…Perhaps it was inevitable that the Illinois Biometric Information Privacy Act would come under threat, as it’s our nation’s strongest law that protects people from facial recognition technology used by private entities. Enacted in 2008, the law was an initiative of the ACLU of Illinois, in response to an episode when a corporation sold off its database of customer biometric information during bankruptcy proceedings.
The Illinois statute requires private entities to get consent from a person before collecting or disclosing their biometric identifiers. Private entities also must destroy collected identifiers within three years, and sooner if they finish using the identifiers for the purpose for which they collected it. The statute extends to “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” The term “face geometry” includes facial recognition. Finally, the statute has teeth: injured parties may sue the private entities that violate these privacy rules.