alerts are intended to provide general information about significant legal developments and should not be construed as legal advice regarding any specific facts and circumstances, nor should they be construed as advertisements for legal services.

IRS CIRCULAR 230 NOTICE: To ensure compliance with requirements imposed by the IRS, we inform you that any US tax advice contained in this communication (or in any attachment) is not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending to another party any transaction or matter addressed in this communication (or in any attachment).