• by Wendy Davis , Staff Writer @wendyndavis, August 6, 2015

In April, Illinois resident Carlo Licata sued Facebook for allegedly violating an Illinois law with its automatic photo-tagging feature, which recognizes users' faces and suggests their names when they appear in photos uploaded by their friends.

Facebook accomplishes this by draws on information gleaned from its vast store of users' photos. Licata alleged in his lawsuit that Facebook's compilation of that "faceprint" database runs afoul of the Illinois Biometric Information Privacy Act.

Two months later, Illinois resident Brian Norberg brought a similar lawsuit against online photo service Shutterfly. Norberg alleged that his "faceprint" was added to the company's directory -- without his consent -- after his photo was uploaded to the service by someone else.

Both companies are accused of violating a 2008 Illinois privacy law that requires companies to obtain users' permission before collecting certain biometric data.

Last week, Shutterfly asked a court to dismiss the lawsuit, arguing that the 2008 Illinois Biometric Information Privacy Act doesn't apply to data gleaned from photographs. "Helping a user re-identify his own friends within his own digital photo album does not violate any law," Shutterfly argues in a motion asking U.S. District Court Judge Charles Norgle in Illinois to throw out the case.

Facebook hasn't yet asked for the lawsuit against it to be dismissed, but is expected to make a similar argument.

No other judges have yet ruled on the argument, meaning that the lawsuits against Shutterfly and Facebook could serve as a test of how the six-year-old Illinois law will apply to online services companies.

Shutterfly points to the precise language of the Illinois law, which requires companies to obtain people's permission before collecting and retaining their fingerprints, retinal scans, and other biometric data including a "scan of hand or face geometry."

The company contends that "face geometry" must be derived from physical, in-person scans -- and not from photos. Shutterfly's argument stems from a section of the law that defines the terms "biometric identifiers" and "biometric information."

Specifically, the Illinois law excludes "photos" from the definition of "biometric identifiers." A separate definition of "biometric information" appears to go further by also excluding any information derived from photos.

The company contends that language excluding photos from the definition of biometric "identifiers" means that "face geometry" is only covered when it's based on something other than photos.

But Alvaro Bedoya, executive director of Georgetown Law School's Center on Privacy & Technology, points out a problem with that argument: Faceprints today typically are derived from photos.

"I have literally never heard of any facial recognition system that works off of anything other than a photo or a video still," says Bedoya, who studied facial recognition technology during his recent tenure as chief counsel to the Senate Judiciary Subcommittee on Privacy, Technology and the Law and its chairman, Sen. Al Franken (D.-Minn.).

Bedoya adds that there's a difference between regulating the ability to take or compile photographs and restricting the ability to create faceprints from computer-generated scans of photos.

Any attempt to stop companies from taking photographs probably would raise free speech concerns, Bedoya says. That makes sense, considering that restrictions on photography could prevent companies from compiling yearbooks, or even stop newspapers from publishing pictures -- activity that's long been protected by free speech principles.

But the Illinois law -- while avoiding the regulation of photos themselves -- restricts the ability to use photos as the raw material from which to extract faceprints, Bedoya says.

He offers the following example of the difference between raw material and a biometric identifier: A customer at a bar leaves his fingerprints on a pint glass. The Illinois law doesn't prevent the bar from keeping the pint glass, but still regulates the bar's ability to extract the customer's fingerprints from the glass.

"Photos are what humans use to identify people," Bedoya says. "Faceprints are what allow computers to analyze millions of photos in a second."