Just before Memorial Day, Silicon Valley decided to take a trip to Springfield.
At least, that’s the belief of privacy advocates who suddenly faced legislation they feared could have weakened the strongest biometric protection law in the country – a law lawyers have in recent months begun to use to bring class action lawsuits against several social media titans and other businesses who collect and use biometric information, such as fingerprints or “faceprints” to either allow customers to access accounts or help people share photos, among other uses.
The Thursday before the holiday at the end of May - three days before the end of the Illinois General Assembly’s spring legislative session - an amendment was attached to a bill which previously had dealt only with unclaimed property, to narrow the scope of protection provided by the Illinois Biometric Information Privacy Act.
It also seemed to create a very large exception for social media companies, three of whom have recently faced lawsuits alleging their various facial recognition systems violated BIPA, said Christopher Dore, a partner at Edelson PC in Chicago, a firm representing plaintiffs in a class action against Facebook.
BIPA protects the use of an individual’s biometric information – in the bill, described as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.”
The proposed amendment would have changed the definitions of “scan” and “photograph” so that digital photographs scanned by a facial recognition system were not protected; only data that was physically scanned in person would be covered.
What’s more, the bill would have been retroactive, essentially crippling the lawsuits currently pending against Facebook and Google, Dore said.
In April, Shutterfly settled a class action for an undisclosed amount after being sued for violating BIPA.
Privacy advocates scrambled to register their opposition, with roughly a dozen privacy groups co-signing letters written by the Electronic Frontier Foundation, Illinois Public Interest Research Group and the World Privacy Forum, said Adam Schwartz, senior staff attorney at the EFF, a nonprofit digital rights group based in California.
In the EFF’s opposition letter, the impact of the amendment was neatly packaged for state Sen. Terry Link, who proposed the revision, and who had actually been one of BIPA’s original sponsors when it was enacted in 2008.
“In short … this bill would effectively reduce BIPA to protecting only fingerprints and voiceprints,” the letter stated.
Link decided to table the bill on Friday, one day after he had submitted the amendment. An employee at Link’s district office in Gurnee said the senator preferred not to comment on the issue.
But policy advocates have had plenty to say.
Trying to weaken a law that has been on the books for nearly a decade, especially without having policy debate, is in poor form, said Gautam Hans, policy counsel for the Center for Democracy and Technology-San Francisco.
“Most of the uses that one would imagine that the law was covering would be digital,” he said. “Having a law that only protects a small percentage of biometrics issues is not ideal.”
Dore, who said BIPA was one of the best privacy bills in the country, believes various lobbyists retained by Facebook and Google worked on the amendment, with possible others involved as well.
“This seems to be the playbook, to try to change the law at the source when you’re losing in court,” Dore said.
In the coming months, his team will be part of a larger movement, if necessary, to make sure the law isn’t changed, he said.
“We’re expecting various different privacy and consumer advocacy groups making their voice heard to say, this isn’t actually helping this bill … and to say, no, this is an active attempt to create exceptions, and very large exceptions, for significant companies,” Dore said. “We think once that information is clearly provided to members of the (Illinois state) Senate and House, there will be waning interest in pursuing this amendment.
“We’re confident that the bill will not be passed.”
Facebook’s official statement was to commend Link for the amendment.
“We appreciate Sen. Link’s effort to clarify the scope of the law he authored,” said a Facebook spokesperson.
Meanwhile, others believe BIPA should not only be upheld as is, it should be used as a guideline for other states, particularly as the use of biometrics increases.
“BIPA, really, is the best law of its kind and the first,” Schwartz said.
Dore said he believed the law should be “mimicked around the country.”
“This is a bill that’s important for privacy, and something that Illinois has shown leadership on, up to this point, to provide these types of protections that aren’t available in other states,” he said.