Facebook faces billions in damages over biometric data harvesting

Judge agrees with Illinois residents who argued state law gives them a “property interest” in the algorithms that constitute their digital identities

Facebook argues it should not be sued by a group but by individuals. AP Photo/Thibault Camus

Facebook users in Illinois whose faces were scanned without their knowledge can sue the social-media company for damages that could amount to billions of dollars.

A federal judge in San Francisco ruled Monday that Facebook must face potentially millions of users from the state who claim the company has gathered and stored their biometric data without their agreement.

US District Judge James Donato’s decision to let the lawsuit proceed as a class action is a significant step for users seeking to put Facebook on the hook for fines of $1,000 to $5,000 for each time a person’s image is used without permission under a unique Illinois law. The ruling could also help advance restrictions on Facebook’s use of biometrics in the US, similar to those in Europe and Canada.

Facebook is reviewing the ruling, according to a company spokesperson. “We continue to believe the case has no merit and will defend ourselves vigorously,” the person said.

The company “seems to believe” that the lawsuit should be pursued by individuals, not as a group, because “damages could amount to billions of dollars”, Judge Donato wrote in the ruling.

_______________

Read more:

Facebook data saga boosts demand for ethical consultants, analysts say

Why social media influencers can be frustrating for journalists 

_______________

The company argued each plaintiff could be “aggrieved” differently, and must prove that they suffered an actual injury beyond a privacy right. Nonetheless, the judge said “substantial damages are not a reason to decline class certification” because he could reduce them at a later stage of the litigation.

The Illinois residents who sued under the Biometric Information Privacy Act have argued the 2008 state law gives them a "property interest" in the algorithms that constitute their digital identities. The judge has agreed that gives them grounds to accuse Facebook of real harm.

Facebook, which got the case moved to San Francisco from Illinois, argued the users hadn’t suffered a concrete injury such as physical harm, loss of money or property; or a denial of their right to free speech or religion.

Courts have struggled over what qualifies as an injury to pursue a privacy case in lawsuits accusing Facebook and Google of siphoning users’ personal information from emails and monitoring their web-browsing habits. Suits over selling the data to advertisers have often failed.

In the case before Judge Donato, he has ruled that the Illinois law is clear: Facebook has collected a “wealth of data on its users, including self-reported residency and IP addresses”. Facebook has acknowledged that it can identify which users who live in Illinois have face templates, he wrote.

Judge Donato previously rejected Facebook’s argument that the case had to be dismissed because the attempt to enforce Illinois law runs afoul of its user agreement that requires disputes to be resolved under the laws of California, where it’s based.