Searching Case Laws & Precedent on Legal Query.....!
Scanned Judgements…!
Searching Case Laws & Precedent on Legal Query.....!
Scanned Judgements…!
Biometric Data as Identifiers - Biometric data must be capable of identifying an individual to qualify as an identifier under BIPA. If biometric data cannot identify a person, it is not covered by the Act. Meta’s case (2024 Supreme(US)(ca9) 292) highlights that creating a face signature from uploaded photos does not necessarily violate BIPA unless it can identify the individual.
Scope and Protections of BIPA - Illinois' BIPA was the first biometric privacy law, granting broad protections over biometric identifiers and information, including rights to privacy and control. It provides a private right of action, allowing individuals to sue for violations such as collection without informed consent, unlawful retention, or dissemination of biometric data (2023 Supreme(US)(ca7) 214, 2021 Supreme(US)(ca7) 14).
Informed Consent and Data Handling - Collecting biometric data without proper informed consent or outside the scope of a clear data-retention schedule constitutes a violation of BIPA (2024 Supreme(US)(ca7) 311, 2024 Supreme(US)(ca7) 312). Repeated collection or disclosure increases privacy risks and can be independently actionable.
Unlawful Retention and Sale of Data - The unlawful retention or sale of biometric data is considered a concrete injury, equivalent to unlawful collection, and constitutes a privacy violation under BIPA. Courts recognize that such actions can amplify privacy invasions, especially when data is disseminated or sold, depriving individuals of control and potential profit from their biometric information (2021 Supreme(US)(ca7) 14, 2021 Supreme(US)(ca7) 18, 2021 Supreme(US)(ca7) 21).
Data Breach and Confidentiality - BIPA also emphasizes the importance of confidentiality; inadequate control over biometric data that leaks or is hacked can violate the law. However, data breaches involving third-party hackers are often distinguished from direct violations unless the entity failed to maintain confidentiality (2024 Supreme(US)(ca7) 311, 2024 Supreme(US)(ca7) 312).
There are limited cases explicitly discussing biometric data in the context of data privacy, but the existing legal landscape, primarily through Illinois BIPA, clearly establishes that biometric data is protected when it can identify individuals. The law covers collection, retention, and dissemination, emphasizing informed consent, confidentiality, and control. Courts have recognized that unlawful retention or sale of biometric data constitutes a concrete privacy injury, akin to unlawful collection, and can lead to actionable claims.
In summary:- Biometric data must be identifiable to fall under BIPA protections.- Violations include collection without consent, unlawful retention, or dissemination.- Unlawful retention or sale is recognized as a concrete privacy injury.- No significant case law explicitly states that biometric data is outside the scope of privacy concerns; rather, the law and courts interpret biometric data as protectable when it identifies individuals.
References:- 2024 Supreme(US)(ca9) 292- 2023 Supreme(US)(ca7) 214- 2024 Supreme(US)(ca7) 311- 2024 Supreme(US)(ca7) 312- 2021 Supreme(US)(ca7) 14- 2021 Supreme(US)(ca7) 18- 2021 Supreme(US)(ca7) 21
In an era where biometric data like fingerprints, iris scans, and facial recognition is increasingly used for authentication, security, and services, concerns about privacy have skyrocketed. Many individuals wonder: So there are no cases that talk about biometrics in light of data privacy? Far from it. Indian courts have addressed this intersection extensively, particularly through landmark rulings that recognize privacy as a . This blog post delves into the evolving legal landscape, key principles, relevant case law, and recommendations, drawing from judicial precedents and statutory frameworks. Note that this is general information and not specific legal advice—consult a qualified lawyer for personalized guidance.
The of India laid the cornerstone for biometric data privacy in Justice K.S. Puttaswamy v. Union of India (). This seminal judgment declared the as a under , encompassing personal data protection. The court emphasized the need for legislative safeguards to protect personal data, including biometric data, from unauthorized collection and use 2023 0 Supreme(Ker) 968 2020 0 Supreme(SC) 257.
Biometric data is uniquely sensitive because it is immutable and linked indelibly to an individual's identity. Unlike passwords, biometrics cannot be changed if compromised, amplifying privacy risks. The physical intrusion involved in collecting fingerprints or iris scans can infringe upon personal space, as noted in legal analyses: The collection of biometric data, such as fingerprints and iris scans, raises significant privacy concerns. The physical intrusion required for biometric data collection can infringe upon an individual's personal space and privacy rights 2018 7 Supreme 129.
No discussion of biometrics in India is complete without the Aadhaar program, managed by the (). This scheme collects biometric and demographic data for targeted delivery of subsidies and services. Challengers argued it violates privacy, prompting scrutiny.
In interim orders, the court mandated consensual collection: Aadhaar cards would only be issued on a consensual basis after informing public at large about fact that preparation of Aadhaar card involving parting of biometric information of individual, which shall however not be used for any purpose other than a social benefit schemes 2015 0 Supreme(SC) 1147. Production of an Aadhaar card cannot be made mandatory for benefits, and data cannot be used beyond specified purposes like PDS schemes, except by court order for criminal investigations 2015 0 Supreme(SC) 1147.
A recent case illustrates the balancing act. In a matter involving a missing person, the court directed to disclose Aadhaar-linked information (excluding biometrics) to aid investigation, weighing confidentiality against the right to a fair probe under Article 21: The court ruled that while the must maintain confidentiality, the pressing need for a fair investigation in a kidnapping case necessitates the disclosure of information pertaining to the Aadhaar Card, except for biometric data 2023 0 Supreme(P&H) 3013. This underscores that biometric data enjoys heightened protection, even in public interest scenarios.
The Aadhaar challenges were referred to a larger bench, highlighting ongoing debates: The examined the legality of the Aadhaar scheme, focusing on the implications of biometric data collection on privacy rights. The matter was referred to a larger bench for further consideration 2015 6 Supreme 458 2019 0 Supreme(P&H) 198.
Courts often navigate tensions between individual privacy and societal needs. For instance, Vysakh v. State of Kerala () addressed privacy in publishing identifiable information in judgments: Concluded that privacy rights cannot completely obstruct the public's right to know about judicial proceedings 2023 0 Supreme(Ker) 968 2023 0 Supreme(Ker) 920. The , an emerging privacy aspect, remains limited in ongoing judicial matters.
This balancing mirrors global concerns. While India's framework evolves, international precedents like Illinois' () offer insights. requires consent for biometric collection and retention policies. have ruled that unlawful retention inflicts a privacy injury akin to collection: We thus held that 'an unlawful retention of a person’s biometric data is as concrete and particularized an injury as an unlawful collection of a person’s biometric data' 2021 Supreme(US)(ca7) 474 2021 Supreme(US)(ca7) 14 2021 Supreme(US)(ca7) 15 2021 Supreme(US)(ca7) 18 2021 Supreme(US)(ca7) 21. Though not binding, such cases highlight best practices for consent and data handling that Indian lawmakers may consider.
Under , identifiers must uniquely identify individuals: if either form of biometric data cannot identify an individual, it is not an identifier and thus not covered by 2024 Supreme(US)(ca9) 292. This precision could inform India's pending data protection laws.
Here are pivotal cases shaping biometric privacy:
Stressed legislative protections for biometric data 2023 0 Supreme(Ker) 968.
Privacy in judicial publications yields to public access 2023 0 Supreme(Ker) 968 2023 0 Supreme(Ker) 920.
Aadhaar-Related Matters
Consensual collection; limited disclosure for investigations 2015 6 Supreme 458 2015 0 Supreme(SC) 1147 2023 0 Supreme(P&H) 3013.
Interim Aadhaar Orders
India lacks a comprehensive biometric-specific law, unlike , which mandates policies: Facebook violated when it failed to publish a written policy establishing a retention schedule 2024 Supreme(US)(ca9) 292. The , addresses general data privacy but needs biometric focus.
Recommendations:- Enact Tailored Legislation: Specific rules for biometric consent, storage, and breaches.- Judicial Guidelines: Protocols for collection in public schemes like Aadhaar.- Best Practices: , minimization, and secure retention, inspired by global standards 2023 Supreme(US)(ca7) 214.
Businesses handling biometrics (e.g., employers using scans) should note risks: Claims arise from non-consensual processing via third parties 2024 Supreme(US)(ca7) 311 2024 Supreme(US)(ca7) 312.
Contrary to the notion of no cases, Indian jurisprudence robustly engages biometrics through privacy lenses, from Puttaswamy to Aadhaar rulings. Courts typically balance rights via proportionality, protecting biometrics while allowing justified uses. As technology advances, expect more clarity via legislation and judgments.
Key Takeaways:- Privacy is fundamental; biometrics demand safeguards 2023 0 Supreme(Ker) 968.- Aadhaar collection must be consensual and purpose-limited 2015 0 Supreme(SC) 1147.- Public interest may override but not erase privacy 2023 0 Supreme(P&H) 3013.- Global lessons emphasize consent and retention policies.
Stay informed on data privacy developments. For specific concerns, seek professional legal counsel.
References:- 2023 0 Supreme(Ker) 968 2020 0 Supreme(SC) 257 2018 7 Supreme 129 2015 6 Supreme 458 2019 0 Supreme(P&H) 198 2015 0 Supreme(SC) 1147 2023 0 Supreme(P&H) 3013 2024 Supreme(US)(ca9) 292 2023 Supreme(US)(ca7) 214 2024 Supreme(US)(ca7) 311 2024 Supreme(US)(ca7) 312 2021 Supreme(US)(ca7) 474 2021 Supreme(US)(ca7) 14
#BiometricPrivacy #DataPrivacyIndia #AadhaarCase
In other words, if either form of biometric data cannot identify an individual, it is not an identifier and thus not covered by BIPA. ... As evidence, Meta cites not only the dictionary definition of “identifiers,”1 but also case law showing that biometric identifiers must be a feature that can identify a person. ... standing of Zellmer’s claim that Facebook violated BIPA when it failed to publish a written policy establis....
See Molly DiRago, The Litigation Landscape of Illinois’ Biometric In- formation Privacy Act, American Bar Association Cybersecu- rity and Data Privacy Committee (Aug. 20, 2021), available at https://www.americanbar.org/groups/tort_trial_insur- ance_practice/committees/cyber-data-privacy/the-litigation ... Illinois became the first state in the nation to enact biometric ....
Section 33 of the Act, a strong case has been made out by the aggrieved person.
This led to a claim that doing so without workers’ wriXen con- sent, and using a third party to process the data, violated the Biometric Information Privacy Act, 740 ILCS 14/1 to 14/20 (BIPA or the Act). ... The data- breach exclusion would apply to situations in which hackers obtained biometric information from Thermoflex. That’s not what the underlying state suit is about, however. ... We grant that, if ....
This led to a claim that doing so without workers’ wriXen con- sent, and using a third party to process the data, violated the Biometric Information Privacy Act, 740 ILCS 14/1 to 14/20 (BIPA or the Act). ... The data- breach exclusion would apply to situations in which hackers obtained biometric information from Thermoflex. That’s not what the underlying state suit is about, however. ... We grant that, if ....
We noted that the informed-consent duties prescribed by section 15(b) protect a person’s privacy interests in his unique biometric data, so a noncompliant collection of biometric data amounts to an No. 20-3202 7 invasion of an individual’s “private domain ... We explained that the duty to comply with a data-retention schedule protects a pe....
We thus held that “an unlaw- ful retention of a person’s biometric data is as concrete and particularized an injury as an unlawful collection of a person’s biometric data. ... After reviewing many of the same cases we have highlighted here, we concluded that “[a]n unlawful retention of biometric data inflicts a privacy injury in the same sense that an unlawful collectio....
We thus held that “an unlaw- ful retention of a person’s biometric data is as concrete and particularized an injury as an unlawful collection of a person’s biometric data. ... After reviewing many of the same cases we have highlighted here, we concluded that “[a]n unlawful retention of biometric data inflicts a privacy injury in the same sense that an unlawful collectio....
We thus held that “an unlaw- ful retention of a person’s biometric data is as concrete and particularized an injury as an unlawful collection of a person’s biometric data. ... After reviewing many of the same cases we have highlighted here, we concluded that “[a]n unlawful retention of biometric data inflicts a privacy injury in the same sense that an unlawful collectio....
We thus held that “an unlaw- ful retention of a person’s biometric data is as concrete and particularized an injury as an unlawful collection of a person’s biometric data. ... After reviewing many of the same cases we have highlighted here, we concluded that “[a]n unlawful retention of biometric data inflicts a privacy injury in the same sense that an unlawful collectio....
Biometric data is part of one's body and control over one's body lies on the very centre of the Right of Privacy. Decisional privacy allows individual to make a decision about their own body and is an aspect of right of self-determination. The Aadhaar Project including the Aadhaar Act violate the informational privacy. The report thus states that: “Policies and interfaces to handle error conditions such as failure to enroll or be recognized should be designed to gracefully av....
2. One of the grounds of attack on the scheme is that the very collection of such biometric data is violative of the "right to privacy". Some of the petitioners assert that the right to privacy is implied under Article 21 of the Constitution of India while other petitioners assert that such a right emanates not only from Article 21 but also from various other articles embodying the fundamental rights guaranteed under Part-III of the Constitution of India.
An indispensable Tool for Legal Professionals, Endorsed by Various High Court and Judicial Officers
Please visit our Training & Support
Center or Contact Us for assistance
Scan Me!
India’s Legal research and Law Firm App, Download now!
For Daily Legal Updates, Join us on :
Back to top
