{"id":4043,"date":"2016-04-04T14:49:32","date_gmt":"2016-04-04T18:49:32","guid":{"rendered":"http:\/\/ncjolt.org\/?p=4043"},"modified":"2020-06-04T20:53:02","modified_gmt":"2020-06-04T20:53:02","slug":"facial-recognition-technology-is-it-legal","status":"publish","type":"post","link":"https:\/\/journals.law.unc.edu\/ncjolt\/blogs\/facial-recognition-technology-is-it-legal\/","title":{"rendered":"Facial Recognition Technology: Is it Legal?"},"content":{"rendered":"

The State of Illinois passed the Illinois Biometric Information Privacy Act (BIPA)<\/a><\/span> which regulates the use of \u201cbiometric identifiers\u201d or \u201cbiometric information\u201d by private entities. A private entity may not obtain a person\u2019s biometric identifier or information without first informing the subject that it is being collected or stored, informing the subject of the purpose for it being obtained, and receiving a written release by the subject.
\nThere are several cases<\/a><\/span> alleging that facial recognition technology violates this Act. An example of facial recognition technology is when a website recommends who to take in a photo when the picture is uploaded to a site like Facebook. In these situations, the website recommends who to \u201ctag\u201d in the photo based on its recognition of the facial features of each person in the photo as compared to other \u201ctagged\u201d pictures of the given person. Currently, there is a putative class action pending against Google based on Google\u2019s cloud-based \u201cGoogle Photos\u201d service for \u201ccollecting, storing and using Plaintiff\u2019s and other similarly situated individuals\u2019 biometric identifiers and biometric information (collectively \u201cbiometrics\u201d) without informed written consent, in direct violation of the BIPA.<\/a><\/span>\u201d This case is: Rivera v. Google, Inc., No. 16-02714 (N.D. Ill. Filed Mar. 1, 2016).
\nThe Rivera case<\/a><\/span> arises from users of Google \u201cDroid\u201d devices who take photos and upload them to \u201cGoogle Photos.\u201d This service has millions of \u201cface templates\u201d of Illinois residents stored in the Google cloud. What is frightening to the plaintiffs bringing this case is that they don\u2019t have to be a member of \u201cGoogle Photos\u201d for their \u201cface template\u201d to be stored. Thousands of Illinois citizens are subject to this face template storage without ever being a user of Google Photos<\/a><\/span>. Other people have uploaded these photos of non-users in turn putting their face templates at risk. Google did not obtain consent from the non-users to store this information. The complaint<\/a><\/span> points out an even more frightening factor about this case.<\/p>\n

Unlike Social Security numbers that can be changed when there is fraud, biometrics are unique to each individual, and once the biometrics are compromised, there is no way to simply change them.<\/p><\/blockquote>\n

 
\nFace templates are a unique and personal attribute to each and every individual just like one\u2019s DNA. It belongs to that person, and only that person.
\nEven further, the effects of this case could be huge. The number of persons in this Class are likely to be in the tens or hundreds of thousands. The BIPA provides for a private right of action. The potential awards in this statute provide for $1,000 in damages for negligent violations of the statute, and $5,000 for each intentional or reckless violation of the statute. Multiply these possible damages by each plaintiff, and Google could owe tens of millions in damages.
\nMany questions arise because of this case. The courts must decide what are \u201cbiometric identifiers\u201d and what constitutes \u201cbiometric information\u201d under this statute. In addition, these cases will have to resolve why facial recognition technology fits within these statutory definitions. Courts have not yet litigated<\/a><\/span> on this statutory interpretation in reference to facial recognition technology, and perhaps much of this case will depend on cases against Facebook (Gullen v. Facebook, Inc., No. 15-07681 (N.D. filed Aug. 31, 2015))<\/span><\/a> and Shutterfly<\/a><\/span>.
\nA second important question is whether this information has the same ability as personal identifiers such as social security numbers to contribute to identity theft and fraud. Is the information so vital to these purposes that it is worth a potential multi-million dollar loss by Google, one of our nation\u2019s most well known companies? Stores such as Wal-Mart have tested the benefits of this technology by using it to catch shoplifters<\/a><\/span>. What if the information can also be used in a beneficial manner?
\nWhat we do know is that these cases have the potential for a huge impact on companies like Google and Facebook, and potentially on facial recognition technology as we currently know it. Will other states begin to implement these statutory rules, and if so, how will these companies fare?<\/p>\n","protected":false},"excerpt":{"rendered":"

The State of Illinois passed the Illinois Biometric Information Privacy Act (BIPA) which regulates the use of \u201cbiometric identifiers\u201d or \u201cbiometric information\u201d by private entities. A private entity may not obtain a person\u2019s biometric identifier or information without first informing the subject that it is being collected or stored, informing the subject of the purpose …<\/a><\/p>\n","protected":false},"author":1,"featured_media":4044,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[51],"tags":[],"_links":{"self":[{"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/posts\/4043"}],"collection":[{"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/comments?post=4043"}],"version-history":[{"count":1,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/posts\/4043\/revisions"}],"predecessor-version":[{"id":7211,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/posts\/4043\/revisions\/7211"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/media\/4044"}],"wp:attachment":[{"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/media?parent=4043"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/categories?post=4043"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/tags?post=4043"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}