A federal district court in California recently rejected Facebook’s request to dismiss a class action lawsuit related to Facebook’s biometric facial recognition database. The case arises from a complaint by Illinois residents that Facebook’s “Tag Suggestions” program violates the Illinois Biometric Information Privacy Act (BIPA) [view related posts here, here and here]. When a Facebook user uploads a photograph, the program scans the photograph for identifying features, suggests names for the faces in the photograph and encourages Facebook users to tag the individuals who have been named.  Illinois is one of a handful of states in the U.S. that regulates the use of biometrics and facial recognition technology.

In the suit, the plaintiffs allege that the Tag Suggestions program violated BIPA because Facebook did not: inform users that biometric identifiers were being created, collected and stored; describe the purposes for the use and how long the data would be stored; provide a publicly-available retention schedule or guidelines for permanently destroying the identifiers; or receive a written release from the plaintiffs to collect or otherwise obtain their biometric identifiers. While the case originated as three separate cases in Illinois, the parties agreed to move them to federal district court in California and consolidate them into one class action. Facebook argued that California law should apply as that is the law designated in its user agreement. The court rejected that argument, noting that California does not have a biometric policy similar to BIPA and therefore, if California law were to apply, it would override Illinois’ policy of protecting its citizens’ biometric data.  Facebook is also challenging whether the images collected actually fall within the scope of BIPA.  The court did not rule on that issue stating that “those questions are for another day.”

[View source.]