On Thursday, the U.S. Court of Appeals for the Ninth Circuit became the first appellate court in the nation to directly address the privacy harms posed by face recognition technology. The decision is a significant advance in the fight against the threats of face surveillance, sounding the alarm on the potential for this technology to seriously violate people’s privacy.
In Patel v. Facebook, a group of Facebook users from Illinois allege that Facebook violated the Illinois Biometric Information Privacy Act (BIPA) by using face recognition technology on the users’ photographs without their knowledge and consent. BIPA is the oldest and strongest biometric privacy law in the country, requiring companies to obtain informed consent before collecting a person’s biometric identifiers, including face recognition scans. Importantly, the law provides individuals in Illinois with a right to sue for damages if a company has violated their rights.
Facebook’s primary argument in the case was that in order to establish “standing” to sue, the plaintiffs should have to demonstrate some concrete injury beyond a violation of BIPA’s requirement of notice and consent. As we argued in an amicus brief last year, surreptitious use of face recognition technology does cause harm, by subjecting people to unwanted tracking and by leaving them vulnerable to data breaches and invasive surveillance. Given the rapid proliferation of face surveillance technology in recent years, it is critical that Illinoisans are able to enforce BIPA’s protections against unwanted collection of their biometric information. A requirement that a person must demonstrate monetary loss or similar injury in order to sue would seriously undermine BIPA’s intent to safeguard against abusive collection of biometric data in the first place.
In Thursday’s ruling the Ninth Circuit agreed, holding that “the development of a face template using facial-recognition technology without consent (as alleged here) invades an individual’s private affairs and concrete interests.”
To reach that conclusion, the court looked not only to the long-recognized entitlement of people to sue private parties over violations of common-law privacy rights, but also to evolving Fourth Amendment protections against law enforcement surveillance. This includes the landmark decision in Carpenter v. United States, an ACLU case about police access to cell phone location data decided last year. As the Ninth Circuit explained, drawing from language in Carpenter, “[i]n its recent Fourth Amendment jurisprudence, the Supreme Court has recognized that advances in technology can increase the potential for unreasonable intrusions into personal privacy… As in the Fourth Amendment context, the facial-recognition technology at issue here can obtain information that is ‘detailed, encyclopedic, and effortlessly compiled,’ which would be almost impossible without such technology.”
The Ninth Circuit’s ruling is important not only because it explains why surreptitious use of face recognition by corporations harms people’s privacy interests, but also because it puts law enforcement on notice that recent Supreme Court cases regulating other forms of electronic surveillance have something to say about face surveillance technology.
Indeed, the potential for this technology to enable the government to pervasively identify and track anyone (and everyone) as they go about their daily lives is one of the reasons the ACLU is urging lawmakers across the country to halt law enforcement use of face surveillance systems. This decision puts both corporations and law enforcement agencies on notice that face surveillance technology poses unique risks to people’s privacy and safety.
The Ninth Circuit’s ruling also demonstrates the importance of privacy laws including strong private rights of action, affirming people’s right to turn to the federal courts for redress when their rights have been violated. Without a right to sue, privacy guarantees will often prove ephemeral. As state legislatures and Congress move forward on consumer privacy legislation, they should follow Illinois’ lead by including private rights of action in these statutes.
- [LLODO] Michigan state Dem pepper-sprayed, charged with DUI, resisting arrest, weapons possession: report
- [LLODO] Head of NYC’s posh Dalton School leaving at the end of 2021
- [LLODO] Chilling video captures moment a love triangle erupts in murder, revenge in NYC
- [LLODO] NYPD officers hit with Molotov cocktail and liquid chemical in face, police say
- [LLODO] California group files federal civil rights complaint over San Diego school district’s ‘racist’ teachings
- [LLODO] Podcast helped in hunt for 1996 killer of California student
- [LLODO] National weather forecast: Parts of Northeast could see more than a foot of snow
- [LLODO] Cuomo boasts he ‘invented’ NYS-scented hand sanitizer, faces no questions over scandals
- [LLODO] Teacher who decried NYC school’s ‘indoctrination’ put on remote work: ‘Feels like punishment’