Your biometric data tells the tale of who you are in intricate detail. Often, your biometric data is used to verify your identity at work or school. Currently, Illinois has the most comprehensive biometric privacy law in the country with the Illinois Biometric Information Privacy Act. Maryland and Mississippi look to join Illinois in protecting their citizens’ biometric data. Maryland has already had the first reading of HB 33, the Commercial Law-Consumer Protection-Biometric Data Privacy bill. HB 33 would require private companies that hold the biometric data of Maryland citizens to “publish policies, establish a retention schedule and data destruction guidelines within certain timeframes.” HB 33 will also require companies to obtain consent from a consumer before collecting the consumer’s biometric data, and it establishes a set of security requirements. Importantly, HB 33 establishes a private right of action, along with being enforceable pursuant to the Maryland Consumer Protection Act.
 
Mississippi’s proposed Biometric Identifiers Privacy Act is similar to Maryland’s HB 33 insofar as it requires companies to “publish policies for the biometric data they hold, including a retention schedule and data destruction policy[,]” and requires the consumer to consent to the collection of the consumer’s biometric data. Mississippi’s proposed legislation allows employers to collect employee’s biometric data, but limits the use of the data, including preventing the use of employee biometric data to track the employee. While the Mississippi Biometric Identifiers Privacy Act allows for a private right of action just like Maryland’s proposed legislation, Mississippi’s proposed legislation also allows consumers to “demand information about what biometrics of theirs are held, the source of the data, what it has been used for, whether it was disclosed to any third parties, and if so who those third parties are.” If your company needs assistance complying with the data privacy and biometric privacy laws in the states you operate in, please contact Spilman’s cybersecurity and data privacy practice group.