What is the Biometric Information Protection Act?
The Biometric Information Protection Act (BIPA) is a common sense, well-crafted, and time-tested measure to protect biometric privacy. Georgia has no protections in place for the collection and use of Georgians’ biometric info, the unique physical traits that make each of us unique – fingerprints, retinas, and facial structures, to name a few. Such a law would ensure that individuals are in control of their own biometric data and how it is used.
Five common-sense pillars of BIPA help explain its need and why biometric information is too sensitive to go unprotected. If passed, the law would do the following:
- Prohibit the collection and use of biometric data without your written permission.
- Because of the highly sensitive nature of biometric information, it would ban biometric data from being sold. Your DNA is unlike any other commodity.
- Long-term storage of biometric data increases the potential for hacking or accidental release, so businesses must delete the info one year after your last interaction with them or upon request.
- Under the bill, people have the right to find out which companies have their biometric data and what specific data they have.
- The provisions of the law are enforceable through a “private right of action.” Learn more about this right below.
BIPA is the leading law in the ever-shifting field of biometric privacy, originally crafted in Illinois in 2008. Washington and Texas have their own state biometric privacy laws, but Illinois’ BIPA is the only law that is enforceable through a private right of action, meaning a private person's ability to legally enforce their rights upon other people or even organizations, such as tech companies. This right of action can result in monetary awards for victims.
During the 2023 legislative season, 15 biometric privacy law proposals have emerged across 11 states including Arizona, Hawaii, Maryland, Massachusetts, Minnesota, Mississippi, Missouri, New York, Tennessee, Vermont, and Washington. The ACLU of Georgia is supporting the introduction and passage of a BIPA model bill during the 2022–2023 legislative sessions.
How BIPA Protects Your Private Information
BIPA has proven essential for protecting people’s privacy in Illinois, with some positive spillover effects in other states, for roughly 15 years now.
One recent victory: Due to a May 2022 legal settlement, Clearview AI — a secretive face surveillance company claiming to have captured more than 10 billion faceprints from peoples’ online photos worldwide — agreed to a set of restrictions in alignment with BIPA. The settlement barred Clearview AI from selling its faceprint database to most businesses and other private entities not just in Illinois, but across the United States. The lawsuit was filed on behalf of groups representing survivors of domestic violence and sexual assault, undocumented immigrants, current and former sex workers, and other vulnerable communities uniquely harmed by unconstitutional surveillance.
This lawsuit and settlement are emblematic of the battles being fought in courtrooms and statehouses about who is going to control biometrics — Big Tech or the people being tracked by them. The court case was a major victory for consumers, whose data was being unknowingly collected and shared.
For most businesses, like local mom-and-pop stores that don’t collect biometric data and don’t use it for targeted sales promotions, the rules of BIPA will actually allow them to compete a bit more evenly with larger companies, which have financial resources to use biometric collection to go after small businesses’ customers. BIPA is not ideal for the bottom line of large tech businesses that rely on the permissionless collection of biometrics to identify and target Americans for profits.
Technological innovation has outpaced our privacy protections. As a result, our digital footprint can be tracked by the government and corporations in ways that were once unthinkable. Georgians should not have to choose between using new technologies and protecting their civil liberties.
“The fact that technology now allows an individual to carry such information in his hand does not make the information any less worthy of the protection for which the Founders fought.” —U.S. Supreme Court Chief Justice John Roberts in Riley v. California (2014)
Negatives of Unregulated Use Your Sensitive Data
While the passage of BIPA and court victory in Illinois have helped people beyond that state’s borders, Georgians should not have to rely on establishing a sufficient legal link to the midwestern state in order to protect the biometric privacy. By enacting BIPA, Georgians would be able to vigorously protect their biometric privacy.
Biometric information is particularly sensitive. Certain biometrics like DNA can reveal intimate details about a person’s life, such as the likelihood they will get certain genetically-influenced diseases including cancer. The unregulated sharing of such data could lead to higher insurance premiums. Second, biometrics are increasingly used for security purposes, such as using your fingerprint or face as a password. Unlike alpha-numeric passwords or social security numbers, which can be changed, if a biometric password is compromised, it is lost forever.
Certain biometric technologies have significantly higher failure rates when it comes to identifying faces of people of color, women’s faces, and young and old faces. This means that false-positive matches are more likely to happen within these populations. Those failures have real-world consequences. In November, Louisiana authorities’ use of facial recognition technology led to the wrongful arrest of a Black man from Georgia on a fugitive warrant. The man was jailed in DeKalb County for nearly one week before being released. Authorities erroneously linked him to purse thefts in Jefferson Parish and Baton Rouge.
The man’s arrest shows how easy it is for a person of color to wind up in jail as a result of faulty facial recognition technology. The technology has led to at least three wrongful arrests, and using facial recognition as the only justification to put suspects behind bars is a troubling trend. In most of the country, law enforcement can use facial recognition without restriction.
Enacting the ACLU of Georgia’s BIPA model bill would allow Georgians to have control over the use of their sensitive biometric data.
WHO SUPPORTS BIPA PRIVACY PROTECTIONS?
As is the case with many other privacy issues, concerns about the improper/permissionless collection and use of biometric information are not tied to one region or political party, with blue, purple, and red states and progressives, moderates, conservatives, and libertarians all showing interest in expanding BIPA to their states. The only group that regularly opposes BIPA bills are large tech companies.
CONTACT YOUR REPS AND TELL THEM TO PASS BIPA DURING THE LEGISLATIVE SESSION.