Bill Description: House Bill 744 would regulate the commercial capture and use of biometric identity information, prevent most commercial uses even with consent, and give government broad authority for the use of such information.
Rating: -3
Does it give government any new, additional, or expanded power to prohibit, restrict, or regulate activities in the free market? Conversely, does it eliminate or reduce government intervention in the market?
House Bill 744 would create Chapter 21, Title 48, Idaho Code, to regulate the commercial capture and use of biometric identity information. Notably, this chapter does not protect individual privacy from government capture or use of such information, as it only applies to commercial activities.
The bill says, “A person may not capture a biometric identifier of an individual for a commercial purpose unless the person informs the individual before capturing the biometric identifier; and receives the individual’s consent to capture the biometric identifier.”
Requiring simple disclosure and consent is reasonable, but the bill goes on to say that “persons or entities possessing a biometric identifier of an individual that is captured for a commercial purpose may not sell, lease, or otherwise disclose the biometric identifier to another person unless the individual consents to the disclosure for identification purposes in the event of the individual’s disappearance or death; the disclosure completes a financial transaction that the individual requested or authorized; the disclosure is required or permitted by state or federal law; or the disclosure is made by or to a law enforcement agency for a law enforcement purpose in response to a warrant.”
This language is concerning for several reasons including giving broad latitude to government to use biometric identity information both “for a law enforcement purpose” and for essentially any purpose “required or permitted by state or federal law.”
Additionally troubling is that immediately after requiring disclosure and consent for the commercial capture and use of biometric identity information, the law goes on to limit almost all commercial use — other than “for identification purposes in the event of the individual’s disappearance or death” or to complete a financial transaction — even if the individual provides full consent for some other commercial use.
There are many possible uses for biometric identifiers including content personalization and accessing devices or facilities that do not fall with these narrow parameters.
The bill would impose additional regulations requiring enhanced security for the stored information, and mandatory destruction of it after a certain period.
(-1)
Does it directly or indirectly create or increase penalties for victimless crimes or non-restorative penalties for non-violent crimes? Conversely, does it eliminate or decrease penalties for victimless crimes or non-restorative penalties for non-violent crimes?
The bill would impose a civil penalty of up to $25,000 per violation, and allow the Attorney General to bring an action to recover civil penalties pursuant to this law. This penalty would not be limited to cases where there was a victim whose biometric identity information was misused, nor would the fine be remitted to the victim if one existed.
(-1)
Does it violate the spirit or the letter of either the United States Constitution or the Idaho Constitution? Examples include restrictions on speech, public assembly, the press, privacy, private property, or firearms. Conversely, does it restore or uphold the protections guaranteed in the US Constitution or the Idaho Constitution?
The bill says, “A person may not capture a biometric identifier of an individual for a commercial purpose unless the person informs the individual before capturing the biometric identifier; and receives the individual’s consent to capture the biometric identifier.” Requiring disclosure and consent is consistent with protecting individual privacy and property rights.
(+1)
Beyond the fact that the bill would apply only to commercial uses, and not government uses, the bill contains a number of concerning exceptions explicitly allowing government uses beyond the scope of the consent obtained from the person providing their biometric identity information.
The bill would allow the use and disclosure of biometric identity information “for a law enforcement purpose” and for essentially any purpose “required or permitted by state or federal law.”
The bill would also allow the use of biometric identity information for “the development or deployment of an artificial intelligence model or system for the purposes of preventing, detecting, protecting against, or responding to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any other illegal activity; preserving the integrity or security of a system; or investigating, reporting, or prosecuting a person responsible for a security incident, identity theft, fraud, harassment, a malicious or deceptive activity, or any other illegal activity.”
In other words, this law would prohibit a wide range of commercial uses for biometric identity information (such as advertising) even with full consent, while effectively allowing governments and developers of security and surveillance systems (whose largest clients tend to be governments) to use this data to pursue their goals.
(-1)
Does it violate the principles of federalism by increasing federal authority, yielding to federal blandishments, or incorporating changeable federal laws into Idaho statutes or rules? Examples include citing federal code without noting as it is written on a certain date, using state resources to enforce federal law, and refusing to support and uphold the tenth amendment. Conversely, does it restore or uphold the principles of federalism?
As noted above, the law would allow the use and disclosure of biometric identity information for essentially any purpose “required or permitted by state or federal law.”
The bill also outsources its definitions of “financial institution” and “affiliate of a financial institution” to the federal definitions found in “15 U.S.C.35 6809.”
Broadly referencing or requiring compliance with federal law, and incorporating federal laws and definitions by reference, subordinates state law to changeable federal statutes, which means that the federal government can effectively change state law without the Legislature’s knowledge or consent.
(-1)
