Google tries to get class action over biometric data tossed

Google is seeking to dismiss a proposed class action alleging violations of Illinois' signature privacy law that might test the scope of liability for major technology companies analyzing facial recognition data.

Pointing to none of the conduct having occurred in Illinois, the Alphabet-owned company argued it is improperly being sued under the Biometric Information Privacy Act.

"This clearly extends BIPA too far," defense attorney Bobbie Wilson wrote.

Google, Amazon and Microsoft were hit with class actions in July claiming they are illegally using personal biometric data on Illinois residents without their consent to improve their facial recognition technology. They obtained the information from IBM, which said it created the "Diversity in Faces" data set in question in the cases to improve the ability of artificial intelligence systems to better identify women and individuals with darker skin tones.

The companies have maintained the Biometric Information Privacy Act cannot be interpreted to require entities that played no role in the collection of the data to obtain consent before receiving it. Microsoft declined to comment, while Google and Amazon did not immediately return requests for comment.

The Illinois-specific state law obligates private companies that collect residents' biometric information, such as fingerprints, DNA and face geometry, to receive permission from consumers to do so and detail how they store and protect the data. It carries damages of $1,000 for negligent violations and up to $5,000 for intentional or reckless violations.

In the motion to dismiss filed in federal court in San Francisco on Wednesday, Google detailed the chain of custody of the disputed data that it claimed places the company outside of liability under the Illinois law. Vance v. Google LLC, 20-cv-04696 (N.D. Cal., filed July 14, 2020); Vance v. IBM, No. 20-cv-00577 (N.D. Cal., filed July 14, 2020).

Plaintiffs Steven Vance and Time Janecyk have uploaded thousands of photos to Flickr since 2008, according to their lawsuit. Through parent company Yahoo, Flickr compiled in 2014 a data set of roughly 100 million user pictures that it made publicly available, claiming it was to help improve the accuracy and reliability of facial recognition technology.

IBM used Flickr's data set to create the Diversity in Faces data set that it shared with defendants. Plaintiffs claimed IBM offered the data to other companies that develop and use facial recognition technology, and that it "included the biometric identifiers and information extracted from each photograph" as well as "links to each photograph on Flickr."

Google countered that it could not have violated the Biometric Information Privacy Act since it only applies to conduct occurring substantially in Illinois. It cited plaintiffs declining to allege against the company that the data set was created, shared or used in the state.

"Plaintiffs' only bases for invoking BIPA are that Plaintiffs reside in Illinois and uploaded photos to Flickr (not to Google) from devices in Illinois," Coie wrote.

The Illinois Legislature, the Perkins Coie LLP partner argued, could not have intended for a company headquartered in California to be liable for receiving a data set hosted by a company with no alleged Illinois connection simply because the information is associated with state residents.

"Google's alleged conduct is not the conduct that BIPA was enacted to regulate, and Plaintiffs should not be permitted to manufacture a BIPA claim against Google where none exists."

Google is also seeking a stay of the litigation pending the outcome of plaintiffs' lawsuit against IBM. The company has advanced many of the same arguments as the other tech giants.

Facial recognition technology has faced criticism from privacy advocates, especially in the wake of Black Lives Matter protests over law enforcement using such software to track down and arrest individuals for alleged criminal activity.

Miami police used Clearview AI, the startup behind a controversial facial recognition program used by hundreds of police departments in the country, to arrest a woman for allegedly throwing a rock at a police officer during the protests. Google, in addition to Twitter, sent a cease-and-desist letter to the company demanding it to stop scraping YouTube videos for its database and delete any photos it has collected.