Do You Own Your Own Fingerprints? An obscure law could lead to broader limits on biometrics
Do You Own Your Own Fingerprints?
An obscure law could lead to broader limits on
biometrics.
By Dune Lawrence
July 7, 2016 — 4:00 AM PDT
These days, many of us regularly feed pieces of ourselves
into machines for convenience and security. Our fingerprints unlock our
smartphones, and companies are experimenting with more novel biometric
markers—voice, heartbeat, grip—as ID for banking and other transactions. But
there are almost no laws in place to control how companies use such
information. Nor is it clear what rights people have to protect scans of their
retinas or the contours of their face from cataloging by the private sector.
There’s one place where people seeking privacy
protections can turn: the courts. A series of plaintiffs are suing tech giants,
including Facebook and Google, under a little-used Illinois law. The Biometric
Information Privacy Act, passed in 2008, is one of the only statutes in the
U.S. that sets limits on the ways companies can handle data such as
fingerprints, voiceprints, and retinal scans. At least four of the suits filed
under BIPA are moving forward. “These cases are important to scope out the
existing law, perhaps point out places where the law could be improved, and set
principles that other states might follow,” says Jeffrey Neuburger, a partner
at law firm Proskauer Rose.
The bankruptcy of fingerprint-scanning company Pay By
Touch spurred BIPA’s passage. Hundreds of Illinois grocery stores and gas
stations used its technology, allowing customers to pay with the tap of a
finger. As the bankrupt company proposed selling its database, the Illinois
chapter of the American Civil Liberties Union drafted what became BIPA, and the
bill passed with little corporate opposition, says Mary Dixon, legislative
director of the Illinois ACLU.
Under the Illinois law, companies must obtain written consent
from customers before collecting their biometric data. They also must declare a
point at which they’ll destroy the data, and they must not sell it. BIPA allows
for damages of $5,000 per violation. “Social Security numbers, when
compromised, can be changed,” the law reads. “Biometrics, however, are
biologically unique to the individual; therefore, once compromised, the
individual has no recourse, [and] is at heightened risk for identity theft.”
In April 2015, Chicagoan Carlo Licata, a Morgan Stanley financial
adviser, sued Facebook under BIPA, arguing that the company violated his
privacy by using its facial-recognition software to create a detailed geometric
map of his face and tag him in photos. Two more Illinois residents filed
complaints against Facebook the following month. That June a logistics engineer
and paratriathlete named Brian Norberg brought an almost identical suit against
the photo-sharing site Shutterfly. Two more plaintiffs sued video game
publisher Take-Two Interactive Software on similar grounds in October, and two
more went after Google in March. The companies declined to comment for this
story.
“I think people had really imagined, well, biometrics,
it’s got to be an in-person thing. You walk in front of a facial scanner,” says
Mark Eisen, a lawyer at Sheppard Mullin in Chicago who specializes in consumer
privacy and class-action suits. (He’s not involved in any of the cases.) “So
that first lawsuit got a lot of attention, and follow-up lawsuits happened
pretty quickly.” Most of the suits focus on photo tagging; in Take-Two’s case,
the plaintiffs are worried about the game maker’s creation of realistic digital
look-alikes using their facial profiles.
Take-Two has argued that the plaintiffs lack standing
because they haven’t claimed harm. The lawsuit against Shutterfly survived a
motion to dismiss in December and ended with an undisclosed settlement in
April. In the Facebook suit, the plaintiffs are seeking information about,
among other things, Facebook’s marketing of and third-party access to its
faceprint database. Facebook is arguing that BIPA was meant to apply to
physical facial scans and shouldn’t apply to photos.
The Facebook plaintiffs, whose cases have been
consolidated in California, where the company is based, passed a crucial test
in May. Facebook had argued that according to its terms of use, disputes should
be handled under California law, which lacks BIPA-style protections for
biometric data. The judge didn’t agree, ruling that BIPA applies. In a June 29
filing, Facebook made the same argument as Take-Two—that the plaintiffs lack
standing to sue because they haven’t claimed harm. Google, meanwhile, is
challenging BIPA as unconstitutional on the grounds that one state can’t set
rules for the rest of the country.
National efforts to establish biometric guidelines
haven’t gone well. In 2014 a Department of Commerce agency led an effort to
develop a code of conduct for companies using facial-recognition technology,
but consumer advocates withdrew from the group the following year, saying tech
companies refused to consider the most modest of privacy protections. The
effort yielded an unenforceable set of privacy recommendations, published in
June.
Part of the problem is that government agencies often
have an interest in looser consumer protections. In May the Department of
Justice proposed exempting the FBI’s facial-recognition program, called Next
Generation Identification, from privacy protections. In June the Government
Accountability Office reported that the FBI program failed tests of accuracy
and privacy. So far the report hasn’t led to any action.
In Canada and Europe, Facebook stopped offering tag
suggestions on photos following pressure from regulators to obtain consent to
collect people’s images. In the U.S., BIPA has become a target. Just before
Memorial Day, with the Illinois legislature rushing to finish its session,
Democratic state Senator Terry Link proposed an amendment to the statute that
would have excluded photos and digital images from protection and neatly
undercut the lawsuits. The ACLU’s Dixon says the amendment was Facebook’s doing.
Link declined to comment. Following outrage from advocacy groups such as the
ACLU and the Electronic Frontier Foundation (EFF), it was shelved without a
vote, but there’s nothing stopping its reintroduction.
“This measure was introduced right before the Memorial
Day weekend and could have been passed and changed the law over that weekend,”
says Jennifer Lynch, a senior staff attorney at EFF. “If we only have one state
with a law that protects use from commercial biometric data collection, and
it’s so easy to change that law, it just shows how tenuous the protections on
our privacy are.”
The bottom line: For now, an Illinois statute is the
strongest check on corporate use of biometric data such as fingerprints and
facial profiles
Comments
Post a Comment