A US judge ruled last week that a class action lawsuit against Facebook over the company’s face recognition practices, with potentially millions of plaintiffs, can move forward to trial.
In 2008, the state of Illinois established the Biometric Privacy Act, or BIPA. The law requires that all companies that collect biometric data (like thumbprints and photos to be used in face recognition) get consent and meaningfully inform people how their data is being used. Illinois alleges Facebook is violating BIPA because of how it collects use data for face recognition.
Facebook’s lawyers raised a suite of reasons why the case should be dismissed, Techcrunch reports, but most crucial is the concept of “actual harm.” When users’ data is mishandled or improperly maintained, are they hurt in any tangible way? Facebook argued that individual BIPA privacy violation isn’t “actual harm” by this standard, but Judge James Donato of the US District Court for California’s Northern District disagreed, finding that legal precedent supports the state’s claim that “injury to a privacy right is enough to make a person aggrieved under BIPA.”
Facebook also argued that Illinois law does not apply because its servers are not located in the state. Donato dismissed this fact as a reason to block the lawsuit.
The state is seeking damages on behalf of “Facebook users located in Illinois for whom Facebook created and stored a face template after June 7, 2011.” Under Donato’s reading, potentially millions of people in Illinois were harmed and could potentially join in on the suit as plaintiffs. Facebook recently moved to explicitly ask users to opt into face recognition and its automated tagging suggestions, but when the feature was first implemented years ago, it was turned on by default until users opted out.
While reassuring for the state’s lawyers, the finding has no bearing on the case itself, save to say that it can now proceed.
In a statement to TechCrunch, Facebook said simply: “We are reviewing the ruling. We continue to believe the case has no merit and will defend ourselves vigorously.” [TechCrunch]