ANSWER: FACEBOOK USES FACIAL-RECOGNITION TECHNOLOGY TO MATCH FACES, BUT IT MAY NOT BE LEGAL UNDER ILLINOIS STATUTE.
Expensive privacy violation on social media?
Some citizens of Illinois brought a class-action lawsuit against Facebook claiming somewhere around $35 billion for privacy violations! Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir., 2019). (The plaintiffs apparently don't understand that "private" and "social" are antonyms.)
The Ninth Circuit said that Facebook runs one of the biggest social media platforms in the world and has over 1 billion active users. About seven out of ten adults in the U.S. use Facebook. (Our household has the three non-Facebook users.)
According to the court: "When a new user registers for a Facebook account, the user must create a profile and agree to Facebook's terms and conditions, which permit Facebook to collect and use data in accordance with Facebook's policies." If someone wants to deal with someone else on Facebook, they identify another Facebook user as a "friend" and send a "friend request." If the "friend" accepts the request, the two Facebook users are able to share things such as photographs and texts.
"For years, Facebook has allowed users to tag their Facebook friends in photos posted to Facebook." The "tag" identifies the "friend" in the photograph and includes a link to that person's Facebook profile. If a Facebook user is "tagged" he or she is notified of the tag and given access to the photograph. He or she is also allowed to share the image with other friends or can "un-tag" himself or herself.
Facebook started a feature called Tag Suggestions in 2010. If a Facebook user enables Tag Suggestions, Facebook can use facial-recognition technology to analyze whether any of the user's friends are in images uploaded by that Facebook user. When the photograph is uploaded, Facebook's technology scans the image and detects whether it contains pictures of faces.
If the Facebook technology detects the photograph, its technology "extracts the various geometric data points that make a face unique, such as the distance between the eyes, nose, and ears, to create a face signature or map." Then the technology compares the face to other pictures of faces in the Facebook database of user faces. Then if the software matches the "face signature" and the "face template", Facebook suggests tagging the person in the photograph.
How can something that I voluntarily placed on social media be private?
The plaintiffs alleged that Facebook had violated the Illinois Biometric Information Privacy Act by using its facial-recognition technology. The Illinois Biometric Information Privacy Act says that companies are prohibited from collecting, using and storing biometric identifiers from photographs without obtaining written releases from the people in the photographs. The statute also requires that the company establish a "compliant retention schedule."
The statute defines "biometric identifier" as "a retina or iris scan, finger print, voice print or scan of hand or face geometry."
But who has been harmed?
Facebook moved to dismiss the complaint because the plaintiffs had not claimed any concrete injury from the violations of the Illinois privacy statute. The Ninth Circuit Court of Appeals said: "We conclude that the development of a face template using a facial-recognition technology without consent . . . invades an individual's private affairs and concrete interests." The analysis by the court was convoluted, but interesting, as it arrived at the conclusion that with no harm shown there was still a "concrete injury."
The court talked about privacy rights protected by the Fourth Amendment to the Constitution. But Facebook is not the government and facial-recognition technology of information voluntarily provided by subscribers to Facebook is not anywhere close to "unreasonable searches and seizures."
The court also talked about the First Amendment right to privacy. But the First Amendment applies to government restrictions, not to private enterprises such as Facebook.
The court also quoted the common law causes of action for privacy torts by quoting The Restatement (Second) of Torts § 652A(2) (1977) which provides:
The right of privacy is invaded by:
(a) unreasonable intrusion upon the seclusion of another, as stated in 652B; or
(b) appropriation of the other's name or likeness, as stated in 652C; or
(c) unreasonable publicity given to the other's private life, as stated in 652D; or
(d) publicity that unreasonably places the other in a false light before the public, as stated in 652E.
While that recognition of common law privacy rights is accurate, I still fail to see what that has to do with a cause of action based upon a specific Illinois statute.
The future of "private" social media?
Facebook has taken defense of the $35 billion class action claim to the U.S. Supreme Court. We will see whether the Supreme Court chooses to review the case.
We have helped many companies comply with various U.S., Canadian, and European privacy laws and regulations. If you and your company would prefer not to be the subject of a $35 billion class action lawsuit, call us and get some advice first.
Michael R. King, Gammage & Burnham Attorneys at Law • firstname.lastname@example.org • 602-256-4405
This article may be distributed with attribution but may not be excerpted or modified without the permission of the author. Copyright © 2020.