Handprints for IDs? State liquor board discusses biometrics for alcohol sales

This story is republished from Washington State Standard. Read the original article.

The power to purchase alcoholic beverages in Washington could soon be in the palm of your hand – if you’re of legal drinking age of course.

A state panel last Tuesday discussed allowing biometric data – like finger or hand prints, retinal scans or voice recognition – to be used instead of a physical ID when buying beer, wine or liquor.

Major companies, including Amazon, offer technology to make this possible and even have ways to let people pay by simply flashing their palm in front of a scanner. While that might sound convenient to some consumers, it’s stoking concerns among privacy advocates.

In the backdrop is a broader debate about how far government policymakers should go in regulating companies’ emerging uses of biometric data they vacuum up from consumers.

The state Liquor and Cannabis Board will take up proposed rule changes on biometric identification again at its Wednesday meeting. Some members indicated last week that the board would likely defer to the Legislature on the issue.

“This would be a paradigm shift in how Washingtonians verify who they are for purposes of purchasing alcohol,” said Daniel Jacobs, liquor and alcohol rules coordinator at the board.

How it works

The proposed rule changes came in response to a request from Claire Mitchell, a partner at the law firm Stoel Rives, which represents food and beverage businesses that serve alcohol.

The changes would add biometric screening to the list of acceptable forms of identification under Washington’s administrative code. This could allow places that sell alcohol to use this data as identification instead of a driver’s license or other ID card.

Customers could register with a third party company, complete a fingerprint or retinal scan, and submit a copy of their government ID. When they go to purchase drinks, they could then scan a hand or finger print, and a photo of their ID would pop up for the bartender to approve.

A similar system is already in place at Denver’s Coors Field, home of the Colorado Rockies baseball team, which installed biometrics screening for alcohol purchases last month. The stadium uses Amazon One devices to scan customers’ hands.

The Amazon One device also advertises itself as a convenient way for customers to pay with their palm, if they add their credit card information to their account.

Amazon isn’t the only company that has biometric screening devices. Jacobs said there are likely between seven and nine companies that businesses in Washington could partner with.

Another example is CLEAR, which uses biometrics at airports, including Seattle-Tacoma International Airport, to allow customers to skip regular security lines. CLEAR lets customers sign up with a government-issued ID or passport and scan their eyes or fingerprints.

Washington Liquor and Cannabis Board Chair David Postman said he could see Washington allowing biometric identification in a contained place, such as the Seattle Mariners baseball stadium, as a pilot program, but he said he had concerns about where the Legislature stood on the issue.

“We don’t have to wait for the Legislature, but I don’t want to do something that the Legislature would then overturn or block somehow,” he said.

Privacy risks

Being such a new technology, biometric data collection has sparked a host of privacy and equity concerns.

Jen Lee, technology policy program director at the American Civil Liberties Union of Washington, said she wasn’t familiar with the proposal for age verification for alcohol, but that the ACLU is worried about biometric data collection generally.

There are a lot of unknowns with third-party data collection and how that connects with the data governments can access and use, she said. Lee added that there isn’t a lot of regulation for how third parties use this data, leaving consumers in the dark about what happens with it.

“The more biometrics are collected in this often non-contractual, but also non transparent manner … the more privacy risks increase,” Lee said.

Lawmakers haven’t tackled using biometrics for age verification before, but they have dealt with a number of other data privacy and biometric proposals.

In 2017, the Legislature passed a biometrics privacy law. The law requires that biometric identifiers collected for commercial use only be used according to the terms a customer originally agreed to, unless a company goes back and gets agreement on updated terms.

The law also prohibits the sale, lease or disclosure of biometric data for commercial purposes without permission from the person it is collected from, except in certain situations outlined in law, like if sharing the information is necessary for a financial transaction.

Lee said the biometrics law on the books in Washington is “really weak,” mostly because the definition of biometrics does not include facial recognition.

Most recently, the Legislature passed a bill that protects health data, including biometric data, from being shared without people’s consent. The legislation, part of a suite of bills meant to strengthen reproductive rights in Washington, could protect people who use health apps, such as menstrual cycle tracking apps, from having their data sold or used without their permission.

Lee said the definition of biometrics in the health data law is much stronger than the one in the 2017 law, but it only applies to certain types of health data.

Curiosity among lawmakers

Lawmakers reached last week expressed interest in hearing how biometric screening for alcohol purchases would work.

State Sen. Jamie Pedersen, D-Seattle, former chair of the Senate Law & Justice Committee, said if a person wants to voluntarily provide biometric information at a stadium to assure service, that’s fine, but he had concerns about what happens with the information after the event.

“I’m not sure there are a lot of restrictions on that information right now,” he said, adding he wasn’t sure lawmakers had to be the ones to set the rules.

Whoever oversees the process, he said, must be sure it is thorough and thoughtful. Consumers should not be encouraged to give up that data “without thinking about how it might be used,” he said.

Next steps

Members of the Liquor and Cannabis Board voiced mixed feelings about how much they should lean into biometrics for age verification.

Board member Jim Vollendroff said it’s an area the panel should consider, even if they do not need to take immediate action on it.

He offered to bring a bill to the Legislature for their consideration. He said biometrics for identification is something that’s likely coming, and the board should get ahead of it.

Board member Ollie Garrett agreed, saying the board should start to have discussions about it as opposed to waiting for the Legislature to prod them along.

Even if the panel agrees Wednesday to look at the proposed rulemaking, members said last week it doesn’t mean they will make any changes immediately.

Standard reporter Jerry Cornfield contributed to this report.