FRANCISCO – Alphabet Inc. is pushing
efforts to roll back the most comprehensive biometric privacy law in
the U.S., even as the company and its peers face heightened scrutiny
after the unauthorized sharing of data at Facebook Inc.
Mark Zuckerberg and Sheryl Sandberg were publicly apologizing this
month for failing to protect users’ information, Google’s lobbyists
were drafting measures to de-fang an Illinois law recognized as the
most rigorous consumer privacy statute in the country. Their ambition:
to strip language from a decade-old policy that regulates the use of
fingerprints, iris scans and facial recognition technology, and insert
a loophole for companies embracing the use of biometrics.
is trying to exempt photos from the Illinois law at a time when it’s
fighting a lawsuit in the state that threatens billions of dollars in
potential damages. The world’s largest search engine is facing claims
that it violated the privacy of millions of users by gathering and
storing biometric data without their consent.
has faced a global backlash for failing to secure users’ information,
triggered by revelations that a British firm with ties to President
Donald Trump’s 2016 campaign harvested information from as many as 87
million Facebook users without their knowledge. That breach has put
the tech behemoth and its Silicon Valley cohort at the center of a
fierce data privacy debate.
is trying to show it’s taking consumer privacy more seriously, but
there’s an inexorable dilemma: The business models and future growth
of both Google and the world’s largest social network are tied up with
the very data they’re now being asked to lock up — information most
users have volunteered in exchange for these companies’ free products
state senator Bill Cunningham proposed an amendment to the Biometric
Information Privacy Act in February then aimed at saving a local
nursing home from overly burdensome litigation. Google and lobbyists
from the Illinois Chamber of Commerce — of which Facebook is a member
— intervened, and on April 4 they offered a new version with
Cunningham to embed further caveats in the legislation, including
language to exclude photos from regulatory scrutiny.
— which attempted to scale back the law in 2016 — said it didn’t play
a role in the drafting or lobbying of the recent proposal. Still,
critics contend the company would be an obvious beneficiary of a
watered-down BIPA, along with Google, which declined to comment on its
role in revising the bill.
ball is in tech companies’ court now,” said Pam Dixon, executive
director of the World Privacy Forum. “Working to overturn a privacy
law is certainly not the best approach.”
amended bill in Illinois has twice been called to committee in the
state senate, and twice pulled from the agenda over “misconceptions
with what the bill aims to achieve,” said Cunningham. He confirmed
he’ll continue to meet with Google’s lobbyist, the Illinois Chamber
and privacy advocates in search of a compromise. Central to his effort
and Google’s is ending the mountain of litigation triggered by BIPA
that’s spawned more than 140 lawsuits since 2014.
like to see a fix to the law, which is as old as the iPhone 3G,” said
Tyler Diers, director of legislative relations at the Illinois Chamber
of Commerce. “The technology this law was regulating has evolved.”
of the claims have been filed on behalf of employees in Illinois whose
employers have incorporated biometric technology without written
consent. The lawsuits threaten the viability of those local
businesses, Cunningham said.
my goal to find a middle ground where we protect the privacy of
citizens and their biometric material, but do it in a way that allows
people in Illinois to access technologies and applications that
everyone else in the country is accessing,” he said. Services such as
Google’s Arts & Culture app — which will locate museum portraits
that resemble you based on a selfie, among other things — weren’t
released in Illinois because of BIPA.
can allow for certain technological advances without relieving the
burden on businesses to protect that data,” Cunningham said. “If a
business is negligent in protecting biometric material, they should be
the bill passes, Cunningham, a Democrat, is confident both houses of
the state assembly will push the law to the governor’s desk.
is the only U.S. state or federal law that affords people the right to
sue companies for using their biometric data without consent. The
proposed amendment would undoubtedly trim the number of lawsuits that
employers face in state courts, such as the nursing home in
Cunningham’s district sued for replacing punch-out cards with
fingerprint scanners for its hourly employees without their written
the law could also affect a pair of federal lawsuits against Google
and Facebook, which are two of the world’s largest users of
biometrics. Facebook is headed toward trial in July in a case brought
on behalf of more than 6 million users in Illinois that seeks as much
as $5,000 per BIPA violation.
years Facebook has encouraged users to tag people in photographs they
upload in their personal posts, and the company stores the
information. Alphabet’s cloud-based Google Photos service uses similar
technology, prompting a separate lawsuit with a comparable class.
Facebook lobbied for a similar legislative amendment in 2016 after
failing to persuade a federal judge to dismiss the lawsuit over its
about two years ago, Google had maintained a reputation as a tech
giant even some privacy advocates could support. When Google altered
its offerings so advertisers could mix users’ browsing behavior with
their search history in ad targeting, the company insisted on
providing an opt-out option. Those privacy advocates are worried the
BIPA proposal may signal a shift in ideology over user consent.
regard to the privacy suit it faces in Illinois, filed in 2016, Google
has said photos don’t belong under BIPA and that including them would
render the law unconstitutional. By pushing to strip photos from the
Illinois statute, Google is distancing itself from being known as an
organization that prioritizes user consent in order to avoid further
litigation, said Alvaro Bedoya, Executive Director for the Center on
Privacy & Technology at the Georgetown University Law Center.
Google has gone out of its way to give people a choice about whether
they want to be in a face recognition system,” Bedoya said. “Their
support for this amendment would mark a complete reversal in the
company’s approach to this powerful and invasive technology. It would
be deeply disappointing.”