In Patel v. Facebook, a three-judge panel of the U.S. Court of Appeals for the 9th Circuit affirmed a decision by the U.S. District Court for the Northern District of California granting class certification to users of Facebook who alleged that Facebook’s collecting and storing of their face scans using facial recognition technology violated Illinois’s Biometric Information Privacy Act (“BIPA”). In doing so, the panel, based in San Francisco, relied on BIPA’s legislative history to conclude that, “it is reasonable to infer that the [Illinois] General Assembly contemplated BIPA’s application to individuals who are located in Illinois, even if some relevant activities occur outside the state.” Patel v. Facebook, slip op. No. 18-15982 (9th Cir. Aug. 8, 2019) (citing BIPA, 740 Ill. Comp. Stat. 14/1, 14/5 (2008)). Although the extraterritoriality doctrine has been used in other legal contexts, the panel’s holding specifically extends it to distributed artificial intelligence systems, specifically facial recognition, where some components of the system engage with individuals in one state while others process user data in another. Following Patel, businesses looking to avoid liability from private right of action lawsuits, like those brought pursuant to BIPA, may no longer find safe harbor by distributing AI system components (e.g., data servers) outside a regulated jurisdiction. And state lawmakers who wish to pass laws to protect citizens from AI technologies should be mindful not only of the wording of their legislation, but also of developing a sufficient legislative history if they do not want their laws’ reach to stop at state borders.
Enacted a decade before the recent swell of anti-facial recognition sentiment, BIPA sought to address the unconsented storage of “biometric identifiers” in Illinois, including a “scan of hand or face geometry.” Id. at 14/10. The Patel class members accused Facebook of making scans of their faces in violation of BIPA, using Tag Suggestions, a feature Facebook launched in 2010 and applied to the Illinois class member’s uploaded images. As explained by the panel, Tag invokes use of facial recognition technology to analyze whether a user’s Facebook friends are in uploaded photos by “scanning” the photos (using a deep learning model for object detection) to see whether it contains faces. If so, the process determines geometric facial landmarks associated with the faces, such as the distance between the eyes, length of the...
