Biometric Data Sharing With Third Parties

A person may provide biometric information to one company without realizing that other organizations are involved behind the scenes.

An employee scans a fingerprint into a workplace time clock, but an outside workforce-management company may provide the system. A consumer uses facial recognition to verify an identity, while a separate technology provider processes the biometric information. A financial service may use another company to provide voice authentication.

These arrangements do not necessarily violate biometric privacy law. Modern biometric systems frequently depend on outside service providers.

But once biometric information moves beyond the organization that originally collected it, additional privacy questions can arise.

Who received the information? What exactly was transferred? Why did the third party need it? Did the individual authorize the disclosure? Can the recipient use it for another purpose? How long will each company retain it?

The answers depend on the technology, the relationship among the companies, the applicable jurisdiction, and the specific biometric privacy law involved.

Net Law Advocates represents individuals nationwide in matters involving the collection, disclosure, storage, and other handling of biometric information.

What Does It Mean to Share Biometric Data?

Biometric data sharing can involve more than sending a fingerprint image or photograph from one company to another.

Many biometric systems generate digital templates or other information derived from a biometric characteristic.

Depending on the technology, shared information might include:

• Fingerprint-related data
• Facial geometry or facial templates
• Voiceprints
• Iris or retina information
• Hand-geometry data
• Biometric templates or identifiers associated with an individual
• Information used to authenticate or identify a person

The legal significance of a transfer can depend on what information actually moved between the companies.

A vendor receiving an ordinary photograph is not necessarily receiving the same information as a vendor receiving data generated by facial-recognition technology. Likewise, an audio file is not automatically equivalent to a biometric voiceprint.

Understanding the technology is often necessary before determining whether a transfer involved information protected by a biometric privacy statute.

Why Would Another Company Receive Your Biometric Information?

Outside providers perform many of the technical functions that make biometric systems work.

A company using biometric technology may rely on another business to provide:

• Timekeeping or payroll systems
• Workforce-management software
• Identity-verification technology
• Facial-recognition services
• Voice-authentication systems
• Fraud-prevention technology
• Access-control systems
• Cloud infrastructure or data storage
• Software supporting biometric matching

The consumer or employee may have a relationship with the organization using the system but little or no direct interaction with the company providing the underlying technology.

That does not mean the vendor’s involvement is improper.

The important question is whether the collection and subsequent disclosure complied with the law that applies to the biometric information.

Illinois BIPA Separately Regulates Disclosure of Biometric Information

Illinois’ Biometric Information Privacy Act distinguishes between collecting biometric information and disclosing it.

Under BIPA, a private entity in possession of a person’s biometric identifier or biometric information generally may not disclose, redisclose, or otherwise disseminate that information unless one of four statutory circumstances applies.

Those circumstances include situations in which:

• The individual or the individual’s legally authorized representative consents to the disclosure or redisclosure
• The disclosure completes a financial transaction requested or authorized by the individual
• State or federal law or a municipal ordinance requires the disclosure
• A valid warrant or subpoena issued by a court of competent jurisdiction requires the disclosure

BIPA also separately provides that a private entity may not sell, lease, trade, or otherwise profit from a person’s or customer’s biometric identifier or biometric information.

These provisions make disclosure a distinct part of Illinois biometric privacy law rather than simply an extension of the initial consent process.

Consent to Collection and Consent to Disclosure Are Different Questions

Someone may knowingly provide biometric information without necessarily understanding that another company will receive it.

Consider an employee who enrolls a fingerprint to use a workplace time clock.

The employee may know that the employer is collecting biometric information for timekeeping. But the technology could involve an outside company that provides the scanner, software, database, or cloud service.

That creates two separate questions.

Was the initial biometric collection legally authorized?

And was any subsequent disclosure or dissemination permitted under the applicable law?

The first issue belongs primarily to biometric collection and consent. The second concerns what happened after the organization possessed the information.

A valid collection process should therefore not automatically be treated as authorization for every later transfer.

Service Providers Can Be Part of the Biometric Data Chain

The phrase “third party” can make it sound as though biometric information was sold to an unrelated company for an entirely different purpose.

Sometimes that happens. Often, however, the relationship is more technical.

An organization may hire a vendor specifically to perform the function for which the biometric information was collected.

For example, an employer might use a vendor’s platform to match fingerprint templates every time an employee clocks in. A consumer-facing company might rely on an identity-verification provider to determine whether a face matches identification documents.

In these arrangements, the outside provider may need access to certain information for the system to function.

Whether the transfer is legally permissible cannot be determined simply by labeling the recipient a vendor or service provider. The analysis depends on the applicable statute, what was disclosed, the purpose of the disclosure, what consent was obtained, and how the recipient may use the information.

Biometric Timekeeping Often Involves Outside Vendors

Workplace timekeeping is a particularly common example.

An employee may interact only with a scanner located at work, while the biometric technology itself comes from another company.

The employer might control employee enrollment. A workforce-management vendor may provide the software. Another provider could host portions of the system.

That means a worker trying to understand what happened to a fingerprint or other biometric identifier may need to identify more than the employer.

Relevant questions can include who manufactured the system, which company processed the biometric information, where templates were stored, and whether biometric information moved between the employer and the technology provider.

These issues overlap naturally with biometric time clock privacy and broader workplace biometric practices.

Disclosure Does Not Always Mean the Same Thing as Sale

Biometric information can move between companies without being sold.

A vendor may process information as part of a contracted service. A cloud provider might store information. An authentication provider may receive data so it can perform a match.

Those transfers are different from a company selling biometric information as an asset or commercial dataset.

The distinction matters because statutes can regulate these activities differently.

Illinois BIPA, for example, contains one provision prohibiting private entities from selling, leasing, trading, or otherwise profiting from biometric identifiers or biometric information and another provision governing disclosure, redisclosure, or dissemination.

An analysis should therefore identify what actually happened instead of using “sharing” and “selling” interchangeably.

What If the Biometric Information Is Shared for a New Purpose?

The purpose of a transfer can be important.

A person might provide biometric information for one function, such as verifying identity. Questions may arise if that information is later disclosed or used for a materially different purpose.

Washington’s commercial biometric statute illustrates this principle.

The statute generally restricts a person who has enrolled an individual’s biometric identifier from selling, leasing, or otherwise disclosing it to another person for a commercial purpose without consent unless a statutory condition applies.

Those conditions include certain disclosures necessary to provide a product or service the individual requested or expressly authorized, certain financial transactions, and disclosures required or authorized by law or court order.

Washington also provides that a person who enrolls a biometric identifier for a commercial purpose, or obtains one from a third party under the statute, generally may not use or disclose it in a manner materially inconsistent with the terms under which it was originally provided without obtaining consent to the new terms.

This is one example of why the original purpose for providing biometric information can matter later in its lifecycle.

Texas Also Restricts Certain Biometric Disclosures

Texas uses a different statutory framework.

Its Capture or Use of Biometric Identifier law covers retina or iris scans, fingerprints, voiceprints, and records of hand or face geometry.

For covered biometric identifiers captured for a commercial purpose, a person possessing the identifier generally may not sell, lease, or otherwise disclose it to another person unless one of the statute’s specified circumstances applies.

Those circumstances include consent to disclosure for identification purposes in the event of a disappearance or death, completing a financial transaction requested or authorized by the individual, disclosures permitted or required by federal or state law, and disclosures made by or to law enforcement for a law-enforcement purpose in response to a warrant.

Texas therefore should not be described as simply adopting Illinois BIPA’s disclosure requirements.

The statutes use different language, contain different exceptions, and provide different enforcement structures.

Can a Company Sell Biometric Data?

The answer depends on the applicable law and circumstances.

Illinois BIPA contains a direct prohibition against a covered private entity selling, leasing, trading, or otherwise profiting from a person’s or customer’s biometric identifier or biometric information.

Other privacy laws may regulate sales through different definitions, consent mechanisms, notices, consumer rights, or exceptions.

The technical details also matter.

Before concluding that biometric information was “sold,” it may be necessary to determine what information was transferred and what the recipient provided in return.

Paying a technology provider to operate a biometric system is not necessarily the same thing as selling the users’ biometric information to that provider.

Third-Party Sharing Can Affect Who Possesses the Data

Once another company receives biometric information, privacy questions can extend beyond the initial transfer.

The recipient may store the information within its own systems. It may retain information after the relationship with the original company ends. It may use subcontractors or other infrastructure providers.

The result can be a chain of possession that is difficult for an individual to see.

This becomes particularly important when evaluating biometric retention and destruction.

Deleting biometric information from the original company’s system may not necessarily establish that information held elsewhere was also destroyed.

Whether a recipient has independent retention obligations depends on the applicable law and circumstances.

A Third-Party Breach Can Expose Biometric Information

Sharing biometric information can also change the security landscape.

The organization that originally collected the information may never suffer a cyberattack. Instead, the technology company storing or processing the biometric data may be compromised.

For an affected person, the result can be confusing.

A breach notification might arrive from a company whose name is unfamiliar even though the biometric information was originally provided to an employer, financial institution, application, or another business.

Understanding the relationship between the companies can become essential to determining why the breached organization possessed the information in the first place.

Those incidents may involve both disclosure issues and the separate legal questions associated with a biometric data breach.

What If You Never Knew a Third Party Had Your Biometrics?

People often have limited visibility into the technology vendors used by companies and employers.

Someone may know that a fingerprint, face, or voice is being used for authentication without knowing the name of the provider operating the underlying system.

Discovering another company’s involvement does not automatically establish improper disclosure.

Instead, it can prompt additional questions:

What information did the third party receive? Why did it receive the information? Was the transfer necessary to provide the requested service? What did the original notice or consent process say? What restrictions applied to the recipient? Did the recipient use the information for another purpose?

The answers can determine whether the third-party relationship is routine, legally authorized processing or potentially problematic disclosure.

Privacy Policies and Consent Forms Can Help Identify Sharing Practices

Documents provided when biometric information was collected may describe outside companies or categories of recipients.

Relevant materials can include:

• Biometric consent or release forms
• Privacy policies
• Employee handbooks
• Timekeeping policies
• Application enrollment screens
• Identity-verification disclosures
• Vendor privacy notices
• Terms governing biometric authentication
• Data breach notifications
• Emails introducing new workplace technology

A document does not necessarily have to name every company involved to be legally sufficient under every statute.

At the same time, general language authorizing broad information sharing should not automatically be assumed to satisfy a biometric-specific disclosure requirement.

The applicable law and actual language matter.

Vendor Agreements May Become Important in a Legal Dispute

Individuals generally will not possess contracts between a company and its biometric technology provider.

Those agreements can nevertheless become important in litigation.

A vendor agreement may help establish which company stored biometric information, what services were performed, whether data could be used for other purposes, how long information was retained, which party controlled deletion, and what security responsibilities each company assumed.

Technical records may also show whether biometric information was actually transmitted between systems or remained within a device or environment controlled by one organization.

That evidence can be important because the presence of a vendor does not necessarily prove that protected biometric information was disclosed to it.

Sharing Can Occur at Several Points in the Biometric Data Lifecycle

Biometric information can pass through multiple stages:

An organization collects it.

Software processes it.

A database stores it.

Another system uses it for authentication.

A vendor may maintain the platform.

The information may later be deleted, retained, or exposed in a security incident.

Privacy issues can arise at more than one of those stages.

That is why collection, sharing, retention, and security should be analyzed separately even though they concern the same underlying biometric information.

A problem at one stage does not necessarily establish a problem at every other stage.

Does Sharing Biometric Data With Another Company Automatically Create a Lawsuit?

No.

The involvement of a third party does not by itself establish unlawful disclosure.

A potential claim may depend on factors such as:

• What biometric information was involved
• Whether the information is covered by the applicable statute
• Who originally collected it
• Which entity received it
• Why the information was disclosed
• Whether the individual consented
• Whether a statutory exception applies
• Whether the recipient used the information consistently with the authorized purpose
• Where the relevant conduct occurred
• Which state’s law applies
• Whether the applicable law provides an individual right to sue

Illinois is particularly significant because BIPA provides a private right of action to a person aggrieved by a violation of the Act.

Texas and Washington use different enforcement mechanisms for their biometric-specific statutes, so the existence of a statutory disclosure restriction does not necessarily mean an individual has the same type of private claim available under Illinois law.

Understanding Who Received Your Biometric Information

Someone concerned about biometric sharing may know only one side of the story.

An employee knows the employer. A customer knows the company providing the service. Neither may know which biometric vendors operate behind the scenes.

Preserving the documents available to you can help establish that relationship.

Consent forms, privacy notices, application screens, employee policies, breach letters, and communications about biometric technology may identify the vendor or explain categories of companies that receive information.

An attorney can then evaluate whether additional technical or contractual evidence may be relevant.

The central issue is not simply whether another company was involved. It is what biometric information that company received, why it received it, what authority existed for the transfer, and what happened to the information afterward.

Speak With Net Law Advocates About Biometric Data Sharing

Biometric technology often involves multiple companies even though an employee or consumer interacts with only one of them.

Whether sharing biometric information with a technology provider or another organization creates a legal claim depends on the type of information transferred, the purpose of the disclosure, consent, statutory exceptions, jurisdiction, and the law governing the information.

Net Law Advocates represents plaintiffs nationwide in biometric privacy matters. If you believe your fingerprint, facial geometry, voiceprint, or other biometric information was improperly disclosed or shared with another company, contact Net Law Advocates at 888-913-2318 to schedule a free, confidential consultation.