Biometric Privacy

Q:    After buying two Google Nest cameras with a facial recognition feature and struggling to get them to work, I found that this feature advertised as a selling point is illegal to use in Illinois - only illegal in Illinois.  Nowhere else in the world.  Is that correct?

A:    The applicable Illinois law is the Illinois Biometric Information Privacy Act (the "Act") which became effective on October 3, 2008 – a lifetime ago in the world of technology.  It was the first state biometric legislation in the United States.  The Act applies to "biometric identifiers" defined as "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry."  The Google facial recognition feature is a "scan of face geometry."

    The General Assembly stated its rationale in the Act itself by finding all of the following:

        (a)  The use of biometrics is growing in the business and security screening sectors and appears to promise streamlined financial transactions and security screenings.

        (b)  Major national corporations have selected the City of Chicago and other locations in this State as pilot testing sites for new applications of biometric-facilitated financial transactions, including finger-scan technologies at grocery stores, gas stations, and school cafeterias.

        (c)  Biometrics are unlike other unique identifiers that are used to access finances or other sensitive information. For example, social security numbers, when compromised, can be changed. Biometrics, however, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.

        (d)  An overwhelming majority of members of the public are weary of the use of biometrics when such information is tied to finances and other personal information.

        (e)  Despite limited State law regulating the collection, use, safeguarding, and storage of biometrics, many members of the public are deterred from partaking in biometric identifier-facilitated transactions.

        (f)  The full ramifications of biometric technology are not fully known.

        (g)  The public welfare, security, and safety will be served by regulating the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.

    The Act provides: "No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information, unless it first:

        (1)    informs the subject or the subject's legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored;

        (2)    informs the subject or the subject's legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and

        (3)    receives a written release executed by the subject of the biometric identifier or biometric information or the subject's legally authorized representative.

    The Act also governs storage and retention of biometric identifiers that are legally collected.

    The act provides for damages of $1,000 or actual damages if an entity negligently violates the Act, $5,000 or actual damages if an entity intentionally violates the Act, attorneys' fees and costs, and other relief deemed appropriate by the court.

    Facebook recently settled a class action lawsuit based on the Act.  Plaintiffs claimed that Facebook violated the Act by using its face-matching software to suggest names to be "tagged" in a picture.  Facebook settled the lawsuit for $650 million.  Illinois Facebook users who joined the suit will each receive around $340.  US District Judge James Donato said, according to the Chicago Tribune. "This is real money that Facebook is paying to compensate them for the tangible privacy harms that they suffered."

    Lawsuits are also pending in Illinois against Microsoft, Amazon, Alphabet (Google), and Clearview AI.  The complaint against Clearview was filed by the American Civil Liberties Union.  Clearview is a New York-based tech company that calls its product the "world's best facial recognition technology combined with the world's largest database of headshots." Clearview claims it has the legal right to gather and use the photos because they're public information.  The company also says it will only provide its services to law enforcement agencies.

    Facebook has backed amendments to the Act in 2016 and 2018.  The Illinois Chamber of Commerce Technology Council (of which Facebook was a member) also backed the amendments, but none of them passed.

    Other states have followed with their own biometrics protection laws.  Prior to 2018, only Illinois, Texas and Washington had such statutes.  Now, California, New York, Arkansas, Oregon, and Louisiana, also have biometrics security laws, and many other states are considering legislation.

    The law is this area will continue to evolve, and could eventually be replaced by a federal law.  In the meantime, the Illinois Act continues to apply, and lawsuits will continue to be brought against companies that violate the Act.

This article is for informational and educational purposes only and does not constitute legal advice.