By: Holly Santapaga
In recent years, the use of biometrics has entered the mainstream. With the rise of any immerging technology, legal challenges inevitably follow.
Biometrics are defined by the Department of Homeland Security as the “unique physical characteristics” of a person, which could include fingerprints or facial recognition information.[1] Biometric technology is not a new concept, but its use has become prominent in apps, smart devices, and in media in recent years.[2] For example, Apple’s current range of devices use biometric authentication for easier device access.[3] News outlets are even using facial recognition to spot celebrities when covering large events.[4]
With this expanding market for biometrics has come an abundance of legal questions, as state laws are in flux.[5] Some states have laws in place, while others are in the process of implementing laws.[6] The only states with biometric privacy laws in place are Illinois, Texas, and Washington, though new legislation is being proposed in jurisdictions throughout the country.[7] Several states, including Arizona, Massachusetts, and Florida, have proposed statutes that govern the protection of biometric data.[8] The lack of strict legislation and prominent use of biometrics in popular interfaces has led to several lawsuits involving user privacy.[9] Consumers recently brought suit against the popular photo publishing website Shutterfly, alleging that Shutterfly has violated the Illinois Biometric Privacy Act (“BIPA”).[10] The complaint alleges that Shutterfly was “collecting, storing, and using” biometric information gathered from its facial recognition technology without notice or consent to its users.[11] The complaint further alleges that faces from all uploaded images are scanned, whether or not the person in the image is a Shutterfly user, in violation of Illinois law providing in part that a “private entity” must obtain consent “in writing that biometric identifiers or information will be collected or stored[.]”[12] Based on the statutory language of BIPA, the court should rule against Shutterfly to prevent use of personal biometric data without consent.[13]
The lawsuit against Shutterfly shows how far reaching the power of an app or media services’ ability to collect biometric information could be. Shutterfly is not the first entertainment related company caught up in a biometric information related lawsuit under Illinois law. In August 2019, the 9th Circuit allowed a class action lawsuit to proceed against Facebook, which alleges that the company “illegally collected and stored” user’s biometric information.[14] A major issue cited by the plaintiffs’ attorney in the lawsuit is that a person cannot change their biometric information like they can a stolen credit card.[15] If found guilty, Facebook could be subjected to billions in damages.[16] If services such as Shutterfly or Facebook are able to freely collect and store this information, any photograph you are in could become a potential trove of information for these corporations.
The use of biometric information has gone beyond the niche of image based platforms, and is making its way into the sports market.[17] For example, the Seattle Seahawks made buying beer easier for fans through the use of fingerprint verification, with other sports teams following the trend.[18] Countries around the world are also using biometrics to streamline entertainment.[19]For example, London is using biometrics to streamline ticketing during sporting events.[20]Biometrics are also being used to improve the performance of athletes themselves.[21] In Formula 1, biometric gloves are used to monitor the physical condition of a driver during races.[22] If the allegations against Shutterfly are upheld, and, for example, BIPA’s requirement of consent in writing becomes a requisite, this may prove challenging in adapting biometric use for large crowds.[23] Organizers would have to determine the most efficient way to obtain consent if they intended to collect and store biometric used to streamline ticketing.[24] With the use of biometrics extending around the globe, it will be interesting to see how both the legal field and private companies react, and how law and regulations are shaped around this new technology.
[1]Department of Homeland Security, Biometrics, Homeland Security, https://www.dhs.gov/biometrics (last visited October 17, 2019).
[2]See Amazon Web Services, The Facts on Facial Recognition with Artificial Intelligence, AWS, https://aws.amazon.com/rekognition/the-facts-on-facial-recognition-with-artificial-intelligence/ (last visited Oct. 17, 2019) (explaining the abilities of Amazon’s facial recognition software does
[3]See Apple Inc., About Face ID advanced technology, Apple(Sept. 19, 2019), https://support.apple.com/en-us/HT208108 (providing information regarding Apple’s use of Face ID technology).
[4]See Amazon Web Services, supra note2(discussing how Amazon’s facial recognition software is used by companies).
[5]See Torsten M. Kracht et. al., Biometric information Protection: The Stage is Set for Expansion of Claims, LexisNexis(Feb. 28, 2018), https://www.lexisnexis.com/lexis-practice-advisor/the-journal/b/lpa/posts/biometric-information-protection-the-stage-is-set-for-expansion-of-claims (describing the measures taken by jurisdictions states to regulate biometric use).
[6]Molly R. McGinley, et. al., The Biometric Bandwagon Rolls On: Biometric Legislation Proposed Across the United States, National Law Review(Mar. 25, 2019), https://www.natlawreview.com/article/biometric-bandwagon-rolls-biometric-legislation-proposed-across-united-states.
[7]Id.
[8]Id.
[9]See Alan S. Wernick, Biometric Information – Permanent Personally Identifiable Information Risk,American Bar Association(Jul. 2, 2019), https://www.americanbar.org/groups/business_law/publications/committee_newsletters/bcl/2019/201902/fa_8/ (discussing the how the law is being shaped to accommodate for the use of biometric data).
[10]Corrado Rizzi, Shutterfly Violated Illinois Biometric Law by Collecting, Storing Face Scans from Uploaded Photos, Class Action Says, ClassAction.org, https://www.classaction.org/news/shutterfly-violated-illinois-biometric-law-by-collecting-storing-face-scans-from-uploaded-photos-class-action-says (last updated Jun. 14, 2019).
[11]Id.; Complaint, ¶ 4, Vernita Miracle-Pond v. Shutterfly Inc. No. 2019-CH-07050 (Ill. Cir. Ct. Jun 11, 2019).
[12]Complaint, ¶ ¶ 3-4, Vernita Miracle-Pond v. Shutterfly Inc. No. 2019-CH-07050 (Ill. Cir. Ct. Jun 11, 2019); Corrado Rizzi, Shutterfly Violated Illinois Biometric Law by Collecting, Storing Face Scans from Uploaded Photos, Class Action Says, ClassAction.org, https://www.classaction.org/news/shutterfly-violated-illinois-biometric-law-by-collecting-storing-face-scans-from-uploaded-photos-class-action-says (last updated Jun. 14, 2019).
[13]Id.
[14]Jonathan Stempel, Facebook loses facial recognition appeal, must face privacy class action, Reuters (Aug. 8, 2019), https://www.reuters.com/article/us-facebook-privacy-lawsuit/facebook-loses-facial-recognition-appeal-must-face-privacy-class-action-idUSKCN1UY2BZ.
[15]Id.
[16]Id.
[17]See Madhvi Mavadiya, Does Sport Have Its Finger On The Pulse Of Biometrics?, Forbes(Oct. 8, 2018), https://www.forbes.com/sites/madhvimavadiya/2018/10/08/does-sport-have-its-finger-on-the-pulse-of-biometrics/#796fb91c3a68(discussing how biometrics are being used to improve different facets of the sports market, including creating a more cohesive fan experience).
[18]Id.
[19]See How biometrics is changing the face of sports for athletes and fans alike, XESOLbiometrics, https://xesolbiometrics.com/biometrics-in-sports/ (last visited Oct. 17, 2019) (explaining how biometrics can be used to improve the performance of athletes across various sports); Mavadiya,supranote 19.
[20]Id.
[21]Id.
[22]Id.
[23]Complaint, ¶ 3, Vernita Miracle-Pond v. Shutterfly Inc. No. 2019-CH-07050 (Ill. Cir. Ct. Jun 11, 2019).
[24]Mavadiya, supra note 19.
