EFF urges appeals court to side with plaintiff interpretation of harm in Facebook biometric privacy suit

The Electronic Frontier Foundation (EFF) is urging a U.S. appellate court to reject Facebook’s interpretation of the harm criteria of Illinois’ Biometric Information Privacy Act (BIPA), which it says it too narrow, and has joined an amicus curiae brief making its case. The call comes just as an Illinois woman has filed a complaint against cosmetics retailer Sephora for collecting biometric data without the consent required under BIPA.

The Cook County Record reports that local woman Auste Salkauskaite has filed suit against Sephora and Modiface Inc. after a Virtual Artist Kiosk allegedly collected her biometric information for a digital cosmetic application. The plaintiff further alleges at least some information collected from her, which also included her cellphone number, was disseminated to sell her Sephora products.

The U.S. Court of Appeals for the Ninth Circuit is hearing arguments in ‘In re Facebook Biometric Information Privacy Litigation,’ which like the Sephora suit is somewhat unusual among BIPA cases in that it does not involve biometrics collection by an employer for time and attendance controls. The EFF is joining the ACLU, the Center for Democracy & Technology (CDT), and the Public Interest Research Group (PIRG) in the brief. The EFF, ACLU, CDT, and the Chicago Alliance Against Sexual Exploitation are among groups that filed a brief in support of the plaintiff’s position on BIPA’s harm criteria in the case of Rosenbach v. Six Flags, which is being heard by Illinois’ Supreme Court. At least three of the judges in that case seem sympathetic to the position the EFF is supporting.

On the defendant’s side, the Internet Association has warned that the Facebook suit, if successful, would impose barriers to biometric technology development.

“EFF and our fellow amici argue that a person is “aggrieved,” and may sue, based just on capture of their biometric information without notice and consent,” writes EFF Senior Staff Attorney Adam Schwartz in a blog post. “We offer several reasons. First, face surveillance and other forms of biometric tracking are a growing menace to our privacy. Our face measurements can be harvested at a distance and without our knowledge, and we often have no ability as individuals to effectively shield ourselves from this grave privacy intrusion. Second, BIPA follows in the footsteps of a host of other privacy laws that prohibit the capture of private information absent consent, and that define capture-without-consent by itself as an injury. Third, allowing private lawsuits is a necessary means to ensure effective enforcement of privacy laws.”

The appeals court granted an emergency stay in Facebook’s case earlier this year after a district court judge ruled the suit could certify as a class action. If the suit is successful, more than 20 million people could be eligible to receive up to $5,000 each in damages, though it seems farfetched that Facebook would really be forced to pay out $100 billion.

Incoming State Attorney General Kwame Raoul has vowed to push back against attempts to weaken BIPA.

Article Topics

Biometric Information Privacy Act (BIPA)  |  biometrics  |  data collection  |  legislation  |  privacy