On May 16, 2017, Governor Jay Inslee signed into law H.B. 1493—Washington’s first statute governing how individuals and non-government entities collect, use, and retain “biometric identifiers,” as defined in the statute.  The law prohibits any “person” from “enroll[ing] a biometric identifier in a database for a commercial purpose, without first providing notice, obtaining consent, or providing a mechanism to prevent the subsequent use of a biometric identifier for a commercial purpose.”  It also places restrictions on the sale, lease, and other disclosure of enrolled biometric identifiers.  With the new law, Washington has become only the third state after Illinois and Texas to enact legislation that regulates business activities related to biometric information.  Although the three laws seek to provide similar consumer protections around the collection, use, and retention of biometric data, the Washington law defines the content and activity it regulates in different terms, and, similar to Texas, but unlike Illinois, the Washington law does not provide a private right of action.

The Washington statute, as compared to existing biometrics laws, is notable for its definition of “biometric identifier.” In the law, a “biometric identifier” is “data generated by automatic measurements of an individual’s biological characteristics,” including “fingerprints, voiceprints, eye retinas, irises, or other unique biological patterns or characteristics that is used to identify a specific individual.”  Washington’s definition of “biometric identifier” may be broader than that in the Texas statute, but Washington’s definition does not specifically provide for a “scan of hand or face geometry,” as is the case in the Illinois statute.  Washington’s definition of “biometric identifiers” specifically excludes “physical or digital photograph, video or audio recording or data generated therefrom” (in addition to certain health-related data), suggesting the statute will have limited application in the context of facial recognition technology.

Washington’s regulation of “enrolling” also appears to make the law unique.  The other two state laws do not appear to regulate the multi-step process of “enrolling,” which is defined as an activity “to capture a biometric identifier of an individual, convert it into a reference template that cannot be reconstructed into the original output image, and store it in a database that matches the biometric identifier to a specific individual.”  Illinois and Texas place requirements on the single activity of collecting or capturing biometric identifiers.

Washington’s biometric law is furthermore notable for its provisions on “notice” and the enumerated exceptions it provides to its prohibition on selling, leasing, or “otherwise disclos[ing]” enrolled data “to another person for commercial purposes.” Indeed, the law provides that “[t]he exact notice and type of consent required to achieve compliance . . . is context-dependent” and only requires that notice be “given through a procedure reasonably designed to be readily available to affected individuals.”  Moreover, “[n]otice . . . is not affirmative consent.”  Compared to the analogous provisions from the other states, Washington appears to have a more defined standard than Texas, but less than Illinois, which mandates a “written policy” and the receipt of written authorization.  As for regulation of the sale, lease, and disclosure of collected data, the Washington law has the longest enumerated list of exceptions to the prohibition on such activity.  The three statutes all impose additional standards on the retention and disposal of biometric identifiers.

Significantly, the Washington statute only allows for enforcement by the attorney general under the state’s consumer protection act.  Because the Texas law also only provides for enforcement by the attorney general, Illinois remains the only state with a biometric statute that includes a private right of action.

Washington is only the third state to enact a biometric law, but legislatures in other states around the country are considering similar bills, as they try to address innovations in a rapidly growing space.  As of this posting, those legislatures include Alaska, California, Massachusetts, and New Hampshire.  In Washington, there is additional activity around the collection and use of biometric identifiers.  On the same day that Governor Inslee signed H.B. 1493, he also signed H.B. 1717, which covers government agencies.  Both laws go into effect on July 23, 2017.

Rebecca Yergin authored this post.