California Proposes Stricter Data Privacy Regulations

A California State Senator is pushing a stronger biometric privacy law. The proposed California Biometric Information Privacy Act (BIPA) would supplant the existing California Consumer Privacy Act (CCPA), and create a legal environment similar to that of Illinois, which currently has some of the strictest privacy protections in the US thanks to its own BIPA law.

In that regard, the California BIPA law states that all private entities would need to obtain clear consent before collecting anyone’s biometric information, and bars those entities from using biometric data for their own profit. In plain terms, that means that California businesses would not be able to sell or trade biometric data to third parties, or use that data to deliver targeted ads or drive revenue in some other fashion.

The new law would also carve out a private right of action for regular civilians. That could ultimately prove to be the most impactful component of Senate Bill 1189, since it would allow people to file their own lawsuits against companies that violate the new privacy protections. The private right to action has already led to some massive class action settlements in Illinois, where TikTok and Facebook were forced to pay $92 million and $650 million, respectively, for collecting people’s biometric data without consent. In Texas, which has had fewer privacy lawsuits, the right of legal action is reserved for the Attorney General.

“Biometric technologies are becoming more prevalent in our society and it is important that we safeguard consumers from this encroachment into their privacy,” said Bob Wieckowski, the Democratic Senator who introduced the new bill. “SB 1189 would ensure biometric information is applied in a responsible manner that protects individuals’ privacy by expanding control over their personal information. It takes the onus off of consumers by requiring their informed consent to collect or disclose biometric data.”

The proposed California bill expands the definition of biometric data to cover a broader range of biometric identifiers, and includes behavioral and biological traits in addition to physiological characteristics like fingerprints. Any businesses that want to collect biometric data would need to publish a written policy that details its storage schedule and how it will delete biometric information when it becomes necessary to do so.

The CCPA was passed in 2018, and allows citizens to block the sale of their personal information. The Electronic Frontier Foundation and the Privacy Rights Clearinghouse are acting as sponsor and co-sponsor of SB 1189.

Source: Sierra Sun Times

–

February 21, 2022 – by Eric Weiss