Answer By law4u team
Biometric data, including fingerprints, facial recognition, and voiceprints, is increasingly used for authentication and security purposes in apps and online platforms. However, biometric data is highly sensitive and falls under special protection due to its ability to uniquely identify individuals. In many countries, collecting or storing biometric data without explicit consent is a violation of privacy and data protection laws. If an app collects biometric data without the user's knowledge or consent, consumers may have legal grounds to sue the app for violating their privacy and data protection rights.
Legal Protections for Consumers
General Data Protection Regulation (GDPR) – EU
The GDPR is one of the strictest privacy regulations globally and applies to apps that collect or store biometric data in the European Union. The regulation requires explicit consent from individuals for processing sensitive personal data, including biometric data. If an app collects biometric data without prior consent, it violates the GDPR’s consent requirements and data processing principles.
- Action: Consumers have the right to request deletion of their biometric data and may file a complaint with the Data Protection Authority (DPA) in their region. In certain cases, they can also pursue compensation for the harm caused.
California Consumer Privacy Act (CCPA) – USA
Under the CCPA, consumers in California have the right to know what data is being collected about them, the right to opt-out of the sale of their data, and the right to request that their data be deleted. Biometric data is considered sensitive personal data under the CCPA, and if an app collects this data without consent, it may be violating the consumer's rights.
- Action: Consumers can file a complaint with the California Attorney General or the Consumer Privacy Protection Agency and demand that their biometric data be deleted and the app cease the unauthorized collection.
Biometric Information Privacy Act (BIPA) – USA (Illinois)
In the United States, the Biometric Information Privacy Act (BIPA) is one of the few laws that provides specific protections for biometric data. Under BIPA, businesses (including apps) are required to obtain informed consent before collecting or storing biometric data such as fingerprints, facial recognition data, or voiceprints. Failure to comply with these requirements can lead to hefty fines and lawsuits.
- Action: If an app is operating in Illinois and collects biometric data without consent, consumers have the right to file a lawsuit under BIPA. Individuals can also sue for damages, including statutory damages for each violation.
Personal Data Protection Bill (PDPB) – India
In India, the Personal Data Protection Bill (PDPB), once enacted, will introduce strict regulations around the collection and processing of personal data, including biometric data. The bill requires explicit consent from individuals before collecting biometric data and provides for data protection and consumer rights in case of misuse.
- Action: If an app collects biometric data without consent, consumers can lodge a complaint with the Data Protection Authority once the PDPB is in force.
Legal Remedies Available to Consumers
Right to Consent and Deletion of Data
In many jurisdictions, consent is a core requirement for collecting and processing biometric data. If an app stores or uses biometric data without obtaining proper consent, consumers can exercise their right to deletion.
- Action: Consumers can request the app to delete their biometric data and stop using it. If the app refuses, legal action can be taken to force compliance with data protection laws.
Filing a Complaint with Regulatory Authorities
If an app collects biometric data without consent, consumers can file a formal complaint with data protection authorities in their region. These authorities have the power to investigate violations, issue fines, and enforce compliance.
- Action: For instance, under the GDPR, consumers can report violations to the Data Protection Authority (DPA) in their country. In California, complaints can be filed with the Attorney General's office.
Filing a Lawsuit for Privacy Violation
If an app collects or stores biometric data without consent, consumers may be entitled to compensation for damages caused by the violation of their privacy rights. This could include emotional distress or any financial losses related to the misuse of biometric data.
- Action: Under laws like BIPA, consumers can sue apps for statutory damages (e.g., $1,000 for each violation, or $5,000 for each willful violation). In cases of data breaches, consumers can also claim damages related to identity theft or fraud.
Class Action Lawsuit
If multiple consumers are affected by the same issue (i.e., the app collects biometric data without consent), they can join together to file a class action lawsuit. This allows consumers to collectively pursue legal action for privacy violations.
- Action: If the app is collecting biometric data from many users without consent, a class action lawsuit can help maximize compensation and put pressure on the app to comply with privacy regulations.
Injunction or Court Orders
In some cases, a consumer may seek an injunction (a court order) to stop the app from continuing to collect or store biometric data without consent.
- Action: Consumers can ask the court to issue an injunction to prevent further violations of privacy and ensure the app ceases its data collection practices.
Steps to Take If an App Collects Biometric Data Without Consent
Review the App’s Privacy Policy
Check the app’s privacy policy for any clauses regarding the collection and use of biometric data. If the app collects biometric data without disclosing it, this may be a violation of data protection laws.
- Action: If the privacy policy does not mention the collection of biometric data or is unclear, take screenshots for evidence.
Request Data Deletion
If the app has collected biometric data without your consent, request deletion of all your personal and biometric data from the app.
- Action: Contact the app’s support team or data protection officer and formally request data deletion. If the app does not comply, escalate the issue.
File a Complaint with Relevant Authorities
Depending on your location, file a complaint with the relevant data protection authority or privacy regulator.
- Action: For example, in the EU, file a complaint with the Data Protection Authority (DPA), or in California, contact the Attorney General's office.
Consult Legal Counsel
If you have suffered harm (e.g., identity theft, fraud) as a result of the biometric data collection, consider consulting with a lawyer who specializes in privacy law to explore options for filing a lawsuit.
- Action: Seek legal advice on pursuing damages or taking legal action under laws like BIPA, GDPR, or CCPA.
Example
Scenario
You downloaded a fitness tracking app that, while offering services like workout plans, asks for your fingerprint and facial recognition data to access your profile. However, the app’s privacy policy does not mention biometric data collection or seek your explicit consent.
Steps the consumer should take
- Review Privacy Policy: Check if the app's privacy policy mentions the collection of biometric data. If it doesn't, document this discrepancy.
- Request Data Deletion: Contact the app’s support team to request immediate deletion of your biometric data.
- File a Complaint: Report the issue to the Data Protection Authority or consumer protection agency in your region (e.g., GDPR in the EU, CCPA in California).
- Consult Legal Counsel: If the issue persists, consult a privacy lawyer to discuss potential legal actions under laws like BIPA or GDPR.
