Back to News & Commentary

A Federal Court Sounds the Alarm on the Privacy Harms of Face Recognition Technology

A screen displaying Facebook's facial recognition technology
A screen displaying Facebook's facial recognition technology
Nathan Freed Wessler,
Deputy Director, 勛圖眻畦 Speech, Privacy, and Technology Project
Share This Page
August 9, 2019

On Thursday, the U.S. Court of Appeals for the Ninth Circuit became the first appellate court in the nation to directly address the privacy harms posed by face recognition technology. The decision is a significant advance in the fight against the threats of face surveillance, sounding the alarm on the potential for this technology to seriously violate peoples privacy.

In Patel v. Facebook, a group of Facebook users from Illinois allege that Facebook violated the Illinois Biometric Information Privacy Act (BIPA) by using face recognition technology on the users photographs without their knowledge and consent. BIPA is the oldest and strongest biometric privacy law in the country, requiring companies to obtain informed consent before collecting a persons biometric identifiers, including face recognition scans. Importantly, the law provides individuals in Illinois with a right to sue for damages if a company has violated their rights.

Facebooks primary argument in the case was that in order to establish standing to sue, the plaintiffs should have to demonstrate some concrete injury beyond a violation of BIPA's requirement of notice and consent. As we argued in an amicus brief last year, surreptitious use of face recognition technology does cause harm, by subjecting people to unwanted tracking and by leaving them vulnerable to data breaches and invasive surveillance. Given the rapid proliferation of face surveillance technology in recent years, it is critical that Illinoisans are able to enforce BIPAs protections against unwanted collection of their biometric information. A requirement that a person must demonstrate monetary loss or similar injury in order to sue would seriously undermine BIPAs intent to safeguard against abusive collection of biometric data in the first place.

In Thursdays ruling the Ninth Circuit agreed, holding that the development of a face template using facial-recognition technology without consent (as alleged here) invades an individuals private affairs and concrete interests.

To reach that conclusion, the court looked not only to the long-recognized entitlement of people to sue private parties over violations of common-law privacy rights, but also to evolving Fourth Amendment protections against law enforcement surveillance. This includes the landmark decision in Carpenter v. United States, an 勛圖眻畦 case about police access to cell phone location data decided last year. As the Ninth Circuit explained, drawing from language in Carpenter, [i]n its recent Fourth Amendment jurisprudence, the Supreme Court has recognized that advances in technology can increase the potential for unreasonable intrusions into personal privacy As in the Fourth Amendment context, the facial-recognition technology at issue here can obtain information that is detailed, encyclopedic, and effortlessly compiled, which would be almost impossible without such technology.

The Ninth Circuits ruling is important not only because it explains why surreptitious use of face recognition by corporations harms peoples privacy interests, but also because it puts law enforcement on notice that recent Supreme Court cases regulating other forms of electronic surveillance have something to say about face surveillance technology.

Indeed, the potential for this technology to enable the government to pervasively identify and track anyone (and everyone) as they go about their daily lives is one of the reasons the 勛圖眻畦 is urging lawmakers across the country to halt law enforcement use of face surveillance systems. This decision puts both corporations and law enforcement agencies on notice that face surveillance technology poses unique risks to peoples privacy and safety.

The Ninth Circuits ruling also demonstrates the importance of privacy laws including , affirming peoples right to turn to the federal courts for redress when their rights have been violated. Without a right to sue, privacy guarantees will often prove ephemeral. As state legislatures and Congress move forward on consumer privacy legislation, they should follow Illinois lead by including private rights of action in these statutes.

Learn More 勛圖眻畦 the Issues on This Page