Last week, a Northern California District Judge ruled that Facebook will have to face a class action lawsuit from Illinois Facebook users who are unnerved by the site’s photo-tagging feature that relies on facial recognition to suggest people to tag.
The plaintiffs argue that the feature runs afoul of Illinois’ Biometric Information Privacy Act (BIPA), which was passed in 2008 and restricts how private companies are allowed to collect biometric data.
The lawsuit had been transferred from an Illinois court to one in California at Facebook’s request. The social media company, asked the judge to dismiss the case, saying that the plaintiffs had no grounds to sue given that Facebook’s Terms and Conditions have stipulated since 2015 that claims against the company must be litigated according to California law, where no such provision against biometric tagging exists.
The judge denied the request to dismiss the case, ruling that dismissing the case because California has no such prohibition against the collection of biometric data is “contrary to a fundamental policy of Illinois.”
The ruling notes that Illinois’ lawmakers were concerned because “Biometrics are unlike other unique identifiers . . . [and] are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.”
The judge’s ruling notes that “Among other protections, BIPA requires written policies on biometric data retention and informed consent before obtaining or disclosing personal biometric data.”
Facebook has long used facial recognition software to get users to tag their friends in photos, which encourages those friends to click around on the site more, generating more page views for Facebook. Facebook has argued that this information doesn’t constitute biometric data as defined by BIPA—Facebook’s facial recognition software works by measuring the distance between a person’s eyes, nose, and ears to create a “template,” whereas BIPA covers retina scans, fingerprints, voice prints, but also, vaguely, scans of “hand or face geometry.”[related-posts]
The Wall Street Journal notes that Facebook has also argued that users are able to turn off facial recognition data, which ostensibly deletes the template it has made using any particular customer’s facial data.
The judge did not rule on whether Facebook’s facial recognition did or did not violate BIPA, but he said that the plaintiffs have a “plausible claim” to argue their case in court.
[Arstechnica]
