吃瓜大本营

On Thursday, the U.S. Court of Appeals for the Ninth Circuit became the first appellate court in the nation to directly address the privacy harms posed by face recognition technology. The decision is a significant advance in the fight against the threats of face surveillance, sounding the alarm on the potential for this technology to seriously violate people鈥檚 privacy.

In Patel v. Facebook, a group of Facebook users from Illinois allege that Facebook violated the Illinois Biometric Information Privacy Act (BIPA) by using face recognition technology on the users鈥� photographs without their knowledge and consent. BIPA is the oldest and strongest biometric privacy law in the country, requiring companies to obtain informed consent before collecting a person鈥檚 biometric identifiers, including face recognition scans. Importantly, the law provides individuals in Illinois with a right to sue for damages if a company has violated their rights.

Facebook鈥檚 primary argument in the case was that in order to establish 鈥渟tanding鈥� to sue, the plaintiffs should have to demonstrate some concrete injury beyond a violation of BIPA's requirement of notice and consent. As we argued in an amicus brief last year, surreptitious use of face recognition technology does cause harm, by subjecting people to unwanted tracking and by leaving them vulnerable to data breaches and invasive surveillance. Given the rapid proliferation of face surveillance technology in recent years, it is critical that Illinoisans are able to enforce BIPA鈥檚 protections against unwanted collection of their biometric information. A requirement that a person must demonstrate monetary loss or similar injury in order to sue would seriously undermine BIPA鈥檚 intent to safeguard against abusive collection of biometric data in the first place.

In Thursday鈥檚 ruling the Ninth Circuit agreed, holding that 鈥渢he development of a face template using facial-recognition technology without consent (as alleged here) invades an individual鈥檚 private affairs and concrete interests.鈥�

To reach that conclusion, the court looked not only to the long-recognized entitlement of people to sue private parties over violations of common-law privacy rights, but also to evolving Fourth Amendment protections against law enforcement surveillance. This includes the landmark decision in Carpenter v. United States, an ACLU case about police access to cell phone location data decided last year. As the Ninth Circuit explained, drawing from language in Carpenter, 鈥淸i]n its recent Fourth Amendment jurisprudence, the Supreme Court has recognized that advances in technology can increase the potential for unreasonable intrusions into personal privacy鈥� As in the Fourth Amendment context, the facial-recognition technology at issue here can obtain information that is 鈥榙etailed, encyclopedic, and effortlessly compiled,鈥� which would be almost impossible without such technology.鈥�

The Ninth Circuit鈥檚 ruling is important not only because it explains why surreptitious use of face recognition by corporations harms people鈥檚 privacy interests, but also because it puts law enforcement on notice that recent Supreme Court cases regulating other forms of electronic surveillance have something to say about face surveillance technology.

Indeed, the potential for this technology to enable the government to pervasively identify and track anyone (and everyone) as they go about their daily lives is one of the reasons the ACLU is urging lawmakers across the country to halt law enforcement use of face surveillance systems. This decision puts both corporations and law enforcement agencies on notice that face surveillance technology poses unique risks to people鈥檚 privacy and safety.

The Ninth Circuit鈥檚 ruling also demonstrates the importance of privacy laws including , affirming people鈥檚 right to turn to the federal courts for redress when their rights have been violated. Without a right to sue, privacy guarantees will often prove ephemeral. As state legislatures and Congress move forward on consumer privacy legislation, they should follow Illinois鈥� lead by including private rights of action in these statutes.