.svg)
In a new policy statement, the US Federal Trade Commission (FTC) warns businesses against misusing biometric information and hints at heightened scrutiny of those that do not comply.
Last week, the FTC said that businesses that make false or unsubstantiated claims about the accuracy of biometric information technologies or about the use of biometric information may violate the law.
“In recent years, biometric surveillance has grown more sophisticated and pervasive, posing new threats to privacy and civil rights,” said Samuel Levine, director of the FTC’s Bureau of Consumer Protection.
“Today’s policy statement makes clear that companies must comply with the law regardless of the technology they are using.”
The statement lists further scenarios when businesses could be found to act in an "unfair" manner, in breach of the FTC Act, such as if they do not assess foreseeable harms to consumers before collecting biometric information or fail to address those risks quickly.
The agency also states that the “surreptitious” and “unexpected” collection or use of biometric information is prohibited under the law, as well as the failure to evaluate the practices of third parties.
This means that businesses should get contractual assurances that third parties take the necessary steps to minimise risks to consumers and even “go beyond contractual measures to oversee third parties”.
A broad scope
The policy statement introduces a broad definition of biometric information, which includes data that “depict or describe physical, biological, or behavioural traits, characteristics, or measurements of or relating to an identified or identifiable person’s body”.
This is the most expansive definition of biometric information, which places both an image of an identifier, such as a photo, and its corresponding data template in the agency’s enforcement scope, Alfred Brunetti, a partner at McElroy, Deutsch, Mulvaney & Carpenter, said.
The FTC statement aligns itself with the definitions of data protection laws in California and Washington.
However, it is “a clear departure” from the more restrictive way biometric data is defined by other states that have comprehensive privacy laws, such as Virginia, Colorado and Utah.
These states expressly carve out generated data from their definitions, Brunetti added.
Although the policy statement says it “does not preempt federal, state, or local laws”, it adds that compliance with those laws “will not necessarily preclude Commission law enforcement”.
More scrutiny on the horizon
The statement warns that "unfair" and "deceptive" practices in biometric data handling may trigger FTC scrutiny, signalling that the agency may heat up its enforcement activity in the space.
In recent years, the FTC has brought enforcement actions against photo app maker Everalbum and Facebook regarding their uses of facial recognition technology.
As these technologies have become much more accurate and a lot less expensive, leading to increasing use on the market, the FTC has become increasingly worried of significant consumer privacy and data security risks related to biometric information, as well as about potential bias and discrimination.
For example, using biometric information technologies to identify consumers in certain locations could reveal sensitive personal information about political or religious events they attended or the type of medical care they got.
Studies have also shown that facial recognition technology has higher rates of error for some populations, particularly for certain African and Asian people, as well as for the elderly and children.
In payments, it means that a false negative may result in the consumer being denied access to their own account, whereas a false positive may result in a thief gaining access to the account.
