Preventing Collection of Biometric Identities

How Meta’s $1.4 Billion Settlement Impacts Your Obligations Under the Texas Capture or Use of Biometric Identifier Act

The Texas Capture or Use of Biometric Identifier Act (CUBI) aims to prevent the commercial collection of an individual’s biometric identifiers without their consent. CUBI has been around since 2009, but it has been making headlines recently due to a $1.4 billion settlement between Meta Platforms, Inc. (Meta) and the Texas Attorney General over allegations that a tagging suggestions tool in Meta’s Facebook application violated CUBI.

What Is CUBI?

CUBI defines “biometric identifiers” as “a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.” CUBI imposes limits on the collection, use, and storage of biometric identifiers for commercial purposes.

CUBI bars capturing an individual’s biometric identifiers for a commercial purpose unless the collector “(1) informs the individual before capturing the biometric identifier; and (2) receives the individual’s consent to capture the biometric identifier.”

Biometric identifiers may not be sold, leased, or otherwise disclosed to a third party. There are four narrow exceptions to this rule:

• an individual consents to the disclosure for identification purposes in the event of their death/disappearance;
• the disclosure is pursuant to a financial transaction at the individual’s request;
• the disclosure is required/permitted under federal or state law; or
• the disclosure is to a law enforcement agency acting with a warrant.

Finally, CUBI requires reasonable care and protection of biometric identifiers at least commensurate with the way the person protects other confidential information, including that the biometric identifiers be destroyed within a reasonable time period after the purposes for collecting them have expired.

What Is a Commercial Purpose?

One of the most challenging issues in determining whether CUBI applies is whether a particular use of biometric identifiers is for a “commercial purpose.” The term “commercial purpose” is not defined in the statute, and there is little guidance on the question. But, there is good reason to believe the term, “commercial purpose,” will be broadly construed.

For example, the term does not appear to be limited to the consumer context, as the statute refers to employee biometric identifiers. Specifically, CUBI suggests that collecting employee biometric identifiers for security would be considered a “commercial purpose” as the law specifies that the purpose of collecting employee biometric identifiers would “expire on termination of the employment relationship.”

The recent Meta settlement further suggests that the definition is broad. Meta claimed that part of the reason for collecting facial data was to improve their facial recognition software. And it paid a massive settlement. Businesses, therefore, should beware that the collection of biometric identifiers, even for the purposes of training technology (including AI or large language models), could result in violations of CUBI.

Read more.

More about Bracewell here