A biometric privacy violation usually happens when a company collects, stores, or uses biometric data without following the law. There are several actions that can lead to a legal claim.
One common violation is collecting biometric data without getting proper written consent. Many employees have to scan their fingerprints or use facial recognition systems without being fully told about their rights or why the data is being collected.
Another common problem is not providing a written policy that explains how long biometric data will be kept and when it will be deleted. Laws like Illinois BIPA require clear timelines, and companies that do not set or follow these rules may be breaking the law.
Storing biometric data improperly or failing to keep it secure is also a violation. Companies must use reasonable safeguards to protect this data. If they store it carelessly or let unauthorized people access it, they can be held responsible for any harm that results.
Trying to update the story. As you may recall, retired New Jersey Judge Carmen Messano was scheduled to start his temporary appointment this month. The appointment concerns an evidentiary hearing (a Frye hearing) on the admissibility of fingerprint evidence in state courts.
It is part of the court case State v. French G. Lee. Lee was originally convicted of burglary in based upon latent fingerprint evidence, but the admissibility of the evidence was challenged in a higher court.
And here we are.
I’ve been tracking this case since Mike Bowers mentioned it in mid July. And to be honest, there’s been no new public news since then.
I checked Google News for any new stories on Judge Messano this month and couldn’t find any.
“Calvin Settle, of Jersey City, was arrested Tuesday evening and charged in Hudson County Court with the death of the Brooklyn tot, Natalia Rivera, said District Attorney Carmen Messano.”
He live-streamed himself taking down one of the Flock cameras. And he took down others. In the course of the livestream, he referred to the cameras as “tyranny trees.”
But then he performed an action that most of the cool kids never perform. As he stated on the video:
“For the record, I am not stealing these. I am not destroying them. I am simply returning them to the Bernalillo County Sheriff’s Department because they left their shit on the side of the road.”
I’m sorry, but this is dumb crime. Almost as dumb as taking your bad illegal drugs to the sheriff.
As Martinez discovered when he stepped out of the truck and was arrested by deputies with guns drawn.
Some firms come into possession of protected health information (PHI), or by definition EXTREMELY personal protected health information.
This includes the following:
“…the individual’s past, present or future physical or mental health or condition,
“the provision of health care to the individual, or
“the past, present, or future payment for the provision of health care to the individual…”
As you can imagine, PHI is stuff that the patient wants private.
And because the information is very valuable, it’s stuff that other firms are willing to buy.
Potential employers would love to know if their potential hire is going to run up the company’s health care costs.
And companies that sell products to cure various diseases would love to know who has them.
Which brings us to Grindr
Grindr is the “world’s largest network for gay, bi, trans, and queer adults.” And not just for online chat; the app declares that “proximity unlocks instant access…to one another.”
But before two people choose to meet at a library or whatever, they both fill out profiles. Because like any other dating app, the people involved want to know if they are compatible with each other.
[Grindr added] “optional HIV-related fields in user profiles, such as HIV status (including undetectable), last HIV test date, and pre-exposure prophylaxis (PrEP) use.”
These non-mandatory fields allowed users, if they wished, to disclose this information only to potential partners.
Or so they thought.
They thought wrong; Grindr sold their EXTREMELY personal protected health information
“Grindr will pay £26m to settle a lawsuit brought by thousands of users in the UK who allege that the US dating app shared highly sensitive personal information, including in some cases their HIV status, with advertising companies.”
Obviously the United States HIPAA does not apply in the United Kingdom where the lawsuit was filed, but the UK has its own health privacy laws. As part of the settlement Grindr admitted no wrongdoing, which is an important distinction for legal folks. But Grindr agreed to pay the settlement to users in two installments.
Grindr was previously fined in Norway for sharing EXTREMELY personal protected health information.
And its Chinese owner divested the firm because of fears the PHI could end up in Chinese hands.
Hopefully Grindr didn’t sell mothers’ maiden names.
A day without biometric databases is a day without sunshine. If the more extremist privacy advocates pivot from outlawing AI to outlawing biometrics, we could have all sorts of fun.
And such a ban is possible. In 2022, three political parties in the European Union Parliament supported a ban on facial recognition in public places.
“We’re going to ban what we believe is not according to our values, the deployment [of biometric identification] in public spaces where we as Europeans, we believe that we need to be free of the risks of mass surveillance,” said Renew’s Dragoș Tudorache. “The prevailing position in this house is to support the ban for this technology.”
In the end it didn’t happen, but just one bad story could cause the proposal to reappear.
So what happens in the alternate universe where we don’t need biometric databases any more? Such as criminal databases, or even corporate databases for access control systems?
Criminal investigations without biometric databases
Google Gemini.
Take the night that a drunk and disorderly man spent some time in the police station.
“What’s your name?”
“Jim Member.”
“No, your REAL name.”
“That is my real name! Here’s my driver’s license.”
The booking officer examined it and handed it back. “Ever been arrested before?”
“Never.”
The booking officer set the arrest paperwork on the dusty live scan station, unplugged months ago. “Follow me. We have to hold you for a bit. Then we’ll either hold you for a week and conduct a full investigation of your inked prints against the state card files, or just let you go, Jim.”
And no corporate access control databases
Google Gemini.
Or the next morning, when Sheila overslept and was almost late for work.
After frenetic preparation and reckless driving, she pulled into the parking lot and rushed toward the front door, relieved that she had made it.
But when she glanced toward the camera to unlock the door, nothing happened.
Then she noticed that the status monitor said “FR OFFLINE.”
That message was followed by another: “PLEASE ENTER 10 DIGIT EMPLOYEE ID.”
What is my employee ID number, she thought to herself as the monitor time advanced to 8:01—one minute after her one-on-one with her boss was supposed to start.
But what about…
Making agencies and enterprises work without biometric databases is an extreme way to take care of a legitimate problem: the misuse of biometrics.
But like any data misuse, the solution is to identify and punish the abusers, not to throw out the technology altogether.
If your technology helps agencies and enterprises reduce misuse and promote privacy, Bredemarket can help you tell your story. Talk to me.
Chasing the Revision. Google Lyria. Public Domain.
There’s a reason.
People don’t act.
Perhaps tiny startups are all too willing to act, to the point of moving fast and breaking things. But executives at more established firms become well versed in loss aversion.
“Loss aversion is a cognitive bias where the emotional impact of a loss is felt more intensely than the joy of an equivalent gain….
“According to the original research conducted by Daniel Kahneman and Amos Tversky, the pioneers of loss aversion, the torment of a loss can be psychologically twice as powerful as an equivalent gain. This discrepancy often motivates the choices we make, leading us to cling to what we already have rather than try to acquire new objects or opportunities. Simply put, it’s better not to lose $10 than to find $10.”
Once you look at it dispassionately, you realize that loss aversion makes no sense from an economic perspective.
But corporate leaders are loss averse anyway.
Why?
Four reasons for loss aversion
Here are some reasons for loss aversion.
Reason 1, Product unreadiness
Executives may panic because the product on the floor is nowhere near the one in the product marketing materials. The product on the floor is buggy, and that amazing new capability that the marketing slick discusses isn’t even in the code yet.
And I can tell you from personal experience that this isn’t limited to product marketing.
When I was writing and managing proposals for automated fingerprint and biometric identification systems (AFIS and ABIS), the product usually wouldn’t hit the “factory acceptance test” phase until a year after I wrote the proposal.
Sometimes the agency explicitly asked whether feature 129 was in your code today. If it did, then you had to be honest and say whether it existed, or whether you’d have to add it in a future release in the next year.
Sometimes the agency didn’t ask, so you took a different approach with your answer.
Same with product marketing. If you are writing the data sheet in September, but you’ll show the product at a trade show next March, then you write the data sheet as if it were already March and the amazing new capability was already in the code.
If everything goes well.
“But John,” you’re saying. “Isn’t it dangerous to write about things that are 6 months or a year in the future?”
Think about it. Even if a prospect sees the data sheet and gets really really excited, the prospect couldn’t buy it that day even if they wanted to.
First, you’re not selling it. (Well, probably not.)
Second, even if you were taking pre-orders, the prospect probably won’t buy it that day anyway. It will take months if not years to line up the budget and all the approvals, and the prospect may be forced to go to competitive bidding anyway, which tacks another year on the timeline (at least for complex offerings such as AFIS and ABID).
In summary, some “future present tense” writing probably isn’t going on hurt you. Don’t be scared to tell your prospects where you’re going. At least that’s my view.
Reason 2, Compliance and legal exposure
Google Gemini.
Now I’m going to contradict what I just said.
Because there are some times when you CANNOT go the future present tense route.
You can’t say that your algorithm ranks high in NIST FRTE 1:N testing if you haven’t submitted your algorithm to NIST.
You can’t even say that you’re doing business in the United States when you’re not.
If there is a legal requirement and you claim to meet it, make sure you do.
Reason 3, Positioning ambiguity
I’m old enough to remember Shimmer, the Saturday Night Live “product” that was both a floor wax and a dessert topping.
But for most products you have to decide on positioning and messaging, and there may be known consequences if you get it wrong.
Certainly for the products sold by Bredemarket’s clients, products with critical security, privacy, and legal implications. If you say something stupid such as “Our facial recognition product provides all you need to arrest bad people,” you will be in BIG trouble.
Now I’m not denying that product positioning is critically important.
I’m just saying that it shouldn’t take two years to create your positioning and messaging.
And don’t be afraid to iterate. Get something out there and tweak it later during the next review cycle. (You ARE setting regular review cycles for your positioning and messaging, right?)
Reason 4, Fear of firing
Are you afraid of losing your job? Join the club.
I like the way Google Gemini put it:
“In risk-averse corporate cultures, a failed campaign carries higher personal downside for an executive than the neutral outcome of waiting a few extra weeks.”
But I have learned the hard way that you don’t have to fail to lose your job. You can lose your job for a myriad of reasons, including office politics, a worldwide pandemic, or the need to boost short-term profitability. Or no reason at all; some companies terminate employees and can’t say why.
Pausing a risky go-to-market initiative does NOT guarantee that you will keep your job.
But doesn’t loss aversion reduce risk?
Let’s go back to the beginning of this post. Loss aversion seems so attractive because it prevents you from losing $10.
So it avoids risk, right?
Um, no. Loss aversion is risky.
It introduces the risk of not gaining $10.
Or gaining a lot more than $10, according to this article that was republished on (checks notes) Yahoo! Finance.
“Back in 1998, two individuals, Larry Page and Sergei Brin, who were unknown to the technology company offered to sell their little startup to AltaVista for $1 million so they can resume their studies at Stanford….
“AltaVista turned down the offer to acquire the company. Similarly, Yahoo wanted its users to spend more time on its own platform, contrasting PageRank, which sends a user to the most relevant web site.”
So Page and Brin kept working, along with Eric Schmidt, and their startup Google started doing pretty well.
So much so that in 2002, Yahoo! came calling again.
“Yahoo had another opportunity to acquire Google. In 2002, Yahoo’s CEO at the time, Terry Semel, engaged in negotiations to acquire Google, which lasted several months.
“The outcome of the negotiation was Semel balking at Google’s price tag of $5 billion.”
“The FTC’s Safeguards Rule, which dates back to 2003, requires financial institutions to maintain safeguards to protect customer information. The FTC issued the Rule to implement the requirements of the Gramm-Leach-Bliley Act, and it applies to financial institutions subject to the FTC’s authority.”
Go on…
“That includes most automobile dealers who finance or lease automobiles.”
The safeguards
So what safeguards do car dealers need to implement?
Maintain a comprehensive written information security program that covers the customer information, including unauthorized access to the information. The program must cover any third-party service providers that can access the customer information, including anyone who bought or sold the data.
Create a written security incident response and recovery plan so that when things go wrong, you are prepared.
Update your information security program as necessary.
Mechanics of breach reporting
The most visible part of the response and recovery plan is breach reporting in accordance with federal law and state law.
But that firm will be just one of many firms that will be reporting. Many if not all companies that provided data to this identity verification provider will ALSO have to report.
Expect a flood of notifications, possibly very soon.
What should you say in advance of breach reporting?
But breach reporting is not enough. Your firm, whether it’s a car dealer, an identity verification provider, or someone else, needs to proactively communicate how you handle breaches. And communicate this long before a breach occurs.
Why? To give your customers reassurance that if a breach happens, you’ll handle it.
Have you developed:
the strategy to explain how you will handle PII breaches?
the tactics to write these explanations for your content and your proposals?
If you haven’t, bring on an experienced identity, privacy, and product marketing consultant to help you with your strategy and tactics.
John E. Bredehoft in Bredemarket’s worldwide corporate headquarters in Ontario, California.
Bring on Bredemarket.
And book a free appointment to assess your needs.
Feel free to reshare using the “Share this” buttons below.
“Judge Carmen Messano…is hereby recalled by the Supreme Court for temporary service within the judicial system other than the Supreme Court effective September 1, 2026 through March 1, 2027, or until further Order, to serve as a Special Adjudicator in the matter of State v. French G. Lee…”
“Perhaps the assessment will determine that fingerprint evidence is admissible provided that certain safeguards are implemented: for example, that the latent examiner is not subject to bias before making their forensic examination, or perhaps the blind secondary verification is implemented.
“Or the assessment may regard fingeprint evidence as inadmissible, or not sufficient on its own merits to result in a conviction (in other words, just like facial recognition and DNA).”
I was not able to determine if Judge Messano literally started working yesterday, or if he will wait until after Labor Day.
Google Gemini.
Regardless, it will presumably be some time before any hearings, or anything else, are publicly announced.
I’ve been tracking California SB 690, “Crimes: invasion of privacy,” for over a year now. After much delay and wrangling, it’s on its way to Governor Newsom for signature, if he signs.
Update from last month: it’s now “engrossed” and “enrolled.” History here. This is what happened Friday, in reverse chronological order.
08/28/26 Assembly amendments concurred in. (Ayes 39. Noes 0.) Ordered to engrossing and enrolling.
08/28/26 In Senate. Concurrence in Assembly amendments pending.
08/28/26 Read third time. Passed. Ordered to the Senate.
“The California Legislature passed a bill to eliminate the right to file private lawsuits under a provision of the California Invasion of Privacy Act, partly stemming a recent wave of litigation.”
