As most of you already know, the Illinois Biometric Information Privacy Act (“BIPA”) regulates the storage and sale of biometric data.  Following a New York Times expose earlier in the year, ten lawsuits were filed against Clearview AI which alleged, among other things, that Clearview’s practices violated BIPA.  Why?  Well, according to complaints filed in these cases, Clearview extracted faceprints from three billion photographs of people’s faces from social media platforms and other websites and created a database.  That database was then provided to Clearview’s clients, which purportedly includes national law enforcement agencies and government bodies.  Unsurprising, public and media scrutiny of Clearview’s practices followed.

This development has rocked the tech world, which responded in a variety of fashions.  Several of the tech giants sent cease and desist letters to Clearview after they learned Clearview’s database was compiled by scraping images from their platforms.  Other name brand companies, which previously had been engaged in developing facial recognition technologies, announced they were stopping such activities altogether.

What was Clearview’s response?  In contrast with these other approaches, it claimed that the company had a First Amendment right to access public information (including images from online platforms).  This assertion was followed in October with a motion to dismiss a complaint filed against it by the American Civil Liberties Union (“ACLU”), where Clearview asserted that the ACLU’s claims were barred under the First Amendment and the Illinois constitution.  Clearview claimed that its use of publically-available images was permissible because its collection and organization of images was essentially the creation and dissemination of information, which is protected by the First Amendment.

Clearview also argued that the activities of search engines like its own have historically been entitled to First Amendment protections.  Because the information that it used was publically available online, Clearview argued that the individuals featured in those photos had no reasonable expectation of privacy.  Clearview further claimed that BIPA violated the First Amendment as a content-based restriction on speech that cannot survive strict scrutiny.  Pointing to BIPA’s definition of “biometric identifiers,” Clearview argued that the way that BIPA targets the information included in that definition limits Clearview’s effectiveness and ability to use public information, and therefore burdens its speech.  Clearview also moved to dismiss the ACLU’s complaint for lack of jurisdiction, among other grounds.

Well, as this issue is sorted out by an Illinois court (where the litigation is pending), last week an amicus brief was filed on behalf of the Electronic Frontier Foundation (“EFF”) that addresses Clearview’s First Amendment argument head on.  As summarized in EFF’s brief, the applicable First Amendment test is not strict scrutiny but “intermediate judicial review,” which requires “a close fit between a speech limit and a substantial government interest.”  This is because, according to EFF’s brief, the speech Clearview seeks to protect is commercial speech that does not concern a public issue.  Instead, the speech is solely in the interest of Clearview and its business audience, as its faceprinting is offered as a proprietary and confidential service for paying customers.  Although Clearview sells its service to law enforcement agencies, EFF argued that this does not make collecting personal data a matter of public concern.

EFF’s brief argued that the application of BIPA to Clearview satisfies intermediate scrutiny as “Illinois has substantial interests in protecting privacy, and the free speech and information security that depends on privacy, from the special hazards posed by faceprinting” and “BIPA’s requirement of opt-in consent to collect faceprints is narrowly drawn to these interests.”  EFF’s brief highlighted that BIPA’s opt-in consent measure does not burden more speech than is necessary, even though businesses have argued that opt-in consent is more burdensome than opt-out consent, because opt-out is only marginally less intrusive than opt-in.  EFF’s brief further argued that opt-out could be ineffective for consumers who may not know that a business collected their faceprint.

What does this all mean?  Well for now, it is unclear as the court at least in this specific Clearview suit has yet to rule on the issue.  Given the proliferation of the collection and use of biometric information – including but not limited to employers in the wage and hour industries using biometric information for timekeeping purposes – this case and others are of particular interest.  Stay tuned as CPW will continue to cover these developments as they occur.