Technology
Considering touchless biometric tech? Read this first
The pandemic has ushered in a new demand for touchless tech at all levels of customer and employee engagement at QSRs. But before you make the leap to any type of biometric-based tech, make sure you're on the right side of the law.
July 21, 2020 by Bradley Cooper — Editor, ATM Marketplace & Food Truck Operator
Editor's note: This story first appeared on sister site, Digital Signage Today. That site's editor, Bradley Cooper, said some businesses are now using biometrics, like retinal scanning, to perform any number of employee- or customer-directed actions that get business done without using the touch of a hand or finger, a definite advantage in a COVID-19-era world.
If your QSR is considering touchless technology of any kind you are certainly not alone, as fast food brands flock to all types of equipment under the touchless heading to help customers and employees feel safer at a time when the touch of a hand or finger can mean transmission of COVID-19, or any other invisible-to-the-eye contaminant. In QSRs and other businesses, touchless tech can now do everything from performing payments, triggering digital signage content or otherwise interacting with users in a completely hands-free manner.
Still, these types of potentially useful technologies have also spawned questions around their legality, with some U.S. states already having laws on the books about how this tech can be used and where. One example is the Illinois' Biometric Information Privacy Act, which governs all businesses using this type of tech within that state.
Recently, a partner and attorney with the legal firm of Burke, Warren, MacKay & Serritella, Brian Weinthal, fielded some questions around these types of regulations and how businesses — including QSRs interested in employing the technology — can make sure they remain on the right side of the law early on in the process of investigating these options.
Q. How will the Illinois Biometric Information Privacy Act, referred to as BIPA, affect businesses who want to use touchless tech?
A. Any business that invests in touchless technology and operates in Illinois will need to be aware of whether the technology collects biometric information from the employees, customers, or members of the general public who use it.
In Illinois, biometric information includes fingerprints, voiceprints, retinal scans or scans of facial geometry (often referred to as facial recognition software). An example of this in the signage industry would be the use of fingerprints or retinal scans to gain access to buildings or to clock in or out of work.
Under BIPA, the collection of such information is highly regulated and can result in substantial penalties for companies (that) collect biometric information without permission. Today, businesses can be fined up to $5,000 per violation. For a company that uses fingerprint technology to have employees clock in and out, plaintiffs argue that each finger print scan is considered a violation.
It is also critical to remember that even companies based outside of Illinois can be held liable under BIPA, where the company collects biometric information within the geographic boundaries of the state, either in person or via the internet.
Q. What can QSRs and other business do to cover their bases?
A.Any business that collects biometric information in Illinois needs to first obtain the consent of the person whose biometric information is collected. The consent form -- which can be electronic -- must explain what biometric information is being collected and why such information is being retained.
In addition, companies collecting biometric information must maintain a publicly available retention schedule that explains when any captured biometric information will eventually be deleted or destroyed.
Q. How can businesses adhere to regulations, while also following regulations around social distancing and wearing technology with this technology?
A. Businesses that collect biometric information face significant challenges during the COVID-19 pandemic. For example, any scanning devices that collect either fingerprints or retinal scans will need to be sanitized between uses.
At the same time, businesses will need to find ways to demarcate appropriate social distancing if significant numbers of individuals are waiting to use this technology. Interestingly, the COVID-19 pandemic may also interfere or interrupt this technology for some, as is the case where a mask makes it difficult or impossible to capture facial recognition scans.
If businesses require individuals to remove masks for some reason to conform to security requirements, those businesses will need to ensure that any mask removal occurs in an appropriately socially distant environment, lest they face complaints from those who subsequently become sick.
Q. Where do you see this regulation going in the future?
A. BIPA is apparently here to stay, as two different initiatives to limit the statute have both failed in the Illinois legislature. As such, alleged violations of the statute against businesses collecting biometric information will continue to grow at an exponential rate, with dozens of new class-action lawsuits being filed against Illinois and out-of-state companies each week.
Fortunately, the remedy is simple. Any business that collects biometric information in Illinois must take steps immediately to obtain consent.
About Bradley Cooper
Related Media
Subscribe
Get the latest news and resources from QSR Web.
