Draft Privacy Law Would Establish Federal Biometric Data Protections

Federal lawmakers are making progress on a national data protection law. A bipartisan group of legislators have put forward a 64-page draft version of a new privacy framework bill that would give US citizens much more control over the use of their personal and biometric information.

In that regard, the draft framework covers both biometric and non-biometric applications of personal data. For example, the bill would allow consumers to opt out of all targeted advertising, and limit the amount of information that companies are allowed to collect from people using their services. It also includes protections to prevent user data from being used in a discriminatory fashion.

The bill creates even stronger protections for biometric data. Under the terms of the new framework, companies would only be able to collect and share biometric data with the explicit, affirmative consent of the end user, or if they are responding to a warrant.

Of course, the bill is still in the draft stage, and there is no guarantee that it will ever become law, at least in its current iteration. Privacy advocates are pushing Congress to pass a bill before the midterm elections in November, but Senate Commerce Chairwoman Maria Cantwell could hold up the bill’s progress through the Committee phase. Cantwell is reportedly circulating her own version of a privacy bill.

On that front, privacy advocates applauded Congress’ initiative, though they were wary of certain elements of the bill itself. Most notably, the draft pre-empts state privacy legislation, and could therefore pull back privacy restrictions in states like California and Virginia, which have introduced stronger privacy laws. However, the bill does not pre-empt the Biometric Information Privacy Act in Illinois, nor does it supersede any state laws that provide protections for medical records, and for specific groups like students and employees. It also does not override any laws that address illicit data collection through hacking or some other means.

The Federal Trade Commission would be tasked with enforcing the new bill. Privacy advocates argued that a federal bill should be held to a higher standard than a state one, since a federal bill will affect more people and could halt momentum on alternative privacy laws.

Congress has tabled facial recognition legislation in the past, though those efforts have come to naught thus far. Activists believe that the momentum for a privacy law is growing in the wake of the controversy around the IRS and its proposed use of ID.me for online identification.

Source: CyberScoop

–

June 7, 2022 – by Eric Weiss