Our readers know that the Illinois Biometric Information Privacy Act (“BIPA”) is one of our favorite topics.  Enacted in 2008, BIPA continues to raise interesting issues.  One notable one that has emerged is whether BIPA would apply to a photograph of a fingerprint or handprint.  Although the plain text of the statute suggests that BIPA would not apply, the answer is not so clear (at least, according to some courts).  Read on to learn more

At first glance, it seems that BIPA would plainly not apply to a photograph of a fingerprint or handprint.  After all, two crucial definitions of BIPA seem to exclude this scenario.  BIPA regulates “biometric identifiers” and “biometric information.”  The statute expressly states that photographs may not be a “biometric identifier” and excludes information derived from items excluded from the definition of “biometric identifier.”  Therefore, if a photograph may not be considered a “biometric identifier,” then any information taken from it (e.g., a finger or hand print) cannot be “biometric information.” Simple, right?

Courts that have confronted this issue, however, have found otherwise (whether or not these decisions were rightly decided is a question for another day).  Although these cases acknowledge that information learned through a photograph may not be “biometric information,” due to BIPA’s express exclusion of information learned from something that is not a “biometric identifier” (like a photograph), they have begged the question that the information itself may be a “biometric identifier.”

In Monroy v. Shutterfly, Inc., No. 16-cv-10984, 2017 U.S. Dist. LEXIS 149604 (N.D. Ill. Sept. 15, 2017), the court declined to find that BIPA should not apply to the use of facial recognition software to scan a photo of someone’s face.  There were at least two significant takeaways.  First, the court confirmed that the information derived from the photograph of the plaintiff was not “biometric information,” stating:

It is clear that the data extracted from [the] photograph cannot constitute “biometric information” within the meaning of the statute: photographs are expressly excluded from the definition of “biometric identifier,” and the definition of “biometric information” expressly excludes “information derived from items or procedures excluded under the definition of biometric identifiers.”

Second, the information itself, however, could qualify as a “biometric identifier.”  The court stated, in relevant part:

But this leaves open the question of whether the data obtained from the photograph . . . may constitute a “biometric identifier” . . . [the defendant] maintains that by excluding data derived from photographs from the definition of “biometric information,” the Illinois legislature intended to exclude from BIPA’s purview all biometric data obtained from photographs. Accordingly, [the defendant] contends, it would make no sense to interpret “biometric identifier” as including such data.  This reading of the statute seems sensible enough at first blush, but it begins to unravel under scrutiny.

Notably, the court rejected an argument that BIPA only applies to data that is collected in-person, as opposed to an automated process, like facial recognition software.  Here, the court addressed fingerprints in photographs, noting:

As an initial matter, [the defendant’s] argument assumes that the other biometric identifiers listed in the definition can be obtained only via in-person processes. That is incorrect. For example, it appears that fingerprints and retinal scans can be obtained from images and photographs.

Monroy continues a trend in earlier case law.  See Norberg v. Shutterfly, Inc., 152 F. Supp. 3d 1103, 1106 (N.D. Ill. 2015) (denying motion to dismiss regarding automated use of facial recognition software on photos because plaintiff was not presented with a written biometrics policy or consented to have his biometric identifiers used).

There you have it.  Whether or not other courts when confronted with the same question rule similarly remains to be seen–particularly in light of BIPA’s plain language.