.svg)
In a new policy statement, the US Federal Trade Commission (FTC) warns businesses against misusing biometric information and hints at heightened scrutiny of those that do not comply.
Last week, the FTC that businesses that make false or unsubstantiated claims about the accuracy of biometric information technologies or about the use of biometric information may violate the law.
鈥淚n recent years, biometric surveillance has grown more sophisticated and pervasive, posing new threats to privacy and civil rights,鈥 said Samuel Levine, director of the FTC鈥檚 Bureau of Consumer Protection.
鈥淭oday鈥檚 policy statement makes clear that companies must comply with the law regardless of the technology they are using.鈥
The lists further scenarios when businesses could be found to act in an "unfair" manner, in breach of the FTC Act, such as if they do not assess foreseeable harms to consumers before collecting biometric information or fail to address those risks quickly.
The agency also states that the 鈥渟urreptitious鈥 and 鈥渦nexpected鈥 collection or use of biometric information is prohibited under the law, as well as the failure to evaluate the practices of third parties.
This means that businesses should get contractual assurances that third parties take the necessary steps to minimise risks to consumers and even 鈥済o beyond contractual measures to oversee third parties鈥.
A broad scope
The policy statement introduces a broad definition of biometric information, which includes data that 鈥渄epict or describe physical, biological, or behavioural traits, characteristics, or measurements of or relating to an identified or identifiable person鈥檚 body鈥.
This is the most expansive definition of biometric information, which places both an image of an identifier, such as a photo, and its corresponding data template in the agency鈥檚 enforcement scope, Alfred Brunetti, a partner at McElroy, Deutsch, Mulvaney & Carpenter, said.
The FTC statement aligns itself with the definitions of data protection laws in California and Washington.
However, it is 鈥渁 clear departure鈥 from the more restrictive way biometric data is defined by other states that have comprehensive privacy laws, such as Virginia, Colorado and Utah.
These states expressly carve out generated data from their definitions, Brunetti added.
Although the policy statement says it 鈥渄oes not preempt federal, state, or local laws鈥, it adds that compliance with those laws 鈥渨ill not necessarily preclude Commission law enforcement鈥.
More scrutiny on the horizon
The statement warns that "unfair" and "deceptive" practices in biometric data handling may trigger FTC scrutiny, signalling that the agency may heat up its enforcement activity in the space.
In recent years, the FTC has brought enforcement actions against photo app maker and regarding their uses of facial recognition technology.
As these technologies have become much more accurate and a lot less expensive, leading to increasing use on the market, the FTC has become increasingly worried of significant consumer privacy and data security risks related to biometric information, as well as about potential bias and discrimination.
For example, using biometric information technologies to identify consumers in certain locations could reveal sensitive personal information about political or religious events they attended or the type of medical care they got.
Studies have also that facial recognition technology has higher rates of error for some populations, particularly for certain African and Asian people, as well as for the elderly and children.
In payments, it means that a false negative may result in the consumer being denied access to their own account, whereas a false positive may result in a thief gaining access to the account.
