By Anaya Robinson, Senior Policy Strategist
Biometric identifiers are a person’s most sensitive data. People’s fingerprints, DNA, facial mapping, the way we walk, and the way we think all make up who we are. Some of this data is being collected, stored, and processed by private companies in the tech sector, marketing sector, and even by some employers. This year, the ACLU of Colorado spearheaded efforts to protect Coloradans’ vulnerable information. The ACLU helped develop the Colorado Biometric Identifiers Privacy Act (BIPA), also known as HB24-1130.
BIPA amends the Colorado Privacy Act (CPA) to enhance protections and regulations around private sector use of people’s biometric identifiers. It continues the CPA’s requirement of affirmative consent for the collection of biometric data (which consists of biometric identifiers that are used to uniquely identify an individual) and expands some of our rights under the CPA when it comes to protecting our most personal data types. It also expands the CPA by requiring notice when biometric identifiers are being collected, no matter what they will be used for. When people walk through a grocery store or enter a Rockies game, companies will have to disclose when biometric identifiers are being collected, and what they’re being used for.
Perhaps most importantly, companies will no longer be able to sell or purchase biometric identifiers in Colorado. The ACLU of Colorado also wanted to ensure that the safety of a person’s biometric data wasn’t dependent on their affiliation with a company, so we added employee biometric identifiers into the CPA. The CPA does not currently protect employees; however, by adding this provision, we can ensure that when someone uses their fingerprint or face to clock in and out of work, for example, that data is kept just as safe as when a person uses it to open their phone.
This bill had bi-partisan support, with Representatives Lindsey Daugherty (Democrat) and Mike Lynch (Republican) and Senators Paul Lundeen (Republican) and Chris Hansen (Democrat) all signing on as co-sponsors. The ACLU worked with over 400 stakeholders and partners on this bill to make sure it struck the right balance of protection while still supporting and reaping the benefits of innovation. BIPA passed unanimously through the House and Senate and is heading to the Governor’s desk to be signed, ensuring that, come July 1, 2025, in Colorado, every Coloradan will solely own the rights to their biometric data.