A Federal Court Sounds the Alarm on the Privacy Harms of Face Recognition Technology

On Thursday, the U.S. Court of Appeals for the Ninth Circuit became the first appellate court in the nation to directly address the privacy harms posed by face recognition technology. The decision is a significant advance in the fight against the threats of face surveillance, sounding the alarm on the potential for this technology to seriously violate people’s privacy.

In Patel v. Facebook, a group of Facebook users from Illinois allege that Facebook violated the Illinois Biometric Information Privacy Act (BIPA) by using face recognition technology on the users’ photographs without their knowledge and consent. BIPA is the oldest and strongest biometric privacy law in the country, requiring companies to obtain informed consent before collecting a person’s biometric identifiers, including face recognition scans. Importantly, the law provides individuals in Illinois with a right to sue for damages if a company has violated their rights.

Facebook’s primary argument in the case was that in order to establish “standing” to sue, the plaintiffs should have to demonstrate some concrete injury beyond a violation of BIPA's requirement of notice and consent. As we argued in an amicus brief last year, surreptitious use of face recognition technology does cause harm, by subjecting people to unwanted tracking and by leaving them vulnerable to data breaches and invasive surveillance. Given the rapid proliferation of face surveillance technology in recent years, it is critical that Illinoisans are able to enforce BIPA’s protections against unwanted collection of their biometric information. A requirement that a person must demonstrate monetary loss or similar injury in order to sue would seriously undermine BIPA’s intent to safeguard against abusive collection of biometric data in the first place.

In Thursday’s ruling the Ninth Circuit agreed, holding that “the development of a face template using facial-recognition technology without consent (as alleged here) invades an individual’s private affairs and concrete interests.”

To reach that conclusion, the court looked not only to the long-recognized entitlement of people to sue private parties over violations of common-law privacy rights, but also to evolving Fourth Amendment protections against law enforcement surveillance. This includes the landmark decision in Carpenter v. United States, an ACLU case about police access to cell phone location data decided last year. As the Ninth Circuit explained, drawing from language in Carpenter, “[i]n its recent Fourth Amendment jurisprudence, the Supreme Court has recognized that advances in technology can increase the potential for unreasonable intrusions into personal privacy… As in the Fourth Amendment context, the facial-recognition technology at issue here can obtain information that is ‘detailed, encyclopedic, and effortlessly compiled,’ which would be almost impossible without such technology.”

The Ninth Circuit’s ruling is important not only because it explains why surreptitious use of face recognition by corporations harms people’s privacy interests, but also because it puts law enforcement on notice that recent Supreme Court cases regulating other forms of electronic surveillance have something to say about face surveillance technology.

Indeed, the potential for this technology to enable the government to pervasively identify and track anyone (and everyone) as they go about their daily lives is one of the reasons the ACLU is urging lawmakers across the country to halt law enforcement use of face surveillance systems. This decision puts both corporations and law enforcement agencies on notice that face surveillance technology poses unique risks to people’s privacy and safety.

The Ninth Circuit’s ruling also demonstrates the importance of privacy laws including strong private rights of action, affirming people’s right to turn to the federal courts for redress when their rights have been violated. Without a right to sue, privacy guarantees will often prove ephemeral. As state legislatures and Congress move forward on consumer privacy legislation, they should follow Illinois’ lead by including private rights of action in these statutes.