CHICAGO — A federal judge’s ruling this week means Facebook could face billions of dollars in damages if the court finds the company violated Illinois residents’ privacy rights with its facial tagging feature.
The potential penalty stems from a federal lawsuit filed in Illinois in 2015 that alleges the social media giant violated a state law protecting residents’ biometric information, such as data from facial, fingerprint and iris scans. Use of the increasingly popular technology by employers has come under fire in Illinois, which has one of the strictest biometric privacy laws in the nation.
The Facebook lawsuit, which has since been moved to federal court in San Francisco, was one of a string of suits filed in recent years alleging violations of the Illinois Biometrics Information Privacy Act. U.S. District Judge James Donato on Monday granted the suit class-action status.
Facebook has argued that if its collection of biometric information did not harm individuals, they do not have grounds to sue under Illinois’ biometrics law. But Donato wrote in his order that an alleged invasion of privacy was injury enough to allow users to sue.
The ruling is a win for privacy advocates, who are fighting in the Illinois legislature against proposed changes they say would gut the biometrics privacy law.
Donato’s ruling validates Illinois law, said Abe Scarr, director of the Illinois Public Interest Research Group, a consumer advocacy organization.
“(It will) demonstrate hopefully to other states that they can and should be protecting their citizens’ privacy rights,” Scarr said. “For years, public policy has allowed the Googles and Facebooks of the world to be able to collect an incredible amount of information about us. … It has a lot of unintended consequences.”
Privacy advocates say that protecting biometric information is critical because, unlike a credit card number, it can’t be changed if it’s stolen. Illinois’ 2008 law mandates that companies collecting such information obtain prior consent from consumers, detailing how they’ll use it and how long it will be kept. The law also allows private citizens to sue.
Facebook started rolling out its facial tagging feature for photos in 2010. The social media platform does have information on its website regarding the feature and points users toward their settings to disable it. However, the lawsuit alleges that the company did not obtain written consent from users or properly notify them about how the information would be used or or how long it would be kept.
Three Illinois residents, Nimesh Patel, Adam Pezen and Carlo Licata, brought the suit against Facebook on behalf of fellow users in the state. They declined to comment Tuesday through their attorney.
The judge’s order defines the class as Facebook users in Illinois from whom the Menlo Park, Calif.-based company created a stored face template after June 7, 2011, the date Facebook said its tag suggestion feature was available in most countries. The feature uses facial recognition software to match users’ new photos with other photos they’re tagged in. It groups similar photos together and suggests the names of friends in the photos.
Millions of Illinoisans could be included in the class, according to the court order.
The lawsuit asks the court to award damages of $5,000 for each reckless violation of Illinois’ biometrics law and $1,000 for each negligent violation. Damages could amount to billions of dollars, Donato noted in his order.
Facebook is reviewing Monday’s ruling, spokeswoman Genevieve Grdina said in an emailed statement.
“We continue to believe the case has no merit and will defend ourselves vigorously,” she said.
A mediation session is scheduled for May 4. If the case isn’t settled, it is expected to go to trial in July.
This case will likely stick with Facebook for a while, said Matthew Kugler, an assistant professor at Northwestern University’s Pritzker School of Law who has published work on privacy policies related to biometrics.
Donato’s order also could affect biometric privacy lawsuits brought against other tech companies and employers, Kugler said. Arguments similar to Facebook’s — that the collection of biometric data caused no real harm to the people suing — have been used in other cases.
There are “stock arguments you make in a (Biometric Information Privacy Act) case, and most of them are being rejected in this opinion,” he said. “It resets the balance a little bit.”
Chicago law firm Edelson is representing the Facebook users in the case. The firm has brought cases against other tech companies, including Google and Netflix, and is representing Cook County in a separate privacy suit against Facebook.
“We are very gratified by the court’s decision to certify this as a class,” Jay Edelson, the firm’s founder and CEO, said in an email.
Edelson pointed to Mark Zuckerberg’s testimony before Congress last week regarding the alleged misuse of Facebook data by political consulting firm Cambridge Analytica. During his appearence, the Facebook founder and CEO said special consent should be used for sensitive technologies like facial recognition.
“We are very much looking forward to contrasting Mr. Zuckerberg’s Senate testimony with Facebook’s actual business practices when we try this case in July,” Edelson said.