Another court ruling this week concludes that the Illinois Biometric Information Privacy Act (IBIPA) covers face geometry scans that are created from digital images, again rejecting the argument that the statute should apply only to facial scans made in person. The case, Monroy v. Shutterfly, Inc., No. 16 C 10984 (N.D. Ill. September 15, 2017) was brought by an individual whose face geometry was scanned by the photo website Shutterfly from a photo uploaded by a different user.

The IBIPA requires anyone who collects and stores certain “biometric identifiers” such as “face geometry” to first obtain the person’s consent and also requires a written policy for retention and eventual destruction of those identifiers.  Like the earlier Rivera v. Google ruling, this is a preliminary ruling in the case and one that still leaves open a thicket of issues related to how Illinois’s statute may apply to activities occurring in other states.  As further discussed in a prior post, if this interpretation ultimately prevails, it would have a significant impact, at least in Illinois, on the privacy compliance requirements for a broad and growing category of technology products.