Google Aims at Privacy Law After Facebook Lobbying Failed
Alphabet is pushing efforts to roll back the most comprehensive biometric privacy law in the U.S.
.jpg?auto=format%2Ccompress&w=200)
(Bloomberg) -- Alphabet Inc. is pushing efforts to roll back the most comprehensive biometric privacy law in the U.S., even as the company and its peers face heightened scrutiny after the unauthorized sharing of data at Facebook Inc.
While Mark Zuckerberg and Sheryl Sandberg were publicly apologizing this month for failing to protect users’ information, Google’s lobbyists were drafting measures to de-fang an Illinois law recognized as the most rigorous consumer privacy statute in the country. Their ambition: to strip language from a decade-old policy that regulates the use of fingerprints, iris scans and facial recognition technology, and insert a loophole for companies embracing the use of biometrics.
Google is trying to exempt photos from the Illinois law at a time when it’s fighting a lawsuit in the state in which billions of dollars of damages may be at stake. The world’s largest search engine is facing claims that it violated the privacy of millions of users by gathering and storing biometric data without their consent.
Facebook has faced global backlash for failing to secure users’ information, triggered by revelations that a British firm with ties to President Donald Trump’s 2016 campaign harvested information from as many as 87 million Facebook users without their knowledge. That breach has put the tech behemoth and its Silicon Valley cohort at the center of a data privacy debate.
Facebook is trying to show it’s taking consumer privacy more seriously, but there’s an inexorable dilemma: The business models and future growth of both Google and the world’s largest social network are tied up with the very data they’re now being asked to lock up -- information most users have volunteered in exchange for these companies’ free products and services.
Illinois state senator Bill Cunningham proposed an amendment to the Biometric Information Privacy Act in February then aimed at saving a local nursing home from overly burdensome litigation. Google and lobbyists from the Illinois Chamber of Commerce -- of which Facebook is a member -- intervened, and on April 4 they offered a new version with Cunningham to embed further caveats in the legislation, including language to exclude photos from regulatory scrutiny.
Facebook -- which attempted to scale back the law in 2016 -- said it didn’t play a role in the drafting or lobbying of the recent proposal. Still, critics contend the company would be an obvious beneficiary of a watered-down BIPA, along with Google, which declined to comment on its role in revising the bill.
“The ball is in tech companies’ court now,” said Pam Dixon, executive director of the World Privacy Forum. “Working to overturn a privacy law is certainly not the best approach.”
The amended bill in Illinois has twice been called to committee in the state senate, and twice pulled from the agenda over “misconceptions with what the bill aims to achieve,” said Cunningham. He confirmed he’ll continue to meet with Google’s lobbyist, the Illinois Chamber and privacy advocates in search of a compromise. Central to his effort and Google’s: ending the mountain of litigation triggered by BIPA that’s spawned more than 140 lawsuits since 2014.
“We’d like to see a fix to the law, which is as old as the iPhone 3G," said Tyler Diers, director of legislative relations at the Illinois Chamber of Commerce. ”The technology this law was regulating has evolved.”
Most of the have been filed on behalf of employees in Illinois whose employers have incorporated biometric technology without written consent. The lawsuits threaten the viability of those local businesses, Cunningham said.
‘Middle Ground’
“It’s my goal to find a middle ground where we protect the privacy of citizens and their biometric material, but do it in a way that allows people in Illinois to access technologies and applications that everyone else in the country is accessing," he said. Services such as Google’s Arts & Culture app -- which will locate museum portraits that resemble you based on a selfie, among other things -- weren’t released in Illinois because of BIPA.
“You can allow for certain technological advances without relieving the burden on businesses to protect that data,” Cunningham said. “If a business is negligent in protecting biometric material, they should be held accountable.
The bill is slated to be called to committee on April 26. If it passes, Cunningham, a Democrat, is confident both houses of the state assembly will push the law to the governor’s desk.
BIPA is the only U.S. state or federal law that affords people the right to sue companies for using their biometric data without consent. The proposed amendment would undoubtedly trim the number of lawsuits that employers face in state courts, such as the nursing home in Cunningham’s district sued for replacing punch-out cards with fingerprint scanners for its hourly employees without their written agreement.
Changing the law could also affect a pair of federal lawsuits against Google and Facebook, two of the world’s largest users of biometrics. Facebook is headed toward trial in July in a case brought on behalf of more than 6 million users in Illinois that seeks as much as $5,000 per BIPA violation.
For years, Facebook has encouraged users to tag people in photographs they upload in their personal posts and the company stores the information. Alphabet’s cloud-based Google Photos service uses similar technology, prompting a separate lawsuit with a comparable class. Facebook lobbied for a similar legislative amendment in 2016 after failing to persuade a federal judge to dismiss the lawsuit over its face-tagging feature.
Until about two years ago, Google had earned a reputation as a tech giant even some privacy advocates could support. When Google altered its offerings so advertisers could mix users’ browsing behavior with their search history in ad targeting, the company insisted on providing an opt-out option. Those privacy advocates are worried the BIPA proposal may signal a shift in ideology over user consent.
With regard to the privacy suit it faces in Illinois, filed in 2016, Google has said photos don’t belong under BIPA and including them would render the law unconstitutional. By pushing to strip photos from the Illinois statute, Google is distancing itself from being known as an organization that prioritizes user consent in order to avoid further litigation, said Alvaro Bedoya, Executive Director for the Center on Privacy & Technology at the Georgetown University Law Center.
“Historically, Google has gone out of its way to give people a choice about whether they want to be in a face recognition system,” Bedoya said. “Their support for this amendment would mark a complete reversal in the company’s approach to this powerful and invasive technology. It would be deeply disappointing.”
--With assistance from Mark Bergen
To contact the reporter on this story: Kartikay Mehrotra in San Francisco at kmehrotra2@bloomberg.net.
To contact the editors responsible for this story: Elizabeth Wollman at ewollman@bloomberg.net, Peter Blumberg
©2018 Bloomberg L.P.