Do New Biometric Restrictions Make Video Surveillance Illegal?

This past October, the State of Illinois passed the Biometrics Information Privacy Act, which joins similar laws previously enacted in Texas and Virginia in imposing restrictions on the use of certain biometric data. Essentially, companies can no longer collect customer “biometric identifiers” without first receiving written consent. A "biometric identifier" is defined as "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry."

Wait a minute! Doesn’t every video surveillance system essentially “scan” people’s faces?

Well, they certainly do record pictures of people’s faces -- lots and lots of pictures, in fact. So, how exactly is a series of pictures any different from a scan? Did Texas, Virginia and Illinois just outlaw all facial video surveillance?

As you might expect, upon closer inspection it turns out that the new legislation DOES NOT outlaw traditional surveillance. Some laws specifically exempt video surveillance, and others protect it by definition. A picture of someone, it turns out, is not a “biometric identifier,” which is strictly defined to be an actual biometric measurement tied to an actual identity.

Because surveillance video captures “images” of people and places, and not individualized measurements, and because those images are not each individually identified, they are not technically biometric identifiers.

So what about Minority Report stuff?

Can businesses install retinal scanners and toss ads at you based on who you are? This would seem to be outlawed, unless permission is obtained from the individuals being scanned. And large retailers that serve millions of customers each year aren’t likely to ask each person that passes through their doors to sign a consent form authorizing a biometric scan. So, I think Minority Report stuff may be officially off the table.

Is 3VR video search and facial surveillance affected by these laws?

No. In fact, 3VR’s technology might be the only system built to survive harsh biometric prohibitions like what we’ve seen in Texas, Vermont and Illinois; its unique approach and privacy protections give it the same exempted status afforded traditional video surveillance recording under the law.

Unlike prohibited technologies like hand, iris or fingerprint scanners, 3VR exclusively records and processes only what is permitted under the law -- standard surveillance imagery of scenes and people. When a 3VR SmartRecorder does a search or performs a facial matching analysis, what the system is really doing is comparing actual images to each other using a mathematical language that has nothing to do with any underlying identity or physical measurement derived from the image.

The distinction might seem subtle at first, but 3VR’s approach offers several important privacy protections, most notably the fact that none of the data that 3VR uses to catalog surveillance video contains any information about who a person is or what they actually look like.

More importantly, a 3VR’s searchable surveillance index relates recorded content only to itself and compares only images collected by the system to each other. This is very different from a biometric scanner that seeks to relate every one of its scans back to a specific identity. A 3VR only relates surveillance to identities under very limited circumstances, such as when a watchlist match has been triggered or during an actual investigation. Thankfully, in both cases, bad guys are afforded much less protection under the law than the general public.

What’s next?

In the future, expect privacy and security law to conflict more and legislation to become increasingly complex. There will no doubt be more laws, like the “Know Your Customer” provision of the Patriot Act demanding more aggressive data collection and customer identification, and there will also be many more laws like those recently passed in Texas, Illinois and Vermont protecting consumer privacy. Ultimately, we need both kinds of laws, but to navigate them, we’ll need new technologies and approaches specifically designed to ensure security without sacrificing our privacy. You can look for that here.