Just before Memorial Day,
Silicon Valley decided to take a trip to Springfield.
At least, that’s the belief
of privacy advocates who suddenly faced legislation they feared could have
weakened the strongest biometric protection law in the country – a law lawyers
have in recent months begun to use to bring class action lawsuits against
several social media titans and other businesses who collect and use biometric
information, such as fingerprints or “faceprints” to either allow customers to
access accounts or help people share photos, among other uses.
The Thursday before the
holiday at the end of May - three days before the end of the Illinois General
Assembly’s spring legislative session - an amendment was attached to a bill which
previously had dealt only with unclaimed property, to narrow the scope of
protection provided by the Illinois Biometric Information Privacy Act.
It also seemed to create a
very large exception for social media companies, three of whom have recently
faced lawsuits alleging their various facial recognition systems violated BIPA,
said Christopher Dore, a partner at
Edelson PC in Chicago, a firm representing plaintiffs in a class action against
BIPA protects the use of an
individual’s biometric information – in the bill, described as “a retina or iris scan, fingerprint,
voiceprint, or scan of hand or face geometry.”
The proposed amendment would have
changed the definitions of “scan” and “photograph” so that digital photographs scanned
by a facial recognition system were not protected; only data that was
physically scanned in person would be covered.
What’s more, the bill would
have been retroactive, essentially crippling the lawsuits currently pending
against Facebook and Google, Dore said.
In April, Shutterfly settled
a class action for an undisclosed amount after being sued for violating BIPA.
Privacy advocates scrambled
to register their opposition, with roughly a dozen privacy groups co-signing
letters written by the Electronic Frontier Foundation, Illinois Public Interest Research
Group and the World Privacy Forum, said Adam Schwartz, senior staff attorney at the EFF, a nonprofit digital rights group based
In the EFF’s opposition
letter, the impact of the amendment was neatly packaged for state Sen. Terry
Link, who proposed the revision, and who had actually been one of BIPA’s
original sponsors when it was enacted in 2008.
“In short … this bill would
effectively reduce BIPA to protecting only fingerprints and voiceprints,” the
to table the bill on Friday, one day after he had submitted the amendment. An employee at Link’s district office in Gurnee
said the senator preferred not to comment on the issue.
But policy advocates have
had plenty to say.
Trying to weaken a law that
has been on the books for nearly a decade, especially without having policy
debate, is in poor form, said Gautam Hans, policy counsel for the Center for
Democracy and Technology-San Francisco.
“Most of the uses that one would imagine that
the law was covering would be digital,” he said. “Having a law that only protects a small
percentage of biometrics issues is not ideal.”
Dore, who said BIPA was one of the best privacy
bills in the country, believes various lobbyists retained by Facebook and Google worked
on the amendment, with possible others involved as well.
“This seems to be the playbook, to try to change
the law at the source when you’re losing in court,” Dore said.
In the coming months, his
team will be part of a larger movement, if necessary, to make sure the law
isn’t changed, he said.
“We’re expecting various different
privacy and consumer advocacy groups making their voice heard to say, this
isn’t actually helping this bill … and to say, no, this is an active attempt to
create exceptions, and very large exceptions, for significant companies,” Dore
said. “We think once that information is clearly provided to members of the (Illinois
state) Senate and House, there will be waning interest in pursuing this
“We’re confident that
the bill will not be passed.”
Facebook’s official statement was
to commend Link for the amendment.
“We appreciate Sen. Link’s effort
to clarify the scope of the law he authored,” said a Facebook spokesperson.
Meanwhile, others believe BIPA
should not only be upheld as is, it should be used as a guideline for other
states, particularly as the use of biometrics increases.
“BIPA, really, is the best law of its kind and
the first,” Schwartz said.
Dore said he believed the law should be “mimicked
around the country.”
“This is a bill that’s important for privacy, and
something that Illinois has shown leadership on, up to this point, to provide
these types of protections that aren’t available in other states,” he said.