• by Wendy Davis  @wendyndavis, September 18, 2017

Siding against Shutterfly, a federal judge has refused to throw out a lawsuit alleging that the company violated an Illinois privacy law regarding faceprints.

The ruling, issued Friday by U.S. District Court Judge Joan B. Gottschall in Illinios, means that Florida resident Alejandro Monroy can move forward with a class-action complaint accusing Shutterfly of violating the Illinois Biometric Information Privacy Act. That law, passed in 2008, requires companies to obtain written releases from people before collecting certain biometric data, including fingerprints, retinal scans and scans of face geometry.

The Illinois measure also requires companies that gather biometric data to notify people about the practice, and to publish a schedule for destroying the information. The law also provides for up to $5,000 in damages for intentional violations.

The ruling stems from a 2016 lawsuit centering on Shutterfly's alleged use of facial recognition technology on photos uploaded by users. Monroy, who says he has never used Shutterfly's service, alleged that he discovered last June that his photo had been uploaded to the service and "tagged" with his name. Monroy said the person who uploaded the photo did so while in Illinois.

"Upon upload of the photograph of Plaintiff, Shutterfly automatically located Plaintiff’s face, analyzed the geometric data relating to the unique contours of his face ... and used that data to extract and collect Plaintiff’s scan of face geometry (i.e., his biometric identifier)," his complaint alleged.

Shutterfly argued that the lawsuit should be dismissed at an early stage for several reasons. Among others, the company said that Illinois law only applies to faceprints derived from in-person scans.

The law refers to "scans of facial geometry," but also has language that appears to exclude both photos and information derived from photos from coverage.

Shutterfly argued that those exclusions mean that the law doesn't apply to faceprints derived from photos. "A 'scan of face geometry' requires a person to present his actual face at a console or other scanner, such as those widely used at airports," the company argued in papers filed earlier this year.

The company attempted to bolster its argument by contending that other forms of biometric data covered by the Illinois law -- like retinal scans and fingerprints -- were derived from information collected in person as opposed to photos.

Gottschall rejected Shutterfly's argument, writing that the company's interpretation of the law "would leave little room for the law to adapt and respond to technological development."

She added that despite Shutterfly's contentions, identifiers like fingerprints and retinal scans can originate with photographs. For instance, the judge wrote, hackers are able to recreate fingerprints by examining photos of them, according to a 2014 CNN report.

Shutterfly, which is headquartered in California, also argued that Illinois can't constitutionally regulate activity that takes place in other states. "On plaintiff’s theory, if a Californian took a vacation in Miami, snapped a photo of a Florida resident, then uploaded the photo to Shutterfly during a layover at O’Hare on his way home, and Shutterfly then analyzed that photo from its California headquarters, Shutterfly would have to comply with this Illinois statute," the company wrote. "Illinois has no interest in regulating this set of facts."

Gottschall rejected that argument as well. "It is true that the statute requires Shutterfly to comply with certain regulations if it wishes to operate in Illinois. But that is very different from controlling Shutterfly's conduct in other states," she wrote.

Shutterfly was previously sued for allegedly violating the Illinois law. The company settled that case in March of 2016.

Shutterfly isn't the only company accused of unlawfully compiling faceprint databases. Facebook and Google are also battling lawsuits accusing them of violating the Illinois privacy law. Judges in those cases have so far rejected the companies' attempts to have the lawsuits dismissed.