Legislature(2011 - 2012)CAPITOL 120
04/14/2012 01:00 PM House JUDICIARY
| Audio | Topic |
|---|---|
| Start | |
| SB179 | |
| SB98 | |
| Adjourn |
* first hearing in first committee of referral
+ teleconferenced
= bill was previously heard/scheduled
+ teleconferenced
= bill was previously heard/scheduled
| + | SB 98 | TELECONFERENCED | |
| + | SB 179 | TELECONFERENCED | |
| + | TELECONFERENCED |
SB 98 - BIOMETRIC INFORMATION FOR ID
1:19:47 PM
VICE CHAIR THOMPSON announced that the final order of business
would be CS FOR SENATE BILL NO. 98(JUD), "An Act relating to
biometric information." [Before the committee was HCS CSSB
98(HSS).]
1:20:09 PM
SENATOR BILL WIELECHOWSKI, Alaska State Legislature, sponsor -
noting that Article I, Section 22, of the Alaska State
Constitution says that the right of the people to privacy is
recognized and shall not be infringed, and that the legislature
shall implement that section - explained that SB 98 would
regulate the collection, disclosure, and use of biometric
information, and would define that term.
1:21:43 PM
SAMUEL GOTTSTEIN, Staff, Senator Bill Wielechowski, on behalf of
the sponsor, Senator Wielechowski, first, in response to a
question, acknowledged that the sectional analysis for SB 98
included in members' packets and dated January 17, 2012, doesn't
reflect the most recent changes to the bill. Remarking, then,
that the Alaska State Constitution provides for a greater right
to privacy than the U.S. Constitution, he referred to the bill's
proposed new AS 18.14.090(1), which now defines the term,
"biometric data" to mean "finger prints, handprints, voices,
iris images, retinal images, vein scans, hand geometry, or other
physical characteristics of an individual". The phrase, "or
other physical characteristics of an individual", he noted, was
added to that definition in order to address possible future
advancements in technology. In response to another question, he
indicated that the concern SB 98 is intended to address revolves
around the possibility that a person's private medical
information could be extrapolated from his/her biometric data;
that with regard to a person's biometric data, the bill would
afford protections similar to those afforded to a person under
existing law with regard to his/her deoxyribonucleic acid (DNA)
samples; and that providing protections for biometric data via
state law is necessary because federal law doesn't yet do so in
a uniform manner.
MR. GOTTSTEIN mentioned that thus far, 18 other states have
adopted laws addressing biometric data, and that members'
packets contain a memorandum dated March 15, 2012, from
Legislative Legal and Research Services specifically addressing
the [biometric data] laws of Illinois, Indiana, and Texas.
Protecting the privacy of Alaska's citizens [as the bill is
proposing to do] is particularly important given that a person's
biometric data can be misused due to recent advancements in
technology; given that once a person's biometric data has been
so misused, it can't just simply be replaced/returned; and given
that database security breaches are now common. Senate Bill 98
as currently written would provide reasonable privacy
protections for Alaskans: requiring that collectors of
biometric information provide clear notice of the intended use
and receive documented consent for that use; prohibiting other
uses or sale; addressing storage and disposal; and providing
civil penalties for violations. In response to a further
question, he explained that the bill no longer contains a
provision allowing for alternate identification to be used for
occupational examinations; that provision was originally
included in the bill in order to preclude a person from being
required to provide his/her fingerprints, for example, just to
take an examination.
1:30:54 PM
MR. GOTTSTEIN, to address the other changes incorporated into
HCS CSSB 98(HSS), then explained that the language in proposed
new AS 18.14.010(b) - pertaining to revoking/amending consent
for biometric information collection - was cleaned up but no
substantive change was made. Proposed new AS 18.14.040 -
pertaining to the disposal of biometric information - no longer
contains language providing for the removal and destruction of a
person's biometric information at his/her written request,
because it was thought that that language would defeat the
purpose of certain security measures. Proposed new AS 18.14.050
- pertaining to the use of biometric information - no longer
contains language stipulating that biometric information may not
be used for marketing or general surveillance purposes, because
it was thought that a person might indeed want to have his/her
biometric information used for such a purpose. Proposed new
AS 18.14.070 - pertaining to the right of bringing civil action
against violators of proposed new AS 18.14 - now uses the word,
"intentionally" instead of "knowingly", thereby providing for a
higher culpable mental state; now clarifies that the penalties
may not exceed the stipulated amounts; and no longer stipulates
that civil action may not be brought against the state [or its
agencies, or the officers or employees of such]. Proposed new
AS 18.14.080 - pertaining to exemptions from proposed new
AS 18.14 - now exempts, via its proposed new paragraph (4),
photographs [not collected specifically for use in a biometric
system]. And proposed new AS 18.14.090 - defining the terms
used in proposed new AS 18.14 - no longer defines the terms,
"facial mapping" or "facial recognition", because those terms
were removed from the definitions of the terms, "biometric data"
and "biometric information", with those two definitions now
including the phrases, "other physical characteristics of an
individual", and, "other recognition of a physical
characteristic of an individual", respectively.
MR. GOTTSTEIN, in response to a question, relayed that the
bill's proposed new AS 18.14.080(3) provides an exemption for
facial images used in driver's licenses and state identification
(ID) cards issued by the Department of Administration (DOA).
REPRESENTATIVE HAWKER noted that proposed new AS 18.14.090 does
not provide definitions for the aforementioned newly-added
phrases, "other physical characteristics of an individual", and,
"other recognition of a physical characteristic of an
individual".
1:40:12 PM
MR. GOTTSTEIN, in response to other questions, offered his
understanding that the bill won't apply to the collection of
medical or dental information because [such is already addressed
under existing law and] the bill's proposed new AS 18.14.080(2)
provides an exemption for the collection, retention, analysis,
disclosure, or distribution of biometric information authorized
under state or federal law. In response to a further question,
he explained that the language in proposed new AS 18.14.080(1) -
exempting the collection, retention, analysis, disclosure, or
distribution of biometric information for a law enforcement
purpose - was taken from [existing law, AS 18.13, addressing DNA
samples]; and acknowledged that the phrase, "a law enforcement
purpose" is not defined under either AS 18.13 or proposed new
AS 18.14.
REPRESENTATIVE GRUENBERG pointed out, however, that proposed new
AS 18.14.080(1) does specify that a law enforcement purpose
could include the identification of perpetrators, the
investigation of crimes, the identification of missing or
unidentified persons, or the identification of human remains;
and predicted that the court would be informed by that language
when determining whether some other activity also qualifies as a
law enforcement purpose under the bill.
SENATOR WIELECHOWSKI concurred.
1:47:53 PM
WALTER G. HAMILTON, Senior Consultant, Identification Technology
Partners (IDTP), Inc.; Chairman & President, International
Biometrics & Identification Association (IBIA), explained that
the IBIA opposes SB 98 because it believes that the bill isn't
really going to serve the interests of Alaskans or protect their
privacy in a meaningful fashion, and could instead result in
unintended consequences, because biometric technology is still
evolving. He then provided some hypothetical examples of how
biometric information might be used in the future by security
personnel, retailers, and computer users; such uses, he
predicted, would probably benefit Alaskans. Referring, then, to
the bill's proposed new AS 18.14.070 - addressing the right to
bring civil action against those who violate AS 18.14 - he
characterized it as excessive, somewhat arbitrary, likely to
engender litigation disproportionate to any real injury
resulting from a particular violation, and likely to discourage
the innovation of future uses for biometric data that could
benefit Alaskans in an important fashion. The IBIA, he relayed,
believes that the concerns SB 98 is intended to address stem
partially from a misunderstanding of biometric technology and
how it works; for example, biometric systems in and of
themselves cannot be used to detect diseases, but such unproven
myths about biometric technology are raising fear and concern
way out of proportion to the potential benefits of such
technology. In conclusion, he relayed that the IBIA believes
that SB 98 as currently written would limit the use of biometric
information and thereby deprive Alaskans of the security and
privacy benefits of such use.
1:53:31 PM
JASON GIAMO - after mentioning that he is the former vice
president of the [Alaskan Chapter] of the Institute of
Management Accountants, Inc. (IMA), a certified internal auditor
(CIA), and a certified management accountant (CMA) - referred to
CSSB 98(JUD), and noted that that version of the bill would have
protected Alaskans willing to show other forms of acceptable
identification from being compelled to also submit fingerprints
as identification simply to take a test. Currently, some
Alaskans, including himself, he relayed, are being denied
educational-testing opportunities when they refuse to submit
fingerprints. Canada addressed this issue a few years ago by
deeming a similar requirement for taking the Law School
Admissions Test (LSAT) as being illegal under Canada law; after
that determination was made, the testing organization merely
changed its admission requirements for Canadian applicants in
order to comply with Canada law. Mentioning that he's been
working on legislation similar to [CSSB 98(JUD)] in five other
states and at the national level, he predicted that those
administering the exam for certified public accountants (CPAs)
will simply likewise change their identification requirements
once sufficient legislation [prohibiting] requiring fingerprints
to take exams is passed. Mr. Giamo explained that in 2008, he
was prohibited from taking the CPA exam because he refused to
submit his fingerprints in accordance with a newly-instituted
requirement; he'd provided other documents for identification
purposes - including a U.S. passport, an [Alaska] driver's
license, his birth certificate, his social security card, and
five credit cards - but was told they weren't sufficient forms
of identification regardless that his digital photograph was
still on file from a previous CPA exam.
MR. GIAMO relayed that he has since been working to protect
Alaskans from what he characterized as an "egregious, Orwellian,
and unnecessary" identification requirement for certain exams.
Once a data collection company such as the one that received the
fingerprints from the CPA exam has a person's biometric data,
there isn't any way of knowing what the company will then do
with that data and with which of its clients it will share it.
Remarking on Alaskans' constitutional right to privacy, he
offered his understanding that author, biometrics expert, and
director of the National Biometric Test Center at San Jose State
University - James L. Wayman, Ph.D. - has said that giving
fingerprints as ID for a test is way beyond what is necessary
when a digital picture would accomplish the same thing, and
seems like security theatre. Expressing his distrust of
biometric-data collection companies, Mr. Giamo suggested that a
U.S. passport ought to be a sufficient form of identification
for exam purposes; and recommended that SB 98 be changed to once
again include the provision precluding a person from being
required to provide his/her fingerprints in order to take an
exam - but add in a stipulation that a U.S. passport constitutes
acceptable alternate identification - and to once again include
the provision stipulating that civil action may not be brought
against the state - the removal of which, he added, resulted in
the Department of Law (DOL) changing its zero fiscal note to an
indeterminate fiscal note. In conclusion, he asked that a so-
amended version of SB 98 be moved from committee.
MR. GIAMO, in response to questions, pointed out that the issue
of maintaining Alaskans' privacy with regard to their biometric
data is very, very important and becoming more so because
security breaches of the companies that collect/store/use such
data have occurred and will continue to occur.
2:10:14 PM
MAX E. MERTZ, CPA, Member, Legislation Committee, Alaska Society
of Certified Public Accountants (AKCPA), relayed that he was
testifying on SB 98 on behalf of the Alaska State Board of
Public Accountancy, and, after mentioning that he was its chair
when the fingerprint-identification requirement for CPA exams
was implemented, offered his belief that reinserting the
previously-removed provision regarding alternate identification
for exams would result in Alaska losing its two CPA exam sites.
In conclusion, he said that Alaska's CPA's are not opposed to
the provisions of SB 98 that would protect Alaskans' privacy.
2:14:47 PM
ERNEST PRAX, Staff, Representative Wes Keller, Alaska State
Legislature, on behalf of Representative Keller, offered his
understanding that existing law addressing the protection of
personal information already protects biometric information as
simply another form of personal information, and - referring to
the previously-removed provision allowing alternate
identification for exams - offered his beliefs that requiring an
individual to provide his/her biometric data in order to take
certain exams is warranted, that the companies that
collect/store/use biometric data already have sufficient
security protocols in place, and that if a person doesn't want
to provide his/her fingerprints in order to take an occupational
exam such as the CPA exam, he/she could simply choose to pursue
a different career. In conclusion, he indicated a belief that
it's only government entities that ought to be regulated with
regard to the treatment of biometric information.
2:26:15 PM
TIMOTHY PEARSON, Co-Chair, Citizens for Privacy in Alaska,
mentioning first that he's been working with Mr. Giamo on SB 98
and agrees with his comments, then provided more information
about what occurred in Canada with regard to that country's
determining that requiring a person to provide fingerprints in
order to take the LSAT was illegal under Canada law, including
noting that in case summary 2008-389, Canada's privacy
commissioner wrote in part:
In sum, it's understandable that LSAC wants to ensure
the authenticity of the test scores and to protect the
integrity of the testing process by deterring
impersonation and by providing the means to identify
the test taker in cases of suspected fraud.
Thumbprinting, however, does not effectively meet that
purpose. It is impossible to measure how effective
thumbprinting has been as a deterrent, and the prints
have never actually been used in cases of suspected
impersonation. Its questionable effectiveness and
lack of use for its intended purpose shifts the
balance, making the loss of privacy greater than the
benefit gained. Finally, it is clear that this
purpose can be appropriately met by properly
authenticating candidates when they arrive to take the
test. As a result, I'm not satisfied that the
collection and retention of thumbprints for the
purpose of deterrence is appropriate under subsection
5(3). Furthermore, this practice is not limited to
that which is necessary for this purpose, in
contravention of Principle 4.4.
MR. PEARSON - referring to the CPA exam and the monopoly its
administrators have over those who wish to pursue an accounting
career as illustrative of the need for the state to regulate the
collection, disclosure, and use of biometric information -
opined that Alaskans deserve a privacy standard that meets or
exceeds Canada's. With regard to the issues of security
breaches and government's access of biometric databases, he
recommended that committee members read a law review article
published in the North Carolina Journal of International Law and
Commercial Regulation, titled, "Big Brother's Little Helpers:
How ChoicePoint and Other Commercial Data Brokers Collect,
Process, and Package Your Data for Law Enforcement," by Chris
Jay Hoofnagle, a lecturer in residence at the University of
California, Berkeley - School of Law, Berkeley Center for Law &
Technology. Referring to the previously-removed provision that
would have allowed alternate identification to be used for
occupational examinations, he too suggested that a passport
ought to be a sufficient form of identification for such a
purpose; and recommended that SB 98 be changed to once again
include that provision, as well as the provision exempting the
state from civil action - so as to address the fiscal note. In
conclusion, he too asked that a so-amended version of SB 98 be
moved from committee.
2:34:51 PM
RODNEY DIAL, Lieutenant, Deputy Commander, A Detachment,
Division of Alaska State Troopers, Department of Public Safety
(DPS), said that the DPS is neutral on SB 98, though believes
it's important to retain the bill's proposed AS 18.14.080(1),
the provision exempting the collection, retention, analysis,
disclosure, or distribution of biometric information for a law
enforcement purpose. Even with the exemption, he assured the
committee, due process would still be followed.
2:35:46 PM
HORST POEPPERL, CEO, Borealis Broadband Inc. - after mentioning
that he's worked in the Internet protocol (IP) industry his
entire career and been involved in most of its aspects, and that
he appreciates the movement on SB 98 - spoke about the frequency
with which database security breaches occur, and said it is
guaranteed that once a person's personal information has been
added to a database, it will at some point be lost, stolen, or
sold - even if that personal information consists of
fingerprints. Regardless that people's personal information has
monetary value and is thus sought after by both businesses and
individuals, and for both legitimate and illegitimate purposes,
it should be protected. With regard to the sponsor's concern
that a person's private medical information could be
extrapolated from information contained in a database, he noted
that Forbes had an article about a customer of a retail store
that tracked information about its customers, who found out his
minor daughter was pregnant because the retail store had begun
mailing advertisements and coupons for baby items to his home
based on her purchases and on the product searches she'd
conducted on the store's web site.
MR. POEPPERL acknowledged the validity of the concern that
reinserting the bill's previously-removed provision regarding
alternate identification for exams could result in Alaska losing
its two CPA exam sites, but pointed out that requiring
fingerprints as identification isn't the solution to a lack of
due diligence on the part of exam administrators in terms of
paying attention to who's entering/leaving the exam room. The
privacy protections guaranteed by the Alaska State Constitution
should not be lessened for the benefit of corporations.
Referring to the bill's proposed civil penalty of $5,000, he
indicated that it is nothing compared to what a person must go
through in order to address a loss of personal information,
which, he again remarked, is guaranteed to occur. In
conclusion, he said he would like to see SB 98 amended to again
include the provision stipulating that civil action may not be
brought against the state, and the provision precluding a person
from being required to provide his/her fingerprints in order to
take an exam - but also add in a stipulation that a passport
constitutes acceptable alternate identification - and urged
passage of SB 98.
2:46:54 PM
ANNE CARPENETI, Assistant Attorney General, Legal Services
Section, Criminal Division, Department of Law (DOL), in response
to a question, relayed that when she took the Alaska bar exam,
she was required to provide fingerprints.
VICE CHAIR THOMPSON, after ascertaining that no one else wished
to testify, closed public testimony on SB 98.
VICE CHAIR THOMPSON relayed that [HCS CSSB 98(HSS)] would be
held over in order to allow further research on the issues
raised to be conducted during the interim.
| Document Name | Date/Time | Subjects |
|---|