Maine introduces biometric privacy legislation modeled on Illinois ‘gold standard’

State lawmakers in Maine last week reintroduced a biometrics privacy bill that would impose strict regulations on companies obtaining, selling or retaining individuals’ facial, fingerprint or eye scans.

The Maine bill, which would require a written release from an individual before a private entity obtains or uses an individual’s biometric data — prohibit private entities from selling that information — is largely modeled on a 2008 Illinois law that’s considered a gold standard for biometrics privacy.

Like Illinois’ Biometric Information Privacy Act, the Maine bill includes a private right of action, a legal mechanism that allows people to individually sue companies that violate the statute. That component of the Illinois law was the basis for a settlement last year between the American Civil Liberties Union and Clearview AI, the controversial facial recognition software company.

In Maine, entities would have to pay $1,000 for violations due to negligence, and $5,000 for violations that result from recklessness or intentional misconduct.

While the definition of biometric data varies from state to state, Maine’s bill denotes it as “a voiceprint or imagery of the iris, retina, fingerprint, face or hand, that can be used to identify that individual.”

Under the proposed law, private entities in Maine also would have to create a policy for the retention and destruction of the biometric identifiers they gather. Biometric data would also have to be destroyed within one year after the customer’s last intentional interaction with the company, or within 30 days if a person requests deletion of the data.

A similar version of the Maine bill was introduced last year, but failed amid opposition from the state’s private sector. The Maine Chamber of Commerce criticized it for being “extremely broad,” singling out the private right of action.

But Maine, which in 2021 banned some usages of facial recognition technology, is a forerunner in biometric regulations, said state Rep. Maggie O’Neil, who sponsored the new privacy bill. O’Neil told StateScoop that it’s on states to enact privacy protections as long as the federal government does not. And, she said, the need for regulation is made more urgent by biometric data, which can’t be altered like a credit card or Social Security number.

“So, to zoom out, Congress has not acted to protect privacy, and we do not have a national privacy law the way that the EU does,” she said. “California has taken steps to do that. But that only protects people in California. So it’s really until Congress acts, it’s on states to put protections in place.”

The Maine bill was developed in collaboration with the ACLU, which for several years has shopped around draft legislation — modeled after the Illinois biometrics law — to state legislatures.

Chad Marlow, an ACLU senior policy counsel, said the draft legislation has been tweaked over the 15 years since the Illinois law was enacted in response to court cases that’ve tested its enforcement powers and ambiguities. One recent case involved the fast food chain White Castle, which was accused by an employee of implementing fingerprint-scanning for computer access without consent.

But much more of the development of the ACLU’s draft bill has concerned the private right of action. While the Illinois BIPA allows individual lawsuits, biometric privacy laws in other states — like Texas and Washington — do not, leaving enforcement up to their attorneys general.

Meagan Sway, policy director at the ACLU of Maine, said the private right of action is essential for making the law enforceable and giving people full control of their privacy.

“Our attorney general’s office shows up to the legislature every year talking about how they’re understaffed, how they can’t get to all the priorities that they need to get to,” Sway said. “And so leaving this in the hands of the attorney general’s office solely means that really only the egregious actors are the ones who are going to be held accountable.”

O’Neil said despite the opposition from the likes of the Maine Chamber of Commerce, she’s confident her biometrics bill has a fair shot of passing this year.

“In Maine, we have been a leader on these issues, and I hope we continue to be,” she said. “We have a best in the nation internet service provider privacy law that requires consent. And same deal with the face recognition game. So I hope to see this as a continuation of Maine leading on it.”