Slashdot Mirror
US Judge Rejects Suit Over Face Scanning for Video Game (newyorklawjournal.com)
Two athletes whose images were scanned for a video game have been bounced from court on their claim that the game maker violated a law protecting biometric information. From a report: Brother-and-sister video basketball players Ricardo and Vanessa Vigil were leading a class action that claimed Take-Two Interactive, which manufactured the NBA 2K15 game, ran afoul of an Illinois law that governs biometric identifiers such as retina or iris scans, fingerprints, voiceprints, or scans of hand and face geometry. The Vigils agreed to have their faces scanned to create digital avatars for NBA 2K15, but said they didn't know their images would be available in unencrypted form online. They tried to hold Take-Two liable under the Illinois Biometric Information Privacy Act (BIPA) in Vigil v. Take-Two Interactive Software, 15-cv-8211. Judge John Koetl of the Southern District of New York dismissed the proposed class action suit filed by brother and sister Ricardo and Vanessa Vigil, saying the plaintiffs didn't show "concrete" harm from the way the gaming company stores and uses their biometric data.
you must register to see this first comment
Available here: https://www.docketalarm.com/ca... Looks like there will be an appeal.
Fast Federal Court and I.T.C. updates
(740 ILCS 14/20) Sec. 20. Right of action. Any person aggrieved by a violation of this Act shall have a right of action in a State circuit court or as a supplemental claim in federal district court against an offending party. A prevailing party may recover for each violation: (1) against a private entity that negligently violates a provision of this Act, liquidated damages of $1,000 or actual damages, whichever is greater; (2) against a private entity that intentionally or recklessly violates a provision of this Act, liquidated damages of $5,000 or actual damages, whichever is greater; (3) reasonable attorneys' fees and costs, including expert witness fees and other litigation expenses; and (4) other relief, including an injunction, as the State or federal court may deem appropriate. (Source: P.A. 95-994, eff. 10-3-08.)
Definition of aggrieved: feeling resentment at having been unfairly treated
There might be grounds for an appeal but whether it would prevail probably depends on what state/court the case is heard in. Get a good lawyer if you want to go this way you two.
Entire law here.
We'll make great pets
n/t
I have to register in order to read the fucking article?
So they can collect my email and the fake data I enter and spam me advertisements in my in-box.
Registering for content is something stupid people do. There is absolutely no technical reason to require it.
There is a marketing reason. The goddamn marketers have ruined the web.
And they have caught on to mailinator and other throw-away email services - try to register on Slashdot with it. Yahoo! sucks because they want a cell phone number now - fuck them. I get enough scam texts as it is.
Anyway, whenever any company wants bio metric data, the answer is no fucking way because they cannot be trusted. It WILL one day be abused.
Why are you suing over a violation of Illinois law in New York?
Regardless, the judge's reasoning is absurd - if Take Two violated the law the plaintiff's don't need to prove further harm. Violation of the law is the harm. The law exists to prevent such use of a person's biometric data because the state of Illinois has determined such use to be harmful.
The extent to which damages can be awarded can be decided in part by looking at harm caused, punitive assessments set forth in the law, potential harm caused (once the biometric cat spills the beans, you can't get the digital Humpty Dumpty back in the lamp), etc. A ruling on the violation of the law is a separate issue.
... saying the plaintiffs didn't show "concrete" harm from the way the gaming company stores and uses their biometric data.
Since the current and future potential problems are not known and biometric data can't really be changed, seems like it would be prudent to want to protect your biometric data *before* something bad happens, and not wait until *after* something bad happens -- you know that "concrete" harm -- that cannot really be undone.
It must have been something you assimilated. . . .
"The Vigils agreed to have their faces scanned to create digital avatars for NBA 2K15, but said they didn't know their images would be available in unencrypted form online"
I guessing the Vigils may not have had a lawyer go over the contract to license their likeness for the game.
US Judge Rejects Suit Over Face Scanning for Video Game
Mark Hamblett, New York Law Journal
January 31, 2017 | 0 Comments
Two athletes whose images were scanned for a video game have been bounced from court on their claim that the game maker violated a law protecting biometric information.
Brother-and-sister video basketball players Ricardo and Vanessa Vigil were leading a class action that claimed Take-Two Interactive, which manufactured the NBA 2K15 game, ran afoul of an Illinois law that governs biometric identifiers such as retina or iris scans, fingerprints, voiceprints, or scans of hand and face geometry.
The Vigils agreed to have their faces scanned to create digital avatars for NBA 2K15, but said they didn't know their images would be available in unencrypted form online. They tried to hold Take-Two liable under the Illinois Biometric Information Privacy Act (BIPA) in Vigil v. Take-Two Interactive Software, 15-cv-8211.
Southern District Judge John Koeltl, in a ruling issued Monday, said the Vigils lacked standing to sue under the act because they had not alleged a concrete injury, and also failed to state a claim.
Illinois passed the BIPA in 2008 to encourage the use of biometric identifiers in commercial transactions and safeguard their use. The law governs disclosure, consent and retention requirements. Violators can pay up to $1,000 per violation, $5,000 in the case of recklessness.
The plaintiffs bar recently has been stepping up suits under the act. In 2016, a judge in the Northern District of California refused to dismiss a class action against Facebook; Six Flags is defending a lawsuit over its use of fingerprints, or finger scans, for season pass members in state court in Illinois; and Shutterfly is a defendant in an action in the Northern District of Illinois.
The Vigils said they didn't understand that Take-Two would collect and retain their images, and the company set no retention schedule for guidelines for permanently destroying biometric identifiers. They also said Take-Two failed to obtain a meaningful release.
Koeltl, however, called the purported violations of the act "at best, marginal."
"There is no allegation that the plaintiffs did not understand that the only purpose of the MyPlayer feature was to create a personalized basketball avatar for in-game play, including in multiplayer mode," he wrote. "And there is no allegation that the plaintiffs' face scans have been disseminated in any form other than to the gamers who played in multiplayer games with the plaintiffs."
Koeltl also said the heart of the complaint was that, while the Vigils agreed to have their faces scanned, they didn't explicitly consent to have their identifiers scanned and retained, a violation of their "biometric privacy."
"Regardless of whether the plaintiffs understood the ins-and-outs of the face scanning technology, or knew that their faces were 'biometric identifiers' under the BIPA, the plaintiffs plainly understood that the MyPlayer feature had to collect data based upon their unique faces to create the personalized basketball avatars," he wrote.
Robert Schwartz, a partner at Irell & Manella, said Monday that Koeltl's opinion was welcomed in a burgeoning field with little case law.
"The good thing is he gave this a comprehensive analysis," Schwartz said. "It's a road map which can guide other judges facing this novel statute."
The plaintiffs were led by John Carey and David Milian of Carey Rodriguez Milian Gonya. They did not return calls seeking comment.
Mark Hamblett can be reached via email or on Twitter @Mark_Hamblett.
Section e of 740 ILCS 14/15 provide some insight. Source: http://www.ilga.gov/legislatio...
(e) A private entity in possession of a biometric identifier or biometric information shall: (1) store, transmit, and protect from disclosure all biometric identifiers and biometric information using the reasonable standard of care within the private entity's industry; and (2) store, transmit, and protect from disclosure all biometric identifiers and biometric information in a manner that is the same as or more protective than the manner in which the private entity stores, transmits, and protects other confidential and sensitive information.
To the first point, I think the developers could argue that they store their geometric face data in the same way other video games do which would seem to abide by the law since it follows the standard throughout the video game industry (and depending on the file format used and if its proprietary in nature, they may be able to argue the encoding was sufficient to protect the information). The second point makes things more tricky since it equates the biometric data with "confidential and sensitive information" whereas I think the developers in the video game industry don't look at it that way.
So legally the brother and sister may have some legs the stand on but I mean c'mon, they really expected their facial models to be protected when they were appearing in a video game?? Lets assume they were able to perfectly encrypt that data, they still have to show it to the player. All of the critical information can then be obtained from viewing the 3D model in-game. I really don't understand the logic here.
Well the idea that a New York judge is hearing a case about Illinois State Law is already suspicious but the Illinois Law does state:
He's not a New York state judicial officer, he's a Federal Judge whose court is in New York.
First, you will not win much,
the lawyers will suck up the
settlement leaving little for
the plaintiffs.
Second, class action can remove
any home court advantage.
Beware of lawyers bearing gifts.
They can potentially sue in Illinois, under Illinois law.
They tried to sue under federal law, which has already been explained by courts in other cases as follows:
--
For an injury-in-fact to be
`âoeconcrete,â it must be âoereal, and not abstract,â and that a
`âoebare procedural violationâ under a federal statute, âoedivorced
`from any concrete harm,â that âoemay result in no harm,â would not
`âoesatisfy the injury-in-fact requirement.â Id. at 1549
--
The federal law allows a federal suit if "concrete injury" comes from violating a state law.
the NCAA says you get nothing and yes joke classes are needed when the team needs 40-60 hours a week you don't have time for class.
Federal law:
For an injury-in-fact to be "concrete", it must be "real, and not abstract" and that a "bare procedural violation" under a federal statute, "divorced from any concrete harm" that "may result in no harm" would not
"satisfy the injury-in-fact requirement" Id. at 1549
mr president, could you please ask the people that live in the united states that are from india to go back to india. thanks in advance.
I'm sorry but if what passes for biometrics security can be put at risk by 3D modeling of your likeness than it would seem current biometrics is what should get fucked.
On the Oregon Cost born and raised, On the beach is where I spent most of my days
So, you scan your face to use in a game playable online, then bitch that the image of your face can be seen online?
What kind of box of rocks did those two crawl out of?
I suppose you're ok with having your imprecise fingerprints stored with the alphabet agencies so you can be a "person of interest" due to a "partial match" on crimes involving multiple states.
If they lived in Washington State, they could sue.
And win.
-- Tigger warning: This post may contain tiggers! --
Ever expanding copyright law, computer fraud law, or just the repeated tendency for US courts to declare a corporation is the victim: Use of corporate assets can automatically be illegal but individuals, they have to prove they suffered damage. When the plaintiff's identity is stolen, how is the court going to 'give' them a new one? How do the plaintiffs prove they lost income because their likeness is a download away? At least this is a lesson to other celebrities: Lock down who can use your likeness and when. Since celebrities have faced that issue before, the plaintiffs should be suing their manager or lawyer for not specifying the terms of use at the time.
Anyone with a 3D scanning phone app could get this so easily
Worse than that, really...
A 3-D scan usually results in a very messy pile of vertices/polygons that resemble the human face. The modeler (for the game) then takes that slop and dumps approximately a zillion polys and vertices from it, creating a mesh that has at least some sort of symmetry (for ease of rendering) and a *lot* less polygons (a typical game engine used today would explode if it had to simultaneously render, on-the-fly, two full basketball teams of figures at various distances, each with 50-75k-poly meshes just for their heads, let alone the additional burden of bodies, fabric dynamics, scenery, oh, and the meshes for the refs, etc.)
Usually when the modeler is done, the head might have up to 1k polygons on it (and that's really pushing things). Add Subdividing Surfaces, and you can squeeze the polycount way the hell down, even from that. The likeness is made-up for by texture (skinning), vertex placement (which will by necessity involve a lot of movement from original), displacement/bump texturing, and perhaps (if you have the GPU cycles to spare) a bit of animation that resembles the personality of the dude being scanned (say, a trademark smile).
Meanwhile, biometric data on a human face only calculates a relatively smaller number of points (that are not as easily affected by small variations in emotion, muscular movement, etc), and has fuck-all to do with what a human would expect to see. Neither one will resemble the other in any way, shape, or form, because they're made for two totally different purposes. For example: biometrics will have, say, vertices marking the center of each pupil, whereas a game mesh doesn't give a flying frig about the eyes beyond telling subdivision make them spheres and by the way here's the UV Map image to set the texture on them.
TL;DR: You cannot (as a practical matter) make a usable mesh of the guy from biometric data, nor can you make usable biometric data from the mesh used in-game.
Quo usque tandem abutere, Nimbus, patientia nostra?
Oh - forgot...
For the console players? Yeah, no. They most likely have pre-baked meshes to work with (to account for different-but-common facial shapes), and slap a texture on one made from a photograph. That's even more useless as a biometric base...
Quo usque tandem abutere, Nimbus, patientia nostra?
To continue reading, become a free ALM digital reader.
Eh... no.
Are you allowed to copy/paste from a paywalled article? I guess we could ask ALM, they'd know.
Two athletes
Brother-and-sister video basketball players
They're video basketball players? That's not very athletic.
systemd is Roko's Basilisk.
Seriously, no backsies.
Comment removed based on user account deletion
The State of Illinois should be the party suing Take Two if no action is taken for the proper storage of the bio-metric information. No expensive class action suit should be necessary.
Definition of aggrieved: feeling resentment at having been unfairly treated
I don't in fact think that is the legal definition of "aggrieved". I think it's that under this law, you have claim to a grievance against you, that is, harm done as defined under the letter of the law. Hmm, yep, teh goog say "An aggrieved party can be any person whose financial, personal, or property rights or interests are adversely affected by an act of another or an order, judgment or statute. An aggrieved party is entitled to challenge the adverse decisions." It's not feeling butt-hurt. It's being able to show harm due to someone's physical or legal action. Of course, IANAL, but I do know how to internet.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
It looks like a hopelessly stupid law, where the first found findings basically admit that it's a stupid situation and that all the remaining text of the law is going to have to be stupid. The best parts being the third and fourth findings:
Right there, they could have ended it, and said that biometrics can't be considered diligent authentication and therefore 100% of the risk of a transaction based on it, shall reside with the idiot who decided that biometrics are good enough.
Instead, the law then goes out into TOTALLY INSANE land, where it's all based on half-assed, doomed, hopeless attempts to protect biometric data, as though this has more than a percent chance of working, despite finding "c" being a complete and total admission of the futility.
This is a stupid law. The best thing that could happen for the people of Illinois, is for all the biometric databases to be leaked and for everyone to know that the data is publically available to all criminals, so that everyone will be in agreement that the data definitely should not be repurposed to authenticate anything "sensitive."
Your face is in public, and countless computers owned by countless entities are photographing you every day, if you go out. Your fingerprints are on that glass you drank from at the restaurant. This is not secret information. It never will be. Anyone who tells you otherwise is not merely mistaken: they are lying. It's public data, whether there's a file on TPB containing your info yet, or not.
"The Vigils agreed to have their faces scanned to create digital avatars for NBA 2K15, but said they didn't know their images would be available in unencrypted form online."
What? How could their images be used in any meaningful way if they aren't visible/available?
I must be missing something, this sounds like they either don't know what they're talking about OR that they were too dumb to understand that after scanning their faces (!!) their likenesses would be used for display purposes in the game. I mean, why the hell else would they be having their faces scanned??
Just cruising through this digital world at 33 1/3 rpm...
Never heard of theses two jokers. Just use a generic player and slap a number on their back. Nobody is gonna notice.
> By that interpretation, "attempted" murder isn't a crime either, so long as you completely miss your shot, swing, swerve..
The definition is for a "crime", crimes are defined mostly in state laws. The definition has to do with what actions you have a federal class action for, suing for money due to harm caused to many people. If no harm is caused, you can't sue as a federal class action.