Court rules Apple possesses users’ biometric data, privacy suit goes ahead

While biometric templates generated by Apple’s Photos app are stored on the device in the control of the user, they could still be in the possession of Apple, legally speaking, according to a preliminary ruling by an Illinois federal court.

The court denied an Apple motion to dismiss a suit against it alleging the company violated the state’s Biometric Information Privacy Act, attorneys for Ulmer & Berne LLP write for JD Supra. Specifically, the suit alleges Apple did not provide the necessary information about its retention schedule and the eventual destruction of user data. Because Apple retains “complete and exclusive control” of the data, they take on BIPA’s informed consent obligations.

The suit alleges that Apple holds facial recognition databases harvested from users, and that users cannot disable collection of the data.

The ruling interprets possession under BIPA in a way that, if not overturned, could lead to many more suits against third-party biometric technology vendors who retain some element of control over data storage within customer devices.

Apple contends that “the biometric data remains in the solid-state memory on the Apple Device, which is owned and controlled by the user.”

TouchID and FaceID biometric data, which is also stored on the user’s Apple device, is the subject of a separate lawsuit filed against the company in state court, Law360 reports.

With the exception of the device unlock feature rather than the app being identified, and therefore the inclusion of fingerprint biometrics, the plaintiffs’ arguments are essentially the same as in the above case, with regards to the definition of “possession,” of the biometric data. The stakes are higher for users in the case of TouchID and FaceID, however, according to the case filed in Cook County, because the authentication methods are “inextricably intertwined with other services it (Apple) provides.”

Macy’s denies using plaintiffs’ biometrics

Macy’s has moved to dismiss a BIPA case against it, alleging that as it had never collected an image of the plaintiffs, they lack standing, according to Law Street Media. The company also asserted it is only minimally associated with Clearview AI, which is the focus of most of the plaintiffs’ allegations, according to a memorandum filed by Macy’s in support of its motion.

The retailer had earlier noted that the plaintiffs did not assert a visit to a Macy’s store, and therefore would not have been affected in any way by its video security practices or alleged use of biometrics.

Any BIPA violations contained in the alleged violations would have been performed by Clearview, Macy’s says. The memorandum says in summation that “the plaintiffs did not plead actual facts.”

McDonald’s denies holding customer biometrics

McDonald’s says its use of speech recognition with its voice assistant technology does not involve the use of biometric identifiers or voice recognition data, and a BIPA suit against it should therefore be dismissed, according to another Law360 article.

The proposed $5 million class action is based on assumptions unsupported by the facts, according to the fast food giant.

Article Topics

Apple  |  biometric data  |  biometric identifiers  |  Biometric Information Privacy Act (BIPA)  |  biometric template  |  biometrics  |  Clearview AI  |  data collection  |  data protection  |  facial recognition  |  lawsuits  |  McDonald’s  |  privacy  |  speech recognition