Bill Seeks to Protect Consumers' Biometric Information

Companies would be prohibited from using customers' fingerprints, DNA and other biometric information for purposes beyond what a customer could reasonably expect under a bill before a New Hampshire Senate committee.

Mnet 211064 Biometric Dna

CONCORD, N.H. (AP) — Companies would be prohibited from using customers' fingerprints, DNA and other biometric information for purposes beyond what a customer could reasonably expect under a bill before a New Hampshire Senate committee.

The bill, which passed the House in March, would allow customers to file complaints under New Hampshire's Consumer Protection Act. It defines biometric information as "an individual's physiological, biological, or behavioral characteristics," including images of the iris, retina, face and fingerprints; voice recordings; and sleep, health or exercise data that contains identifying information.

Rep. David Luneau, the bill's sponsor, said Tuesday that protecting such information is particularly important because, unlike other identifying information, such as a driver's license number, people can't separate themselves from biometric data.

"You can't unlink that," Luneau, D-Hopkinton, told the Senate Commerce Committee.

Luneau gave an example of popular at-home DNA test kits, saying consumers who buy them have a reasonable expectation that the information will be used to provide them with their own genetic profile.

"I'm not expecting they're going to sell my genetic code that is connected with my identity, David Luneau, off to the highest bidder or even the lowest bidder to be used for whatever purposes are possible," he said. "That's not what I'm reasonably expecting."

The bill faced opposition from the New Hampshire Business and Industry Association, a group representing internet companies and others. They argued that the definition of biometric information was too broad and that the standard for compliance was too subjective.

Andrew Kingman, counsel to the State Privacy & Security Coalition, described a scenario in which someone shopping at a mall goes into two adjacent stores, one selling electronics and the other clothing. The stores could have identical security cameras to record customers, but the shopper could have different expectations for each store.

"It's impossible for a business to build a compliance program around that," he said.

Former Rep. Neal Kurk, a Republican who represented Weare, previously sponsored a bill that created a committee to study such issues. He addressed the Senate committee as a private citizen and was the only person other than Luneau to speak in support of the bill.

"If your biometric information is compromised, there is no going back. You can't get a new face as a realistic matter. You can't change your DNA," he said. "You're locked into whatever it is that others are doing with that information."

More in Cybersecurity