Washington Becomes the Third State With a Biometric Privacy Law: Five Key Differences

• Jurisdiction: United States,Federal
• Publication year: 2018
• Citation: Vol. 1 No. 1

Michelle J. Anderson and Jim Halpert^*

The new Washington law regulating biometric information reflects a nuanced view of biometric data. The authors of this article discuss the new law and how it differs from Illinois and Texas first-generation biometric information laws.

The State of Washington has become the third state (after Illinois and Texas) to enact a law regulating biometric information (HB 1493).¹ The new law, enacted in mid-May, went into effect on July 23, 2017.

Although the Washington law has consumer protection goals similar to those that motivated the Illinois Biometric Information Privacy Act ("BIPA")² and the Texas biometric law,³ HB 1493 is more narrowly tailored. The new Washington law reflects a more nuanced view of biometric data: that it can be inadvertently collected in situations that should not require consent, that it can be used for some beneficial purposes (e.g., fraud prevention) that do not require consent and that "biometric data" should be defined with precision to avoid covering information that is not broadly understood to be biometric.

The law differs from the Illinois and Texas first-generation laws in five important ways:

1. HB 1493 focuses on "enrollment" of biometric identifiers,

2. The definition of biometric identifier does not include photographs, video or audio recordings or face geometry,

3. The notice and consent requirements are more flexible,

4. HB 1493 includes a number of important exceptions to the notice and consent requirement, and

5. There is no private right of action.

[Page 41]

HB 1493 FOCUSES ON "ENROLLMENT" OF BIOMETRIC IDENTIFIERS

The scope of Washington's new law differs principally from both BIPA and the Texas biometric law by limiting "enrolling" biometric identifiers in a database for commercial purposes and further sale or disclosure of those enrolled identifiers—instead of broadly requiring affirmative consent for virtually any collection, use or disclosure of biometric data. Under the Washington law, biometric identifiers may be collected without consent but may not be "convert[ed] it into a reference template that cannot be reconstructed into the original output image, and store[d] in a database that matches the biometric identifier to a specific individual" unless consent has been obtained.

In order lawfully to enroll a biometric identifier in a database for a commercial purpose, a person must:

1. provide notice;

2. obtain consent; or

3. provide a mechanism to prevent subsequent use

...