|
July 12, 2016 - It seems like a fairly straightforward question. Who owns your fingerprints? For that matter, who owns all of your biometric data? Things like retina scans and DNA. It also seems like the answer should be pretty straightforward. Of course, you should own those things. After all, they are the things that make you who you are. As it turns out though, the answer is anything but straightforward. As it stands right now only one state - Illinois - has a law on the books that names you as the owner of your own biometric markers, and because of some lawsuits that are moving forward, someone is trying to gut that law.
|
|
|
|
|
 |
The Illinois law is called the Biometric Information Privacy Act (BIPA). The law was passed in 2008 after a company that used fingerprint scans to authorize electronic payments went bankrupt. That company's database of fingerprint scans was an asset of the company and could have been sold. But since the company did most of its business in Illinois, state legislators decided to act. BIPA put strict rules in place for the ways that companies handle biometric information, and it made the sale of biometric information illegal.
BIPA has resulted in several law suits. So far, several of those suits have survived legal challenges. Several suits against Facebook, Google and other companies claim that the company violated people's privacy by using facial recognition software to construct a digital image of their faces. Facial recognition is considered a biometric marker so it is covered by BIPA.
The companies being sued have mounted vigorous challenges to the law. So far, those challenges have been largely unsuccessful.
But the companies aren't just using the courts to fight their battles. Just before the Memorial Day weekend, Democrat state senator Terry Link tried to amend BIPA to exclude the use of stored photos from the law. Since the companies being sued had used stored photos in conjunction with their facial recognition software, his amendment would have gutted the basis of the lawsuits. Only public pressure prevented the amendment from moving forward. And it can be reintroduced at any time. According to an article in Bloomberg, the amendment was actually introduced at the behest of Facebook.
BIPA is not an ideal law. It only covers residents of Illinois. Legislation is desperately needed in other states to prevent biometric data abuse. Much the way that data breach laws migrated from California to the rest of the nation, we would like to see the same thing happen with biometric data.
A word of warning though. If this type of legislation does take off in other states, it won't be long before we'll start to hear from Washington that we need a national standard for biometric data privacy, and that standard will inevitably be weaker than the state laws it will usurp. For years now, congress has been trying to gut state data breach laws with a much weaker national law. There is no reason to believe that the same thing won't happen here too.
byJim Malmberg
Note: When posting a comment, please sign-in first if you want a response. If you are not registered, click here. Registration is easy and free.
Follow me on Twitter:
|
Privacy Issues 
