IEEE Technology and Society Magazine - December 2021 - 91

passed Biometric Information Privacy Acts (BIPAs),
which directly regulate the conditions under which
facial recognition (and other collection of biometric
information) may occur. At least eight other states
have considered similar legislation. At the Federal
level, several proposals have been floated but none
have advanced [40]. More recently, Portland, Oregon,
banned FRT in any place of public accommodation,
including any place where goods or services
are sold [41].
The Illinois law was the first BIPA law passed
(in 2008) and therefore is a good case study for the
potential effect of BIPA laws on FRT. The Illinois
law requires that companies describe how they
will use biometric information, including " scans of
face geometry, " and obtain the customers' express
written consent for any collection of BI. The law
also imposes retention limits, data destruction
requirements, and data security requirements.
Thus far, the Illinois law is the only BIPA to allow
a private right of action, with up to $5000 per violation
in statutory damages plus attorneys' fees
and costs. Interestingly, the Illinois law expressly
exempts state and local governments from its
requirements [40].
What have been the effects of the law? We are
only beginning to see the effects as the technology
enters broader use in the past several years. We can
identify, however, some of the technologies that may
be impacted by looking at some of the early cases
brought and the reactions by some companies.
The Illinois BIPA law has caused companies
to withdraw products or services in that state. For
example, Sony does not sell its robot dog companion,
Aibo, in Illinois [42], [43]. Google disables the
facial-recognition features of its in-home Nest security
cameras in Illinois [24]. In Illinois and Texas
(another state with a BIPA), Google blocks one feature
of its " Arts and Culture " app that uses selfies to
find users' doppelganger in a large database of paintings
by recognized artists [44].
The most dramatic effect of Illinois' law, however,
has been in class action litigation. For about
10 years, there was neither state AG enforcement
nor much private class action use of the law in raw
numbers-although lawsuits had been brought
against several of the major tech companies, United
Airlines, the Kimpton hotel chain, and a grocery
store chain. But on January 25, 2019, the Illinois
Supreme Court held in Rosenbach v. Six Flags
December 2021
(Ill. 2019) that plaintiffs need only allege a violation
of the statute, not any particularized harms to
themselves, to establish that they are " aggrieved "
under the Act. That opened the floodgates of class
action lawsuits. Between the date Rosenbach was
decided and the end of June 2019, 151 new class
actions were filed under the BIPA-approximately
one per day. Since the 2019 ruling, approximately
900 total cases have been filed [45], [46]. Many
of these lawsuits target employers such as the Salvation
Army who use biometric fingerprinting for
hourly employees punching in and out-each scan
allegedly a violation of BIPA and subject to $1000
to $5000 penalty-even though the technology
reduces fraud, and no one has demonstrated any
risk to consumers more generally [47]. Rosenbach
also triggered new or revived cases against Google
and Shutterfly for use of FRT.
In short, while Illinois' BIPA and the associated
litigation imposes costs on businesses and deprives
Illinois residents of useful services, there is little or
no evidence that the law is materially protecting the
privacy of Illinois residents. Indeed, BIPA litigation
is usually focused on technical violations of the law
with no consumers suffering even subjective harms
such as embarrassment [40], [48].
The trend of BIPA class action lawsuits being
based on technical violations may be reduced by
recent Supreme Court decisions in Spokeo v. Robins
and TransUnion v. Ramirez, both of which clarify the
judicial doctrine of standing, which sets under what
general conditions a party has the right to bring a
case [49], [50]. In the latter case, handed down in
June 2021, the Supreme Court upheld a judgment
against a credit reporting company for individuals
whose credit record, although inaccurate in some
way (such as an incorrect indication that the person
might be on a terrorist watch list), was shared with
third parties. But the Court struck down the judgment
for individuals whose credit record, even if
inaccurate, was not shared with any other company,
holding that for such individuals there was no injury
" that the defendant caused and the court can remedy "
[50].
That BIPA has spurred significant litigation and
other costs with little quantifiable evidence of
consumer benefit does not prove that all hard law
approaches to governing FRT would do the same.
But it does provide a warning and a reason to consider
other approaches-namely, soft law.
91
IEEE Technology and Society Magazine - December 2021

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - December 2021
