SB 98-BIOMETRIC INFORMATION FOR ID  1:33:32 PM CHAIR FRENCH announced the consideration of SB 98 and noted that the committee was hearing the version that came from the State Affairs Committee. SENATOR WIELECHOWSKI said he introduced the bill last year but time ran out before it made it through both bodies. He decided to reintroduce the bill when concerns were again raised about how biometric information is collected and used. The bill basically does two things. First, AS 18.14.010 which is found on page 1, lines 5-9, says a person may not retain, analyze, disclose, or distribute someone's biometric information without first obtaining the informed consent of that individual. Second, the language on page 1, lines 10-15, says that an individual is not required to provide their biometric data for the purpose of identification if they provide either a passport or some other form of identification card. The Alaska Constitution has a very good privacy provision and this bill seeks to continue that protection now and in the future. Alaskans don't want private information about themselves like iris scans, hand geometry recognition, and retinal scans floating around and this bill seeks to provide that protection. He said his staff member would answer questions or walk through the bill. 1:36:19 PM MICHAEL CAUFIELD, Staff to Senator Wielechowski, introduced himself and offered to proceed at the chair's direction. CHAIR FRENCH asked if the bill interferes with the ability of the Department of Corrections (DOC), the Department of Public Safety (DPS), or the Department of Law (DOL), to fingerprint criminals and retain those fingerprints to analyze in a database. MR. CAUFIELD replied the bill provides exemptions for law enforcement purposes including identification of perpetrators, investigation of crimes, identification of missing or unidentified persons, or identification of human remains. Exemptions are also provided for the Department of Administration for presenting drivers licenses and any facial images as well as any biometric information when authorized by state or federal law. While the Department of Health and Social Services (DHSS) hasn't endorsed the bill, it has no stated objection. 1:38:06 PM SENATOR COGHILL asked if the Health Insurance Portability and Accountability Act (HIPAA) requirements are covered under the federal exemption. MR. CAUFIELD replied anything that's written in state or federal statute is exempted from this law. He added that the bill may be amended to expand the exemptions to address DOL's concern about having private rights of action brought against them. SENATOR COGHILL questioned how the revocation provision would mesh with the electronic signature laws that accommodate people who are physically unable to sign for themselves. MR. CAUFIELD replied the bill specifically states that a person can consent to have their fingerprints used for identification purposes. 1:40:41 PM SENATOR MCGUIRE joined the committee. CHAIR FRENCH asked if the bill would stop store owners from capturing images of their customers when on the premises. MR. CAUFIELD replied the bill still allows the use of security cameras to keep people from shoplifting and there's also an exemption for circumstances like grandma taking pictures at a family picnic. CHAIR FRENCH asked which aspect of the definition of biometric system allows store owners to continue to run closed video. MR. CAUFIELD directed attention to Sec.18.14.090(3)(D), "comparing the biometric data extracted under (B) of this paragraph with biometric data stored for the individual for use in future recognition of the individual;" and said that to run afoul of the statute the store owner would need to make a comparison with a past picture in order to monitor the person's whereabouts. He added that DOL has said that facial recognition is when you use a machine to identify the person. The packets contain a report from the Electronic Frontier Foundation indicating that facial recognition scans were used at the Tampa Bay Super Bowl just before 9/11. CHAIR FRENCH reviewed the report and asked if this bill would prohibit that sort of police or private security activity from taking place in the state of Alaska. MR. CAUFIELD answered yes. 1:44:10 PM MICHAEL LESMEIER, State Farm Insurance, expressed concern about what SB 98 would prevent. For example, a private building owner couldn't use biometric information for building security, computer security, and a variety of other ways that the information potentially can be used or could be used in the future. State Farm doesn't use this information in Alaska but a company that wanted to would need to have two separate security systems, one for the people who gave consent and the other for those who did not give consent. Our judgment is that's not good, he stated. Perhaps there are situations where this sort of information is being captured and misused, but State Farm isn't aware of any and wonders about the wisdom of taking this kind tool off the table. CHAIR FRENCH asked if State Farm gathers biometric information as part of its insurance work. MR. LESMEIER answered no, but he believes it's used for security purposes in one building at the home office in Illinois. CHAIR FRENCH expressed surprise that building security is a core concern of State Farm. MR. LESMEIER responded that building security is a legitimate concern of anybody in private or public business, both during and after hours. In particular, it's a concern for anyone who handles confidential information. We may have other concerns as we study the bill further, but we would urge caution when there doesn't appear to be an immediate need, he stated. 1:48:07 PM SENATOR PASKVAN referenced the exemption under Sec.18.14.060 (1) on page 2, line 18, and wondered if that exemption would satisfy State Farm's concerns to gather biometric data for internal law enforcement purposes. What the bill intends to stop is State Farm or any other company from extracting that data and using it to target their own customers or others. MR. LESMEIER said this bill would prevent companies from using this information to protect buildings, computers, medical information, and financial information and that's not a good idea. CHAIR FRENCH posed a hypothetical situation of an employer who requires his employees to consent to a thumbprint scan to password protect company computer files. He said he didn't know if that would run afoul of Sec.18.14.050 and create a private right of action, but he believes that collecting and using that information for a private business purpose is different than someone who collects and then uses the information from the public at large. He opined that collecting biometric information for the purpose of building security would be problematic because it affects people who are not employed by the owner of the building. MR. LESMEIER said his understanding of the bill is that a potential employee would have to consent to the thumb scan and it couldn't be a condition of employment because that would create a private cause for action. He added that he appreciates the committee's concern about secondary use of the information, but the bill goes way beyond that. 1:54:06 PM SENATOR WIELECHOWSKI said he reads the bill differently. The purpose of the bill is to protect an individual's privacy by limiting the secondary transmission and use of this personal information. He offered to work with the drafter to clarify that because biometric information does have certain values. CHAIR FRENCH referenced point three on the sponsor's fact sheet that indicates that the bill is aimed at organizations that collect and sell biometric data to third parties without consent. The fourth point states that biometric data is useful in fields like medicine and security and the bill doesn't aim to stop that use, but it has to be with consent. 1:56:25 PM HORST POEPPERL, Chief Executive Officer, Borealis Broadband Inc., Anchorage, AK stated strong support for SB 98 because people today face an onslaught of organizations determined to extract every piece of personal information possible. This situation is out of hand, and is becoming more and more dangerous for the average citizen. Companies buy and sell this data, and it can also be lost or stolen. The best defense is not giving up the information in the first place.  The best protection is to not allow the data to be collected in the first place. The idea that a nation is more secure by collecting private information is Orwellian at best. In fact, we need to reverse the data mining that already exists, he stated. 2:00:51 PM TIMOTHY PEARSON, Executive Coach, Pearson Consulting, Anchorage, AK, stated support for SB 98. He pointed out that Section 1.22 of the Alaska State Constitution clearly recognizes the right of the people to privacy without infringement, and states that the Legislature shall implement this section. We need to look at what that means and how to apply it in a digital era but the reasons undergirding that constitutional right are unchanging and significant, he stated. This bill will help correct some of the current imbalance given the fact that the power of private sector databases has significantly altered the balance of power between the state and the individual. He suggested the committee review the book "Identity Crisis: How Identification is Overused and Misunderstood" by Jim Harper and an article entitled "Big Brothers Little Helpers: How Choicepoint and Other Commercial Data Brokers Collect, Process, and Package Your Data for Law Enforcement" by Chris Jay Hoofnagle. MR. PEARSON said he would also note that you can't always trust the people at the top of an organization regarding the security of personal data; that is where most security breaches occur. He cited information from a WikiLeaks document in which the head of TSA offered U.S. citizen fingerprint databases to the head of the Egyptian secret police in exchange for the Egyptian government sharing fingerprints of extremists that it had on file. Trusting that law enforcement agencies will handle such information securely has been breached such that the safeguards provided by Section 1.22 of the Alaska constitution deserve to be strengthened, he concluded. 2:08:12 PM JASON GIAIMO, Co-chair, Citizens for Privacy in Alaska, and President, Net Gain Business Consultants of Alaska, Anchorage, AK, said he doesn't believe that SB 98 would affect anybody who puts up a surveillance camera in their shop unless they also use facial recognition software. Actually, he said, the question boils down to whether Alaskans should be compelled to submit to fingerprinting that will be stored in a private database. He thinks the answer is no because it will get lost. The State of Alaska knows this. Data mining and biometrics collection is big business; it is estimated that industry revenues will exceed $7.5 billion in 2012 alone. Corporate revenues from fingerprints, iris, vein scanning and facial recognition and surveillance make up about 49 percent of that total. The Superintendent of the Los Angeles unified school district is considering mandatory fingerprinting of all low income school children or they will be denied subsidized lunches. A city in Arizona is trying to pass an ordinance requiring fingerprint ID to receive medicine at a local pharmacy. MR. GIAIMO said his involvement started in 2008 when he went to take the last two parts of the CPA exam in Anchorage. He was told that policy had changed and his fingerprints were required as proof of identification; a passport, driver's license, or birth certificate was no longer sufficient as ID to enter the exam room. He refused, which was very hard, but he felt it was important to retain his integrity. Because he is also a certified internal auditor, he was able to follow the money trail. He learned that a company called Prometric Corporation receives a fee for collecting the fingerprints, and they sell the data to an international data mining company called ChoicePoint. This company is owned by LexisNexis who received the largest fine in the history of the Federal Trade Commission for violating consumer privacy rights, federal laws, and for making false statements about their privacy policies. These companies are all about maximizing profits for shareholders and their goal is to profit from Alaskans' loss of privacy. View what they say in that context, he cautioned. 2:15:15 PM CHAIR FRENCH announced he would hold SB 98 in committee.