A federal judge will allow a class action to continue against IBM over its scans of millions of photos from Flickr, accusing it of violating Illinois’ biometrics privacy law in the way it worked to develop tech to help companies train A.I. to better recognize a range of human faces.
However, the judge’s ruling tees up key battles to come on defining the reach of the Illinois state law on which the class action lawsuit is built.
The litigation has lasted in court since January, when attorneys with the firm of Carson Lynch LLP, of Chicago, and Loevy & Loevy, of Chicago, each filed suit in Cook County Circuit Court. The complaints, filed on behalf of named plaintiffs Steven Vance and Tim Janecyk, accused IBM of improperly downloading and scanning millions of photographs from the Yahoo Flickr Creative Commons 100 Million Dataset.
That dataset was part of “a reference library of scientific datasets,” according to the lawsuit, eventually containing more than 99 million photos uploaded to Flickr since 2004.
Each photo allegedly included such information as who uploaded the photo, when the photo was taken and uploaded, and the location at which each photo was taken, among other identifiers.
The complaints said Yahoo transferred the photos from Flickr without notifying users, and then made them available to IBM and others.
The complaints assert IBM then scanned the tens of millions of photos for human faces, and added those faces to its Diversity in Faces (DiF) dataset. DiF had been created to help artificial intelligence (A.I.) systems better recognize female faces and those belonging to people of color. Such shortcomings in A.I. facial recognition software had been criticized for reflecting sexist and racist biases.
After IBM used so-called facial mapping technology to prepare the images for use in A.I. training, the company released the dataset publicly in early 2019.
The plaintiffs assert that facial mapping process, followed by the public release, violated the Illinois Biometric Information Privacy Act. The lawsuits allege IBM was required to identify and notify Illinois residents, to secure their authorization before scanning photos that contained their image and mapping their facial geometry.
According to the complaints, Janecyk, for instance, had uploaded more than a thousand photos to Flickr since 2008, including self portraits and photos of others, including many of strangers he would meet in Chicago.
According to the Janecyk complaint, IBM included at least seven of Janecyk’s photos in the DiF dataset, including a self portrait. The complaints allege there may be millions of others whose rights under the Illinois BIPA law were similarly allegedly violated.
Under BIPA law, the plaintiffs could be entitled to as much as $5,000 per violation, plus attorney fees. This could quickly push the potential damages into the billions of dollars.
IBM had the case removed to U.S. District Court for the Northern District of Illinois in Chicago, and then asked the judge to dismiss the case.
However, Judge Kocoras said it was premature to do so for most of the counts. He said that is particularly so on IBM’s claims concerning the “extraterritoriality” of the BIPA law, and whether the lawsuit should be disallowed under the so-called Dormant Commerce Clause of the U.S. Constitution.
While both the plaintiffs and IBM agree that the Illinois BIPA law can’t be enforced on behalf of those outside Illinois, the plaintiffs have asserted IBM’s use of the Flickr photos should be considered to have occurred in Illinois, thus falling under the law.
IBM has argued that should not apply here, because it is based in New York, and its employees completed the DiF work outside Illinois. Therefore, IBM said, the lawsuit should be disallowed.
Judge Kocoras, however, said more fact-finding is required to determine precisely how much of the work can be said to have been done in Illinois.
Similarly, the judge said more time was needed to address the question of whether the lawsuit can be allowed under the Commerce Clause.
IBM has argued that allowing the lawsuit to go forward, would essentially allow the plaintiffs to install Illinois law over the state of New York, as well. This, the company said, would violate the Constitution’s Commerce Clause, which reserves the right to regulate interstate commerce to the federal government.
Kocoras, however, appeared poised to side with plaintiffs on that question, as he said plaintiffs have noted courts have routinely rejected that very argument when it has been raised by other defendants based outside Illinois.
The judge pointed findings in a photo-face-scanning action brought against Google under BIPA, in which a judge ruled the ambiguities of the “face-scan process” makes it hard to determine exactly where an alleged violation may have occurred, for the purposes of the law.
Kocoras said questions concerning the Commerce Clause and extraterritoriality would need to wait for the next stage in proceedings, when the two sides battle over summary judgment.
Kocoras, however, sided firmly with the plaintiffs in rejecting IBM’s attempt to argue the BIPA law’s technical notice and consent requirements don’t apply to photographs – or more precisely, the way in which IBM scanned the photos.
In this case, Kocoras said IBM created a dataset that “includes biometric measurements that can be used to identify Plaintiffs,” actions which, he said, “implicate BIPA.”
Quoting again from the decision in the case against Google, Judge Kocoras said: “It is not the how that is important to the (BIPA law); what’s important is the potential intrusion on privacy posed by the unrestricted gathering of biometric information.”
And the judge rejected IBM’s assertions that the plaintiffs need to show they were harmed economically by IBM’s alleged face-scans, to press their action.
The judge said the alleged violation of the technical requirements of the BIPA law is sufficient to allow the lawsuit to proceed.
IBM is represented by attorneys with the firm of Quinn Emanuel Uquhart & Sullivan LLP, of Chicago.