IBM Collection and Sharing of Facial Geometry BIPA Class Action

Biometric identifiers are being used increasingly to identify people. Fingerprints and hand scans are now common. This class action involves facial geometry. The complaint alleges that International Business Machines Company (IBM) violated the Illinois Biometric Information Privacy Act (BIPA) when it scanned the facial geometry of about a million faces from photographs and built a database that it shared with third parties.

The class for this action is all Illinois residents depicted in photos on the Flickr photo-sharing service whose images and biometric identifiers or information were taken, stored, disclosed or disseminated by IBM.

The gathering of biometric information is a concern these days when identity theft is so common. If credit card information or passwords are stolen, it’s possible to cancel the credit card and obtain a new one or change the password. However, if an individual’s fingerprints are stolen, the person can’t do very much to rectify the situation.

Where did IBM get the images of the faces it scanned? The complaint claims it got them from Flickr, a photo-sharing site, and it did it “without advising any of the affected individuals” that this was being done. 

Even worse, the complaint alleges that IBM also “shar[ed] this immutable, identifying information about each individual with third-party researchers, once again without consent. As a direct result of IBM’s actions, these individualized facial measurements could be tied back to the Flickr accounts that originally posted the originating photos.” This could end up subjecting the individuals to surveillance, stalking, identity theft, other invasions of privacy, or fraud, the complaint says.

The complaint claims IBM used the information it gathered “to improve its own facial recognition products and to cement its market-leading position in artificial intelligence.” Among its products are IBM Watson Visual Recognition, “which clients can use to estimate the age and gender of people depicted in images and, in some instances, identify specific individuals.”

According to the complaint, “As businesses worldwide compete to develop ever more advanced facial recognition technology, the race for data collection imperils the privacy of individuals everywhere.” Illinois has made a start at regulating the taking, storage, and use of biometrics through BIPA.

BIPA requires certain things of private individuals who wish to take, keep, or use biometric information:

  • They may not take an individual’s identifiers and information unless they provide written notice and obtain a written release.
  • They may not sell, lease, trade, or otherwise profit from the identifiers and information.
  • They may not disclose or disseminate the identifiers or information except as allowed by the law.
  • They must develop a written policy, available to the public, with a retention schedule and guidelines for permanently destroying the identifiers and information after a time.

The complaint alleges that IBM took and used identifiers and information from residents of Illinois without following these requirements, thereby violating the law.

Article Type: Lawsuit
Topic: Privacy

Most Recent Case Event

IBM Collection and Sharing of Facial Geometry BIPA Complaint

January 24, 2020

Biometric identifiers are being used increasingly to identify people. Fingerprints and hand scans are now common. This class action involves facial geometry. The complaint alleges that International Business Machines Company (IBM) violated the Illinois Biometric Information Privacy Act (BIPA) when it scanned the facial geometry of about a million faces from photographs and built a database that it shared with third parties.

ibm_biometric_facial_measurements_bipa_compl.pdf

Case Event History

IBM Collection and Sharing of Facial Geometry BIPA Complaint

January 24, 2020

Biometric identifiers are being used increasingly to identify people. Fingerprints and hand scans are now common. This class action involves facial geometry. The complaint alleges that International Business Machines Company (IBM) violated the Illinois Biometric Information Privacy Act (BIPA) when it scanned the facial geometry of about a million faces from photographs and built a database that it shared with third parties.

ibm_biometric_facial_measurements_bipa_compl.pdf
Tags: Biometric Data, Sharing Personal Information with Third Parties, Taking/Storing/Using Biometric Data, Using Your Private Information Without Consent, Your Privacy