biometric information privacy act

photobucket-opted-inactive-users-into-privacy-nightmare,-lawsuit-says

Photobucket opted inactive users into privacy nightmare, lawsuit says

biometric data, biometric information privacy act, generative ai, Illinois, myspace, photobucket, Policy / /

Photobucket was sued Wednesday after a recent privacy policy update revealed plans to sell users’ photos—including biometric identifiers like face and iris scans—to companies training generative AI models.

The proposed class action seeks to stop Photobucket from selling users’ data without first obtaining written consent, alleging that Photobucket either intentionally or negligently failed to comply with strict privacy laws in states like Illinois, New York, and California by claiming it can’t reliably determine users’ geolocation.

Two separate classes could be protected by the litigation. The first includes anyone who ever uploaded a photo between 2003—when Photobucket was founded—and May 1, 2024. Another potentially even larger class includes any non-users depicted in photographs uploaded to Photobucket, whose biometric data has also allegedly been sold without consent.

Photobucket risks huge fines if a jury agrees with Photobucket users that the photo-storing site unjustly enriched itself by breaching its user contracts and illegally seizing biometric data without consent. As many as 100 million users could be awarded untold punitive damages, as well as up to $5,000 per “willful or reckless violation” of various statutes.

If a substantial portion of Photobucket’s entire 13 billion-plus photo collection is found infringing, the fines could add up quickly. In October, Photobucket estimated that “about half of its 13 billion images are public and eligible for AI licensing,” Business Insider reported.

Users suing include a mother of a minor whose biometric data was collected and a professional photographer in Illinois who should have been protected by one of the country’s strongest biometric privacy laws.

So far, Photobucket has confirmed that at least one “alarmed” Illinois user’s data may have already been sold to train AI. The lawsuit alleged that most users eligible to join the class action likely similarly only learned of the “conduct long after the date that Photobucket began selling, licensing, and/or otherwise disclosing Class Members’ biometric data to third parties.”

Photobucket opted inactive users into privacy nightmare, lawsuit says Read More »

illinois-changes-biometric-privacy-law-to-help-corporations-avoid-big-payouts

Illinois changes biometric privacy law to help corporations avoid big payouts

biometric information privacy act, biometric privacy, illinois biometric privacy law, Policy / /

Biometric Information Privacy Act —

Possible damages payments dramatically lowered by change to 2008 Illinois law.

–

Illustration of a woman's face being scanned for a facial recognition system.

Getty Images | imaginima

Illinois has changed its Biometric Information Privacy Act (BIPA) to dramatically limit the financial penalties faced by companies that illegally obtain or sell biometric identifiers such as eye scans, face scans, fingerprints, and voiceprints.

The 2008 law required companies to obtain written consent for the collection or use of biometric data and allowed victims to sue for damages of $1,000 for each negligent violation and $5,000 for each intentional or reckless violation. But an amendment enacted on Friday states that multiple violations related to a single person’s biometric data will be counted as only one violation.

The amendment, approved by the Illinois Legislature in May and signed by Gov. J.B. Pritzker on August 2, provides “that a private entity that more than once collects or discloses a person’s biometric identifier or biometric information from the same person in violation of the Act has committed a single violation for which the aggrieved person is entitled to, at most, one recovery.”

As Reuters reports, the “changes to the law effectively overturn a 2023 Illinois Supreme Court ruling that said companies could be held liable for each time they misused a person’s private information and not only the first time.” That ruling came in a proposed class action brought against the White Castle restaurant chain by an employee.

Change lowers potential for big settlements

The change to the privacy law “will significantly reduce the potential damages and lower the settlement value of BIPA claims. The amendment also provides that an e-signature satisfies the written requirements for the release,” Squire Patton Boggs lawyer Alan Friel wrote in National Law Review yesterday.

In 2020, Facebook agreed to a $650 million settlement after being sued by users who alleged violations of the Illinois law. Settlement class members received over $400 each.

The Illinois law is unique in letting individuals sue for damages, Friel wrote. “Colorado recently enacted a BIPA-like biometrics law, but like other states except only Illinois, it does not have a privacy right of action and can only be enforced by the state,” he wrote. “However, states are active in enforcing their privacy laws as illustrated by a recent Texas settlement with a social media company for biometric consent claims that included a 9-figure civil penalty payment.”

Friel was referring to Facebook-owner Meta agreeing to a $1.4 billion settlement with Texas Attorney General Ken Paxton. The Texas AG alleged that Meta “unlawfully captur[ed] the biometric data of millions of Texans without obtaining their informed consent as required by Texas law.” The claim was over Facebook using facial recognition for a feature that makes it easier to tag people in photographs.

The Information Technology and Innovation Foundation, a research group funded by various corporations, said the change to BIPA “makes a bad law slightly better.”

“BIPA is a prime example of privacy legislation gone too far,” ITIF Senior Policy Manager Ash Johnson said. “With steep fines for even minor violations and a private right of action that has gone out of control, with multiple multi-million-dollar settlements. This has led companies to limit the technology available to Illinois consumers or even pull out of the state entirely.”

Illinois changes biometric privacy law to help corporations avoid big payouts Read More »