Illinois’ law regulating the collection of biometrics – or physical measurements like fingerprints – is one of the strictest in the nation but could be amended through a current bill in the state Legislature.

Enacted in 2008, the Biometric Information Privacy Act, or BIPA, requires businesses and other private entities notify and obtain consent from employees or customers before collecting their biometric information. It also prohibits them from selling or otherwise profiting from someone’s biometric data.

Following hundreds of class-action lawsuits filed against employers for allegedly violating the law, the proposed Illinois House Bill 559 makes biometric agreements less public and gives employers a 30-day deadline to “[cure] the noticed violation.”

Peter Hanna, American Civil Liberties Union of Illinois’ legal adviser on privacy and technology, said protecting one’s biometrics is of the utmost concern since the data is effectively immutable.

“Once they’re out there, once information about your biometrics is leaked or breached, they’re out there forever,” Hanna said. “These are the most sensitive types of personal information because they’re bound to your biology and physiology and they’re unchangeable.”

Yet technologists like Kristian Hammond, a professor of computer science at Northwestern University, may be uneasy with laws stifling the development and application of emerging biometric technology. 

Hammond points to use by law enforcement in finding wanted suspects or missing persons.

“In trying to reduce the amount of time, for example that a particular policeman is spending looking at mug shots when a machine can do something that’s faster, better and stronger,” Hammond said. “That allows that individual an opportunity to actually be a cop – get in the community and work with people.”

Last year the ACLU sued Clearview AI after the Chicago Police Department announced a two-year contract to use the company’s facial recognition technology, alleging violations under the state’s biometric law. The police department terminated the agreement.