Chris Cruger
on
From the Lawyers of WRW Legal, PLLC
Does or did the funeral home you are considering acquiring collect fingerprints, DNA or locks of hair from decedents for the creation of keepsakes? If so, you may be acquiring liability related to that practice. You’ll want to give attention to that business’s practices relating to the collection and use of biometric data.
Currently, there are only a few states which have enacted laws regarding biometric data privacy. But, that does not mean that those are the only states where collecting and using biometric data without prior permission can be problematic. There are currently two lawsuits of which we are aware against funeral homes for capturing decedent fingerprints prior to obtaining authorization from the decedent’s next of kin, aka the authorizing agent – a class action in Illinois and another case in Florida. The cases are underway, which means that no court has yet ruled that prior permission to capture fingerprints or DNA is required; but, the trauma, expense and loss of business reputation associated with being sued is enough for our firm to instruct our clients in all states to obtain authorization before collecting any biometric data. That’s always been our advice and we stand by it.
Going forward, what does authorization to collect biometric data look like? That’s an easy and not so easy question because the law differs based on the biometric privacy law in place. Because there are so few, we recommend that you take adopt the strictest practices. In short, you form needs: (1) prior authorization from the appropriate authorizing agent; (2) a description of the use of the biometric data (create keepsakes, for instance); (3) a description of how the data will be stored; and (4) identification of a time period after which the data will no longer be maintained. On that last point we recommend two years because that’s the shortest of the times established in the relevant laws.
So, buyer beware if your target has been collecting biometric data. While the practice is definitely not a reason to avoid the acquisition, it is something to be aware of so that you can best assess your risks when making a deal!