CHICAGO — A Chicago federal judge recently rejected Google’s argument that an Illinois law on obtaining a person's biometric data does not apply to scanned photographs, and the decision could have far-reaching ramifications if other courts adopt the judge's interpretation of the law.
Rivera vs. Google Inc. alleges the company’s policies for handling the images violate the Illinois Biometric Information Privacy Act (IBIPA). Google argued the lawsuit should be dismissed because the law only applies to digital scans of real faces. U.S. District Judge Edmond E. Chang, however, ruled against the tech giant in late February.
“If this interpretation of the IBIPA is sustained through this case and by other courts, it would be significant in making it clear that the requirements of the statute apply to face scans from photos, not just face scans made in person,” said Steve Gold, an attorney at McGuire Woods in Chicago.
Gold said the ruling isn’t binding and only allows the lawsuit to proceed, though he said the judge’s interpretation of the law was well-reasoned, which could encourage other courts to adopt it.
The IBIPA prohibits a private entity from obtaining an individual’s biometric information, such as fingerprints, retina scans and facial geometry, unless it informs the person in writing and receives written consent. The entity must also have a written policy on storing and eventually destroying the data.
In the lawsuit, Lindabeth Rivera and Joseph Weiss allege Droid cellphones that took photographs of the two plaintiffs in Illinois automatically uploaded the photographs to Google Photo. Google’s software scanned the photographs and stored the plaintiffs’ facial geometry, allegedly in violation of the IBIPA.
Google argued Illinois lawmakers meant to apply the law to biometrics taken directly from people, not from digital images. Chang disagreed.
Gold said the judge based the decision on the wording of the statute and IBIPA’s legislative history. If a court later rules that the law applies to Google Photo, the company would have to notify users about its collection of facial geometry and how long it keeps the data.
“The statute is not specific to Google’s business, but applies to any private entity that collects the types of biometric information covered by the statute," Gold said.
Gold said the court accepted the plaintiffs’ assertion that the photographs were uploaded in Illinois without considering where the biometric data were extracted or stored. The ruling did not address whether the law governs a company's actions outside Illinois.
Gold said he can’t make any recommendations on how businesses should manage biometric data until the case is adjudicated.
“Any business that collects retina or iris scans, fingerprints, voiceprints or scans of hand or face geometry may wish to consult its attorney about the applicability of the statute,” he said.