• by Wendy Davis  @wendyndavis, September 16, 2020

Amazon and Microsoft are urging federal judges to dismiss lawsuits accusing the companies of violating an Illinois biometric privacy law by acquiring a database of faceprints.

Both companies were sued recently by Illinois residents Steven Vance and Tim Janecyk, who alleged the tech companies obtained a faceprint database from IBM, which reportedly acquired 100 million pictures from the photo-sharing service Flickr.

Amazon and Microsoft allegedly acquired the database in order to improve their facial-recognition products and technologies, Vance and Janecyk alleged in separate class-action complaints in the Western District of Washington.

Vance and Janecyk claim the tech giants violated the Illinois Biometric Information Privacy Act, which requires companies to obtain consumers' written consent before collecting or storing certain biometric data -- including scans of facial geometry.

That law provides for damages of up to $5,000 per violation.

Vance and Janecyk have also sued Google, FaceFirst and IBM for allegedly violating the Illinois privacy law. Those matters are pending in other federal district courts.

Microsoft and Amazon are now making similar arguments in motions seeking dismissal of the cases.

Both companies say the Illinois privacy statute only applies to activity that occurs in the state, and that the allegations in the complaint -- even if proven true -- wouldn't show that the companies engaged in unlawful conduct in Illinois.

“Microsoft’s alleged possession of photographs of Illinois residents ... would not show it collected biometric information or profited from that information in Illinois,” Microsoft argues in papers filed this week with U.S. District court Judge John Coughenour in Seattle. “On the contrary, Plaintiffs allege Microsoft obtained the [data] online from IBM, a New York corporation, for free.”

Amazon makes the same argument in a motion to dismiss filed with U.S. District Court Judge Richard Jones, also in Seattle.

The companies also say the Illinois privacy law doesn't apply to faceprints derived from photos.

The statute contains language excluding "photos" from the definition of "biometric identifiers." A separate definition of "biometric information" excludes any information derived from photos.

“The Illinois legislature went out of its way to exclude both photographs and information derived from photographs” from the law's scope,” Microsoft and Amazon argue in their court papers.

Other tech companies that have faced lawsuits over the Illinois law -- including Facebook and Google -- have made the same argument, but without success.

For instance, after Facebook was sued for allegedly violating the Illinois statute, the company argued that the law only applied to faceprints that were based on something other than photos, like in-person scans.

In 2016, U.S. District Court Judge James Donato in California rejected Facebook's argument, writing that the company's interpretation of the law was “antithetical to its broad purpose of protecting privacy in the face of emerging biometric technology."

Earlier this year, Facebook agreed to settle the matter for $650 million.