How Much Dead-Hand Control Is Too Much? Why Biometric Data Privacy Laws Need Expanding

Abstract

Biometric data privacy laws are meant to prevent certain harm envisioned by the legislature in the drafting process. The state legislatures that have passed and are currently drafting these laws consider their constituency’s discomfort with unforeseen downstream consequences of biometric data collection by companies and the potential for repeated fraud due to the immutability of biometric identifiers. In response to their constituency’s concerns, legislatures have passed laws that protect biometric identifiers in these two contexts.

This legislation stops short of its intended purpose by not extending the same protections to the deceased. This gap leaves the deceased vulnerable to cybercriminals and unintended downstream consequences alike. However, this Comment argues the right of control and right to private action created in biometric privacy legislation creates a property interest in biometric identifiers bringing this within the realm of estate planning. Estate planners in the states that have enacted biometric privacy legislation can protect the decedent’s privacy while managing the risk of post-mortem fraud.

Keywords: Biometric data, physical biometrics, behavioral biometrics, privacy, fraud, identity theft, ADAPPA, RUFADAA