Illinois residents may proceed with a lawsuit alleging that Amazon and Microsoft violated a state biometric privacy law by amassing a database of faceprints, a federal judge has ruled.
The
ruling, issued this week by U.S. District Court Judge James Robart in Seattle, stems from a lawsuit filed in July by Illinois residents Steven Vance and Tim Janecyk. They alleged the tech companies
obtained a faceprint database from IBM, which reportedly acquired
100 million pictures from the photo-sharing service Flickr.
Amazon and Microsoft allegedly obtained the database in order to improve their facial-recognition products and technologies, Vance
and Janecyk alleged in separate class-action complaints against the companies.
Vance and Janecyk contend the tech giants violated the Illinois Biometric Information Privacy Act, which requires
companies to obtain consumers' written consent before collecting or storing certain biometric data -- including scans of facial geometry.
Both companies urged the judge to dismiss the lawsuits
at an early stage, arguing that the Illinois privacy law only applies to activity that occurs in the state. The companies contend that even if the allegations in the complaint were proven true, they
wouldn't show that the companies engaged in unlawful conduct in Illinois.
Robart rejected that argument for now, but suggested that he could revisit the question in the future.
“It is certainly possible that with more factual refinement around this complex issue, the circumstances around Microsoft’s attainment, possession and use of the ... dataset will reveal
that the alleged violations did not occur primarily in Illinois,” he wrote. “But more information is needed to reach any determination.”
Both companies also unsuccessfully
argued that the Illinois privacy law doesn't apply to faceprints derived from photos. The statute contains language excluding "photos" from the definition of "biometric identifiers," and excludes
information derived from photos from the definition of "biometric information."
“The Illinois legislature went out of its way to exclude both photographs and information derived from
photographs” from the law's scope,” Microsoft and Amazon argued in their court papers.
Robart rejected that argument, noting that other judges throughout the country have refused
to dismiss lawsuits against tech companies that allegedly applied facial-recognition technology to photos in order to generate a faceprint.
For instance, after Facebook was sued for allegedly
violating the Illinois statute, the company argued that the law only applied to faceprints based on something other than photos, like in-person scans.
In 2016, U.S. District Court Judge James
Donato in California rejected Facebook's argument, writing that the company's interpretation of the law was “antithetical to its broad purpose of protecting privacy in the face of emerging
biometric technology."
Facebook recently settled that matter for $650 million.