[ad_1]
Today, the Supreme Court of Illinois ruled unanimously that when companies collect biometric data such as fingerprints or faceprints without informed consent, they may be prosecuted. Users do not need to prove an injury such as identity fraud or physical harm: just lose control of a biometric's privacy for a victim.
In Rosenbach c. Six flagsA 14-year-old filed a lawsuit against an amusement park for collecting his thumbprint without his informed consent, in violation of Illinois law. The law in question, the Illinois Biometric Information Privacy Act (BIPA), prohibits companies from collecting, using or sharing biometric information without their informed consent. EFF, as well as ACLU, CDT, the Chicago Alliance Against Sexual Exploitation, PIRG and Lucy Parsons Labs, filed a amicus curiae short urging the Illinois Supreme Court to adopt a strong interpretation of BIPA.
The Illinois Supreme Court agreed with us and strongly rejected the defendants' argument that BIPA required a person to show that an injury was caused beyond the loss of the intended right of privacy by the law. The court rejected the company's argument that the violation of a privacy law is simply a "technical violation of the law". In fact, the Court decided that it was causing serious prejudice in support of a lawsuit.
The court acknowledged that, through BIPA, the legislator had codified the "right to privacy of its biometric identifiers and biometric information and the control of its confidentiality". The need to codify this right was corroborated by the legislator's finding that biometrics could be used to access information, but unlike other identifiers such as social security numbers, biometrics is unique to each individual and not can not be changed. As a result, the court said, quoting the legislator: "Once compromised, the person has no recourse, presents an increased risk of identity theft and is likely to withdraw from transactions facilitated by biometrics ".
For these reasons, said the court, a person is "clearly aggrieved" under BIPA by the mere violation of the act alone:
When a private entity fails to comply with statutory procedures, as the accused allegedly do, "the right of the person to [their] Biometric privacy disappears in the air. The specific harm that the Illinois legislature sought to prevent is then realized. " It's not a simple "technicality". The injury is real and significant. (Underlining added.)
Illinois BIPA is the strictest privacy law in the United States. As biometric collection, use, and sharing become more prevalent and invasive each year, it is becoming increasingly important for private citizens to sue under laws such as BIPA to protect their privacy. . More companies than ever capture and monetize our biometric information. Retailers use facial recognition for buyer behavior as they move in the store, and to identify potential display thieves. Employers use fingerprints, iris scans and facial recognition to handle employee access to the phones and computers of the company. People have filed BIPA lawsuits against big tech companies like Facebook, Google, and Snapchatalleging that the companies had applied facial recognition to their uploaded photographs without their consent.
EFF and other privacy groups for years to have resisted big deal efforts to empty BIPA. Laws such as BIPA allowing private citizens to sue are needed for several reasons. First, biometric monitoring is a growing threat to our privacy. Our biometric information can be collected remotely and without our knowledge, and we often have no individual ability to effectively protect ourselves from this serious invasion of privacy. Secondly, BIPA is following in the footsteps of many other privacy laws that prohibit the entry of private information in the absence of prior informed consent, and which define capture without notice and consent in and of itself as a precautionary measure. injury. Third, allowing private prosecutions is a necessary means to ensure effective enforcement of privacy laws.
the Rosenbach This case has important implications for another case submitted to BIPA, which challenges the use of Facebook's biometric face monitoring without users' consent. This case, In re Facebook Biometric information litigation (also called Patel v. Facebook), is currently on appeal to the Court of Appeals of the Ninth Circuit of the United States in California. Like the accused in Rosenbach, Facebook argued that the loss of biometric confidentiality rights under the law was not sufficient to sue a company, but that the plaintiff also had to show additional prejudice. EFF and our privacy allies have filed a amicus curiae in this case too.
the Facebook The district court rejected this argument last year, as did the Illinois Supreme Court today.
We hope that the Rosenbach decision closes this argument once and for all. The Supreme Court of Illinois cited California Facebook case with approval and quoted extensively. Now, it's the ninth circuit to let this business go on.
Source link
