On February 17, 2022, the California Legislature introduced a Biometric Privacy Act (SB 1189) similar to the Illinois Biometric Information Privacy Act (“BIPA”). SB 1189 would dramatically increase biometric privacy protections for California consumers, broaden regulation among private companies, and add to the wave of biometric privacy class action lawsuits that have gripped US courts.
Introduced by State Senator Bob Wieckowski, SB 1189 would expand the definition of biometric data under California law to include physiological, biological and behavioral characteristics of a person used to establish individual identity. If passed, the law will prohibit any private entity from selling, renting, trading, using for advertising or otherwise profiting from a person’s biometric information. And all private companies would be required to obtain consumer consent before collecting their biometric information, in addition to publishing a written policy setting out a retention schedule and guidelines for permanently erasing biometric information.
SB 1189 would complement CCPA/CPRA*, which includes an opt-out for the sale of an individual’s personal information, as well as other protections. Notably, SB 1189 is even broader than current California privacy laws; it would cover any “private entity” (defined as “an individual, partnership, corporation, limited liability company, association, or similar group, however organized”, but does not include the University of California ).
Like BIPA, SB 1189 includes a private right of action. It would certainly fuel major class action lawsuits like its Illinois counterpart. If passed, SB 1189 will become effective January 1, 2023, which could place significant time pressure on companies doing business in California to prepare compliance programs before the end of the year. Companies should closely monitor SB 1189, proactively prepare to establish compliant biometric policies, and simultaneously pursue other avenues, including effective class action waivers, to mitigate the potential for costly private biometric class action litigation. .