Ronnie M. Farr
Technology using biometric identification methods has existed for centuries, but only more recently have it forced its way into political and legal arenas. As companies push to implement biometric technology into their everyday business practices more and more, lawmakers are challenged to strike the careful balance between protecting consumer and employer privacy on one hand, while encouraging efficient technological development on the other. Historically, lawmakers have erred on the side of consumer protection by placing tight restrictions on companies gathering biometric data. However, this blog post will argue that this is likely to change in the near future—the COVID-19 pandemic left consumers much more willing to concede personal data, including biometric identifiers, in exchange for safer, touchless payment methods and convenience. This makes biometric technologies—especially ones that allow for touchless transactions like Amazon’s newest initiative Amazon One—far more appealing to consumers than before the pandemic. The fact that this area is largely unlegislated both at the federal and state levels makes it ripe for development and, particularly, development that is more lenient in encouraging companies to implement touchless biometric technology.
What Is Biometric Technology?
Biometric identifiers are physical or behavioral characteristics unique to a person, including fingerprints, hand geometry, iris scans, facial recognition, voice inflection, walking gait, keystroke dynamics while typing, and more.[1] Immutable physical characteristics, like fingerprints and retinal scans, are the most common forms of biometric identifiers because they are not only unique to the individual, but unlikely to change with regular aging.[2] The primary advantage of using a biometric identifier for consumers is that another person cannot recreate it the same way they could guess or hack a traditional alphanumeric password.[3] Additionally, using a biometric identifier as a password removes the human weakness element, insofar as people tend to use simple passwords and repeat the same passwords for multiple accounts in both their personal and professional lives.[4] These advantages make biometric identification technology especially popular among banks, government agencies, investigative services, and marketing companies—all of which have special interests in securing private information.[5]
Amazon’s Biometric Technology: What Is Amazon One?
Like many companies seeking a competitive edge, Amazon is no stranger to implementing biometric technology into its products. Amazon is currently in the process of integrating biometric voice recognition technology into its Alexa product, which would allow customers to make Amazon purchases with voice authorization alone.[6] Additionally, Amazon is planning biometric updates to its smart Ring Doorbell product, which would allow the Ring Doorbell to not only record, but also create a database of people in the neighborhood based on voice recognition, walking gait patterns, and other factors.[7] Amazon also has its own facial-recognition video analysis product, called Rekognition, available for sale to the general public. Consumers can use it to moderate content to detect unwanted or unsafe images or videos, detect specific text or logos, compare images of faces, and more.[8]
Amazon’s latest biometric effort is Amazon One, a product that allows consumers to link their palmprints with their credit cards. Unlike a fingerprint reader, however, this technology does not require consumers to actually press their hands to a scanner. Rather, consumers merely wave their hands in front of a spatially aware scanner that identifies the hand’s geometry and retrieves the linked credit card.[9] Unlike other more common biometric technology, like Apple’s FaceID or TouchID, Amazon One stores the biometric information in a cloud database, rather than locally on a device.[10] When Amazon first put this product into the public in September of 2020, the comopany envisioned Amazon One would increase expedience in areas that needed to authenticate people’s identities quickly.[11] Amazon first introduced this product in its own public Amazon Go stores in Seattle and expanded it to allow consumers to use the palm identification to authorize their transactions.[12] As of early 2022, Amazon One has expanded further into public usage, with ninety-one public locations using the technology throughout the United States, including Whole Foods Markets, Climate Pledge Arenas, and other event venues, with more likely to come.[13] Amazon intentionally chose palm recognition as the biometric method as a security mechanism because a person cannot determine an identity just by looking at the palm, and the Amazon One palm detector requires the customer to use an intentional hand-waving motion, rather than using a static scan with no motion.[14]
The Current State of Biometric Privacy Legislation
Congress has not passed any federal legislation regulating how companies can collect and use biometric data from consumers.[15] Prior to biometric-identification technology becoming mainstream, Congress passed various pieces of consumer privacy legislation to protect potential users. For example, the Gramm-Leach Bliley Act is a federal statute, created in response to data breaches and bank mergers, that safeguards consumer data. While this is somewhat relevant, it only applies to data that financial institutions collect, not retailers like Amazon, and the Act does not contain any biometric-specific language.[16] Likewise, Congress also passed the Federal Trade Commission Act, which declares any “deceptive acts or practices in or affecting commerce” to be “unlawful” and enables the Federal Trade Commission to prevent people and entities from engaging in these “deceptive” acts.[17] The definition of what could count as a “deceptive act” is broad enough to apply to private companies collecting and selling consumers’ biometric data in certain situations, yet it still makes no explicit reference to biometric data.[18] Lawmakers are aware of this legislative hole: On August 13, 2021, Senators Amy Klobuchar, Bill Cassidy, and Jon Ossoff raised specific concerns over Amazon One’s biometric identification features.[19]
The biometric privacy legal landscape is almost as sparse at the state level. Currently, only four states have legislation specifically aimed at regulating biometric identification.[20] Other states merely have general consumer privacy protection laws that make no mention of biometrics.[21] Despite the fact that plaintiffs seem to have limited statutory options under which to bring suit, most litigation has been plaintiff-permissive by allowing citizens to have a private right of action, meaning an individual can bring a biometric privacy suit on their own.[22] This makes the legal system more accessible to plaintiffs because private citizens need not wait for a state attorney general to initiate proceedings.[23] Currently, Illinois remains the only state with a full private right of action for citizens, and California allows a limited private right of action.[24]
COVID-19 and the Legal Landscape
In 2019, the outbreak of COVID-19, an infectious and highly transmissible disease resulting in respiratory illness, changed the legal landscape for biometric identification technology.[25] Because COVID-19 spreads through infectious respiratory fluids or aerosol particles, people can best minimize transmission by maintaining distance from others, wearing a mask, and washing hands frequently, especially after touching surfaces that may be soiled with exhaled respiratory fluids and mucous membranes.[26] Evolving evidence supports the notion that reducing how often people touch surfaces—especially frequently touched surfaces—is the most effective way to reduce transmission. In one study, researchers found that infectious particles remained on plastic and stainless-steel surfaces, like automated teller machines (ATMs), for up to seventy-two hours after initial contact.[27] Thus, moving away from commonly touched items like ATMs, plastic credit cards, or metal-based fingerprint readers at stores, banks, and more, and moving towards touchless transaction methods could be a viable way to prevent the further spread of disease.
Lawmakers Should Create Biometric Identification Legislation that Accommodates Touch-Free Technology
Biometric technology continues to grow in popularity with consumers and companies alike recognizing serious security and health benefits, and yet, many state legislatures still do not have any legislation specifically aimed at regulating how companies can collect and use consumer data.[28] This is a critical moment for new legislation, because not only are lawmakers aware this gap exists and are seeking to fill it, but also how strictly they choose to regulate biometric technology may alter the course of biometric development for years to come.[29] Lawmakers would be remiss not to consider a consumer desire for touch-free payment options that use biometric security measures to avoid COVID-19 transmissions in their discussions.[30] Mounting evidence suggests that touching common surfaces contributes massively to the spread of COVID-19, making many transactions—like cash exchanges or thumbprint ID verification—a potential vector of spread. Even though the United States introduced several vaccines, COVID-19 remains prevalent in everyday life for many, with new variants coming to the forefront unpredictably.[31] Even before COVID-19, many states began to shift towards implementing biometric technology; in the United States, COVID-19 rapidly increased the pace at which consumers and business sought out biometric solutions.
Regardless of whether consumers and business find that the advantages of introducing biometric technology into everyday life outweigh the benefits or not, Amazon has already integrated many biometric systems into their products, and many companies are likely to follow suit. With advancements in biometric technology coming, whether the public is fully ready to embrace these advancements or not, it is critical that lawmakers keep abreast of this issue. Proper regulation from state and federal lawmakers, as well as decisions by the courts, will help consumers and businesses enjoy the benefits biometric technology brings while reducing the risks by minimizing the chances of the data being stolen or misused.
The COVID-19 pandemic illustrated the benefits of touchless transactions and, through its course, has ingrained in the public the preference for touchless options. With companies rising to answer consumers’ calls, lawmakers should be prepared to take COVID-19 into special consideration as they deliberate touchless technology legislation. While lawmakers should continue to prioritize the need for consumer privacy protections, they should also consider how restrictions on companies’ and agencies’ ability to gather and store biometric data may hinder the biometric field. This is especially critical when biometric technology could be a foundational answer, or at least a step in the right direction, towards advancement.
[1] Alan S. Wernick, Biometric Information – Permanent Personally Identifiable Information Risk, ABA (Feb. 14, 2019), https://businesslawtoday.org/2019/01/biometric-information-permanent-personally-identifiable-information-risk/ [https://perma.cc/CC85-U3HZ] (listing common forms of biometric identifiers); Peter Martis, Face the Future: How Biometrics is Already Reshaping the Way We Do Everything, BiometricUpdate (Apr. 29, 2021), https://www.biometricupdate.com/202104/face-the-future-how-biometrics-is-already-reshaping-the-way-we-do-everything [https://perma.cc/WL8G-88CE] (stating fingerprints and facial geometry most common forms of biometric identifiers); Rawlson King, What Are Biometrics?, BiometricUpdate (Jan. 24, 2016), https://www.biometricupdate.com/201601/what-are-biometrics-2, [https://perma.cc/QX3M-26EP] (discussing behavior biometric identifiers).
[2] See Wernick supra note 1 (noting some biometric features more immutable than others).
[3] See Louis Columbus, Why Biometrics Are Your Best Password, Forbes (Mar. 8, 2020), https://www.forbes.com/sites/louiscolumbus/2020/03/08/why-your-biometrics-are-your-best-password/?sh=32bd7d556c01 [https://perma.cc/8RDT-DW46] (explaining security advantages of biometric passwords).
[4] See id. (stating 81% of data breaches involve weak, stolen, or default credentials).
[5] See Martis, supra note 1 (stating banks implementing biometric security measures for customers); Ariel N. Redfern, Face It – The Convenience of a Biometric Password May Mean Forfeiting Your Fifth Amendment Rights, 125 Penn State L. Rev. 597, 597 (2021) (stating law enforcement “targeting . . . biometric passwords” new investigatory tool); Next Generation Identification, Fed. Bureau Investigation, https://www.fbi.gov/services/cjis/fingerprints-and-other-biometrics/ngi, [https://perma.cc/CAY3-7ZXQ] (discussing FBI’s biometric fingerprint-based database); Fed. Trade Comm’n, Data Brokers: A Call for Transparency and Accountability, FTC Report, at i (May, 2014), https://www.ftc.gov/system/files/documents/reports/data-brokers-call-transparency-accountability-report-federal-trade-commission-may-2014/140527databrokerreport.pdf [https://perma.cc/P4X8-QX29] [hereinafter “Data Brokers”] (describing how data brokers compile databases for collected consumer information).
[6] See Jim Nash, Alexa Voice Biometrics to be Integrated in Touchless Purchases Across India, BiometricUpdate (Sep. 15, 2021), https://www.biometricupdate.com/202109/alexa-voice-biometrics-to-be-integrated-in-touchless-purchases-across-india [https://perma.cc/M423-3E4W] (explaining Amazon initiative introducing voice biometrics for touchless purchases across India).
[7] See Adam Smith, Amazon Ring Working on Doorbells That Detect People by Their Skin and Smell, Independent (Dec. 16, 2021), https://www.independent.co.uk/life-style/gadgets-and-tech/amazon-ring-doorbells-skin-smell-b1977254.html [https://perma.cc/TGE6-4SAL] (explaining Ring doorbell’s biometric capabilities). The judge found the Ring Doorbell unjustifiably invaded the plaintiff’s privacy by capturing their personal data without the plaintiff ever realizing the device was ever there. See id. (discussing lawsuit result and noting Amazon stated customers must respect neighbors’ privacy when using Ring).
[8] Amazon Rekognition, Amazon, https://aws.amazon.com/rekognition/, [https://perma.cc/4HLC-SLEC] (introducing Amazon’s facial recognition technology in Rekognition product).
[9] See Dilip Kumar, Introducing Amazon One—a New Innovation to Make Everyday Activities Effortless, Amazon (Sept. 29, 2020), https://www.aboutamazon.com/news/innovation-at-amazon/introducing-amazon-one-a-new-innovation-to-make-everyday-activities-effortless [https://perma.cc/4QDR-SVPF] (introducing Amazon One’s concept); Halie Lesavage, We Tested Amazon One, Amazon’s Palm Payments System, Morning Brew (June 3, 2021), https://www.morningbrew.com/retail/stories/2021/06/03/tested-amazon-one-amazons-palm-payments-system [https://perma.cc/RUH4-9VEQ] (describing process of setting up Amazon One).
[10] See Sarah Perez, Amazon Expands Its Biometric-Based Amazon One Palm Reader System to More Retail Stores, TechCrunch (Feb. 1, 2021), https://techcrunch.com/2021/02/01/amazon-expands-its-biometric-based-amazon-one-palm-reader-system-to-more-retail-stores/ [https://perma.cc/N378-MA5Y] (comparing Amazon One to Apple’s biometric technology).
[11] See Kumar, supra note 9 (discussing initial goals for Amazon One). Amazon envisioned implementing Amazon One at venues like retailers, stadiums, and office buildings so that these areas could admit large groups of people quickly without compromising identification methods. See id. (explaining goal to identify people quickly).
[12] See id. (discussing Amazon releasing Amazon One to public in Seattle).
[13] See Amazon One, Amazon, https://one.amazon.com/ [https://perma.cc/N93J-EMCH] (listing ninety-one locations using Amazon One, including Whole Foods, AXS, and more).
[14] See Kumar, supra note 9 (discussing reason for choosing palmprint recognition).
[15] See Julia M. Siracuse, The Future of Our Fingerprints: The Importance of Instituting Biometric Data Protections in Pennsylvania, 59 Duq. L. Rev. 303, 311-12 (2021) (discussing lack of regulation of biometrics nationwide); see also Biometric Data and Privacy Laws (GDPR, CCPA/CPRA), Thales (June 16, 2021), https://www.thalesgroup.com/en/markets/digital-identity-and-security/government/biometrics/biometric-data [https://perma.cc/AA7X-GHEN] (providing overview of biometric regulation worldwide).
[16] See Gramm-Leach Bliley Act, 15 U.S.C. § 6809 (making no reference to biometric information).
[17] See 15 U.S.C. § 45(a)(1)-(2) (granting Federal Trade Commission power to intervene in certain transactions).
[18] Agreement Containing Consent Order, 6-7, In re Everalbum, Inc., No. 192-3172 (F.T.C. Jan. 11, 2021), 2021 WL 118895 (representing instance of FTC pursuing suit against company under Federal Trade Commission Act); David J. Oberly, FTC’s First Settlement on Facial Recognition Technology Yields Lessons, Bloomberg Law (Feb. 18, 2021), https://news.bloomberglaw.com/business-and-practice/ftcs-first-settlement-on-facial-recognition-technology-yields-lessons [https://perma.cc/N2FK-JN8A] (explaining implications of Federal Trade Commission pursuing biometric information collection cases).
[19] See Allison Grande, Sens. Raise Flag on Amazon’s Biometric Data Collection, Law360 (August 13, 2021), https://www-law360-com.ezproxysuf.flo.org/articles/1409/sens-raise-flag-on-amazon-s-biometric-data-collection [https://perma.cc/FU42-2G3Y] (explaining senators requested information on Amazon’s plans to protect data).
[20] See 740 Ill. Comp. Stat. Ann. 14 (describing Illinois’s biometric-specific privacy regulation); Tex. Bus. & Com. Code Ann. § 503.001 (describing Texas’s biometric-specific privacy regulation); Wash. Rev. Code Ann. § 19.375.020 (describing Washington’s biometric-specific privacy regulation); Cal. Civ. Code § 1798.100 (describing California’s biometric-specific privacy regulation); Siracuse, supra note 15, at 311-12 (identifying Illinois, Texas, Washington, and California, sole states with biometric laws).
[21] See U.S. Biometric Laws & Pending Legislation Tracker, Bryan Cave Leighton Paisner LLP (May 12, 2021), https://www.bclplaw.com/en-US/insights/us-biometric-laws-and-pending-legislation-tracker.html [https://perma.cc/4WC7-89EX ] (providing visual representation of states with pending consumer privacy laws). Several other states have consumer data privacy protections that do not specifically account for the collection and use of biometric data. See, e.g., Conn. Gen. Stat. Ann. § 36a-701b (discussing breach of security for computerized data containing personal information); Iowa Code Ann. § 715C.1 (providing security breach protection for “personal information”); Neb. Rev. Stat. Ann. § 87-802 (safeguarding “data security”). Plaintiffs tend to have mixed success when citing statutes not specific to biometric information in biometric cases. See Zier v. State, 1999 NV S. Ct. Briefs LEXIS *22, *8 (holding plaintiff cannot use “genetic information” statute when challenging DNA bank collecting his genetic fingerprint); Cole v. Gene by Gene, LTC, 1:14-CV00004-SLG, 2019 WL 2571244 (D. Alaska June 21, 2019), *1 (allowing case to advance when plaintiff cited Alaska genetic privacy act for biometric privacy issue).
[22] See Charles N. Insler, Understanding the Biometric Information Privacy Act Litigation Explosion, 106:3 Ill. Bar J. 34, 36 (2018) (stating Illinois only state fully authorizing private citizens to sue for misuse of biometric data). Illinois’s unique status makes privacy litigation increasingly popular. See id.
[23] See id. (explaining advantage of private right of action for private citizen).
[24] See id. (noting Illinois only state with full private right of action); Cal. Civ. Code § 1798.150 (creating limited private right of action for California citizens).
[25] Coronavirus Disease (COVID-19), WHO, https://www.who.int/health-topics/coronavirus#tab=tab_1 [https://perma.cc/G3T6-NZGG] (describing COVID-19).
[26] See id. (describing best practices for slowing transmission of COVID-19); SARS-CoV-2 Transmission, Centers for Disease Control and Prevention (May 7, 2021), https://www.cdc.gov/coronavirus/2019-ncov/science/science-briefs/sars-cov-2-transmission.html [https://perma.cc/6CE7-3VAY] (discussing COVID-19 transmissibility).
[27] See Dylan H. Morris et al., Aerosol and Surface Stability of SARS-CoV-2 as Compared with SARS-CoV-1, N. Engl. J. Med. (Apr. 16, 2020), https://www.nejm.org/doi/full/10.1056/NEJMc2004973 [https://perma.cc/6K6Y-NA6H] (discussing viability of COVID-19 particles in air and on surfaces).
[28] See Jessica Dickler, Another Consequence of Covid: A World Without Cash, CNBC (Jan 29, 2021), https://www.cnbc.com/2021/01/29/consumers-abandon-cash-altogether-because-of-covid.html [https://perma.cc/2EZ5-8EMH (stating American consumers and companies alike embracing touchless transactions, including biometrics); Columbus, supra note 3 (discussing security advantages of using biometric password); N.K. Ratha et al., Enhancing Security and Privacy in Biometrics-Based Authentication Systems, 40 IBM Sys. J. 614, 614 (2001) (stating some consumers struggle remembering nonbiometric passwords); AnnaMaria Andriotis, In a Pandemic, Another Worry: Touching the Payment Screen at Checkout, Wall St. J. (Apr. 3, 2020), https://www.wsj.com/articles/in-a-pandemic-another-worry-touching-the-payment-screen-at-checkout-11585914251 [https://perma.cc/MY8P-ANK7] (discussing health benefits of biometrics in touchless payment during pandemic).
[29] See Grande, supra note 19 (showing lawmakers aware of hole).
[30] See Mark E. Budnitz, The Restatement of the Law of Consumer Contracts: The American Law Institute’s Impossible Dream, 32 Loy. Consumer L. Rev. 369, 433-32 (2020) (stating benefit of touchless transactions during COVID-19).
[31] See The Possibility of COVID-19 After Vaccination: Breakthrough Infections, Ctrs. for Disease Control and Prevention (Dec. 17, 2021), https://www.cdc.gov/coronavirus/2019-ncov/vaccines/effectiveness/why-measure-effectiveness/breakthrough-cases.html [https://perma.cc/Y36P-P2CP] (discussing possibility of breakthrough infection, even if fully vaccinated); Omicron Variant: What You Need to Know, Ctrs. for Disease Control and Prevention (Feb. 2, 2022), https://www.cdc.gov/coronavirus/2019-ncov/variants/omicron-variant.html [https://perma.cc/J3T6-VDAV] (stating Omicron variant spreads more easily than original COVID-19 virus and Delta variant).