[Infowarrior] - Someone's trying to gut America's strongest biometric privacy law

[Richard Forno]

Someone's trying to gut America's strongest biometric privacy law

Russell Brandom

http://www.theverge.com/2016/5/27/11794512/facial-recognition-law-illinois-facebook-google-snapchat

For years, the Illinois Biometric Information Privacy Act has been a headache for any tech company working with facial recognition. It's a simple law, requiring a person's explicit consent before a company can make a biometric scan of their body. In the eight years since the law was first passed, those scans have become a central part of products like Google Photos, Snapchat filters, and Facebook's photo-tagging system. All three companies are currently facing lawsuits for allegedly violating the Illinois law, producing biometric face prints without notifying Illinois citizens.

Now, Illinois' law is facing sudden and quiet changes that would dramatically reduce its power.

Yesterday, Illinois State Senator Terry Link quietly proposed a revision to the biometrics act, attached to a long-delayed bill concerning unclaimed property procedures. Under Link's revisions, the bill would be limited to "data resulting from an in-person process whereby a part of the body is traversed by a detector or an electronic beam." That conveniently rules out scans from preexisting photography, and — if the revisions become law — would end all three lawsuits in a single stroke.

"We believe that Facebook is a lobbyist that is a part of this."

The property bill has been working its way through the legislature since February, and it's unclear why the biometric amendment was added now — but the timing has led many observers to be suspicious. Today is the last full session before the legislature goes into recess for Memorial Day, and many legislators may already be understaffed as a result. It's the ideal time to rush through legislation.

Many of the plaintiffs suspect Google or Facebook to be behind the last-minute proposal to change the law. "We believe that Facebook is a lobbyist that is a part of this," said Chris Dore, an Edelson partner who is working on the lawsuit against Facebook's photo-tagging system. "The changes that have been proposed certainly mirror the arguments that have been made in our case." Facebook's most recent motion to dismiss confirms this impression, devoting an entire section to the argument that the Illinois law does not apply to information derived from photographs.

In a statement to The Verge, Facebook applauded the amendment, pointing out that State Senator Link originally introduced the Biometric Information Privacy Act in 2008. "We appreciate Sen. Link’s effort to clarify the scope of the law he authored," a Facebook representative said. Google did not respond to a request for comment.

The proposed separation between photographs and biometric scans is increasingly out of sync with modern technology. Fingerprints and iris prints can both be extracted from sufficiently high-resolution photographs. In recent years, that technology has led to a rise in contactless fingerprint scanners, some of which read prints through the embedded camera in a mobile phone. It's unclear if those systems would count as a "detector or an electronic beam" under the proposed language.

The bill still has a number of hurdles to clear within the legislature, and it may well fall short of becoming law. Still, the last-minute proposal has raised real concerns about companies' level of influence in state-level legislatures. "Companies have come in and said, we don’t actually want to have to follow this law, so we’re going to change it," says Dore.

9:41AM ET: Updated with Facebook comment.
For years, the Illinois Biometric Information Privacy Act has been a headache for any tech company working with facial recognition. It's a simple law, requiring a person's explicit consent before a company can make a biometric scan of their body. In the eight years since the law was first passed, those scans have become a central part of products like Google Photos, Snapchat filters, and Facebook's photo-tagging system. All three companies are currently facing lawsuits for allegedly violating the Illinois law, producing biometric face prints without notifying Illinois citizens.

Now, Illinois' law is facing sudden and quiet changes that would dramatically reduce its power.

Yesterday, Illinois State Senator Terry Link quietly proposed a revision to the biometrics act, attached to a long-delayed bill concerning unclaimed property procedures. Under Link's revisions, the bill would be limited to "data resulting from an in-person process whereby a part of the body is traversed by a detector or an electronic beam." That conveniently rules out scans from preexisting photography, and — if the revisions become law — would end all three lawsuits in a single stroke.

"We believe that Facebook is a lobbyist that is a part of this."

The property bill has been working its way through the legislature since February, and it's unclear why the biometric amendment was added now — but the timing has led many observers to be suspicious. Today is the last full session before the legislature goes into recess for Memorial Day, and many legislators may already be understaffed as a result. It's the ideal time to rush through legislation.

Many of the plaintiffs suspect Google or Facebook to be behind the last-minute proposal to change the law. "We believe that Facebook is a lobbyist that is a part of this," said Chris Dore, an Edelson partner who is working on the lawsuit against Facebook's photo-tagging system. "The changes that have been proposed certainly mirror the arguments that have been made in our case." Facebook's most recent motion to dismiss confirms this impression, devoting an entire section to the argument that the Illinois law does not apply to information derived from photographs.

In a statement to The Verge, Facebook applauded the amendment, pointing out that State Senator Link originally introduced the Biometric Information Privacy Act in 2008. "We appreciate Sen. Link’s effort to clarify the scope of the law he authored," a Facebook representative said. Google did not respond to a request for comment.

The proposed separation between photographs and biometric scans is increasingly out of sync with modern technology. Fingerprints and iris prints can both be extracted from sufficiently high-resolution photographs. In recent years, that technology has led to a rise in contactless fingerprint scanners, some of which read prints through the embedded camera in a mobile phone. It's unclear if those systems would count as a "detector or an electronic beam" under the proposed language.

The bill still has a number of hurdles to clear within the legislature, and it may well fall short of becoming law. Still, the last-minute proposal has raised real concerns about companies' level of influence in state-level legislatures. "Companies have come in and said, we don’t actually want to have to follow this law, so we’re going to change it," says Dore.

9:41AM ET: Updated with Facebook comment.
--
It's better to burn out than fade away.