Biometric Information Privacy Act News

A recent privacy bill in Maryland proposes that a biometric identifier is defined as “data of an individual generated by automated measurements of an individual’s biological characteristics.” This could include fingerprints, voiceprints, DNA, retina or iris images, or any other unique biological characteristic used to uniquely authenticate an individual’s identity.

Under current privacy law, the firm or organization that is storing user data is responsible for data breaches and will pay any fines or damages that are the result of legal action. The actual data holder—an organization that provides cloud storage—is not usually legally implicated or held responsible in litigation. 

The majority of BIPA lawsuits are filed against employers who utilize biometric timekeeping systems with fingerprint or facial recognition scans and collect employee biometric data.

BNSF was found guilty of violating the privacy of 45,000 truck drivers, and plaintiffs were awarded  $228 million. BNSF violated the Illinois BIPA after they were accused of using a fingerprint system that allowed drivers to access railyards for pickups and drop-offs but did not obtain written consent.

Motorola, Clearview AI, and Vigilant are facing legal action for allegedly collecting mugshots that were used by law enforcement. Microsoft, Amazon, Alphabet, and FaceFirst Inc. are alleged to have violated privacy laws by collecting photos for facial recognition data from the website Flickr.

A proposed class action alleges Ring, LLC, has failed to protect the privacy of its motion-activated cameras and the personal information of its customers. The complaint alleges Ring’s devices are rife with security vulnerabilities, which may compromise the personal data of existing and future customers.

Cybercriminals may have the potential to hack into Ring devices and home networks. The lawsuit also brings to light the fact that Ring has shared users’ personal identifying information with third parties without first obtaining prior consent. The complaint says the devices are not well-equipped to deal with potential hacks.

Plaintiffs in the case want Ring to take additional security measures to protect the privacy of user accounts and installed devices, as well as stop sharing personal data without clear and informed consent.

Reports have surfaced that several user accounts and devices were hacked, and plaintiffs argue the company was late in addressing security issues.

Beyond the security issues, Ring permits third parties to track users, raising eyebrows from consumer safety and data privacy advocates.

Octapharma agreed to pay $10 million to settle a class action lawsuit regarding fingerprint scans of plasma donors, which violated the Illinois biometric privacy.

The GIPA (Genetic Information Nondiscrimination Act) is a statute that expands on privacy laws, originally drafted under the Health Insurance Portability and Accountability Act (HIPAA). This act is largely concerned with the privacy of Americans’ genetic information. GIPA includes requirements applicable to genetic testing companies, health care providers, business associates, insurers, and employers.

• Under GIPA, genetic testing and personal information derived from genetic testing are confidential and may only be released to the individual tested or other persons specifically authorized to receive the information.
• An insurer may not seek genetic testing information for use in connection with insurance. Insurers may not use or disclose genetic information for underwriting purposes or to determine eligibility for benefits under a plan, coverage, or policy.
• Companies providing commercial genetic testing are prohibited from sharing any genetic information or other personal information about a consumer with any health or life insurance company.
• Employers must treat DNA and other genetic information consistent with the requirements of federal law and under GIPA.
• Employers may not require or purchase genetic testing or genetic information or administer a genetic test to a person as a condition of employment.
• Employers cannot use genetic information or genetic testing for workplace wellness programs unless the employee provides written authorization under GIPA.

Yes, but consent is required to use a person’s biometrics. 

Meta Platforms, the parent company of Facebook, said it was ending the facial recognition system it used to identify people in posted images. The company is trying to limit a public relations crisis on several fronts, and facial recognition has become an increasingly toxic concept.

Meta’s facial recognition tech decision follows Microsoft Corp. and Amazon.com Inc., both of whom restricted the use of their facial recognition by law enforcement agencies. Several municipalities in the U.S. have passed legislation limiting the use of facial recognition technology, and privacy attorneys are calling for further restrictions, which can easily be abused by private companies.

A voiceprint is a unique biometric identifier. Voice recognition technology can identify specific individuals when a voice sample is saved by a company for various reasons. 

Walmart is facing an Illinois biometrics privacy law class action in which the retailer is accused of improperly recording and tracking the “voiceprints” of workers at warehouses.

Walmart and other large retailers use voiceprints and voice technology in their fulfillment and distribution centers. Voiceprints, however, are considered biometrics and subject to the Illinois Biometric Information Privacy Act (BIPA). The collection and storage of voiceprints is the primary issue, and plaintiffs say these ought to be destroyed.

Walmart allegedly violated the BIPA law by failing to obtain written authorization from workers before requiring them to scan their voiceprints.

The lawsuit argues Walmart did not provide necessary notices to workers, such as how the company would use the voice records or how they would be saved, shared, or ultimately deleted from company systems.