SB 98 - BIOMETRIC INFORMATION FOR ID 1:19:47 PM VICE CHAIR THOMPSON announced that the final order of business would be CS FOR SENATE BILL NO. 98(JUD), "An Act relating to biometric information." [Before the committee was HCS CSSB 98(HSS).] 1:20:09 PM SENATOR BILL WIELECHOWSKI, Alaska State Legislature, sponsor - noting that Article I, Section 22, of the Alaska State Constitution says that the right of the people to privacy is recognized and shall not be infringed, and that the legislature shall implement that section - explained that SB 98 would regulate the collection, disclosure, and use of biometric information, and would define that term. 1:21:43 PM SAMUEL GOTTSTEIN, Staff, Senator Bill Wielechowski, on behalf of the sponsor, Senator Wielechowski, first, in response to a question, acknowledged that the sectional analysis for SB 98 included in members' packets and dated January 17, 2012, doesn't reflect the most recent changes to the bill. Remarking, then, that the Alaska State Constitution provides for a greater right to privacy than the U.S. Constitution, he referred to the bill's proposed new AS 18.14.090(1), which now defines the term, "biometric data" to mean "finger prints, handprints, voices, iris images, retinal images, vein scans, hand geometry, or other physical characteristics of an individual". The phrase, "or other physical characteristics of an individual", he noted, was added to that definition in order to address possible future advancements in technology. In response to another question, he indicated that the concern SB 98 is intended to address revolves around the possibility that a person's private medical information could be extrapolated from his/her biometric data; that with regard to a person's biometric data, the bill would afford protections similar to those afforded to a person under existing law with regard to his/her deoxyribonucleic acid (DNA) samples; and that providing protections for biometric data via state law is necessary because federal law doesn't yet do so in a uniform manner. MR. GOTTSTEIN mentioned that thus far, 18 other states have adopted laws addressing biometric data, and that members' packets contain a memorandum dated March 15, 2012, from Legislative Legal and Research Services specifically addressing the [biometric data] laws of Illinois, Indiana, and Texas. Protecting the privacy of Alaska's citizens [as the bill is proposing to do] is particularly important given that a person's biometric data can be misused due to recent advancements in technology; given that once a person's biometric data has been so misused, it can't just simply be replaced/returned; and given that database security breaches are now common. Senate Bill 98 as currently written would provide reasonable privacy protections for Alaskans: requiring that collectors of biometric information provide clear notice of the intended use and receive documented consent for that use; prohibiting other uses or sale; addressing storage and disposal; and providing civil penalties for violations. In response to a further question, he explained that the bill no longer contains a provision allowing for alternate identification to be used for occupational examinations; that provision was originally included in the bill in order to preclude a person from being required to provide his/her fingerprints, for example, just to take an examination. 1:30:54 PM MR. GOTTSTEIN, to address the other changes incorporated into HCS CSSB 98(HSS), then explained that the language in proposed new AS 18.14.010(b) - pertaining to revoking/amending consent for biometric information collection - was cleaned up but no substantive change was made. Proposed new AS 18.14.040 - pertaining to the disposal of biometric information - no longer contains language providing for the removal and destruction of a person's biometric information at his/her written request, because it was thought that that language would defeat the purpose of certain security measures. Proposed new AS 18.14.050 - pertaining to the use of biometric information - no longer contains language stipulating that biometric information may not be used for marketing or general surveillance purposes, because it was thought that a person might indeed want to have his/her biometric information used for such a purpose. Proposed new AS 18.14.070 - pertaining to the right of bringing civil action against violators of proposed new AS 18.14 - now uses the word, "intentionally" instead of "knowingly", thereby providing for a higher culpable mental state; now clarifies that the penalties may not exceed the stipulated amounts; and no longer stipulates that civil action may not be brought against the state [or its agencies, or the officers or employees of such]. Proposed new AS 18.14.080 - pertaining to exemptions from proposed new AS 18.14 - now exempts, via its proposed new paragraph (4), photographs [not collected specifically for use in a biometric system]. And proposed new AS 18.14.090 - defining the terms used in proposed new AS 18.14 - no longer defines the terms, "facial mapping" or "facial recognition", because those terms were removed from the definitions of the terms, "biometric data" and "biometric information", with those two definitions now including the phrases, "other physical characteristics of an individual", and, "other recognition of a physical characteristic of an individual", respectively. MR. GOTTSTEIN, in response to a question, relayed that the bill's proposed new AS 18.14.080(3) provides an exemption for facial images used in driver's licenses and state identification (ID) cards issued by the Department of Administration (DOA). REPRESENTATIVE HAWKER noted that proposed new AS 18.14.090 does not provide definitions for the aforementioned newly-added phrases, "other physical characteristics of an individual", and, "other recognition of a physical characteristic of an individual". 1:40:12 PM MR. GOTTSTEIN, in response to other questions, offered his understanding that the bill won't apply to the collection of medical or dental information because [such is already addressed under existing law and] the bill's proposed new AS 18.14.080(2) provides an exemption for the collection, retention, analysis, disclosure, or distribution of biometric information authorized under state or federal law. In response to a further question, he explained that the language in proposed new AS 18.14.080(1) - exempting the collection, retention, analysis, disclosure, or distribution of biometric information for a law enforcement purpose - was taken from [existing law, AS 18.13, addressing DNA samples]; and acknowledged that the phrase, "a law enforcement purpose" is not defined under either AS 18.13 or proposed new AS 18.14. REPRESENTATIVE GRUENBERG pointed out, however, that proposed new AS 18.14.080(1) does specify that a law enforcement purpose could include the identification of perpetrators, the investigation of crimes, the identification of missing or unidentified persons, or the identification of human remains; and predicted that the court would be informed by that language when determining whether some other activity also qualifies as a law enforcement purpose under the bill. SENATOR WIELECHOWSKI concurred. 1:47:53 PM WALTER G. HAMILTON, Senior Consultant, Identification Technology Partners (IDTP), Inc.; Chairman & President, International Biometrics & Identification Association (IBIA), explained that the IBIA opposes SB 98 because it believes that the bill isn't really going to serve the interests of Alaskans or protect their privacy in a meaningful fashion, and could instead result in unintended consequences, because biometric technology is still evolving. He then provided some hypothetical examples of how biometric information might be used in the future by security personnel, retailers, and computer users; such uses, he predicted, would probably benefit Alaskans. Referring, then, to the bill's proposed new AS 18.14.070 - addressing the right to bring civil action against those who violate AS 18.14 - he characterized it as excessive, somewhat arbitrary, likely to engender litigation disproportionate to any real injury resulting from a particular violation, and likely to discourage the innovation of future uses for biometric data that could benefit Alaskans in an important fashion. The IBIA, he relayed, believes that the concerns SB 98 is intended to address stem partially from a misunderstanding of biometric technology and how it works; for example, biometric systems in and of themselves cannot be used to detect diseases, but such unproven myths about biometric technology are raising fear and concern way out of proportion to the potential benefits of such technology. In conclusion, he relayed that the IBIA believes that SB 98 as currently written would limit the use of biometric information and thereby deprive Alaskans of the security and privacy benefits of such use. 1:53:31 PM JASON GIAMO - after mentioning that he is the former vice president of the [Alaskan Chapter] of the Institute of Management Accountants, Inc. (IMA), a certified internal auditor (CIA), and a certified management accountant (CMA) - referred to CSSB 98(JUD), and noted that that version of the bill would have protected Alaskans willing to show other forms of acceptable identification from being compelled to also submit fingerprints as identification simply to take a test. Currently, some Alaskans, including himself, he relayed, are being denied educational-testing opportunities when they refuse to submit fingerprints. Canada addressed this issue a few years ago by deeming a similar requirement for taking the Law School Admissions Test (LSAT) as being illegal under Canada law; after that determination was made, the testing organization merely changed its admission requirements for Canadian applicants in order to comply with Canada law. Mentioning that he's been working on legislation similar to [CSSB 98(JUD)] in five other states and at the national level, he predicted that those administering the exam for certified public accountants (CPAs) will simply likewise change their identification requirements once sufficient legislation [prohibiting] requiring fingerprints to take exams is passed. Mr. Giamo explained that in 2008, he was prohibited from taking the CPA exam because he refused to submit his fingerprints in accordance with a newly-instituted requirement; he'd provided other documents for identification purposes - including a U.S. passport, an [Alaska] driver's license, his birth certificate, his social security card, and five credit cards - but was told they weren't sufficient forms of identification regardless that his digital photograph was still on file from a previous CPA exam. MR. GIAMO relayed that he has since been working to protect Alaskans from what he characterized as an "egregious, Orwellian, and unnecessary" identification requirement for certain exams. Once a data collection company such as the one that received the fingerprints from the CPA exam has a person's biometric data, there isn't any way of knowing what the company will then do with that data and with which of its clients it will share it. Remarking on Alaskans' constitutional right to privacy, he offered his understanding that author, biometrics expert, and director of the National Biometric Test Center at San Jose State University - James L. Wayman, Ph.D. - has said that giving fingerprints as ID for a test is way beyond what is necessary when a digital picture would accomplish the same thing, and seems like security theatre. Expressing his distrust of biometric-data collection companies, Mr. Giamo suggested that a U.S. passport ought to be a sufficient form of identification for exam purposes; and recommended that SB 98 be changed to once again include the provision precluding a person from being required to provide his/her fingerprints in order to take an exam - but add in a stipulation that a U.S. passport constitutes acceptable alternate identification - and to once again include the provision stipulating that civil action may not be brought against the state - the removal of which, he added, resulted in the Department of Law (DOL) changing its zero fiscal note to an indeterminate fiscal note. In conclusion, he asked that a so- amended version of SB 98 be moved from committee. MR. GIAMO, in response to questions, pointed out that the issue of maintaining Alaskans' privacy with regard to their biometric data is very, very important and becoming more so because security breaches of the companies that collect/store/use such data have occurred and will continue to occur. 2:10:14 PM MAX E. MERTZ, CPA, Member, Legislation Committee, Alaska Society of Certified Public Accountants (AKCPA), relayed that he was testifying on SB 98 on behalf of the Alaska State Board of Public Accountancy, and, after mentioning that he was its chair when the fingerprint-identification requirement for CPA exams was implemented, offered his belief that reinserting the previously-removed provision regarding alternate identification for exams would result in Alaska losing its two CPA exam sites. In conclusion, he said that Alaska's CPA's are not opposed to the provisions of SB 98 that would protect Alaskans' privacy. 2:14:47 PM ERNEST PRAX, Staff, Representative Wes Keller, Alaska State Legislature, on behalf of Representative Keller, offered his understanding that existing law addressing the protection of personal information already protects biometric information as simply another form of personal information, and - referring to the previously-removed provision allowing alternate identification for exams - offered his beliefs that requiring an individual to provide his/her biometric data in order to take certain exams is warranted, that the companies that collect/store/use biometric data already have sufficient security protocols in place, and that if a person doesn't want to provide his/her fingerprints in order to take an occupational exam such as the CPA exam, he/she could simply choose to pursue a different career. In conclusion, he indicated a belief that it's only government entities that ought to be regulated with regard to the treatment of biometric information. 2:26:15 PM TIMOTHY PEARSON, Co-Chair, Citizens for Privacy in Alaska, mentioning first that he's been working with Mr. Giamo on SB 98 and agrees with his comments, then provided more information about what occurred in Canada with regard to that country's determining that requiring a person to provide fingerprints in order to take the LSAT was illegal under Canada law, including noting that in case summary 2008-389, Canada's privacy commissioner wrote in part: In sum, it's understandable that LSAC wants to ensure the authenticity of the test scores and to protect the integrity of the testing process by deterring impersonation and by providing the means to identify the test taker in cases of suspected fraud. Thumbprinting, however, does not effectively meet that purpose. It is impossible to measure how effective thumbprinting has been as a deterrent, and the prints have never actually been used in cases of suspected impersonation. Its questionable effectiveness and lack of use for its intended purpose shifts the balance, making the loss of privacy greater than the benefit gained. Finally, it is clear that this purpose can be appropriately met by properly authenticating candidates when they arrive to take the test. As a result, I'm not satisfied that the collection and retention of thumbprints for the purpose of deterrence is appropriate under subsection 5(3). Furthermore, this practice is not limited to that which is necessary for this purpose, in contravention of Principle 4.4. MR. PEARSON - referring to the CPA exam and the monopoly its administrators have over those who wish to pursue an accounting career as illustrative of the need for the state to regulate the collection, disclosure, and use of biometric information - opined that Alaskans deserve a privacy standard that meets or exceeds Canada's. With regard to the issues of security breaches and government's access of biometric databases, he recommended that committee members read a law review article published in the North Carolina Journal of International Law and Commercial Regulation, titled, "Big Brother's Little Helpers: How ChoicePoint and Other Commercial Data Brokers Collect, Process, and Package Your Data for Law Enforcement," by Chris Jay Hoofnagle, a lecturer in residence at the University of California, Berkeley - School of Law, Berkeley Center for Law & Technology. Referring to the previously-removed provision that would have allowed alternate identification to be used for occupational examinations, he too suggested that a passport ought to be a sufficient form of identification for such a purpose; and recommended that SB 98 be changed to once again include that provision, as well as the provision exempting the state from civil action - so as to address the fiscal note. In conclusion, he too asked that a so-amended version of SB 98 be moved from committee. 2:34:51 PM RODNEY DIAL, Lieutenant, Deputy Commander, A Detachment, Division of Alaska State Troopers, Department of Public Safety (DPS), said that the DPS is neutral on SB 98, though believes it's important to retain the bill's proposed AS 18.14.080(1), the provision exempting the collection, retention, analysis, disclosure, or distribution of biometric information for a law enforcement purpose. Even with the exemption, he assured the committee, due process would still be followed. 2:35:46 PM HORST POEPPERL, CEO, Borealis Broadband Inc. - after mentioning that he's worked in the Internet protocol (IP) industry his entire career and been involved in most of its aspects, and that he appreciates the movement on SB 98 - spoke about the frequency with which database security breaches occur, and said it is guaranteed that once a person's personal information has been added to a database, it will at some point be lost, stolen, or sold - even if that personal information consists of fingerprints. Regardless that people's personal information has monetary value and is thus sought after by both businesses and individuals, and for both legitimate and illegitimate purposes, it should be protected. With regard to the sponsor's concern that a person's private medical information could be extrapolated from information contained in a database, he noted that Forbes had an article about a customer of a retail store that tracked information about its customers, who found out his minor daughter was pregnant because the retail store had begun mailing advertisements and coupons for baby items to his home based on her purchases and on the product searches she'd conducted on the store's web site. MR. POEPPERL acknowledged the validity of the concern that reinserting the bill's previously-removed provision regarding alternate identification for exams could result in Alaska losing its two CPA exam sites, but pointed out that requiring fingerprints as identification isn't the solution to a lack of due diligence on the part of exam administrators in terms of paying attention to who's entering/leaving the exam room. The privacy protections guaranteed by the Alaska State Constitution should not be lessened for the benefit of corporations. Referring to the bill's proposed civil penalty of $5,000, he indicated that it is nothing compared to what a person must go through in order to address a loss of personal information, which, he again remarked, is guaranteed to occur. In conclusion, he said he would like to see SB 98 amended to again include the provision stipulating that civil action may not be brought against the state, and the provision precluding a person from being required to provide his/her fingerprints in order to take an exam - but also add in a stipulation that a passport constitutes acceptable alternate identification - and urged passage of SB 98. 2:46:54 PM ANNE CARPENETI, Assistant Attorney General, Legal Services Section, Criminal Division, Department of Law (DOL), in response to a question, relayed that when she took the Alaska bar exam, she was required to provide fingerprints. VICE CHAIR THOMPSON, after ascertaining that no one else wished to testify, closed public testimony on SB 98. VICE CHAIR THOMPSON relayed that [HCS CSSB 98(HSS)] would be held over in order to allow further research on the issues raised to be conducted during the interim.