Biometrics bill takes on a life of its own

Late session bill dominates legislature’s closing days

Every now and then, a bill comes from out of nowhere to become the “it” bill of the legislative session – one that consumes significant time and effort from lobbyists and lawmakers alike. This session that bill was LD 1945, An Act to Regulate the Use of Biometric Identifiers.

Sponsored by Rep. Margaret O’Neil (D-Saco), the bill had a tortured path through the legislative process. After undergoing nearly a dozen different parliamentary motions in the Senate alone, it was amended from the floor three times between both bodies and headed for a fourth floor amendment before the bill was finally sorted out. It was one of those bills that the legislature could not seem to resolve.

The bill itself was introduced late in January during the second session and did not have a public hearing before the Joint Standing Committee on the Judiciary until the end of February. The committee held two work sessions on the bill in March but did not report the bill out of committee until April 14 – just a week before statutory adjournment. All this is important, as the bill proved to be complex and controversial considering that supporters were desperate to push a flawed piece of legislation through in the session’s closing days.

As drafted, the bill sought to put in place strict regulations and requirements over the use of “biometric identifiers” in Maine. Biometric identifiers are most easily thought of as things like voice, fingerprint or facial recognition used to access our phones, online banking services, credit services, or voice recognition programs. Unheard of and undeveloped even 10 years ago, they are ubiquitous today on cell phones and crucial to those of us who either can’t remember our passwords, want the added security, or both.

LD 1945 was based on legislation passed in Illinois in 2008. In fact, Illinois is the only state with such a strict biometric law, known as the Biometric Information Privacy Act (BIPA). It is worth noting that since BIPA’s enactment in 2008, much has happened in the privacy, security, and technology arena since then. For instance, cell phones didn’t have fingerprint readers in 2008. As drafted, the bill proposed putting in place strict regulations about how and when biometrics could be used in Maine, including not allowing for the use of biometric data for security or fraud prevention, without separate opt-in consent every year for all consumers, while not allowing a clear security exception. However, more troubling than the regulations were the penalties associated with not following them – even accidentally.

As drafted, the bill contained an extremely broad private right of action, including allowing for class action lawsuits. This part of the bill mirrored the Illinois law and has been a disaster for both large and small businesses there. In fact, Illinois has experienced nearly 300 lawsuits annually as a result of the passage of their legislation. In the past five years, trial lawyers have filed more than 1,000 class action lawsuits based on BIPA. The average cost to defend these is $500,000 per case. For this reason, Illinois is actively considering several bipartisan bills amending the law to address this significant unintended consequence and bring beneficial services back to Illinois consumers. The proposed Maine law was arguably worse than Illinois’ because an individual only need to allege harm or violation.

However, the consequences of the bill as drafted were more problematic for Maine consumers. Technology devices would ultimately be less secure because the use of biometrics will likely disappear or be harder to use here in Maine, as they have been in Illinois. Using biometric information for security and authentication purposes protects consumers from hackers and thieves. Biometrics are far more secure and convenient for consumers to use than usernames and passwords. As mentioned, LD 1945 did not allow for the use of biometric data for security or fraud prevention, without separate opt-in consent every year. In addition, technology options would likely be restricted, as the bill creates a negative environment for technological innovations in Maine by making biometric data very burdensome for companies to employ in products. Under Illinois’ BIPA, companies are actively disabling and restricting features of widely available technology products to prevent their use for consumers there due to the threat of litigation through the private right of action portion of the law.

All these concerns resulted in the Maine State Chamber strongly opposing the bill and joining a broad coalition of business groups including banks, credit unions, health care providers, retailers, and others to work for a better alternative.

If the bill as originally offered wasn’t bad enough, the work sessions in committee did not improve it. After debating the merits of the bill twice, the committee split three ways on its recommendation to the full legislature. At the time, a majority of the committee voted to recommend a study of the issue, the usage, and best ways to protect biometric identifiers. The majority report was championed by Rep. Steve Moriarty (D-Cumberland) and the committee’s Senate chair, Sen. Anne Carney (D-Cumberland).

A minority of the committee voted “ought to pass” on an amended form of the bill – knowing it was incomplete, had technical problems, did not include input from impacted stakeholders, and would likely result in unintended consequences. To help allay concerns, the implementation date of the new law would be delayed until January 1, 2024. In the meantime, their proposal further included a study committee that would meet after the passage of the bill, develop any necessary changes, and submit corrective legislation in the First Session of the 131st Legislature in January. In other words, pass the bill then come back – maybe next year – and fix it.

Additionally, a third faction of the committee submitted a straight “ought not to pass” vote.

The Maine State Chamber and others in the coalition strongly supported the majority report’s idea of studying how best to address this developing technology by bringing stakeholders to the table and taking the time to get this important issue right.

Anything can happen with three reports on a single bill, and in the case of LD 1945, that proved to be true. Because the committee’s House chair, Rep. Thom Harnett (D-Gardiner), was on the minority report, that report was moved and passed in the Maine House of Representatives. It was not without debate, and committee members changed their positions from support of the majority report to support of the minority report.  

When the bill arrived in the Senate, the majority report was accepted overwhelmingly. Therefore, the bodies disagreed over the posture of the legislation, called non-concurrence. LD 1945’s sponsor, Rep. O’Neil, tried to amend the bill to get enough senators to join the House in passing the bill, but was unsuccessful twice. As the session wound down, the Senate insisted on their version, and ultimately the House did the same – even as the sponsor was allegedly working on yet a third amendment. Ultimately, the bill died in non-concurrence.

Despite significant discussion and time spent on what is acknowledged by all interested parties as an important issue, nothing came from the debate. This is unfortunate, as there was, from the business community’s perspective, a reasonable alternative for lawmakers in the form of a study. However, passing a bill and then studying the issue to fix its flaws is simply no way to govern. Without question, the Maine State Chamber and others expect to see similar legislation on this important topic in the next session.

The Maine State Chamber of Commerce would like to thank Sen. Anne Carney and Rep. Steve Moriarty (D-Cumberland) for their work, debate, and leadership on this important bill.

While ultimately no legislation was enacted on this issue, it will likely be back in 2023. Likewise, the Maine State Chamber of Commerce will once again be present to make sure our members’ concerns are heard. For questions or additional information, please contact Peter Gore by calling (207) 623-4568, ext. 107, or by emailing [email protected].