Illinois Biometric Information Privacy Act (BIPA)

The Illinois Biometric Information Privacy Act ("BIPA") aims to “regulate the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information”. If your organization operates in Illinois or you have employees that are residents of Illinois, you need to comply with BIPA. You can read the full text of BIPA in the Illinois Compiled Statutes.

Noah Facial Recognition Pty Ltd ("NoahFace") is committed to privacy and provides you with extensive capabilities in the NoahFace App and Dashboard (collectively the "NoahFace Service") to help you comply with BIPA. However, it is important to note that if your organization uses the NoahFace Service you cannot rely on the capabilities of the NoahFace Service alone. You must ensure you configure and use the NoahFace Service appropriately to comply with BIPA and that you comply with the non-system requirements of BIPA. For example, you should update your employment agreements to cover the use of biometrics, ensure your premises and devices are physically secured, and update your own public privacy policy to cover the use of biometrics. Given the importance of privacy, you should obtain your own professional legal advice to ensure you are fully compliant.

The sections below detail the requirements of BIPA and explain how NoahFace provides you with capabilities in the NoahFace Service to help you comply with each of them.

Collection and Consent

Requirements

BIPA requires that: "No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information, unless it first:

1. Informs the subject or the subject's legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored;
2. Informs the subject or the subject's legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and  
3. Receives a written release executed by the subject of the biometric identifier or biometric information or the subject's legally authorized representative."

Compliance

The NoahFace Service displays a written privacy statement which informs subjects that biometric data will be collected (before it is collected), the specific usage of the biometric data, and the length of term for which the biometric data will be stored.

If the privacy statement is accepted, the NoahFace Service will capture the subject's photo and extract their biometric data. If the privacy statement is not accepted, the subject can still use the NoahFace Service by manually identifying themselves using non-biometric methods (eg: passcodes).

The date and time each subject accepts the privacy statement is recorded and can be viewed through the NoahFace Service.

Retention and Destruction

Requirements

BIPA requires that: "A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual's last interaction with the private entity, whichever occurs first."

Compliance

NoahFace has a written privacy policy, made available on our public Web site (NoahFace Privacy Policy), which covers the retention and destruction of data, including biometrics data.

In particular, the NoahFace Service will automatically destroy a subject's biometric data whenever either:

• The subject's record is removed from the NoahFace Service (eg: when the employer / employee relationship is terminated).
• The subject's consent to the use of their biometrics is removed. In this case, the subject can continue to use the NoahFace Service by manually identifying themselves using non-biometric methods (eg: passcodes).

No Commercial Use

Requirements

BIPA requires that: "No private entity in possession of a biometric identifier or biometric information may sell, lease, trade, or otherwise profit from a person's or a customer's biometric identifier or biometric information."

Compliance

NoahFace does NOT sell, lease, trade, or otherwise profit from biometric data.

No Disclosure

Requirements

BIPA requires that: "No private entity in possession of a biometric identifier or biometric information may disclose, redisclose, or otherwise disseminate a person's or a customer's biometric identifier or biometric information [unless required to legally]".

Compliance

NoahFace does NOT disclose, redisclose, or otherwise disseminate biometric data.

Data Protection

Requirements

BIPA requires that: "A private entity in possession of a biometric identifier or biometric information shall:

1. Store, transmit, and protect from disclosure all biometric identifiers and biometric information using the reasonable standard of care within the private entity's industry; and
2. Store, transmit, and protect from disclosure all biometric identifiers and biometric information in a manner that is the same as or more protective than the manner in which the private entity stores, transmits, and protects other confidential and sensitive information."

Compliance

NoahFace has designed data protection into the core of the NoahFace Service. In particular:

• The NoahFace Service encrypts biometric data both at rest and in transit.
• The NoahFace Service does not permit the export of biometric data, even by system administrators.