At the opening of the new millennium, the idea of computer programs using facial recognition software to target ads to people was the stuff of such science fiction stories as 2002’s “Minority Report.”
By 2010, however, Facebook had reported its users had applied more than 100 million “tags” to photos uploaded to its site, identifying millions of people appearing in the photos, and allowing the social media titan to launch a new tool it called “Tag Suggestions” – essentially allowing facial recognition algorithms to identify in those uploaded photos the people whose “faceprint” had been stored in Facebook’s databases from previous tagged photo uploads.
And by 2015, Facebook was served with the first in a series of class action lawsuits under a previously little known Illinois law over the use of facial recognition and other such biometric identification systems.
| Katherine Welles / Shutterstock.com
But if those bringing such class action lawsuits have their way, the state law, enacted in 2008 as the Illinois Biometric Information Privacy Act, will impact businesses of many sizes, far beyond Silicon Valley’s social media giants.
Only Texas and Illinois have such state-level laws in place to protect biometric information. But Illinois was ahead of its time when it created the BIPA eight years ago, said Christopher Dore, a partner at Edelson PC in Chicago.
BIPA regulates the ways in which a person’s biometric identifiers – described in the act as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry” – are collected, stored and used.
Under the act, individuals must be informed in writing ahead of time – and give their written permission – before any biometric identifiers can be obtained by a private entity. The length of time the identifiers will be used also must be disclosed.
But since BIPA was, and is, the only act of its kind in regard to its strength – and since it came into being several years before Facebook implemented Tag Suggestions - it mostly sat on the shelf, going unnoticed by companies operating on a nationwide basis, Dore said.
That is, until early last year, when Dore said Cook County resident Carlo Licata came to Edelson with concerns about his privacy on Facebook.
Licata and two other Illinois residents alleged Facebook violated BIPA by not gathering proper consent before collecting his biometric information. Though the suit originated in Illinois, it was transferred to a California federal court, since Facebook is headquartered in California. But a judge recently determined Illinois would retain jurisdiction, and BIPA regulations would apply.
The case still is pending, and its outcome will provide more definitive guidance on how similar cases will be handled.
Until the courts figure out how broadly or narrowly BIPA should be interpreted and applied, it’s difficult to say whether the statute is working the way it was intended, said A.J. Dixon, an associate attorney who is following the Licata case and others like it at Winston and Strawn LLP in Chicago.
“BIPA’s ‘legislative findings’ provisions, as well as its legislative history, suggest that it was originally meant to cover biometric information used in financial transactions and security screenings - for example, the ‘pay-by-touch’ machines that were being installed in a number of a Illinois grocery stores around the time the legislation was passed,” Dixon wrote in an email, responding to questions from the Cook County Record. “BIPA’s applicability to other technologies, such as Facebook’s photo-tagging function, is far less clear.”
Still, the mere existence of the Facebook case already has opened the door for a new scope of liability for businesses relying on biometric information.
In March, Google was hit with a class action for allegedly collecting the face templates of millions of Illinois residents through its Google Photos service.
In April, Shutterfly quietly settled a class action suit it had been fighting for months in which the photo publishing website was accused of violating BIPA. The amount of the settlement was not disclosed, but BIPA provides $1,000 for each negligent violation and $5,000 for intentional or reckless violations.
Most recently, the popular mobile messaging app Snapchat was sued in late May for collecting face templates through its Lenses feature.
In addition to the suits brought against the social media companies, at least two more cases have been filed under BIPA as of late, Dore said. National tanning salon chains LA Tan and Palm Beach Tan have come under BIPA’s glare for their systems, which collect and store their clients’ fingerprints.
Until there is judicial clarity on the reach of the BIPA, litigation likely will continue to increase, Dixon said.
Dore believes that’s a good thing.
“It’s vital that this type of information is regulated in how it’s collected and sold and used,” Dore said. “You can change your email password, even your Social Security number … but you can’t change your thumb print; you can’t change your face. You’re stuck with it, for better or worse.”
Other privacy advocates believe BIPA is a strong statute and could pave the way for similar protection acts in the future.
“[It’s] a good example of the kind of law that protects privacy in a way that’s effective and balances innovation desires and goals of companies but protects privacy rights of people,” said Gautam Hans, policy counsel of the Center for Democracy and Technology-San Francisco.
Others, such as the Illinois Policy Institute, have questioned whether the law may again make Illinois a haven for what others have called “enterprising litigation.” An Illinois Policy Institute spokesperson said the Institute doesn’t have an official position on BIPA.
But an article written by an Institute staffer and posted on the Institute’s website has openly pondered whether Illinois could “become the tech litigation capital of the nation, akin to Madison County, Illinois’ notoriety as an asbestos trial attorney’s paradise.”
“Might that have a dampening effect on technological innovation that could ultimately benefit huge numbers of people worldwide?” the article asked. “And wouldn’t it give tech firms – and many other companies – pause before they set up shop in Illinois?”