New Biometrics Lawsuits Signal Potential Legal Risks in Ai

• Jurisdiction: United States,Federal,Illinois
• Publication year: 2020
• Citation: Vol. 3 No. 5

Debra R. Bernard, Susan Fahringer, and Nicola Menaldo^*

The authors explain that a new line of biometric information privacy law attack likely increases the risk associated with using publicly available images for purposes of facial recognition research and building data sets for machine learning.

A new type of biometric information privacy law case has emerged recently that should be of interest to companies involved in using, improving, and developing facial recognition and other artificial intelligence ("AI") using photos. Companies that deal with biometrics are likely aware of Illinois' Biometric Information Privacy Act ("BIPA"),¹ which regulates the collection, storage, and use of biometric data, including, for example, fingerprints, voiceprints, and scans of "face geometry." BIPA permits plaintiffs to recover $1,000-$5,000 per violation, which can lead to staggeringly high damages exposure where large classes are involved. As a result, over 500 putative class action lawsuits have been filed in Illinois in the past five years against companies across the country.

Most BIPA cases target companies that collect or possess fingerprint data—for example, employers that require their employees to use fingerprints for timekeeping purposes.

About a dozen cases target companies alleging that they use facial recognition technologies, such as companies that may use facial recognition to enhance services to customers, B2B companies that provide identity verification services, and brick-and-mortar stores that plaintiffs allege use facial recognition to track customers or for security purposes.

A smaller handful of cases allege the collection of voiceprints in violation of BIPA.

New BIPA Lawsuits

Between January 22 and 24, 2020, three new cases were filed, alleging BIPA violations based on facial recognition data drawn from publicly available photos. These cases represent an additional area of legal risk for many companies and could lead to a new wave of BIPA cases against companies engaged in AI and facial recognition research.²

[Page 353]

In the first case, Janecyk v. International Business Machines,³ IBM was sued in connection with its use of publicly available images to create the "DiF" (Diversity in Faces) data set, as NBC News has recounted.⁴

The plaintiff, Tim Janecyk, alleges that he is a photographer who uploaded photographs of people—including himself—in sensitive situations like political rallies to the photo-sharing site Flickr. He alleges that...