Back to News & Commentary

People Should Be Allowed to Sue Facebook If It Violates Law on Face Recognition Privacy

Facebook Offices
Facebook Offices
Nathan Freed Wessler,
Deputy Director, 老澳门开奖结果 Speech, Privacy, and Technology Project
Share This Page
December 18, 2018

Ten years ago, Illinois enacted a law that imposes important protections against companies collecting and storing our biometric information 鈥 including using facial recognition鈥 without our knowledge and consent. The law is called the Biometric Information Privacy Act. Although facial recognition was relatively crude when it was passed, the wisdom of Illinois鈥 decision has been borne out over the last decade, as facial recognition and other biometric collection has developed and spread.

On Monday, the 老澳门开奖结果 filed a friend-of-the-court brief in federal appeals court defending the Illinois law against arguments advanced by Facebook trying to remove the law鈥檚 pro-privacy teeth. (The brief was filed along with 老澳门开奖结果 affiliates in Illinois and California as well as the Electronic Frontier Foundation, Center for Democracy & Technology, and Illinois PIRG).

Under the law, a company may collect a person鈥檚 biometric identifiers 鈥 like fingerprints or data from a person鈥檚 face or iris 鈥 only if it first obtains informed consent from that person. In the case now pending in the Ninth Circuit Court of Appeals, Facebook users in Illinois have alleged that the company violated their rights under the law by using facial recognition technology to identify them in digital images uploaded to the site without disclosing its use of facial recognition or obtaining consent.

One of Facebook鈥檚 is that people should not have an automatic right to sue when their biometric information has been collected in violation of the law. Rather, they must prove that they have suffered monetary or other damages. As we explain in our brief, however, that runs counter to the Illinois Legislature鈥檚 intent, which was to provide strong, enforceable protection against surreptitious collection of sensitive biometric data.

In the decade since passage of the law, the need for its protections has become crystal clear. As we explain in the brief, today:

Retail stores use facial recognition technology to 鈥,鈥 and at least some companies are using such technology to track shoppers in their stores. collect biometrics for time tracking and attendance management, as well as to manage access to company phones, laptops, and cloud storage accounts. have invested in collecting customers鈥 biometric data, including face scans, fingerprints, iris scans, and voiceprints, to authenticate those customers鈥 identities. have facial recognition and fingerprint collection technology 鈥渢o accurately track attendance for various events like Bible studies, worship services and Sunday school.鈥 Many now collect fingerprints to manage attendance, cafeteria purchases, library services, and security, and some have started installing facial recognition systems to control entry into buildings.

Perhaps most concerning, major technology companies like Amazon have invested heavily in powerful facial recognition systems that they sell access to on the cheap. its facial recognition system, called Rekognition, is not only able to store facial recognition images of large numbers of people, but it is also able to 鈥減erform real-time face searches against collections with tens of millions of faces鈥 and 鈥渄etect, analyze, and index up to 100 faces ... in a single image,鈥 such as photographs captured at 鈥渃rowded events ... [and] department stores.鈥

mytubethumb
play

%3Ciframe%20allow%3D%22accelerometer%3B%20autoplay%3B%20encrypted-media%3B%20gyroscope%3B%20picture-in-picture%22%20allowfullscreen%3D%22%22%20frameborder%3D%220%22%20height%3D%22315%22%20src%3D%22https%3A%2F%2Fwww.youtube.com%2Fembed%2FlSSZ3-ZIkHU%3Fautoplay%3D1%26version%3D3%22%20thumb%3D%22%2Ffiles%2Fweb18-amazon-face-recognition-560x315.jpg%22%20width%3D%22560%22%3E%3C%2Fiframe%3E

Privacy statement. This embed will serve content from youtube.com.

Using it is cheap, and as we have warned before, without protections, this technology could enable civil rights and civil liberties violations on a massive scale. Indeed, a recent survey conducted by the 老澳门开奖结果 revealed that 18 of the top 20 American retail companies refused to say whether they collect facial recognition scans of their customers.

That鈥檚 why we support a strong interpretation of the law鈥檚 protections. As the district court in its ruling against Facebook in February, 鈥淲hen an online service simply disregards the Illinois procedures, as Facebook is alleged to have done, the right of the individual to maintain her biometric privacy vanishes into thin air.鈥

Without an enforceable requirement that companies disclose their collection of biometric information and obtain consent, people will have no way to protect themselves against surreptitious corporate surveillance.

Sign up for the and get our finest content from the week delivered to your inbox every Saturday.

Learn More 老澳门开奖结果 the Issues on This Page