BIPA Section 15(c) claims: What does it mean to profit from biometric data?

By David J. Oberly, attorney at Blank Rome, LLP.

One of the more recent trends in Illinois Biometric Information Privacy Act (“BIPA”) class action litigation is the inclusion of claims alleging violations of Section 15(c)’s ban on selling or otherwise profiting from biometric data. This naturally leads to the question: what does it mean to “profit” from biometric data?

BIPA Section 15(c)

First, a review of BIPA Section 15(c): under 740 ILCS 14/15(c), “[n]o private entity in possession of a biometric identifier or biometric information may sell, lease, trade, or otherwise profit from a person’s or a customer’s biometric identifier or biometric information.”

Analysis of the scope of Section 15(c)’s ban on “profiting” from biometric data

The discussion of Section 15(c) by two federal district courts in recent BIPA opinions provides key insight on what constitutes “profiting” from biometric data in the context of Illinois’ biometric privacy statute.

The first analysis originates from the now well-known, high-profile litigation currently pending in the U.S. District Court for the Western District of Washington involving four tech giants and their use of IBM’s “Diversity in Faces” program, which aimed to reduce bias in facial recognition. During the course of the litigation, the court provided a detailed analysis of the scope of Section 15(c) that sheds considerable light on the contours of the phrase “otherwise profiting from” biometric data.

After analyzing the statutory text of Section 15(c) in minute detail, the Washington district court explained that in the specific context of BIPA, “otherwise profit” encompasses commercial transactions—such as a sale, lease, or trade—in which the biometric data is transferred or shared in return for some benefit.

In this regard, the court continued, Section 15(c) regulates transactions with two components: (1) access to biometric data is shared or given to another; and (2) in return for that access, the entity receives something of value.

As to the first component, the biometric data itself may be the product of the transaction, such as in a direct sale. Alternatively, the biometric data may be so integrated into a product that consumers necessarily gain access to others’ biometric data by using the product or service.

As to the second component, “otherwise profit” is not limited to a pecuniary benefit; rather, Section 15(c) prohibits the commercial dissemination of biometric data for some sort of gain, whether pecuniary or not.

Importantly, however, the court rejected a reading of Section 15(c) that would prohibit “any use of biometric data that brings a benefit,” as doing so would “lead to absurd results that contravene BIPA itself.” The court reasoned that “[n]othing—not BIPA’s statutory language, its stated intent, or any authority analyzing Section 15(c)—supports such a broad reading.”

Ultimately, the court held that for a claim to exist under Section 15(c), actual biometric data or the sharing of access to the underlying biometric data must be transferred or exchanged in return for some benefit.

The second analysis comes from the U.S. District Court for the Southern District of Illinois, also involving BIPA claims asserted against a tech titan. The Illinois litigation pertained to the use of proprietary software and facial recognition technology that provides the ability to scan individual face geometries from a user’s photographs to create a unique “faceprint” for every person detected as part of the company’s photos app.

The plaintiffs alleged that the defendant violated Section 15(c) because it profited from biometric data through the marketing and selling of its devices based upon its claims of photograph-sorting technology powered by facial recognition. This claim was soundly rejected by the court.

In doing so, the court drew a critical distinction between profiting from plaintiffs’ individual biometric data and generally profiting from the sales of devices that offer a facial recognition or similar biometrics-related feature. While the former constitutes a violation of Section 15(c), the latter does not.

Applied to the plaintiffs’ contention that the defendant violated Section 15(c) by profiting through its marketing and sales of devices based upon its claims of photograph-sorting technology, the court highlighted the fact that the plaintiffs did not allege the company sold or otherwise profited from the plaintiffs’ individual biometric identifiers or biometric information; rather, the plaintiffs generally alleged that the defendant profited from the sales of its devices which included facial recognition capabilities within its pre-installed photos app. In so doing, the court noted that the language Section 15(c) “clearly” prohibits profiting from “a person’s or a customer’s” biometric identifier or biometric information, not the general sales of devices equipped with facial recognition technology. As such, the mere sale of devices equipped with the ability to collect, use, and store biometric data fell short of constituting a violation of Section 15(c)’s ban on “otherwise profiting” from biometric data.

Takeaways

So there you have it. “Profiting” from biometric data, for purposes of Section 15(c), does not encompass merely marketing and selling biometric devices or other technologies that involve the use of biometric data and which produce a profit—which plaintiffs will continue to argue in support of their allegations of Section 15(c) violations for the foreseeable future.

Rather, to fall under the scope of Section 15(c), the biometric data of individuals or consumers, or the sharing of access to those individuals’ or consumers’ biometric data, must be transferred or exchanged in return for some benefit to the company.

As Section 15(c) claims continue to rise in frequency in BIPA class action litigation, companies should keep in mind the limits that have been drawn by courts on the scope of Section 15(c). And in the event a company finds itself as a defendant in BIPA litigation involving a claim for alleged violations of Section 15(c) that falls outside of the contours of BIPA’s ban on “profiting” from biometric data, it should aggressively pursue an early motion to dismiss for failure to state a claim.

About the author

David J. Oberly is an attorney in the Cincinnati office of Blank Rome LLP and is a member of the firm’s Biometric Privacy, Privacy, Security & Data Protection, and Privacy Class Action Litigation groups. David’s practice encompasses both counseling and advising clients on a wide range of biometric privacy, privacy, and data protection matters, as well as defending clients in high-stakes, high exposure biometric privacy, consumer privacy, and data breach class action litigation. He can be reached at david.oberly@blankrome.com.

DISCLAIMER: Biometric Update’s Industry Insights are submitted content. The views expressed in this post are that of the author, and don’t necessarily reflect the views of Biometric Update.

Article Topics

biometric data  |  biometric identification  |  biometric identifiers  |  Biometric Information Privacy Act (BIPA)  |  biometrics  |  Blank Rome  |  commercial applications  |  data protection  |  data sharing  |  David Oberly  |  lawsuits  |  legislation  |  privacy