State biometric privacy laws

5 minutes 5 Questions

Illinois BIPA and its private right of action, Texas CUBI and Washington's biometric statute, and how consent and retention requirements differ.

Test mode:
Start practice test

CIPP/US - State biometric privacy laws Example Questions

Test your knowledge of State biometric privacy laws

Question 1

A national employer deploys a facial recognition security system at its Illinois warehouses. The employer obtains written releases from all staff and mandates that the third-party system vendor securely encrypts all data. The employer relies entirely on the vendor to maintain the data retention schedule. How should the privacy officer evaluate this deployment's compliance posture?

Correct Answer: The employer faces statutory liability by failing to publish its own written policy establishing a retention schedule and destruction guidelines.

The correct answer is right because the Illinois Biometric Information Privacy Act requires private entities to develop and publish their own written policy establishing a retention schedule and destruction guidelines for biometric data.

The other options are incorrect because securing written consent and encryption alone fail to satisfy the mandate for a publicly available retention policy. Additionally, transferring biometric data does not require prior administrative approval from state agencies, and the law does not mandate submitting an annual risk assessment to the attorney general.

Key concept: Illinois Biometric Information Privacy Act retention policy requirements.

Question 2

Under the Illinois Biometric Information Privacy Act (BIPA), what constitutes the maximum statutory retention period for collected biometric identifiers?

Correct Answer: When the initial collection purpose is satisfied or within three years of the individual's last interaction, whichever occurs first.

The correct answer is right because the Illinois Biometric Information Privacy Act mandates that private entities must permanently destroy biometric data when the initial purpose for collection has been satisfied or within three years of the individual's last interaction, whichever occurs first.
Withdrawal of consent does not dictate the statutory retention maximum under this specific provision. Five years from the collection date is incorrect because the statute specifies three years from the last interaction. One year following the final transaction is incorrect because the maximum timeframe is three years.
The key concept tested is statutory biometric data retention limits under Illinois privacy law.

Question 3

An Illinois retail chain uses a facial recognition system to identify loyalty program members entering its stores. The system vendor offers the retailer a twenty percent discount on monthly software licensing fees if the retailer agrees to share the collected facial geometry data to help train the vendor's proprietary algorithms. Under the Illinois Biometric Information Privacy Act (BIPA), how must the retailer handle this vendor proposal?

Correct Answer: Reject the vendor arrangement because the applicable statute expressly forbids covered organizations from trading or otherwise deriving a profit from consumers' biometric information.

The retailer must reject the arrangement because the Illinois Biometric Information Privacy Act explicitly prohibits private entities from selling, leasing, trading, or otherwise profiting from an individual's biometric identifiers or biometric information.
Executing a contract with safeguards does not cure the statutory ban on profiting from biometric data. Securing signed written releases permits disclosure but does not override the absolute prohibition against monetizing the data. Committing to data destruction addresses retention limits rather than the illegal financial incentive.
The key concept tested is the strict statutory prohibition under BIPA against selling or profiting from biometric data.

More State biometric privacy laws questions
27 questions (total)
Start 27 question test

Other State Privacy Laws concepts

Applicability thresholds and exemptions in state privacy lawsCalifornia CCPA as amended by the CPRACalifornia Consumer Privacy Act (CCPA) and CPRAConsumer rights common to the state comprehensive lawsFederal vs. State Authority and PreemptionKey Differences Among State Breach Notification LawsNYDFS Part 500 cybersecurity regulationOther Comprehensive State Privacy LawsRecent State Privacy Legislative DevelopmentsSensitive data and consent under state lawsState attorney general enforcement and cure periodsState consumer health data lawsState Data Breach Notification Law ElementsState Security Procedures and Cookie RegulationsState SSN and Data Destruction LawsUniversal opt-out mechanismsVirginia Consumer Data Protection Act (VCDPA)
All State Privacy Laws questions · CIPP/US practice test