So happy this is happening to the “We’re making changes to help you tag photos even though you didn’t ask” folks.
Apparently, the “social network” violated Illinois privacy laws:
- Not providing written notification that his biometric data was being collected or stored.
- It is also unlawful to collect biometric data in the state without clearly stating the purpose for which that data is being collected, along with notification of how long it would be stored for.
For those who wish to review the statute: http://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57 . It might exist in that or different form in your location.
At the heart of the suit is Facebook's "tag suggestions" program which scans images uploaded by users - with facial recognition technology developed by Face.com, a company later acquired by Facebook - and then identifies any friends who may also be using the service so that they may tag them if they so wish. Facebook does of course allow users to change their privacy settings, via an opt-out, to prevent other users from tagging them in photos, but that doesn’t prevent Facebook from taking and storing the data and preventing any deletion…which means it’s vulnerable to hacking.
It should be noted that Facebook abandoned the program in Europe in 2012, for just those very concerns. Here (in the USA), it was suspended temporarily but after “improvements” was put back into effect. Facebook’s defense is that Facebook's 'faceprint' database only works with its own proprietary software and "alone, the templates are useless bits of data," adding that users can choose to opt out of the feature, at which time their data will be deleted.
The Federal Trade Commission (FTC) said in 2011 that it was concerned about a "third party maliciously breaching a database of biometric information". The FTC noted how, because a person could not change their face, "once exposed, a victim has no recourse to prevent becoming victim to misconduct like identity theft and unauthorized tracking."
I’ll be keeping you updated as things progress. Undoubtedly the EFF will have an amicus brief to file in the matter. The principle litigant is seeking class action status.
Source:
https://nakedsecurity.sophos.com/2015/04/07/facebook-hit-with-class-action-lawsuit-over-facial-recognition-data/