Illinois Biometric Act Excludes Photographs But Court Says Photos are Included. What??
by Jerry Glover
September 20, 2017
We earlier wrote about the Illinois Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/1 et seq. See story here.
On September 15, the U.S. District Court for the Northern District of Illinois ruled against Shutterfly in a case involving the BIPA. Monroy v. Shutterfly, 16 CV 10984 (N.D. Ill. September 15, 2017). In this case, an unnamed Shutterfly user in Chicago uploaded a photograph of the plaintiff onto a Shutterfly site. Shutterfly operates websites that allow users to upload, organize and share digital photos. Each photo that is uploaded is subject to Shutterfly’s facial recognition software which scans the image, locates each of the faces in the images and creates a detailed map or template for each face. A person can be identified by his face geometry in the same way that he can be identified by his fingerprints. The company stores maps of face geometry in a database. Whenever a new image is uploaded onto Shutterfly’s site, the faces in the image are compared against those in the database. If a face’s geometry matches that of an individual already in its database, Shutterfly suggests that the user “tag” the image with the individual’s name. If there is no match, Shutterfly prompts the user to enter a name.
In this case, Shutterfly prompted the user to enter a name for the Monroy photo and he entered “Alex Monroy.” Monroy is not a Shutterfly user and never consented to Shutterfly’s creation of data representing his face geometry.
BIPA defines “biometric identifier” as a retina or iris scan, fingerprint, voiceprint or scan of hand or face geometry. The statute further notes that biometric identifiers specifically excludes photographs as identifiers. The statute also excludes from the definition of “biometric information” any information derived from items excluded under the definition of biometric identifiers. Shutterfly contended that its scan of Monroy’s photo, not Monroy’s face, is exempt from the statute’s reach.
That would seem like a valid argument. But the court disagreed. The court noted that if Shutterfly’s argument is accepted that biometric identifiers do not include information from photographs then the statute’s reference to a scan of “face geometry” can mean only an in-person scan of a person’s face. But the court labeled that reading of the statute as “problematic. The statute does not define biometric identifies with words like “derived from a person”, “derived in person” or “based on an in-person scan.” But the statute does not refer to the scan of an individual’s actual face. The court claimed that if the state legislature wanted to limit the statute to in-person scans it could have easily written the statute that way. The court noted that such legislation had been introduced in the Illinois Senate in 2016 but it had been put on hold.
Shutterfly noted that all the other processes listed in the statute (iris scan, fingerprint, voiceprint) must be obtained in-person. Therefore, a scan of “face geometry” should be understand as referring only to data obtained from a person who is physically present. But the court noted that this argument assumes that biometric identifiers listed in the statute like finger prints can be obtained only from in-person processes. That, the court believed, is incorrect since both fingerprints and retinal scans can be obtained from photographs. The court added that given the advances in technology it would not be inconceivable that all those identifiers listed in the statute might soon be obtained without an in-person process.
Another issue raised by Shutterfly was one involving the plaintiff’s damages. Shutterfly argued that the plaintiff failed to alleged that he suffered actual damages as a result of Shutterfly’s actions. The plaintiff, however, argued that the statute does not require a plaintiff to plead actual damages but, nevertheless, he also argued that he had claimed actual damages by claiming that Shutterfly invaded his privacy.
BIPA states that a prevailing party in an action pursuant to the statute can recover liquidated damages of $1,000 or actual damages, whichever is greater. The court noted that there was a split of authority among the Illinois courts about whether the statute requires a plaintiff to show actual damages or whether the statutory language allows the prevailing party to elect between liquidated damages and statutory damages. After reviewing other federal statutes with similar bifurcated damage provisions, the court concluded that, even though it was a close question, that actual damages did not need to be shown to state a claim under BIPA.