HOUSE BILL REPORT

HB 2363

As Reported by House Committee On:

Innovation, Technology & Economic Development

Title: An act relating to providing remedies for violations of biometric data ownership rights.

Brief Description: Providing remedies for violations of biometric data ownership rights.

Sponsors: Representatives Smith, Hudgins, Young, Wylie, Kloba and Pollet.

Brief History:

Committee Activity:

Innovation, Technology & Economic Development: 1/14/20, 2/4/20 [DPS].

Majority Report: The substitute bill be substituted therefor and the substitute bill do pass. Signed by 9 members: Representatives Hudgins, Chair; Kloba, Vice Chair; Smith, Ranking Minority Member; Boehnke, Assistant Ranking Minority Member; Entenman, Slatter, Tarleton, Van Werven and Wylie.

Staff: Yelena Baker (786-7301).

Background:

Biometric Identifiers.

The terms "biometric data," "biometric information," or "biometric identifier" variously refer to measurable biological or behavioral characteristics unique to an individual. Biometrics may be used for identification and authentication purposes, such as unlocking a device or authorizing a payment. They may also be used to gather personal characteristics for customizing services or information, such as in advertising.

Regulation of Biometric Identifiers.

There is no federal law that specifically regulates the collection or use of biometric data.

In 2017 two Washington laws regulating the collection and use of biometric data were enacted: one applies to state agencies and the other to any person or business that enrolls biometric identifiers in a database for commercial purposes.

A state agency is prohibited from obtaining a biometric identifier without providing notice that clearly specifies the purpose and use of the identifier and obtaining consent specific to the terms of the notice. A state agency that obtains biometric identifiers must minimize the review and retention of biometric identifiers and establish security policies to ensure the integrity and confidentiality of biometric identifiers. A state agency may only use a biometric identifier consistent with the terms of the notice and consent and is prohibited from selling a biometric identifier. Biometric identifiers collected by a state agency may not be disclosed under the Public Records Act.

A person or business may not enroll a biometric identifier in a database for a commercial purpose, without providing notice, obtaining consent, or providing a mechanism to prevent subsequent use. A biometric identifier enrolled or obtained for a commercial purpose may not be used or disclosed in a way inconsistent with the original terms under which it was provided, unless new consent is obtained. The sale, lease, or disclosure of a biometric identifier for a commercial purpose, without the individual's consent, is prohibited except in certain circumstances, such as when it is necessary in providing a product or service sought by the individual or required under a court order. A person or business in possession of biometric identifiers enrolled for a commercial purpose must guard against unauthorized access and adhere to retention limitations.

Office of Privacy and Data Protection.

In 2016 the Office of Privacy and Data Protection (OPDP) was created to serve as a central point of contact for state agencies on policy matters involving data privacy and data protection. The primary duties of the OPDP with respect to state agencies include conducting privacy reviews and trainings, coordinating data protection, and articulating privacy principles and best policies.

–––––––––––––––––––––––––––––––––

Summary of Substitute Bill:

Each person has an absolute privacy right in the person's biometric identifiers. "Biometric identifier" is defined as any information, regardless of how it is captured, converted, stored, or shared, based on biological, physiological, or behavioral traits that are uniquely attributable to a single individual.

The Attorney General, in consultation with the Office of Privacy and Data Protection, is directed to convene a task force to examine the issues related to infringement by biometric surveillance technology on the privacy of biometric identifiers, including the use of affirmative consent for collection of biometric data and imposition on entities that collect biometric data a duty to protect and prevent misuse of biometric data. The majority of the task force members must be representatives of organizations that advocate for civil liberties, consumer rights, and privacy protections. The task force must also include a data ethics expert and a law enforcement representative.

By December 1, 2021, the Attorney General must submit to the Legislature a report summarizing the findings of the task force and recommending legal remedies for violations of biometric data privacy rights.

Substitute Bill Compared to Original Bill:

The substitute bill:

• modifies the provisions related to biometric identifiers by providing that each person has an absolute privacy right in the person's biometric identifiers;

• specifies the issues that the biometric identifiers task force convened by the Attorney General must examine;

• requires the biometric identifiers task force to include a law enforcement representative and a data ethics expert;

• extends to December 1, 2021, the deadline for the Attorney General to submit a report to the Legislature and makes a corresponding change to the expiration date for the section; and

• clarifies that the Attorney's General recommendations regarding legal remedies must be included in the report for consideration and possible adoption by the Legislature.

–––––––––––––––––––––––––––––––––

Appropriation: None.

Fiscal Note: Requested on January 10, 2020.

Effective Date of Substitute Bill: The bill takes effect 90 days after adjournment of the session in which the bill is passed.

Staff Summary of Public Testimony:

(In support) Corporations have grown wealthy by collecting and using nonbiometric personal data. If corporations want to access consumers' biometric information, consumers should have the right to make an informed choice about to whom and when that access may be granted. Corporations should not be permitted to turn people into templates and make an asset out of something that is unique to every person. Not protecting biometric identifiers impacts future generations and their ability to choose how they want to participate in society.

Biometric surveillance technology gives governments and corporations unprecedented power to locate, track, analyze, make inferences about, and exploit people based on their biometric identifiers. Citizens of Washington should be able to go out in public and access basic social opportunities without automatically being identified, profiled, and potentially exploited. The dangerous uses of biometric surveillance technologies in other states and countries make this legislation a timely and important step toward prioritizing liberty, bodily autonomy, and human dignity.

(Opposed) The bill attempts to tackle a very big issue that is already being addressed in another bill that contains protections for biometric data. Defining a property right in a person's biometric identifiers is an interesting but difficult concept with many unintended consequences. The expansive definition of "biometric identifiers" creates unintended consequences in areas such as health care operations and research, which are regulated under federal and state medical privacy and confidentiality laws.

(Other) Privacy and biometric data are big issues, but providing an exclusive property right to biometric data has some unintended consequences for law enforcement.

Persons Testifying: (In support) Representative Smith, prime sponsor; Natalie Morrison; and Jevan Hutson.

(Opposed) Robert Battles, Association of Washington Business; and Fielding Greaves, Advanced Medical Technology Association.

(Other) James McMahan, Washington Association of Sheriffs and Police Chiefs.

Persons Signed In To Testify But Not Testifying: None.