Maine needs guardrails to protect consumers from potential breaches of their most private information, including facial recognition, voice recordings and fingerprints, a Saco Democrat told fellow lawmakers Monday.

Rep. Maggie O’Neil said the sensitive data needs extra protection because unlike a password or credit card number, the personal identifiers can’t be changed.

“What happens in the event of a breach?” O’Neil asked members of the Judiciary Committee. “You can’t change your biometric identifiers. Once that gets out into the world, it’s there forever.”

O’Neil’s bill, LD 1705, was one of six considered by lawmakers on Monday that seek to update or change Maine law with regard to digital data.

The O’Neil bill requires private entities to get a written release before obtaining or using the identifiers, bans the sale of them, and allows citizens to sue companies for violations.

Sen. Lisa Keim (R-Dixfield) is sponsoring LD 1973, which requires that consumers opt-in to allow businesses to collect personal data, geolocation data and other personal information.

It repeals a 2019 state law that limits data gathered by internet service providers.

“This bill seeks to give Maine people control over their information and create a more transparent relationship between businesses and their customers,” Keim said.

Many of those who testified on the bills said they are complicated and that they could potentially make it difficult for businesses to operate in Maine. They urged the committee to carry over the bills to next year, which would allow time over the summer and fall for all groups to discuss their impacts.

The Maine State Chamber of Commerce, one of the groups that asked for more time to consider the bills, supports Keim’s bill but opposes the one sponsored by O’Neil, said chamber lobbyist Ben Lucas.

He also touched on a key point of contention. Some companies, including banks and credit unions, see the use of biometric identifiers — which include voice, eye, fingerprint, face or hand data — as important technologies that help consumers protect vital information.

Those can be used in multifactor authentication to enhance cybersecurity.

“Use of identifiers is much safer than passwords alone,” said Josh Steirman of the Maine Bankers Association. “We are concerned new legislation might potentially restrict banks’ ability to use biometric identifiers which we use to help keep customers safe.”

And even though O’Neil’s bill would allow consumers to opt-in to those services, Steirman said when consumers can opt-in, rather than opt-out, the rates of participation are significantly lower.

Another major concern for companies is that O’Neil’s bill would allow individuals to sue if there are violations of the law, rather than relying on the state to take up the case.

Attorney General Aaron Frey testified in support of O’Neil’s bill, saying as it is now, Mainers have “no way of being confident with what’s being done with their very sensitive biometric information.”

He opposes Keim’s bill, saying that it unnecessarily repeals current law that regulates internet service providers, which he believes is working to protect Maine consumers.

He also objects to several parts of Keim’s bill, including language that would give companies 30 days to comply if they are violating the law.

“This undermines the bills deterrence since controllers know they can violate the law with impunity until they are caught,” he said.

The ACLU of Maine also testified in opposition to Keim’s bill and in favor of O’Neil’s.

Meagan Sway of the ACLU said the technology is advancing at a rapid rate and consumers likely don’t understand all of the information companies are collecting about them.

“We’re still at a place where the genie, if not go back in bottle, can at least be stopped half-way out of the bottle,” Sway said. “I really think we’re at a place where if we wait too much longer, the genie is out of the bottle and our privacy is out there for anyone.”