Crucial biometric privacy law survives Illinois court fight

Privacy advocates won a crucial court victory on Friday, as the Illinois Supreme Court dismissed a case that would have pared back a state law limiting the use of facial recognition and other biometrics.

Passed in 2008, Illinois’ Biometric Information Privacy Act (or BIPA) requires affirmative consent for companies to collect biometric markers from their customers, including fingerprints and facial recognition models. The law has become a sticking point for a number of tech companies using facial recognition as a photo-sorting tool, and both Facebook and Google have faced lawsuits for alleged BIPA violations in their photo-tagging products. Facebook has pushed for legislative revisions to the law on several occasions, but so far unsuccessfully.

The most recent case comes from Six Flags, which allegedly fingerprinted a 14-year-old visitor without parental approval. Contesting the case, Six Flags argued it couldn’t be held liable unless the plaintiff demonstrated a tangible injury from the unauthorized collection, often a difficult task in privacy lawsuits. If successful, Six Flags’ would have significantly limited BIPA’s power and made facial recognition much easier for companies like Facebook and Google.

However, the Illinois Supreme Court was ultimately unconvinced by the argument, ruling that “a person need not have sustained actual damage beyond violation of his or her rights under the Act.” In Illinois, businesses that collect biometric data will have to do so carefully, which the court took to be a reasonable intent of the law itself. “Whatever expenses a business might incur to meet the law’s requirements,” the ruling reads, “are likely to be insignificant compared to the substantial and irreversible harm that could result if biometric identifiers and information are not properly safeguarded.”

The ruling has been met with cheers from privacy groups and concern from some business groups. The Electronic Frontier Foundation applauded the ruling, calling it a crucial privacy victory. “As biometric collection, use, and sharing become more widespread and invasive every year, it only becomes more important that private citizens can sue under laws like BIPA to protect their privacy,” the group wrote in a post.

The Illinois Chamber of Commerce had a different response. “We fear that today’s decision will open the floodgates for future litigation at the expense of Illinois’ commercial health,” the group said in a statement.