Biometric Privacy Law (Rebroadcast)

In 1996, as the Internet burst into the public imagination, John Perry Barlow, a futurist and sometime Grateful Dead lyricist, published “A Declaration of the Independence of Cyberspace”.  The paper which was written in response to the passage of the Telecommunications Act of 1996 called for a self-governing internet where the governments of the World would have no place and no power.  The online community so enthusiastically embraced Barlow’s vision that nine months after publication, about 40,000 copies of the Declaration had been downloaded.  But what Barlow and other utopians missed was the potential for power on the internet, not of governments, but of corporations. 

Photo Credit: University of Ilinois College of Law

Today, corporate power has slammed head on into individual privacy rights in the case of Patel v. Facebook.  In 2015, Nimesh Patel and others filed a class-action lawsuit in the 9^th Circuit claiming that Facebook had “secretly amassed the world’s largest privately held database of consumer biometric data” without consent and in violation of Illinois’ Biometric Information Privacy Act (known as BIPA).  In 2010, Facebook launched a tool to allow users to identify people they recognize in photos.  This facial recognition technology matched names to faces and the tagged photos were compiled into a Facebook database.  Patel and other privacy advocates fear that the tagged photos will be used to help identify individuals from surveillance or to get around privacy protections such as a facial-recognition lock on a smartphone. 

BIPA is at issue in Patel because it requires that written permission be obtained before capturing biometric data, such as voiceprints, fingerprints, retinal and iris scans, and scans of hands and faces.  In January 2019, the Illinois Supreme Court held in Rosenbach v. Six Flags that plaintiffs could bring claims under BIPA without alleging a real-world harm.  In other words, a violation of the BIPA statute itself is enough to state a claim for statutory damages. 

On August 8, 2019, the 9^th Circuit cited Rosenbach in its holding that Patel’s class action against Facebook could proceed to trial. Shawn Williams, an attorney for the Patel class action lauded the 9^th Circuit opinion as confirming the “availability of legal redress for the growing privacy intrusions by large corporations surreptitiously amassing mountains of personal information from consumers”.  Facebook has until September 5 to file a petition for retrial. If the Patel class action is successful at trial, Facebook may face billions of dollars in damages.  If you are an Illinois user of Facebook (or other social media companies which gather biometric data), watch this case carefully!