Background:

Federal Privacy Laws.

Under both federal and state constitutional rights, an individual has a right to privacy, which includes an individual interest in avoiding disclosure of personal matters.

In the United States, an all-encompassing data privacy law does not exist. The Privacy Act of 1974 (Act) provides general protections for the collection, use, maintenance, and dissemination of personal identifiable information (PII) processed and held by the federal government. However, the Act does not apply to states, local governments, and the private sector, and does not provide specific protections for different types of data. Instead, individual sector-specific privacy laws are applied related to areas such as financial services, communications, and healthcare.

Similarly, biometrics are not currently protected by any specific federal law. Instead various general privacy laws apply both at the federal and state levels to PII, which include biometric data within the same sector specific laws. In more recent years, states have adopted biometric specific privacy laws.

Biometric specific state laws define biometrics, an area of PII, as specific biological, genetic and physical characteristics. These characteristics include, but are not limited to, finger prints, palm prints, hand geometry, iris scans, retina scans, eye vein scans, and voiceprint scans.

Washington does not have a biometric specific privacy law.

Consumer Protection Act.

The Consumer Protection Act (CPA) declares that unfair and deceptive practices in trade or commerce are illegal. The CPA allows a person injured by an unfair or deceptive practice to bring a private cause of action for damages. The Office of the Attorney General may investigate and prosecute claims under the CPA on behalf of the state or individuals in the state.

Summary of Engrossed Substitute Bill:

Commercial use of biometric identifiers is regulated.

Definitions.

"Biometric identifier" is defined in two ways. Both definitions refer to biological, behavioral, or both characteristics. Characteristics that uniquely identify an individual, such as fingerprint, DNA, hand geometry, palm print and iris scan enable automatic recognition and are considered biometric identifiers. Other less sensitive characteristics, including facial imaging, voice, and gait, are considered biometric identifiers if used for a specific automated identification purpose. Video surveillance and photographs are not considered biometric identifiers.

"Consent" means an authorization by an individual, given after the individual has received clear and conspicuous notice in writing of the purposes for which the biometric identifier may be disclosed. If an individual consents to disclosure of their biometric identifier to law enforcement without a warrant, consent must be made separate from any other consent provided. When consent is provided for commercial use of a biometric identifier that was initially captured for a noncommercial purpose, consent requires an individual to actively opt-in.

Capture and Collection.

Capture and disclosure of biometric identifiers for commercial purposes are confined to specific instances. Capture of an individuals' biometric identifier is prohibited unless the individual:

is informed before the capture; and
gives consent.

If a person legally possesses a biometric identifier of an individual for commercial purposes, they are prohibited from selling, leasing, or otherwise disclosing the biometric identifier, unless:

the individual consents to disclosure for identification purposes in the event of the individual's death or disappearance or otherwise consents to the disclosure to third parties;
the person discloses the biometric data to a service provider or other third party as necessary to effect, administer, enforce, or complete a financial transaction that the individual requested, initiated, or authorized;
disclosure is required or permitted by federal or state law; or
disclosure is made to law enforcement for a law enforcement purpose in response to a warrant.

A biometric identifier captured for a noncommercial purpose may not be used for a commercial purpose at a later date without an individual's consent.

Storage.

Storage, transmission and protection from disclosure of biometric identifiers must be done in a manner that uses reasonable care and is the same as or more protective than industry standards.

Retention.

Biometric identifiers must be retained no longer than is legally permissible by law or rule, as necessary to protect against or prevent fraud, criminal activity, claims, or liability. Specific provisions are provided for contractual and employment relationships. In a contractual relationship, the purpose for collecting the biometric identifier expires upon the latter of termination of a continuous contractual relationship, after the time period necessary to carry out the terms of the contract, or as long as is permitted or required by law. In an employment relationship, the purpose for collecting the biometric identifier expires upon termination of the relationship.

Consumer Protection Act.

A violation of the requirements is considered an unfair or deceptive act in trade or commerce and an unfair method of competition for the purposes of applying the CPA.

Staff Summary of Public Testimony:

(In support) The specific concept of legislating in this area is to provide rules for deployment of newer technology. The idea is to determine what are the proper deployment standards for biometric identifiers and to give consumers some control over their personal identifiable information. This gives the consumer control over what relationships they join and how that information is disseminated. Anyone should be able to use this technology if there is a willing relationship. The purpose of the bill is to try to stop surreptitious collection of biometric information. The bill is establishing the propriety of the relationship and gives both parties, the owner deploying technology and consumer, certain rights in how the information is sold to someone else. There is some concern from law enforcement, but the bill is not affecting the normal practice of using video tape surveillance and providing those tapes, such as in a shoplifting case.

(With concerns) If a commercial entity wants to provide information such as video, palm prints, or iris scan without having to get a warrant, then they should be able to.

(Opposed) None.