Tech companies Google, Amazon, Microsoft and FaceFirst were sued this week for allegedly violating an Illinois biometric privacy law by acquiring a database of faceprints.
The lawsuits, brought Tuesday by Illinois residents Steven Vance and Tim Janecyk, allege that tech companies obtained a faceprint database from IBM, which reportedly acquired 100 million pictures from the photo-sharing service Flickr.
Google, Amazon, Microsoft and FaceFirst allegedly did so in order “to improve the fairness and accuracy” of their facial recognition products and technologies, Vance and Tim Janecyk allege in four separate class-action complaints. The lawsuit against Google was brought in federal court in the Northern District of California, while the cases against Amazon and Microsoft were filed in the Western District of Washington, and the complaint against FaceFirst was filed in the Central District of California.
Vance and Janecyk claim the tech companies violated the Illinois Biometric Information Privacy Act, which requires companies to obtain consumers' written consent before collecting or storing certain biometric data -- including scans of facial geometry. That law provides for damages of up to $5,000 per violation.
Earlier this year, Vance and Janecyk sued IBM for allegedly violating the Illinois privacy law. That matter is pending in federal district court in Illinois.
A Microsoft spokesperson said the company is aware of the lawsuit and reviewing it.
“We take privacy seriously and we are committed to ensuring our AI technology is developed and used responsibly,” the spokesperson said.
Silicon Valley companies, including Facebook, have been sued before for allegedly violating the Illinois law. Facebook recently agreed to settle a class-action biometric privacy complaint for $550 million, but the deal hit a roadblock earlier this month when U.S. District Court Judge James Donato in the Northern District of California declined to grant it preliminary approval. Among other reasons, he suggested the settlement was too small, given that the Illinois statute provided for up to $5,000 damages per violation.
Google has faced several lawsuits over the Illinois measure. The company prevailed in one case last year, when U.S. District Court Judge Edmond Chang in Illinois ruled that the people who sued Google couldn't proceed in federal court because they didn't suffer any concrete injury from the company's alleged practices.
“Most people expose their faces to the general public every day, so one’s face is even more widely public than non-biometric information like a social security number,” Chang wrote in an opinion awarding Google summary judgment. “Indeed, we expose our faces to the public such that no additional intrusion into our privacy is required to obtain a likeness of it.”
The plaintiffs in that matter have appealed to the 7th Circuit Court of Appeals.
Google is also facing a separate lawsuit in federal court in California, brought by Illinois resident Brandon Molander. The company said recently it plans to argue for dismissal on several grounds. Among others, Google plans to argue that the Illinois biometric privacy law doesn't apply to data derived from photos.
That argument stems from language in the Illinois law that excludes photos, as well as data derived from photos, from the definitions of “biometric identifiers” and “biometric information.” Despite that language, judges have ruled in several cases that the Illinois law applies when tech companies use facial-recognition technology to create faceprint databases from photographs.