Civil lawsuits against Facebook and Shutterfly claim the sites violated privacy laws by using biometric facial recognition technology to identify people and store that information. Credit: Creative Commons Lic.
A federal judge has has denied a motion to dismiss a civil case against photo-sharing site Shutterfly that claims the company violated users' privacy by collecting and scanning face geometries from uploaded images without consent.
The first of its kind ruling could open the door to future class-action lawsuits against Shutterfly and other social networks that use facial recognition technology without an opt-in policy.
The civil lawsuit, brought by the law firm Carey Rodriguez Milian Gonya LLP on behalf of Brian Norberg, alleges that Shutterfly violated the Illinois Biometric Privacy Act (BIPA) by collecting and scanning face geometry in photos uploaded on Shutterfly's website without the consent of those featured in the images.
In his ruling, U.S. District Court Judge Charles R. Norgle rejected Shutterfly's argument that only in-person scans of people's faces are covered under the statute.
The lawsuit alleges that Norberg, "along with potentially millions of others," was never informed that his facial images would be collected, nor was he informed where the images would be stored, or for how long, which is required under the BIPA, the lawsuit alleges.
In addition to the case against Shutterfly, the law firm is also leading separate claims against other companies on biometric data, including one against Facebook.
Norgle additionally ruled that the collection of face prints from photos is also covered under the statute. The statute, which also covers iris and fingerprint scans, provides for recoveries of $5,000 for each violation.
Jennifer Lynch, a senior staff attorney with the Electronic Frontier Foundation, said the ruling, while significant, meets a relatively low standard in civil litigation.
"It just means there was no way [Shutterfly] could prove their claim... and the judge said the plaintiffs will have an opportunity to prove their claims," Lynch said.
A spokesperson for Shutterfly said the company doesn't comment on pending litigation.
In April, a Chicago man filed a class-action lawsuit against Facebook's "Tag Suggestions," claiming the feature violated BIPA by using facial recognition technology to identify people without their written consent.
"That's the key, whether the company has gotten opt-in consent," Lynch said. "The way I read the law is it's a clear violation if they've not gotten their expressed consent."
Carlo Licata, the plaintiff in the Facebook case, said in his complaint that the social network doesn't disclose "its wholesale biometrics data collection practices in its privacy policies, nor does it even ask users to acknowledge them.
Sign up for Computerworld eNewsletters.