Washington State House of Representatives Office of Program Research | BILL ANALYSIS |
Innovation, Technology & Economic Development Committee |
HB 2363
This analysis was prepared by non-partisan legislative staff for the use of legislative members in their deliberations. This analysis is not a part of the legislation nor does it constitute a statement of legislative intent. |
Brief Description: Providing remedies for violations of biometric data ownership rights.
Sponsors: Representatives Smith and Hudgins.
Brief Summary of Bill |
|
Hearing Date: 1/14/20
Staff: Yelena Baker (786-7301).
Background:
Biometric identifiers.
The terms "biometric data," "biometric information," or "biometric identifier" variously refer to measurable biological or behavioral characteristics unique to an individual. Biometrics may be used for identification and authentication purposes, such as unlocking a device or authorizing a payment. They may also be used to gather personal characteristics for customizing services or information, such as in advertising.
Regulation of biometric identifiers.
There is no federal law that specifically regulates the collection or use of biometric data.
In 2017, two Washington laws regulating the collection and use of biometric data were enacted: one applies to state agencies and the other to any person or business that enrolls biometric identifiers in a database for commercial purposes.
A state agency is prohibited from obtaining a biometric identifier without providing notice that clearly specifies the purpose and use of the identifier and obtaining consent specific to the terms of the notice. A state agency that obtains biometric identifiers must minimize the review and retention of biometric identifiers and establish security policies to ensure the integrity and confidentiality of biometric identifiers. A state agency may only use a biometric identifier consistent with the terms of the notice and consent and is prohibited from selling a biometric identifier. Biometric identifiers collected by a state agency may not be disclosed under the Public Records Act (PRA).
A person or business may not enroll a biometric identifier in a database for a commercial purpose, without providing notice, obtaining consent, or providing a mechanism to prevent subsequent use. A biometric identifier enrolled or obtained for a commercial purpose may not be used or disclosed in a way inconsistent with the original terms under which it was provided, unless new consent is obtained. The sale, lease, or disclosure of a biometric identifier for a commercial purpose, without the individual's consent, is prohibited except in certain circumstances, such as when it is necessary in providing a product or service sought by the individual or required under a court order. A person or business in possession of biometric identifiers enrolled for a commercial purpose must guard against unauthorized access and adhere to retention limitations.
Office of Privacy and Data Protection.
In 2016 the Office of Privacy and Data Protection (OPDP) was created to serve as a central point of contact for state agencies on policy matters involving data privacy and data protection. The primary duties of the OPDP with respect to state agencies include conducting privacy reviews and trainings, coordinating data protection, and articulating privacy principles and best policies.
Summary of Bill:
Each person owns and has an exclusive property right in the person's biometric identifiers. "Biometric identifier" is defined as any information, regardless of how it is captured, converted, stored, or shared, based on biological, physiological, or behavioral traits that are uniquely attributable to a single individual.
The Attorney General, in consultation with the Office of Privacy and Data Protection, is directed to convene a task force to examine the issues related to infringement by biometric surveillance technology on the biometric identifiers ownership rights. The majority of the task force members must be representatives of organizations that advocate for civil liberties, consumer rights, and privacy protections.
By December 1, 2020, the Attorney General must submit to the Legislature a report summarizing the findings of the task force and recommending legal remedies for violations of biometric data ownership rights.
Appropriation: None.
Fiscal Note: Requested on January 13, 2020.
Effective Date: The bill takes effect 90 days after adjournment of the session in which the bill is passed.