Where there is no face scanning, there can be no unlawful use of biometrics. A U.S. District Court granted Facebook’s motion for summary judgment as part of ongoing litigation against the social media company for alleged violations of Illinois’s Biometric Information Privacy Act (“BIPA”). In one of the suits, Plaintiff Gullen (a non-user of Facebook) alleged that a single photo of him uploaded onto an organizational page (as opposed to a personal page) was scanned, mapping his biometric identifiers without the notice and consent required under BIPA. The order granting summary judgment hinged on one undisputed fact: Facebook did not scan the photo at issue.
Facebook supported its motion for summary judgment with a declaration from an engineer stating that “facial recognition is not performed on photos that are posted on business or other organization Facebook Pages.” The Court rejected Gullen’s argument that he was entitled to further discovery on the issue, noting that Gullen had been in possession of the information supporting Facebook’s position long before he conducted discovery on the matter. The Court also found that the record supported Facebook’s assertions on its practices for organizational pages, and that any alleged inconsistencies did “not bear the weight Gullen puts on it ….”
BIPA imposes duties on companies that collect, process, or store biometric data, including providing notice and obtaining informed consent. Illinois’s BIPA provides a private right of action which has undergone significant litigation in Illinois, New York, and California courts. Washington and Texas have similar laws, but can only be enforced by the state Attorney General, and no actions have been brought in either state to date.
While Gullen’s case was dismissed, a related consolidated class action In re Facebook Biometric Privacy Litigation continues. Having survived multiple motions to dismiss, as it enters the summary judgment phase, In re Facebook may ultimately provide greater clarity on BIPA’s application, particularly the statute’s extraterritorial reach and in what instances consumers have sufficient notice prior to collection of their biometric identifiers.
