PHOENIX â A new federal court ruling coupled with a provision in the state constitution could give Arizonans new legal protections against the use of software by private firms that captures and stores facial images.
The lawsuit involves claims of invasion of privacy brought against Facebook by some Illinois residents. They claim the companyâs practice of scanning uploaded photos to match against those already in its database violates that stateâs laws against the collection of anyoneâs biometric information by a private company without informing the person and getting a written release.
The 9th U.S. Circuit Court of Appeals earlier this month rejected a bid by Facebook to have the case thrown out.
In a sometimes strongly worded opinion, the judges said there is reason to believe that such practices are an invasion of privacy rights. More to the point, the court concluded that such an invasion can be considered a harm that victims can litigate.
Arizona does not have a similar law.
But Attorney General Mark Brnovich said Arizona does have something else: a specific right to privacy built in to the Arizona Constitution. And if that isnât enough, Brnovich said state lawmakers should take action to enact a specific statute spelling out what private companies can and cannot do with someoneâs biometric information, similar to what exists in Illinois.
âI donât think itâs too much to ask that people respect our privacy,â he said.
House Speaker Russell Bowers, R-Mesa, actually tried to do that earlier this year with legislation to restrict putting biometric information into a database for commercial purposes and generally prohibit that information from being sold, leased or disclosed for commercial purposes without the individualâs consent.
HB 2478 cleared the House Technology Committee without dissent. But a spokesman for Bowers said he yanked the measure from consideration before it got to the House floor âto give stakeholders more time to improve it.â
Brnovich, in an extensive interview with Capitol Media Services, said itâs important to realize whatâs at stake.
âWeâre talking about facial recognition, voice recognition, the way you walk, your mannerisms, maybe when it starts coming down to issues like DNA and blood information,â he said. âAnd thatâs the kind of stuff that, if itâs compromised or stolen, you can never get back.â
For example, Brnovich said, if credit card information is stolen, the user can cancel the card and get a new one.
âBut if someone steals the information on my voice or voice identity, my facial patterns and stuff, thatâs something that I canât change,â he explained. âAnd thatâs something thatâs lost forever.â
Thatâs exactly the logic used by Judge Sandra Ikuta in writing the unanimous opinion for the 9th Circuit â the federal appeals court whose rulings govern 10 western states including Arizona â in allowing the lawsuit against Facebook to proceed.
In her example, Ikuta talked about a Social Security number being compromised by hackers.
In that case, she said, someone can get a new number.
âBiometric data are biologically unique to the individual,â Ikuta wrote. âOnce compromised, the individual has no recourse, is at a heightened risk for identify theft, and is likely to withdraw from biometric-facilitated transactions.â
Brnovich said the possible harms go far beyond that, saying that once someone has digitized a personâs face, voice and mannerisms, itâs a small step to use artificial intelligence to create an image that mimics someoneâs behaviors and patterns.
âThereâs something really creepy about that,â he said.
According to court records, the specific issue here involves Facebook practice to analyze uploaded pictures to see if they contain faces.
If so, Ikuta said the technology extracts various geometric data points that make a face unique, like the distance between the eyes, nose and ears to create a face signature or map. Then the technology compares that to other faces in its database of face templates to see if there is a match, at which point Facebook may suggest âtaggingâ the person in the photo.
Ikuta said that process creates privacy concerns.
âOnce a face template of an individual is created, Facebook can use it to identify that individual in any of the other hundreds of millions of photos uploaded to Facebook each day, as well as determine when the individual was present as a specific location,â she wrote. âFacebook can also identify the individualâs Facebook friends or acquaintances who were present in the photo.â
And itâs not just what can happen now she said, given how technology is developing.
âIt seems likely that a face-mapped individual could be identified from a surveillance photo taken on the streets or in an office building,â Ikuta said.
âOr a biometric face template could be used to unlock the face recognition lock on the individualâs cellphone,â she continued. âWe conclude that the development of a face template using facial-recognition technology without consent (as alleged here) invades an individualsâ private affairs and concrete interests.â
And that kind of conduct, Ikuta said, is grounds for litigation.
A spokesman for Facebook told Capitol Media Services the company plans to appeal the 9th Circuit decision allowing the lawsuit to go forward. âWe have always disclosed our use of face recognition technology and that people can turn it on or off at any time,â the spokesman said.
Brnovich said, though, that an issue in these kind of cases is how easy â or hard â it is to opt out.
In fact, he wrote to Facebook last year complaining that it took 21 different clicks and screens for someone to be able to opt out of the companyâs data collection policies. The company subsequently agreed to make some changes. That, however, still leaves the question of what rights Arizonans already have to sue over their images being collected, digitized and stored.
It starts with the Arizona Constitution Article 2, Section 8: âNo person shall be disturbed in his private affairs, or his home invaded, without authority of law.â
âI have always believed that because we have that right to privacy that provides us more protection than the Fourth Amendment does,â Brnovich said, with the latter covering âunreasonable search and seizuresâ and requiring government agents to first obtain a warrant.
Still, he conceded, it remains unsettled law to exactly how broad is that right to privacy â especially when it is being invaded not by a government agency but by private corporations.
And complicating matters, he said, is that the lines are not clear.
âOne of the things that we have recently seen is government working with Big Tech and internet service providers to get information that affects individual rights,â Brnovich said. âSo weâre starting to see that line blur a little bit more and more when government is using Big Tech and internet service providers to pretty much do its bidding.â
If nothing else, Brnovich said there needs to be a clear state law about how private companies can use information, particularly if they are making money selling it to others.
