Biometric privateness 2022 year-in-review | Biometric Update

By David J. Oberly, Biometric Privateness & Information Privateness Legal professional

2022 was one other banner yr for biometric privateness, with a variety of high-profile developments going down on this area, probably the most notable being the primary Illinois Biometric Data Privateness Act (“BIPA”) jury verdict in Rogers v. BNSF Ry. Co., No. 19 CV 3083 (N.D. Unwell.). As well as, class motion filings continued apace, a number of selections on key BIPA points prolonged the boundaries of legal responsibility publicity for non-compliance even additional, and a variety of eight- and nine-figure class motion settlements pushed the already-inflated worth of BIPA claims even greater.

On the similar time, state and municipal lawmakers in different elements of the nation unsuccessfully tried to put in larger controls over the gathering and use of biometric information, and are more likely to proceed these pursuits throughout the 2023 legislative session. On the federal degree, lawmakers additionally launched laws that may have ruled biometrics practices in a uniform style throughout all 50 states, whereas the Federal Commerce Fee (“FTC”) commenced its personal rulemaking actions which (amongst different issues) focuses on evaluating the necessity for extra stringent regulation over biometric applied sciences by the nation’s de facto federal privateness regulator.

Taken collectively, these main 2022 developments will make managing authorized dangers and mitigating class motion legal responsibility publicity an much more complicated, troublesome process for firms that make the most of biometrics of their operations in 2023 as in comparison with years previous.

First BIPA trial ends in resounding win for plaintiff

On October 12, 2022, the world of biometric privateness litigation skilled a growth noteworthy sufficient to place it on equal footing with Rosenbach v. Six Flags Ent. Corp., 2019 IL 123186 (Unwell. 2019)—which held precise harm is just not required to pursue BIPA claims—with a jury discovering in favor of a category of Illinois truck drivers within the first BIPA class motion to be tried to verdict in Rogers v. BNSF Ry. Co. After closing arguments, the jury wanted lower than an hour to return its verdict in favor of the category of truck drivers, which awarded $428 million in statutory damages.

The potential implications of Rogers can’t be overstated. For starters, the truth that a jury wanted underneath an hour to succeed in its verdict signifies that it was not even an in depth name within the jurors’ eyes as as to if the conduct at subject violated BIPA. As well as, the jury’s final discovering towards the defendant—even supposing the railroad didn’t itself actively acquire, use, or possess any biometric information—supplies additional help for the essential however unsettled subject of vicarious legal responsibility in BIPA class motion disputes.

Important BIPA settlements

2022 additionally noticed a variety of sizeable BIPA settlements, which is able to serve to additional enhance the already-inflated worth of BIPA claims in 2023.

In August 2022, Snap, the mum or dad firm of photo-sharing platform Snapchat, reached a $35 million settlement to resolve ongoing litigation which alleged that the corporate improperly collected biometric information in violation of BIPA by way of its Lenses characteristic (which permits customers so as to add particular results to their Snapchat photographs) and its Filters characteristic (which permits customers to overlay photographs onto a pre-existing picture framework). The case is Boone v. Snap Inc., No. 2022 LA 708 (Unwell. Cir. Ct. DuPage Cnty.).

In the identical month, an Illinois federal district court docket granted last approval for the $92 million BIPA settlement involving one other fashionable social media platform, TikTok. Along with the settlement’s financial element, the phrases agreed to by TikTok additionally encompassed broad injunctive reduction, together with commitments by TikTok to put limitations on the storage and transmission of knowledge outdoors the U.S., the deletion of sure user-generated content material, implementation of an annual privateness worker coaching program, and a three-year privateness auditing interval. The case is In re: TikTok, Inc., Client Priv. Litig., No. 20 CV 4699 (N.D. Unwell.).

A month later, Google finalized its $100 million settlement to resolve alleged BIPA violations regarding its Google Images service, which purportedly collected thousands and thousands of face templates from customers in violation of Illinois’s biometric privateness statute. The Google settlement additionally features a potential reduction element requiring the corporate to offer discover to all customers, receive customers’ affirmative consent, and develop, publish, and abide by a retention coverage requiring the deletion of all face templates related to a consumer’s account inside an inexpensive time period after sure actions are taken by the consumer, similar to deactivating the “face grouping” characteristic within the firm’s images app. The case is Rivera v. Google LLC, No. 2019 CH 990 (Unwell. Cir. Ct. Prepare dinner Cnty.).

These developments illustrate that top settlement awards have gotten the norm, and never the exception, in BIPA class actions. On the similar time, latest settlements point out that along with sizeable financial penalties, firms which are alleged to have violated BIPA might also be required to make modifications to their compliance packages as properly as a way to resolve biometric privateness class motion disputes.

Extra states introduce (unsuccessful) biometric privateness laws

Persevering with the pattern that has existed for a number of years now, lawmakers throughout the nation launched a variety of legislative proposals aiming to put larger controls over the gathering and use of biometric information. Whereas none of those payments efficiently made their means into legislation in 2022, it was not for an absence of effort on the a part of lawmakers.

In 2022, probably the most easy methodology lawmakers used of their try and enact larger regulation over the industrial use of biometrics was by way of broad biometric privateness payments that focused the usage of all types of biometric information, just like BIPA, Texas’s Seize or Use of Biometric Identifier Act (“CUBI”), and Washington’s “HB 1493” biometrics statute. Different states, nonetheless, tried to enact laws that departed considerably from the BIPA blueprint. Whereas each varieties of laws would have generated broad legal responsibility publicity just like that of the Illinois legislation, the brand new “hybrid” biometric privateness payments launched throughout the 2022 legislative cycle—which blended conventional biometric privateness authorized ideas with these usually confined to extra complete client privateness legal guidelines—would have additionally required wholesale modifications to firms’ present biometric privateness compliance packages as a result of vary of distinctive provisions in these items of laws.

Different lawmakers took a extra centered strategy to their laws. As an alternative of in search of to control all varieties of biometric information, these payments singled out particular varieties of biometric applied sciences—and facial recognition particularly. The focused facial biometrics payments launched in 2022 had been a continuation of the pattern that started in late 2020, when Portland, Oregon turned the primary jurisdiction within the nation to enact a blanket ban over the usage of facial recognition by the personal sector.

Finally, whereas not one of the payments launched this yr made their means into legislation in 2022, the excessive quantity of legislative proposals sign lawmakers’ intention to proceed their efforts to deliver these payments to fruition in 2023.

Federal privateness invoice regulating biometric information launched

On the federal degree, lawmakers on Capitol Hill launched the American Data Privacy and Protection Act (“ADPPA”), which might have regulated biometric information in a uniform style throughout all 50 states. Of notice, the ADPPA would have narrowly restricted the gathering and use of biometric information to solely these situations the place such actions had been strictly obligatory to offer a selected services or products requested by the topic of the biometric information, or underneath one in all ten narrowly-tailored “permitted purposes” set forth within the statute, similar to complying with a authorized obligation. The federal privateness invoice would have additionally restricted firms from disclosing, releasing, sharing, disseminating, or in any other case making biometric information out there to 3rd events except the switch was essential to facilitate information safety or verifying/authenticating people’ identities.

Importantly, whereas the ADPPA would have typically preempted any state legal guidelines which are “covered by the provisions” of the statute or its rules, the invoice didn’t preempt all state privateness legal guidelines, offering carve outs for BIPA and different legal guidelines that solely addressed facial recognition or associated applied sciences. Collectively, the ADPPA would have added vital complexity to the authorized panorama had it made its means into legislation, offering regulation over biometric information in these jurisdictions the place none presently exists, whereas on the similar time preserving in place immediately’s present biometrics-related legal guidelines and rules, every with their very own distinctive nuances.

FTC goals for larger regulation over biometric applied sciences

In August 2022, the FTC commenced its efforts to implement new company guidelines centered on privateness and information safety with the issuance of its Industrial Surveillance and Information Safety Superior Discover of Proposed Rulemaking (“ANPR”), in search of public touch upon whether or not new commerce regulation guidelines are wanted to guard folks’s privateness and data. The ANPR is broad and far-reaching, in search of touch upon 95 questions regarding harms stemming from industrial surveillance and lax information safety practices.

From a common perspective, the ANPR supplies key insights on the precise practices and related harms considered by the FTC as most regarding and doubtlessly in want of larger enforcement. As famous within the ANPR, the FTC seeks to create a “public record about prevalent commercial surveillance practices” which are misleading or unfair, which is able to “help to sharpen” the Fee’s enforcement exercise—even within the occasion the ANPR doesn’t consequence within the promulgation of latest commerce regulation guidelines. As well as, the ANPR additionally affords a helpful information on the Fee’s latest privateness and safety enforcement actions, whereas additionally offering a synopsis of notable latest FTC enforcement actions and the Fee’s coverage work within the space of facial recognition.

Importantly, the ANPR focuses instantly on whether or not the Fee ought to contemplate limiting industrial surveillance practices that contain the usage of facial recognition, fingerprinting, and different biometric applied sciences—and in that case, how that ought to be carried out. Furthermore— past the ANPR—the FTC has additionally not too long ago reiterated its intent on a number of events to extend its efforts in policing the misuse of improper facial recognition practices by way of investigations and, when obligatory, enforcement actions.

Conclusion

As has been the case in years previous, 2022 concerned many noteworthy developments within the space of biometric privateness that haven’t solely elevated the complexity of complying with the legislation when utilizing biometrics, however which have additionally expanded the scope of legal responsibility publicity for non-compliance with the ever-increasing patchwork of biometric privateness legal guidelines as properly.

As we head into 2023, firms will be sure that the approaching yr will characteristic larger litigation dangers, in addition to the potential for the enactment of latest biometric privateness statutes and ordinances—which collectively will make the duty of staying compliant with the legislation whereas utilizing biometrics much more difficult.

Collectively, along with sustaining compliance with immediately’s present physique of biometric privateness regulation, firms also needs to guarantee they’ve in place versatile biometric privateness compliance packages that may be simply modified and expanded to quickly adapt to the various new adjustments within the space of biometric privateness which are certain to be seen all through 2023.

In regards to the writer

David J. Oberly is an legal professional within the Cincinnati workplace of Squire Patton Boggs LLP and a member of the agency’s international Information Privateness, Cybersecurity & Digital Belongings follow. David’s follow focuses on counseling and advising shoppers on a variety of biometric privateness, synthetic intelligence, and information privateness/safety compliance and threat administration issues. He will be reached at david.oberly@squirepb.com.

DISCLAIMER: Biometric Update’s Trade Insights are submitted content material. The views expressed on this publish are that of the writer, and don’t essentially replicate the views of Biometric Update.

Article Subjects

biometric identifiers  |  biometrics  |  data privacy  |  data protection  |  lawsuits  |  legislation  |  regulation