Missouri businesses are increasingly adopting biometrics to streamline authentication, prevent fraud, and improve customer experience. In response, Missouri lawmakers are considering Senate Bill No. 1359, which proposes enacting the Missouri Biometric Information Liability Act. The act would limit liability for businesses using biometric identifiers so long as those businesses meet certain compliance standards for consumer notice, retention policies, and data security.
What counts as biometric data?
“Biometric identifiers” and “biometric information” include retina and iris scans, fingerprints, voiceprints, and hand and face geometry as well as any information based on an individual’s biometric identifier used to identify that individual. The proposed act excludes biometric data in certain health-care contexts, genetic materials, and diagnostic imaging that are already subject to other regulations, such as HIPAA.
How would the act create a safe harbor for businesses exercising good data protection practices?
The act would create a safe harbor to protect a private entity from being liable for damages for “unauthorized or negligent disclosure” of biometric identifiers if the private entity satisfies specific compliance conditions.
What 5 things must a Missouri business do to qualify for the safe harbor protection?
1) Post and maintain signs or notices that include this warning: “This entity obtains biometric identifiers or biometric information and complies with the collection and retention requirements under Missouri law. This entity shall not be liable for damages for the unauthorized or negligent disclosure of such identifiers or information. Information about this entity’s collection and retention schedule is made available to the public.
2) Inform both the public and the affected individual of the specific purpose for which the biometric data is being collected, captured, or obtained.
3) Develop a written, publicly available policy establishing a retention schedule and guidelines for permanent destruction of biometric identifiers and information when the initial purpose has been satisfied or within three years of the individual’s last interaction with the entity, whichever occurs first.
4) Comply with its written policy, except where a valid warrant or subpoena from a court of competent jurisdiction requires otherwise.
5) Store, transmit, and protect biometric identifiers and information in a manner equal to or more protective than how it safeguards other confidential and sensitive information (e.g., Social Security numbers, driver’s license numbers, account credentials, and similar data).
All five conditions must be met to activate the safe harbor. The act would apply only to private entities and would not apply to government entities or GLBA-covered financial instructions.
How would the act differ from Illinois’ Biometric Information Liability Act?
Illinois’ Biometric Information Privacy Act (740 ILCS 14) is consent-centric and plaintiff-enforced, with a private right of action, statutory damages, fee shifting, a ban on profiting from biometrics, and strict pre-collection written release requirements. Unlike Illinois’ act, Missouri’s proposed act would not create a new cause of action for consumers and would instead offer a damages safe harbor tied to signage, disclosure, policies for retention and destruction, and security—without requiring consent or prohibiting data sales.
Takeaways
Senate Bill No. 1359’s proposed Biometric Information Liability Act would reward businesses who have robust and transparent data protection practices by limiting liability for damages from data breaches. The proposed act signals an attempt by the Missouri legislature to afford liability protection to businesses whose use of biometrics is backed by transparent notices, disciplined retention, and good security hygiene. Businesses in the process of ramping up biometrics use should be sure to check their policies against the five conditions listed above—including verifying retention and destruction policies, ensuring security protocols for biometric data match or exceed protocols for other sensitive data, and reviewing vendor contracts to support policy compliance and timely deletion—to position themselves to qualify for any enacted liability safe harbor.
