Technology companies say it won’t be long before people can use scans of their fingerprints — or even their faces — to start their cars, access their bank accounts or buy lunch at a school cafeteria.
But before that future becomes reality, lawmakers in Washington want to set some ground rules for how companies and government agencies can use people’s biometric data, a broad term that encompasses everything from a person’s voice pattern to the way they walk.
After several years of negotiation with retailers and the state’s tech industry, several lawmakers said they think 2017 could finally be the year the Legislature approves new limits on how companies and governments can collect and sell people’s biometric identifiers.
Two proposals in Olympia this year aim to prevent people’s characteristics — such as retinal scans, handprints, fingerprints, voice imprints and facial geometry — from being cataloged and used without their knowledge.
The legislation comes after companies have unveiled new ways of accessing a phone with a fingerprint, identifying people in social media photos via facial recognition software and unlocking doors with a scan of a person’s iris or retina.
Should lawmakers approve new restrictions on the commercial use of biometric data, Washington would be the third state to do so, following Texas and Illinois.
“If I steal your password, you can do another password,” said state Rep. Jeff Morris, D-Mount Vernon, one of the lawmakers tackling the issue.
“If I steal your biometrics, you’re not going to go get a facelift. You’re not going to go break your legs so you walk differently. You’re not going to change your DNA out.
“Because it’s irreplaceable, you always want to maintain some sort of joint ownership of it, so the consumer always controls where that goes,” he said.
Concerns about commercial and government use
A bill Morris is sponsoring would set new rules for companies before they can enter people’s specific biometric information into a database for commercial purposes. To do that, companies would either have to notify a person, obtain his or her consent, or provide a way to limit future commercial use of the data.
House Bill 1493 would also limit how companies can share and sell people’s biometric information after it is collected.
State Rep. Mark Harmsworth, a co-sponsor of the measure, said he thinks it is important to get ahead of the issue before more companies start using fingerprints, hand scans and facial recognition to confirm someone’s identity or authenticate a purchase.
“You can issue a new credit card — you can’t issue a new thumbprint,” said Harmsworth, R-Mill Creek.
Another bill in the Legislature would restrict the collection of biometric data by public agencies. House Bill 1717 would require government officials to notify people and obtain their consent before collecting their biometric information, while also prohibiting agencies from selling that data.
State Rep. Norma Smith, the prime sponsor of the measure, said she wants to make sure people know when their biometric data is being collected and why.
“I believe you should own the image of your face — not someone else,” said Smith, R-Clinton. “That is very personal, private, intimate and unique to you and you alone, and we need to respect that both in the public and private sectors.”
Smith’s bill would also require agencies to limit the amount of biometric data they collect, while ensuring they store it securely.
“The good news that we’ve heard back from agencies is that, in general, their current guidelines align with this,” Smith said.
Right now, few government agencies appear to be collecting biometric data, outside of law enforcement agencies that use fingerprinting, Smith said.
One exception is the state Department of Licensing. The agency creates a biometric profile of the face of each person who gets a driver’s license photo, to prevent people from applying for multiple driver’s licenses, said department spokesman Brad Benfield.
Benfield said the agency already has strict rules about protecting the biometric templates it creates of people’s faces, but would have to adopt new procedures for notifying drivers about the practice if Smith’s bill passes.
Police and law enforcement agencies would be exempted from some parts of Smith’s bill, such as the requirement to get people’s consent before collecting biometric data such as fingerprints. Law enforcement agencies still would have to prevent people’s biometric information from being publicly disclosed.
Capt. Monica Alexander, legislative liaison for the Washington State Patrol, said she doesn’t think the agency would have to change any of its procedures to comply with the bill.
While the State Patrol collects electronic scans of people’s handprints and fingerprints when they are arrested, that data is already protected on a state server equipped with firewalls, she said.
She said state troopers aren’t yet using the more advanced technology mentioned in Morris’ and Smith’s bills, such as facial recognition software or retinal scanners.
“That sounds pretty great and I’ve seen it on television, but we’re not quite there yet,” Alexander said.
Industry groups wary, but open
Both of the proposals dealing with biometric data have cleared the House Technology and Economic Development Committee, which Morris chairs. They now await a vote by the full House.
Previous attempts to regulate the commercial use of biometric data stalled in the state Senate the past two years. But state Sen. Mike Padden, R-Spokane Valley and the chairman of the Senate Law and Justice Committee, said he thinks the legislation could pass this year due to the work House members have done to address some of the concerns of technology companies and retailers.
While the Association of Washington Business, the Washington Retail Association and the Washington Technology Industry Association all testified against the legislation when it came before Morris’ committee earlier this year, the head of the technology industry group said he thinks the bill has “evolved substantially” since then, leaving only a few technical issues remaining.
“We are still confident we can resolve those elements and see a new law this session,” said Michael Schutzler, CEO of the Washington Technology Industry Association.
In an interview, Schutzler said he is pleased the bill was amended to allow companies to work with biometric data that is anonymized, or not connected to the profile of any individual person. He said engineers can use that anonymous information to improve their algorithms — such as to make a more accurate and secure thumbprint reader — without compromising people’s personal information.
Schutzler said he thinks a deal on biometrics rules is more likely this year, in part because more lawmakers are seeing the technology in action and can grasp how it works.
Unlike four years ago, “It doesn’t require a detailed technical expert to know what it means,” Schutzler said.
“It’s becoming more commonplace, so it’s easier to understand and debate, frankly.”