Big tech companies are surveilling your face for profit. Fortunately, Illinois’ Biometric Information Privacy Act (BIPA) prohibits companies from harvesting and monetizing your biometrics, including a scan of your face measurements, without your informed opt-in consent. But now Facebook is asking the U.S. Court of Appeals for the Ninth Circuit to defang BIPA, by narrowly interpreting its enforcement tool and thus depriving injured parties of their day in court.
EFF has joined an amicus curiae brief urging the Ninth Circuit to properly interpret BIPA to provide strong protection of biometric privacy. Our fellow amici are ACLU, CDT, and PIRG.
The case on appeal is In re Facebook Biometric Information Privacy Litigation, which is sometimes called Patel v. Facebook. The plaintiffs challenge Facebook’s “tag suggestions” feature, which uses powerful face recognition technology to identify the people in images uploaded to the platform. Facebook then suggests that the people who uploaded the images tag the people in the images with those identities. The plaintiffs allege that this feature violates BIPA, by conducting face surveillance absent informed opt-in consent. The federal trial court certified a class of people allegedly harmed by this feature, and the Ninth Circuit granted an immediate appeal of whether the class was properly certified.
In deciding the class appeal, the Ninth Circuit may rule on the effectiveness of BIPA’s enforcement tool. BIPA provides that “any person aggrieved by a violation of this Act” may bring an action against the company that violated the Act. An important issue is whether a person is “aggrieved,” and may sue, based solely on the collection of their biometric information without their consent, or whether a person must also show some additional injury. The answer to this question may determine whether the members of the class suffered a common injury, and thus whether the class was properly certified.
EFF and our fellow amici argue that a person is “aggrieved,” and may sue, based just on capture of their biometric information without notice and consent. We offer several reasons. First, face surveillance and other forms of biometric tracking are a growing menace to our privacy. Our face measurements can be harvested at a distance and without our knowledge, and we often have no ability as individuals to effectively shield ourselves from this grave privacy intrusion. Second, BIPA follows in the footsteps of a host of other privacy laws that prohibit the capture of private information absent consent, and that define capture-without-consent by itself as an injury. Third, allowing private lawsuits is a necessary means to ensure effective enforcement of privacy laws.
Illinois’ BIPA is the strongest biometric privacy law in the United States. EFF and other privacy groups for years have resisted big business efforts to gut BIPA through the legislative process. Earlier this year, we filed an amicus brief before the Illinois Supreme Court, seeking a robust interpretation of BIPA. Now we are proud to join our privacy allies in a new amicus brief before the Ninth Circuit, pushing back against this latest effort to weaken BIPA.
