Use of biometric data has become an integral part of everyday life: It unlocks your phone with face-ID or voice recognition; it verifies your identity at work or the gym with a fingerprint or palm scan; it allows access to secure buildings, areas, and files; and it expedites your clearance at airport security for both domestic and international flights. As the commercial uses of biometric data increase, so do concerns about consumer privacy, data security, potential for bias and discrimination, and a consumer’s control of this uniquely personal identifying information.
In response to these concerns, regulators and lawmakers have increasingly been focused on biometric data privacy and the complex web of inter-related issues that arise with the use of consumer biometric information. Several states and municipalities have adopted statutes or regulations specifically establishing requirements for the collection and use of biometric data, while other states have included biometric information in the “personal data” subject to the respective state’s omnibus privacy statute. At this juncture, there is no federal statute or regulation that directly addresses the commercial use of biometric data. However, the Federal Trade Commission (FTC) has emerged as the leading federal agency in this area, having issued a formal policy statement and undertaken enforcement actions confirming that it is committed to combating unfair or deceptive practices in connection with the collection and use of consumers’ biometric information and the marketing and use of biometric information technologies.
This overview discusses the FTC’s policy statement and past enforcement actions relating to collection and use of biometric data, identifies other federal agencies that have issued regulations relating to use of biometrics and certain state laws applicable to biometric information, and provides action items for compliance efforts and best practices that will assist businesses attempting to align with the FTC’s proscriptions. A subsequent overview will cover in greater detail the various state statutes and regulations applicable to the collection and use of biometric data from residents of the subject state.