Class Action Accuses IBM of ‘Flagrant Violations’ of Illinois Biometric Privacy Law to Develop Facial Recognition Tech

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit alleges IBM committed “flagrant violations” of the Illinois Biometric Information Privacy Act (BIPA) with regard to its collection, storage and dissemination of the facial geometries of potentially a million state residents through the Flickr photo-sharing service. 

The timeline detailed in the suit begins in 2014, when Yahoo, the parent company of Flickr, released more than 99 million user photos as part of a downloadable dataset called the YFC100M. Each image, the case says, came with information identifying which account uploaded the photo, while others were linked to geographic data and description tags. Images of the plaintiff and proposed class members were included in the YFC100M dataset, the lawsuit says.

The plaintiff claims Yahoo, a non-party to the suit, never received consent from either uploaders or the subjects in each photograph to release the images and connected data as part of the Flickr dataset. A step further, the case alleges Yahoo also never informed proposed class members that their images would be utilized in the development of facial recognition technology such as that built by IBM. 

The 22-page lawsuit claims IBM, using the images uploaded to Flickr, scanned the facial features of approximately one million individuals and built its own database that included each person’s “craniofacial measurements” without advising anyone that their biometric information was being collected or stored. The case further charges that IBM not only released this database to third party researchers without consent but shared “immutable, identifying information” about each individual, data that the complaint says can be used to tie back an individualized facial measurement to the given Flickr account that originally posted a photo. This could allow third parties to connect the biometric information of a particular individual to other photos in which they appeared, as well as to other people in those photos, “subjecting them to increased surveillance, stalking, identity theft, and other invasions of privacy and fraud,” the lawsuit says.

According to the complaint, IBM from 2016 to 2018 derived more revenue from artificial intelligence (AI) than any other company in the world, raking in reportedly more than $2.5 billion alone in 2018. Among IBM’s AI products, the suit says, is its Watson Visual Recognition, a tool with which clients can estimate the age and gender of people in images and sometimes identify specific individuals. The case asserts that IBM will not disclose the datasets used to train its Watson AI products.

In 2019, the suit goes on, IBM released to third parties its “Diversity in Faces” dataset containing one million photos and a “comprehensive set of annotations of intrinsic facial features.” All of the images in IBM’s dataset can be traced back to the individuals who originally posted the photos to Flickr, according to the lawsuit. 

In contrivance to the Illinois BIPA, IBM allegedly disclosed and disseminated illegally obtained biometric identifiers—scans of individuals’ facial features—without authorization to do so. The case says that proposed class members, to this day, do not know which entities have accessed, stored or made use of their facial measurements. 

The case looks to represent all Illinois residents depicted in photos on Flickr whose images and biometric identifiers or information were captured, collected, obtained, stored, disclosed, redisclosed or disseminated by IBM.