Law note · Washington
HB 1493, Biometric Privacy Law
Requires a person to provide notice, obtain consent, or provide a mechanism to prevent use, before enrolling an individual's biometric identifier in a database for a commercial purpose.
Biometric identifier is defined as data from automatic measurement of biological characteristics such as fingerprint, voiceprint, retina, or iris, but the definition excludes any identifier generated from a photo, video, or audio recording and any HIPAA covered information, so a faceprint or voiceprint pulled from an existing recording falls outside this statute even though the same identifier is covered as consumer health data under the My Health My Data Act.
An enrolled identifier may be retained no longer than reasonably necessary for the purpose it was enrolled for, a legal retention duty, or fraud and security prevention, and the chapter separately exempts Gramm-Leach-Bliley financial institutions and law enforcement.
What it asks of an app
- Provide notice, obtain consent, or provide a mechanism to prevent use, before enrolling a biometric identifier such as a voiceprint or faceprint in a database for a commercial purpose. This duty does not reach an identifier generated from a photo, video, or audio recording.
- Retain an enrolled biometric identifier no longer than reasonably necessary for the purpose it was enrolled for, a legal retention duty, or fraud and security prevention needs.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, deploys_chatbot
Primary source: official codified statute text, Revised Code of Washington, and the official Washington State Legislature bill history for HB 1493