Just two weeks ago, Facebook filed a lawsuit for violating privacy laws in Illinois (for the substantial amount of $ 550 million). Now, the controversial startup Clearview AI, which has cheerfully admitted that it has tracked and analyzed the data of millions of people, is the target of a new lawsuit citing similar violations.
Clearview started waving earlier this year with a business model that apparently was based on wholesale abuse of audience-oriented data on Twitter, Facebook, Instagram and so on. If your face is visible to a web scraper or public API, Clearview has it or wants it and will submit it for analysis by face recognition systems.
Only one problem: that is illegal in Illinois, and you ignore it until your own risk, as Facebook discovered.
The lawsuit, filed yesterday on behalf of various residents of Illinois and first reported by Buzzfeed News, claims that Clearview "has actively collected, stored and used the biometric data of claimants – and the biometric data of most Illinois residents – without prior notice, obtaining informed written consent or publishing data retention policies "
Not only that, but this biometric data is licensed to many law enforcement agencies, including in Illinois itself.
All of this would violate the Biometric Information Privacy Act, a law from 2008 that has proven to be remarkably long-sighted and resists industry attempts (including, apparently, by Facebook while fighting its own lawsuit) to water down it.
The lawsuit (filed in New York, where Clearview is located) is in its earliest stages and has only been assigned a court and sent summonses to Clearview and CDW Government, the intermediary for selling its services to law enforcement officers. It is impossible to say how it will work out at this point, but the success of the Facebook suit and the similarity of the two cases (essentially the automatic and undisclosed recording of photos by a facial recognition machine) suggest that it has legs.
The scale is difficult to predict and probably largely depends on Clearview's disclosure regarding the number and nature of the analysis of photos protected by BIPA.
Even if Clearview were to immediately remove all information about Illinois citizens, it would probably still be liable for previous acts. A federal judge in the Facebook case wrote: "The development of face template using unauthorized face recognition technology (as claimed here) violates an individual's private affairs and concrete interests," and is therefore enforceable. That is a strong precedent and the agreements are undeniable – not that they will not be refused.