Legal Cases and Privacy Rulings Aim to Curtail Facial Biometrics

Decisions in the UK and Australia, and lawsuits in the United States, could force facial-recognition providers to remove data from their machine-learning models.

New York-based Clearview AI is paying the price for launching a facial-recognition service based on publicly posted pictures, as the company has become a focus of numerous privacy investigations and lawsuits alleging that the firm violated individuals rights by collecting online pictures and making them searchable.
On Monday, the top privacy official of the United Kingdom levied a potential fine of more than £17 million, or about US $26.6 million, for the companys collection of facial data from images posted online without gaining the consent of the subjects. The ruling, stemming from a joint investigation with the Office of the Australian Information Commissioner (OAIC), also ordered the company to stop processing the data of UK citizens. A separate ruling is expected from the Australian government.
The decision comes three months after an Illinois court
ruled
that a lawsuit against Clearview AI for allegedly violating the states Biometric Information Privacy Act (BIPA) could continue and dismissed a variety of legal defenses argued by the company.
The Court favors [allowing the application of BIPA], fully recognizing that this may have an effect on Clearviews business model, Judge Pamela McLean Meyerson wrote in her ruling. Inevitably, Clearview may experience reduced effectiveness in its service as it attempts to address BIPAs requirements. That is a function of having forged ahead and blindly created billions of faceprints without regard to the legality of that process in all states.
Policy Catches Up With Technology
The privacy cases highlight the problems that occur when policy finally catches up to technology. BIPA, passed in Illinois, following the
meltdown of fingerprint biometric service Pay By Touch in 2008
, requires that a private entity inform citizens when it intends to use a biometric information or identifiers, set specific terms and uses for the information, and obtain permission from the subject. The American Civil Liberties Union (ACLU) sued Clearview AI in May 2020 on behalf of Illinois residents who are required to be notified of any biometric data collection.
[T]he involuntary capture of biometric identifiers — which cannot be changed — can pose greater risks to an individual’s security, privacy, and safety than the capture of other identifiers, such as names and addresses,
the ACLU stated
. And capturing an individual’s faceprint — akin to generating their DNA profile from genetic material unavoidably shed on a water bottle, but unlike the publication or forwarding of a photo — is conduct, not speech, and so is appropriately regulated under the law.
The travails of Clearview AI underscore the problems that innovative technology firms face when forging ahead with new technology. While the US does not have a federal biometric privacy law, five states have already passed such legislation, although only two have any teeth, such as the ability to bring private legal actions, says Christopher Ward, a partner with the law firm Foley & Lardner LLP, who represents businesses and employers defending against biometrics-related lawsuits. In addition to Illinois, California allows private lawsuits, or will starting in 2022.
The Illinois law is where all the action is — in the short term, the primary focus of the legal arena is going to be a money grab until the gravy train runs out, Ward says, adding that business law will always trail behind technology. The law moves a lot more slowly than technology does, and we are still working on a lot of wage and hourly employment issues dating back to the New Deal.
A Trio of Lawsuits
Currently,
at least three lawsuits
have targeted Clearview AI in Illinois courts, while Facebook settled a lawsuit in Illinois for identifying people as part of its tag suggestions feature. Some 21 other states are considering — or have considered — legislation regarding the collection of biometric information and the use of biometric identifiers, Ward and an associate
wrote in a legal analysis
.
Despite the initial ruling in the Illinois court, the company
gained another $30 million
in a Series B round of investments and is now valued at $130 million.
The company has pushed the bounds between using the online world to have an impact on the real world, where pictures posted on social media can suddenly lead to
identification of participants in the Jan. 6 Capitol riot
. The UK Information Commissioner argued that people need to be aware of and consent to how their information is being used.
UK data protection legislation does not stop the effective use of technology to fight crime, but to enjoy public trust and confidence in their products technology providers must ensure peoples legal protections are respected and complied with, UK Information Commissioner Elizabeth Denham
said in a statement
. [T]he evidence weve gathered and analyzed suggests Clearview AI Inc. were and may be continuing to process significant volumes of UK people’s information without their knowledge.
The UK ruling, part of the Preliminary Enforcement Notice, allows Clearview AI to respond and refute the allegations. The company has already stopped doing business in the country.
The UK ICO Commissioners assertions are factually and legally incorrect, Clearview AI’s UK attorney Kelly Hagedorn, said in a statement sent to Dark Reading. The company is considering an appeal and further action. Clearview AI provides publicly available information from the internet to law enforcement agencies.
The impact on facial recognition databases is currently not clear. Nearly half of 42 federal agencies that employ law enforcement officers currently use facial recognition technology, according to
a June 2021 report by the General Accounting Office
. Both the Illinois court ruling and the UK privacy commissioners preliminary ruling raise the possibility that facial recognition will require the permission of subjects before using their images and faces as training data for the machine-learning models that power the technology.
San Francisco; Portland, Oregon; and Portland, Maine, have banned the use of facial recognition in their cities.
Companies need to be aware of their risk before using facial recognition, attorney Ward says. So far, the compliance piece of using this technology is not all that difficult for businesses, he says. You just need the proper notices and consent. It is really just an issue of having the knowledge of what you need to do, or having good advisers as part of your team.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Legal Cases and Privacy Rulings Aim to Curtail Facial Biometrics