Modern technologies found in sensors, software, and readers make it increasingly possible to use fingerprints, facial recognition, retinal or iris scans, voiceprint reading, gait analysis, or keystroke analysis to identify a person.

In response to these technologies, some state legislatures (Arkansas, California, Illinois, New York, Texas, Washington) have enacted biometric information privacy laws that govern the collection and use of this data.

For example, in Illinois, the Biometric Information Privacy Act (BIPA) provides a set of rules for companies collecting biometric data—and unlike the biometric data privacy statutes in Texas and Washington, it creates a private cause of action, allowing Illinois residents whose biometric data is improperly collected or used to file a lawsuit for the violation of the statute.

There are essentially five key features of the Illinois law known as BIPA:

• it requires informed consent prior to collection;

• it prohibits any profiting from biometric data;

• it allows only a limited right to disclose the data;

• it sets forth both protection obligations and data retention guidelines for businesses; and

• it creates a private cause of action for those harmed by BIPA violations.

As of my knowledge cutoff date in early 2023, New Mexico has not enacted comprehensive biometric information privacy laws similar to the Biometric Information Privacy Act (BIPA) in Illinois. While some states have specific regulations governing the collection, use, and storage of biometric data, New Mexico's statutes do not currently address biometric privacy to the same extent. However, businesses operating in New Mexico that collect biometric data should still be aware of general privacy principles and potentially applicable federal laws, such as the Children's Online Privacy Protection Act (COPPA) and the Health Insurance Portability and Accountability Act (HIPAA), which may impose certain requirements regarding the handling of biometric data in specific contexts. Additionally, New Mexico's data breach notification law requires businesses to protect personal identifying information, which could include some forms of biometric data, and to notify affected individuals in the event of a security breach. It is important for entities dealing with biometric data in New Mexico to stay informed about any future legislative developments in this area and to ensure compliance with any applicable federal regulations.