Is America’s Strongest Biometric Privacy Law About To Be Gutted?

One way to avoid difficult legislation is to change the law altogether.

At least, that might be what is about to happen in Illinois. One of the strongest state digital privacy statutes may soon be gutted. Known as the Biometric Information Privacy Act (BIPA), this Illinois state law expressly forbids companies from collecting personal identifiers from people without informed consent. A new amendment is being pushed through that could dramatically change the meaning of the law.

When it was first enacted in 2008, BIPA was meant to prevent people’s personal biological information from being collected by technology companies. This meant that if an online service was collecting your physical data, it had to explicitly let you know. Over the last year, Facebook has been fighting a class action lawsuit that alleges that its photo tagging program–-which scans digital photos, and uses facial recognition to automatically identify people–-is in direct violation of the Illinois law.

Facebook has been vigorously fighting this suit, claiming on multiple occasions that it is without merit. Earlier this month, a judge ruled against Facebook’s motion to dismiss the case, meaning it would be brought to trial.

This latest amendment might change all that. Chris Dore, a partner at the law firm Edelson PC (which represents the class action suit being brought against Facebook) explained to Fast Company that this change would essentially “carve out a huge chunk of it.” In his estimation, the change would make it possible for companies to collect digital biometric data-–like facial templates-–without any consent at all. As Dore put it, this amendment would take the teeth out of the privacy act.

It’s a little complicated. The existing law didn’t count photographs as biometric identifiers, but it was disputed whether “photographs” included digital photographs or not. Additionally, the law said that analyzing “facial geometry” needed consent. The new change specifies that both digital and physical photographs are not subject to BIPA protections. Perhaps more significantly, the amendment specifically identifies biometric scanning as something that happens in person, IRL—which means scanning a digital photograph of someone’s face online would no longer be illegal in Illinois without that person’s consent.

It seems the amendment’s backers are trying to pass it through quietly; Notice how this is all happening on the eve of a holiday weekend—the amendment was introduced today and the vote could happen as early as tomorrow. What’s more, the Illinois legislature is about to go on a break this Monday. The amendment is tacked on a law that focuses on unclaimed property, not biometric data—which means legislators might not even realize that they are voting for the BIPA amendment, too. It should be noted that the author of this change, Senator Terry Link, was one of the original lawmakers behind BIPA.

If the amendment doesn’t pass and Facebook loses the trial, the social network may have to change its facial recognition services for everyone in Illinois.

Related Video: Worried about biometric data? You should be aware of your genetic data too