Fingerprints, Retinal Scans Raise Privacy Problems

When my twin sons entered George Mason University, the school had just implemented a new security system for its dining hall: Students had to submit to a retinal scan to gain entry.

At the time, it didn’t occur to me or their father—two law school graduates who’ve worked in the cutting edge world of legal journalism for more years than I’ll admit here—that there might be a privacy problem with the scanner idea.

State lawmakers in Illinois weren’t so sanguine. Recognizing that retinal scans, facial geometry mapping, and electronic fingerprint scans collect uniquely personal information that should be guarded against casual disclosure, they enacted a law that requires companies that use such data to tell people how and why they use, collect, store, and destroy it. People must consent in writing.

Litigation alleging violations of this law has exploded over the last six months. Employers that use biometric data for logging into work or accessing certain areas of their facilities are favorite targets.

The health-care industry has been caught up in the frenzy, with at least three lawsuits filed against hospital and health system employers. The stakes are high—negligent violations will cost a company $1,000 per incident, while deliberate violations carry a $5,000 per incident price tag.

One lawyer watching the trend, K&L Gates’ Molly K. McGinley, told me there haven’t been enough court decisions interpreting the law, known as the Illinois Biometric Information Privacy Act—BIPA, for short— to predict how the litigation will play out.

But the BIPA doesn’t prohibit the collection of biometric information; it just sets out parameters for its use. Companies that adopt policies that comply with the law should be able to avoid liability.

I took a look at this 21^st Century issue, and came away convinced the law is catching up to technology that allows entities of all types to capture biometric data, with or without their permission. Read my article here.

By the way—Mason no longer uses the biometric data scanning system at its dining halls.

Stay on top of new developments in health law and regulation, and learn more, by signing up for a free trial to Bloomberg Law.