Facebook faces legal fight over facial recognition

Facebook should have done more to tell people it was collecting facial data, say Illinois users

A US court has thrown out an attempt by Facebook to stop legal action over the way it collected images of people's faces.

The case centres around images people uploaded to Facebook that were later used to help identify them in other pictures.

This led Facebook users in Illinois to allege that the service had not got permission to use images in this way.

The decision means their class action lawsuit can now go ahead.

Unique harm

The social network had sought to defuse the legal claims by trying to convince the court that each user's claim was unique and required its own lawsuit.

The San Francisco court unanimously rejected this and said those suing Facebook had suffered "sufficient privacy injuries" to allow them to sue as a group.

The lawsuit alleges that Facebook did not do enough to warn people it would be collecting detailed images of their faces and that it did not get their explicit consent to do so.

"This biometric data is so sensitive that if it is compromised, there is simply no recourse," said lawyer Shawn Williams who is acting for the group. "It's not like a Social Security card or credit card number where you can change the number. You can't change your face."

Police forces in the UK have been criticised for their use of facial recognition

The class action has also won support from the American Civil Liberties Union (ACLU) which has taken a strong stance against the growing use of facial recognition data.

The ACLU said such recognition systems had the potential to do "unique privacy harms".

"This decision is a strong recognition of the dangers of unfettered use of face surveillance technology," ACLU staff attorney Nathan Wessler said in a statement.

The legal action began in 2015 with a claim Facebook had broken Illinois laws limiting the collection of biometric data.

If the class action court case succeeds, Facebook could end up paying substantial damages. The Illinois law levies fees of $1,000 (£826) for each "negligent violation" of its biometrics laws and $5,000 for each "reckless" violation.

Millions of users could be included in the class action, said Reuters, potentially leading to a massive payout.

Facebook said it planned to appeal against the decision.

It added: "We have always disclosed our use of face recognition technology and that people can turn it on or off at any time."

Facial recognition technology is coming under increasing scrutiny by regulators and governments. In the UK, MPs have said it should stop being used and the Information Commissioner said it raised "significant" privacy issues.