0

If I collect the face and voice properties of someone and inform them that they would not be able to request its deletion under any circumstance, would I still have to delete it under request in any US state? I know biometric collection laws are pretty strict in some places, so this is why I ask.

Improve this question
9
  • 2
    What kind of request? How do you acquire the samples? Which State?
    – Trish
    Feb 13, 2022 at 18:14
  • @Trish What do you mean by "what type of request?" Sorry I am not too familiar with this. Is any state too broad? The samples would be acquired via a website.
    – Kile Maze
    Feb 13, 2022 at 18:27
  • What kind of "Delete my data" requests do you plan to ignore? You do know that some of such requests might have legal obligations for you to do so, yes? Yes, because data privacy in the US is widely varied, all is far too wide. Especially, if people from the EU might use your site, you might face being sued in the EU under GDPR and such...
    – Trish
    Feb 13, 2022 at 18:52
  • 2
    There is still the infinite regress of jurisdiction questions. Some jurisdictions have created a right to force data-deletion irrespective of any "waiver". You have to start with a jurdisction, e.g. "Can I be sued in Germany if X".
    – user6726
    Feb 13, 2022 at 20:34
  • 1
    A simple GDPR request containing the Revocation Of Consent would be such a "delete my data" request which you can not contract out of under the laws that any EU state made, because they agreed to make that part of the law. Similarily, in most countries a contract that is forever and can't be terminated can (in many cases) make it void ab initio (from the start).
    – Trish
    Feb 13, 2022 at 21:29

1 Answer 1

Reset to default
1

If a person or firm collects and stores personal data (PD) (which can include biometric information) of a natural person who is located in the EU (or the UK) while offering products or services (even free services) that are "targeted" at the EU, then the GDPR will apply to the person or firm collecting that info, if the biometric data is associated with an identifiable natural person, or such a person can be singled out, perhaps with the aid of other available data. In that case a request made in accordance with Article 17 of the GDPR a request for deletion of that PD may have to be honored if the need for the data is over; processing of the PD was based on consent, which has now been withdrawn; the data subject (DS) objects under GDPR article 21(1); the data was unlawfully processed; or ther data was collected in relation to an offer of Information Society services (which includes social media).

If a person or firm collects and stores PD of a natural person who is located in the state of California, the holder of that data can be requested by the DS to delete the data under section 1798.105 of the California Consumer Privacy Act (CCPA), and may be required to comply with such a request.

The CCPA does not authorize an individual lawsuit to enforce such requests, all such action is taken by the California AG's office.

These rights under the GDPR or the CCPA may not be waived by a terms of service (or any other) agreement

Several other US states have passed privacy laws similar to the CCPA, and after the effective dates of such laws, similar requirements may apply.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .