Risk Management

Biometric legislation introduced in California

Judy Greenwald

February 23, 2022 Reprints

Cyber Risks Emerging Risks P/C Legislation & Regulation Technology More + Less -

A California legislator has introduced legislation comparable to the Illinois Biometric Information Privacy Act, where it has led to significant litigation.

As is the case with BIPA, the proposed California Biometric Information Privacy Act, which was introduced by State Senator Bob Wieckowski (D-Fremont) last week, provides for a private right of action, permitting Californians to file suit for the law’s violation.

S.B. 1189, which is sponsored by the San Francisco-based Electronic Frontier Foundation and co-sponsored by the San Diego-based Privacy Rights Clearinghouse advocacy groups, defines biometric data as a person’s physiological, biologic or behavioral characteristics.

These can include imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns and voice recordings as well as keystroke and gait patterns or rhythms, and sleep, health or exercise data that contain identifying information.

There are statutory damages of $100 to $1,000 per violation per day under the bill.

It would supplement the California Consumer Privacy Act of 2018, which gives consumers the right to withhold business’ permission to sell or share personal information.

Sen. Wieckowski said in a statement the bill “takes the onus off of consumers by requiring their informed consent to collect or disclose biometric data.”

Last week, a federal district court in Chicago refused to dismiss putative class action litigation filed against a company charged with downloading more than 3 billion facial images from the internet in violation of the Illinois BIPA.