Facebook Facial Tagging Biometric Lawsuit Moves Forward - InformationWeek
IoT
IoT
Government
News
5/7/2016
11:06 AM
50%
50%
RELATED EVENTS
Moving UEBA Beyond the Ground Floor
Sep 20, 2017
This webinar will provide the details you need about UEBA so you can make the decisions on how bes ...Read More>>

Facebook Facial Tagging Biometric Lawsuit Moves Forward

A federal district court denies Facebook's request to dismiss a case that alleges that the social media giant violated Illinois biometric privacy laws with its photo-tagging feature.

Facebook F8: AI, Future Of Apps On Display
Facebook F8: AI, Future Of Apps On Display
(Click image for larger view and slideshow.)

Facebook has lost the first round in a legal fight that alleges that the social media giant's photo tagging violates privacy rights.

A federal court in San Francisco has ruled that Illinois biometric privacy laws trump California laws, even if users have signed a terms of use agreement that states California laws would apply. The ruling may set a precedent that Illinois strict biometric privacy laws could override other state laws, a potentially significant issue as facial recognition becomes more pervasive in its use by Facebook and other tech titans.

A US District Judge James Denato said on Thursday that plaintiffs Nimesh Patel, Adam Pezen, and Carlo Licata can move forward in their Facebook biometric information privacy lawsuit. Although the plaintiffs are Illinois residents who filed in Illinois, all parties in the case agreed to transfer the case to the US District Court of Northern District of California, according to court documents. Donato denied Facebook's request to dismiss the case and set a case management conference for June 15.

(Image: ymgerman/iStockphoto)

(Image: ymgerman/iStockphoto)

The lawsuit, filed in 2015, argued that Facebook "amassed users' biometric data secretly and without consent," according to a PDF of court documents obtained by InformationWeek. The parties specifically cited Facebook's use of its Tag Suggestions program, in which users can upload photos to their Facebook account and tag the photos with an individual's identity.

According to the lawsuit, the parties filed their class action lawsuit under the Illinois Biometric Information Privacy Act (BIPA ). Facebook had argued that the plaintiffs had signed a user agreement that stipulated California state laws would govern the agreement. But Donato ruled the contractual choice of law would not apply.

In his ruling, he stated:

The plain language of BIPA indisputably evinces a fundamental privacy policy of Illinois.

It is equally undeniable that enforcing the contractual choice of California law would be contrary to this policy in the starkest way possible. Facebook tries to downplay the conflict as merely the loss of a claim. But if California law is applied, the Illinois policy of protecting its citizens' privacy interests in their biometric data, especially in the context of dealing with "major national corporations" like Facebook, would be written out of existence. That is the essence of a choice-of-law conflict. The conflict is all the more pronounced because California has no law or policy equivalent to BIPA. Unlike Illinois, California has not legislatively recognized a right to privacy in personal biometric data and has not implemented any specific protections for that right or afforded a private cause of action to enforce violations of it.

Illinois' greater interest in the outcome of this BIPA dispute is also readily apparent. The fundamental question on this point is "which state, in the circumstances presented, will suffer greater impairment of its policies if the other state's law is applied." The answer here could not be clearer. Illinois will suffer a complete negation of its biometric privacy protections for its citizens if California law is applied. Facebook makes the implausible argument that California has the superior interest of needing to provide "certainty and predictability to technology companies like Facebook" by "enforcing choice-of-law provisions." This makes little sense.

[Editor's note: References to specific document numbers and case numbers in the above quote have been omitted for easier reading.]

The judge added that, while California has a significant interest in enforcing contracts executed by its citizens and businesses, Illinois in this particular case has a "case-specific interest" in protecting its residents from losing statutory protections.

[Read Facebook Faces Trouble in France for Tracking Non-Users.]

Although the judge noted that further facts in the case may emerge that could affect the plaintiff's BIPA claims, for now the court accepts their allegations that Facebook's face recognition technology involves scanning a person's face geometry and does it without the plaintiff's consent.

The plaintiffs are seeking a jury trial and $75,000 in damages.

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
5/9/2016 | 9:11:46 AM
Compliance
Legal-wise and logic-wise, makes a certain amount of sense to me (in the context of this article, of course; I have not read the full opinion/decision, so perhaps (or perhaps not) my opinion would change if it did).  You reach out to do business in a jurisdiction, you gotta deal with the laws of the land there.

On the other hand, this is why you compliance costs are so high for companies -- and why those costs get passed on to consumers and users one way or another.

Plus, facial tagging is one of THE features of FB.  The paternalism here just seems silly -- but, then, I am not an Illinois voter.
NJ Mike
50%
50%
NJ Mike,
User Rank: Moderator
5/9/2016 | 9:11:36 AM
You don't like it . . . . don't use Facebook
If you don't like Facebook collecting information about you, DON'T USE IT!!  If you are really upset about them collecting infomation about you, ask for a refund . . . . . wait, IT'S FREE!!! 
SGTCROWLEY
100%
0%
SGTCROWLEY,
User Rank: Apprentice
5/7/2016 | 3:03:34 PM
Biometric Facials
I have a Love-Hate relationship with Facebook. For the most part it is heavier on the Hate side. I wish a new service would appear and knock that smug little brat, Zuckerberg off his throne.  

I'm guessing facial recognition data from each user is stored without consent, ...well if you count clicking a user agreement consent, which I don't.  You need a lawyer to understand those small font, forever scrolling agreements, who has money for that?

This really should be a Federal Privacy Law, if the Feds were on the side of the people. Unfortunately they are not.  The Feds love this technology.  It's invassive, diabolical and can be completely covert, just they way they like it!
How Enterprises Are Attacking the IT Security Enterprise
How Enterprises Are Attacking the IT Security Enterprise
To learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
Register for InformationWeek Newsletters
White Papers
Current Issue
IT Strategies to Conquer the Cloud
Chances are your organization is adopting cloud computing in one way or another -- or in multiple ways. Understanding the skills you need and how cloud affects IT operations and networking will help you adapt.
Video
Slideshows
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Flash Poll