Legal Aspects of Airport Programs

Reconciling Privacy Laws with Biometric Innovation at Airports

It is proposed to conduct legal research to produce a survey of Federal, state, and foreign privacy laws applicable to the collection and use of biometric technology by the air industry, analyses and categorization of pertinent laws, and their requirements, and a discussion of practices best designed to foster compliance.

Background--State the problem and why research is necessary. Highlight the legal and regulatory issues as they specifically pertain to airports.

Airport stakeholders are in the process of recovering from the travel industry's devastating impacts of COVID-19. Global sources are encouraging the commercial use of biometric technology for accelerating recovery, health screening, streamlining travel processes, managing workforces, ensuring security, etc. In the meantime, legislatures at national and state levels are enacting laws to govern, and in some cases, limit the collection and use of biometric data, and including provisions that sanction commercial entities for violations. As an added complexity, several state laws apply based on the data subject's state of residence or where the data is stored or where the company is located.

By conducting research to identify and analyze Federal, state and foreign (e.g., EU GDPR) laws that apply to airport industry stakeholders' collection and use of biometric technology in the airport environment, the airport industry would have greater awareness and understanding of the requirements of privacy laws which are predicates to using biometric technology. An appreciation of privacy and associated IT security system protections can inform cost assessments and considerations. Research will also include a discussion of sources for best practices such how best to inform the traveling public whether they can opt out (or opt in) and offer ideas for risk avoidance based on relevant recognized privacy protection principles such as Privacy by Design and the World Economic Forum 2020 framework for the responsible use of facial recognition, and include an assessment of whether frequently noted best practices are still relevant under today's laws and court decisions eroding long-standing precedents.

Objective--State the objective, including a brief description of the intended deliverable, which airport stakeholders are the intended audience, and how their needs will be met by the deliverable.

The objective of the research is to provide the air industry with clear and concise information about the patchwork of privacy laws and their requirements applicable to the collection and use of biometric technology by the air industry and offer best practices to mitigate the risk of non-compliance. Research would also alert airport stakeholders to potential legislative actions on the horizon.

Relevance to Airport Legal Issues--ACRP's Legal Research Program focuses on legal and regulatory challenges and issues as they specifically pertain to airports. Please describe how this topic is relevant and unique to airports such that it should be researched.

Armed with information about legal requirements linked to the use of biometric technology, airport stakeholders would be able to not only make decisions for the immediate near-term, but to plan for the future. The research would inform airports within the United States regardless of whether they cater to interstate, regional, or international traffic.

The research would provide a survey of applicable privacy laws and explain specific legal provisions of privacy laws, group them by shared requirements or elements in common, highlight unique aspects, and suggest options for compliance. To achieve this objective, the following tasks will be completed within 12 months:

1. Review and analyze privacy-related laws applicable to the use of biometrics by airport operators in the United States and globally;

2. Create a table summarizing relevant laws and highlight any potential conflicts;

3. Include a discussion of best practices and whether they practically meet legislative requirements;

4. Provide an interim report to the review panel after 6 months;

5. Arrange for a series of webinars to communicate findings and invite additional input;

6. Offer compliance guidance to avoid litigation and possible sanctions; and

7. Provide a final report to ACRP.

This research project is expected to cost $95,000 which includes all direct and indirect costs. The expected cost reflects additional and complex research into international sources, which is likely to pose additional challenges for the conduct of any comparative law analyses.

Information Sources--Organizations, individuals, or related literature.

A review of prior and on-going research revealed a current project that touches on the legal and policy aspects of biometric use by the air industry in general terms and at a high level, ACRP 03-55 Airport Biometrics-a Primer.



4 votes
4 up votes
0 down votes
Idea No. 700