On August 5, 2020, an Illinois woman filed a proposed class action lawsuit against Macy’s for its alleged use of facial-recognition software, Clearview AI, to identify shoppers in Chicago stores. Filed in the Northern District Count of Illinois, the complaint claims that Macy’s is in violation of the Biometric Information Privacy Act (BIPA), an Illinois law limiting the use of biometric data in the state. The protected biometric data includes facial images used for facial recognition purposes.
Illinois’s Biometric Information Privacy Act
The Biometric Information Privacy Act (BIPA) is one of the broadest examples of state legislation intended to regulate the use of biometric information. The primary provisions of the BIPA include:
- Requiring companies seek informed consent prior to collecting biometric data
- Limiting companies’ right to disclose biometric information
- Mandating the creation of confidentiality and retention guidelines
- Prohibiting companies from profiting from the biometric data they collect
- Creating a private right of action for individuals affected by BIPA violations
- Enacting statutory damages of up to $1,000 per negligent violation and up to $5,000 per intentional or reckless violation.
In addition to being one of the few states regulating business’s use of biometric data, Illinois is unique in allowing individuals to bring a private right of action against companies that violate state biometric data laws. In fact, Illinois plaintiffs do not even have to show actual damages in order to bring a claim under BIPA. In January 2019, the Illinois Supreme Court ruled in Rosenbach v. Six Flags Entertainment Corp. that private individuals could file BIPA claims even if they’re only able to demonstrate that their privacy rights, as protected by the statute, had been violated.
Biometric Violation Allegations Against Macy’s
In the suit against Macy’s, the chief complaint is focused on the department store’s use of facial recognition software created by tech startup, Clearview AI. Originally envisioned as a law enforcement tool, Clearview’s software matches captured facial images to a massive database of images scraped from internet sources like YouTube and Facebook.
The lawsuit claims that Macy’s used Clearview’s software to identify and track customers in its stores. Specifically, the complaint alleges that Macy’s collected images of shoppers from its in-store surveillance systems and sent those images to Clearview. Clearview then provided Macy’s with any information on shoppers matching facial images in its database. This, the complaint states is “biometric data Clearview has harvested and used to identify individuals,” and in clear violation of BIPA.
The claimed BIPA violations include alleged failures to get informed consent from customers, failure to set up an information retention policy, and profiting off information gathered about customers via Clearview “through improved security and/or through marketing.” The lawsuit also alleges that Macy’s actions were intentional, and as such, that the higher statutory damages rate of $5,000 per occurrence should apply.
The Role of Expert Witnesses Biometrics Litigation
Although enacted in 2008, BIPA didn’t appear in many lawsuits until 2015 when several class action lawsuits were brought against online companies, including Facebook and Shutterfly. Between 2015 and 2020, dozens of class actions—involving both consumers and employees—were filed in Illinois courts. In each of these cases, the question inevitably arose on whether the data at issue was indeed biometric. While some types of data, like DNA samples, are generally accepted to be biometric in nature, data like pictures of people’s faces can be a gray area.
In cases like the Macy’s class action, expert witnesses who can speak to the technical aspects of facial recognition software will play an important role in clarifying the facts of the case. Experts with an understanding of Clearview AI’s particular methods of matching submitted images to those in its database may prove particularly helpful as each side attempts to build its argument.
Additionally, since the claim against Macy’s also includes allegations that Macy’s is profiting from its use of facial recognition software, business experts who can draw a connection between this technology and potential business profits may also prove valuable for proving BIPA violations. For example, plaintiffs may seek an expert who can describe how facial recognition software can aid marketing efforts. Both sides may seek such an expert to examine the question of how efforts to use facial recognition for marketing purposes, if any, truly affect a business’s bottom line.
Cases alleging violations of biometric privacy rights are likely to continue appearing as biometric technologies become even more integrated into our daily lives. As these disputes arise, so will a need for expert witnesses who understand both biometrics and business intricacies.
