On February 21, 2019, the Florida Legislature introduced a bill to create the "Florida Biometric Information Privacy Act." The purpose of the Act is to establish requirements and restrictions on private entities as to the use, collection, and maintenance of biometric identifiers and biometric information. Private entities and consumers need to be aware of this proposed legislation because if it becomes law, it creates a private right of action.

The Act is strikingly similar to the Illinois Biometric Privacy Act ("BIPA") that was enacted in 2008 and has resulted in over 200 cases against private entities. Since BIPA was enacted, there have been class action lawsuits related to using employee fingerprints to track work hours, using fingerprint capture for customer access control, and facial recognition for social media (e.g., Facebook and SnapChat). Recently, the Illinois Supreme Court ruled that you do not need to have suffered damages in order to recover for violations of BIPA. Andy Goldstein, wrote a client alert on the topic.

Other states have been slowly following Illinois's lead to protect the collection, use and storage of biometric information.

Under the Act, "Biometric Identifier" means a retina or iris scan, fingerprint, voice print, or scan of hand or face geometry.

"Biometric Information" is defined as any information, regardless of the manner in which it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual.

"Private Entity" means any individual, partnership, corporation, limited liability company, association, or other group. The term, however, does not include a state or local governmental agency or any state court, a clerk of the court, or a judge or justice.

The Act requires private entities in possession of biometric identifiers or biometric information to develop a publicly available written policy establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information.

A private entity may not collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information unless the private entity: (1) Informs the subject or the subject's legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored; (2) Informs the subject or the subject's legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and, (3) Receives a written release executed by the subject of the biometric identifier or biometric information or the subject's legally authorized representative.

For privacy and security reasons, private entities in possession of a biometric identifier or biometric information may not sell, lease, trade, or otherwise profit from a person's or a customer's biometric identifier or biometric information.

If this proposed legislation became law, private entities in possession of a biometric identifier or biometric information must store, transmit, and protect from disclosure all biometric identifiers and biometric information: (1) Using the reasonable standard of care within the private entity's industry; and, (2) In a manner that is the same as or more protective than the manner in which the private entity stores, transmits, and protects other confidential and sensitive information.

Probably the most noteworthy section is where it creates a private right of action for any person aggrieved by a violation of the Act. If successful, an "aggrieved" party can obtain liquidated damages of $1,000 or $5,000 depending on how egregious the violation. An "aggrieved" party can also obtain actual damages for a violation of the Act. The Act also provides for attorneys' fees to the prevailing party.

As we saw in Illinois, this legislation could result in class action lawsuits against private entities for any technical violation. If Florida courts follow Illinois' precedent, Floridians do not need to have suffered actual damages in order to recover for violations of the Act.

If enacted, this new law will take effect on October 1, 2019.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.