Washington State

House of Representatives

Office of Program Research

BILL

ANALYSIS

Technology & Economic Development Committee

HB 1094

This analysis was prepared by non-partisan legislative staff for the use of legislative members in their deliberations. This analysis is not a part of the legislation nor does it constitute a statement of legislative intent.

Background:

Federal Privacy Laws.

Under both federal and state constitutional rights, an individual has a right to privacy, which includes an individual interest in avoiding disclosure of personal matters.

In the United States, there is no all-encompassing data privacy law. The Privacy Act of 1974 (Act) provides general protections for the collection, use, maintenance, and dissemination of personal identifiable information (PII) processed and held by the Federal Government. However, the Act does not apply to states, local governments, and the private sector, and does not provide specific protections for different types of data. Instead, individual sector-specific privacy laws are applied related to areas such as financial services, communications, and healthcare.

Similarly, biometrics are not currently protected by any specific federal law. Instead various general privacy laws apply both at the federal and state levels to PII, which include biometric data within the same sector specific laws. In more recent years, states have adopted biometric specific privacy laws.

Biometric specific state laws define biometrics, an area of (PII), as specific biological, genetic and physical characteristics. These characteristics include, but are not limited to finger prints, palm prints, hand geometry, iris scans, retina scans, eye vein scans, and voiceprint scans.

Washington State does not have a biometric specific privacy law.

Consumer Protection Act.

The Washington Consumer Protection Act (CPA) declares that unfair and deceptive practices in trade or commerce are illegal. The CPA allows a person injured by an unfair or deceptive practice to bring a private cause for damages. The Office of the Attorney General may investigate and prosecute claims under the CPA on behalf of the state or individuals in the state.

Under the CPA, "person" includes natural persons, corporations, trusts, unincorporated associations, and partnerships.

Summary of Bill:

This bill pertains to commercial use of biometric identifiers.

Definitions.

“Biometric Identifier” is defined in two ways. Both definitions refer to biological, behavioral, or both characteristics. Inherently sensitive characteristics such as fingerprint, DNA, hand geometry, palm print and iris scan enable automatic recognition and are considered biometric identifiers. Other less sensitive characteristics, including facial imaging, voice, and gait, are considered biometric identifiers if used for a specific identification purpose.

Collection and Disclosure.

Capture and disclosure of biometric identifiers for commercial purposes are confined to specific instances. Capture of an individuals’ biometric identifier is prohibited unless the individual:

is informed before the capture; or
gives consent.

If a person has legally obtained biometric identifiers of an individual for commercial purposes, they are prohibited from selling, leasing, or otherwise disclosing the biometric identifier, unless the individual:

consents to disclosure for identification purposes;
the disclosure completes a financial transaction that the individual requested/authorized;
disclosure is required or permitted by federal or state statute; or
disclosure is made by or to law enforcement for a law enforcement purpose in response to a warrant.

Storage.

Storage, transmission and protection from disclosure of biometric identifiers must be done in a manner that uses reasonable care (same as or more protective than industry standards).

Retention.

Biometric identifiers must be retained no longer than is legally necessary. Specific provisions are provided for contractual and employment relationships. In these instances, purposes for collecting the identifier expires upon termination of the relationship.

Consumer Protection Act.

The Consumer Protection Act applies. When the prevailing party of an action, brought by the attorney general under the Consumer Protection Act, is the attorney general, costs and reasonable attorneys’ fees may only be awarded to the attorney general and not the defendant.