• by Wendy Davis  @wendyndavis, March 18, 2021

Illinois residents may proceed with a lawsuit alleging that Amazon and Microsoft violated a state biometric privacy law by amassing a database of faceprints, a federal judge has ruled.

The ruling, issued this week by U.S. District Court Judge James Robart in Seattle, stems from a lawsuit filed in July by Illinois residents Steven Vance and Tim Janecyk. They alleged the tech companies obtained a faceprint database from IBM, which reportedly acquired 100 million pictures from the photo-sharing service Flickr.

Amazon and Microsoft allegedly obtained the database in order to improve their facial-recognition products and technologies, Vance and Janecyk alleged in separate class-action complaints against the companies.

Vance and Janecyk contend the tech giants violated the Illinois Biometric Information Privacy Act, which requires companies to obtain consumers' written consent before collecting or storing certain biometric data -- including scans of facial geometry.

Both companies urged the judge to dismiss the lawsuits at an early stage, arguing that the Illinois privacy law only applies to activity that occurs in the state. The companies contend that even if the allegations in the complaint were proven true, they wouldn't show that the companies engaged in unlawful conduct in Illinois.

Robart rejected that argument for now, but suggested that he could revisit the question in the future.

“It is certainly possible that with more factual refinement around this complex issue, the circumstances around Microsoft’s attainment, possession and use of the ... dataset will reveal that the alleged violations did not occur primarily in Illinois,” he wrote. “But more information is needed to reach any determination.”

Both companies also unsuccessfully argued that the Illinois privacy law doesn't apply to faceprints derived from photos. The statute contains language excluding "photos" from the definition of "biometric identifiers," and excludes information derived from photos from the definition of "biometric information."

“The Illinois legislature went out of its way to exclude both photographs and information derived from photographs” from the law's scope,” Microsoft and Amazon argued in their court papers.

Robart rejected that argument, noting that other judges throughout the country have refused to dismiss lawsuits against tech companies that allegedly applied facial-recognition technology to photos in order to generate a faceprint.

For instance, after Facebook was sued for allegedly violating the Illinois statute, the company argued that the law only applied to faceprints based on something other than photos, like in-person scans.

In 2016, U.S. District Court Judge James Donato in California rejected Facebook's argument, writing that the company's interpretation of the law was “antithetical to its broad purpose of protecting privacy in the face of emerging biometric technology."

Facebook recently settled that matter for $650 million.