New York Times

Developing Law

1. must implement a written biometric retention policy available to the public;
2. cannot collect, sell, or obtain biometrics unless it informs data subjects in writing that their biometrics are being collected and stored and the purpose and length of term for use of the biometrics, and receives a written executed release from the data subjects authorizing the company to do so;
3. cannot sell or profit from biometrics;
4. cannot disclose biometrics unless authorized by the data subject, required as part of a financial transaction required by law, or required in response to a valid court order; and
5. must adhere to a reasonable standard of care to store biometrics not less than how the company stores other confidential or sensitive information.

Id. Id. Id. Id.

Regulations

Id.

Other Jurisdictions

In re Facebook Biometric Information Privacy Litigation Facebook Users Win Class Cert. In Face Scan Privacy Row

Conclusion

John T. Wolak and Mitchell Boyarsky are co-chairs of the Gibbons data privacy and security task force. Randy A. Gray is an associate on the task force.