Facebook sued for storing biometric face prints

Facebook sued for storing biometric face prints

The social networking giant, Facebook has been slapped with a class-action complaint over its biometrics slurpage. If Facebook is found guilty of not complying with the laws, there is a possibility of millions of plaintiffs to come forward to claim damages against the advertising giant.

The complaint (PDF) states that “Facebook has created, collected and stored over a billion ‘face templates’ (or ‘face prints’)”, which, ostensibly, are as uniquely identifiable as fingerprints. These have been gathered “from over a billion individuals, millions of whom reside in the State of Illinois”.

In 2008, the state legislature had passed the the Illinois Biometric Information Privacy Act (BIPA), which is alleged to have been violated by Zuckerberg.

The complaint notes that a private entity such as Facebook under BIPA is forbidden by law to acquire or have an individual’s biometrics except if it reaches suitable permission, which is constituted by:

• Letting the person know in writing that biometric identifiers or information will be accumulated or stored
• Letting the person know the exact intention and duration in writing for which such biometric identifiers or biometric information is being accumulated, stored and used
• Need a written confirmation from the person for the accumulation of his or her biometric identifiers or information
• Written retention schedules and guidelines for destroying biometric identifiers and biometric information forever that is publicly available should be published

The complaint alleges that:

In direct violation of… BIPA, Facebook is actively collecting, storing, and using – without providing notice, obtaining informed written consent or publishing data retention policies – the biometrics of its users and unwitting non-users.

The plaintiff claims that he has never had, or does not have, a Facebook account, however points out that a Facebook user uploaded to Facebook at least one photograph showing him that has led to the non-consensual creation of a biometric template of his face. The action is brought on behalf of a class of similarly situated individuals, defined as:

All non-Facebook users who, while residing in the State of Illinois, had their biometric identifiers, including “face templates” (or “face prints”), collected, captured, received, or otherwise obtained by Facebook.

A hearing had taken place before the United States Senate Subcommittee on Privacy, Technology and the Law back in July 2012, particularly to confront what facial recognition technology may mean for privacy and civil liberties.

Senator Al Franken (D-MN) commented in the opening statement of the hearing (PDF) to the subcommittee:

In 2010, Facebook, the largest social network, began signing up all of its then 800 million users in a programme called Tag Suggestions. Tag Suggestions made it easier to tag friends in photos, and that is a good thing.

But the feature did this by creating a unique faceprint for every one of those friends. And in doing so, Facebook may have created the world’s largest privately held database of faceprints — without the explicit consent of its users. To date, Tag Suggestions is an opt-out program. Unless you have taken the time to turn it off, it may have already been used to generate your faceprint.

In 2011, a German data protection authority had raised similar concerns. A Facebook spokesperson at that time said that Zuckerberg “firmly reject any claim that we are not meeting our obligations under European Union data protection law.”

Facebook Artificial-Intelligence Research Team (FART) main interest remains in Facial recognition, which however showed a paper on “Web-Scale Training for Face Identification” at the IEEE Conference on Computer Vision and Pattern Recognition in June. The paper does not mention the words “consent” or “legal” in particular.

The efforts to set up an voluntary code of conduct for the commercial use of facial recognition technology on a federal level in the US recently came to an abrupt stop June when privacy advocates backed away from the talks all together.

The advocates that included the ACLU and EFF, grumbled about not being able to get industry stakeholders “to agree on any concrete scenario where companies should employ facial recognition only with a consumer’s permission”.

The class action complaint case number is 1:15-cv-07681, which was filed in the United States District Court, Northern District of Illinois.

Resource: The Register