Apple wins US biometric privacy case on appeal

In a biometrics-bound lawsuit decision more noteworthy for the name of its defendant than precedent, Apple has prevailed in a state of Illinois Biometrics Information Privacy Act case.

A state appellate court just before Christmas said that Apple does not violate BIPA by offering owners of its mobile devices the ability to unlock the operating system using their fingerprint or face.

The case was brought by David Barnett, Ethel Burr and Michael Henderson in Cook County Circuit Court. It was dismissed in January 2022 and appealed, according to legal news publication Cook County (Ill.) Record.

The matter could still be heard by the state supreme court. There also is an outside chance that a case can be made that software updates by Apple confer some ownership or control. This was not decided here.

It is not a shocking appellate decision and likely will have zero impact on other BIPA cases in the works. If anything, the decision shows businesses how to comply with the law and still legally sell biometric features and services.

Apple never collected, stored or managed the data collected by Touch ID and Face ID, functions that protect mobile Apple products from illicit access. Device owners do the scanning (or they can choose to use other access-control features) and the biometric data is stored nowhere but on their device.

Apple has no role in how the biometrics are managed, including when they are deleted.

The case could allow biometric technology providers like FaceTec, which provides algorithms to clients to process data on their own servers, to argue that they are not subject to BIPA’s requirements. The ruling could also protect on-device implementations such as those based on FIDO.

In every successful BIPA case to date, one or more companies required a person to be biometrically scanned, stored the data, used it for profit, managed the data (including sharing and/or selling it) or all of the above. They did not, however, get express permission to scan and manage or clearly state their intensions for the information or their policies for managing the data.

Article Topics

Apple  |  biometric data  |  Biometric Information Privacy Act (BIPA)  |  biometrics  |  data privacy  |  face biometrics  |  Face ID  |  lawsuits  |  Touch ID