• by Wendy Davis  @wendyndavis, May 17, 2018

Facebook and a group of Illinois residents who are suing the company over its collection of "faceprints" must take their privacy battle to a jury this July, a judge has ruled.

The social networking service and the Illinois residents separately asked U.S. District Court Judge James Donato to decide the case based on evidence that had been developed during the three years the case was pending. But Donato said in a ruling issued this week that the case presented questions that can only be answered by a jury.

"A jury will need to resolve the genuine factual disputes surrounding facial scanning and the recognition technology," Donato wrote in a 10-page decision.

The fight dates to 2015, when several Illinois residents sued Facebook over its photo-tagging feature, which recognizes users' faces and suggests their names when they appear in photos uploaded by their friends. To accomplish this, Facebook draws on its vast store of users' photos. (The company recently unveiled new controls that allow people to opt out of having their photos recognized.)

The Illinois residents alleged that the automatic photo-tagging feature violates the Illinois Biometric Information Privacy Act -- a 2008 law that requires companies to obtain written releases from people before collecting “face geometry” and other biometric data.

Donato ruled last month that the Illinois users can pursue a class-action on behalf of all Facebook users in Illinois who had their "faceprints" stored by the company since 2011. In the course of that ruling, Donato rejected Facebook's argument that the case should be dismissed on the grounds that the photo-tagging feature didn't cause any injuries to the Illinois residents.

In his new decision, Donato criticizes Facebook for attempting to "misread and misrepresent" that previous order.

"The Court is concerned about a troubling theme in Facebook’s briefs," Donato writes. He elaborates that Facebook contended in its most recent papers that the Illinois residents can only prevail if they show "someting more than" a violation of the state law.

"This and similar comments suggest that Facebook is reverting to the faulty proposition that plaintiffs must show an 'actual' injury beyond the invasion of the privacy rights afforded by [the Biometric Information Privacy Act]. That is not what the Court has concluded," Donato writes.

"The Court expressly rejected that contention in considerable detail in the class certification order ... To contend otherwise, or to argue that BIPA requires some individualized quantum of 'actual' injury in addition to the privacy violation caused by the deprivation of the notice and consent requirements, is to misread and misrepresent the Court’s orders to misread and misrepresent the Court’s orders."

Donato also previously rejected Facebook's contention that the Illinois law only applies to faceprints derived from in-person scans, and not to faceprints created from photos.

Facebook raised that argument again in its recent papers, but Donato rebuffed the company's attempt to re-litigate the point. "Facebook did not comply with our district’s rule for seeking reconsideration ... and in any event, it offers nothing in the way of new facts or law that would warrant reconsideration at this stage," Donato wrote. "If facts adduced at trial provide a good-faith basis for further discussion, either side may propose it."

Facebook isn't the only company facing suit for allegedly violating the Illinois law. Google and Shutterfly are also battling lawsuits accusing them of collecting faceprints. Judges in those cases have alsorejected the companies' arguments that the Illinois law only applies to faceprints derived from in-person scans.