US Judge Rejects Suit Over Face Scanning for Video Game (newyorklawjournal.com)

Two athletes whose images were scanned for a video game have been bounced from court on their claim that the game maker violated a law protecting biometric information. From a report: Brother-and-sister video basketball players Ricardo and Vanessa Vigil were leading a class action that claimed Take-Two Interactive, which manufactured the NBA 2K15 game, ran afoul of an Illinois law that governs biometric identifiers such as retina or iris scans, fingerprints, voiceprints, or scans of hand and face geometry. The Vigils agreed to have their faces scanned to create digital avatars for NBA 2K15, but said they didn't know their images would be available in unencrypted form online. They tried to hold Take-Two liable under the Illinois Biometric Information Privacy Act (BIPA) in Vigil v. Take-Two Interactive Software, 15-cv-8211. Judge John Koetl of the Southern District of New York dismissed the proposed class action suit filed by brother and sister Ricardo and Vanessa Vigil, saying the plaintiffs didn't show "concrete" harm from the way the gaming company stores and uses their biometric data.

Comments

Full Case Information

[speedplane]

Available here: https://www.docketalarm.com/ca... Looks like there will be an appeal.

New York Judge/Court arguing Illinois State Law?

[zifn4b]

Well the idea that a New York judge is hearing a case about Illinois State Law is already suspicious but the Illinois Law does state:

(740 ILCS 14/20) Sec. 20. Right of action. Any person aggrieved by a violation of this Act shall have a right of action in a State circuit court or as a supplemental claim in federal district court against an offending party. A prevailing party may recover for each violation: (1) against a private entity that negligently violates a provision of this Act, liquidated damages of $1,000 or actual damages, whichever is greater; (2) against a private entity that intentionally or recklessly violates a provision of this Act, liquidated damages of $5,000 or actual damages, whichever is greater; (3) reasonable attorneys' fees and costs, including expert witness fees and other litigation expenses; and (4) other relief, including an injunction, as the State or federal court may deem appropriate. (Source: P.A. 95-994, eff. 10-3-08.)

Definition of aggrieved: feeling resentment at having been unfairly treated

There might be grounds for an appeal but whether it would prevail probably depends on what state/court the case is heard in. Get a good lawyer if you want to go this way you two.

Entire law here.

Registration

[Anonymous Coward]

I have to register in order to read the fucking article?

So they can collect my email and the fake data I enter and spam me advertisements in my in-box.

Registering for content is something stupid people do. There is absolutely no technical reason to require it.

There is a marketing reason. The goddamn marketers have ruined the web.

And they have caught on to mailinator and other throw-away email services - try to register on Slashdot with it. Yahoo! sucks because they want a cell phone number now - fuck them. I get enough scam texts as it is.

Anyway, whenever any company wants bio metric data, the answer is no fucking way because they cannot be trusted. It WILL one day be abused.

Re:Registration

[PPH]

I have to register in order to read the fucking article?

Yes. And look at the camera on your phone. Hold it ..... [click] .... Got it. Now you can go ahead and exist online*.

*P.S. You ought to have that mole looked at.

Re:Registration

[Altrag]

You make it sound like this is new and/or surprising. As long as corporate greed is given priority over personal liberties, you can expect this to not only continue but get worse as companies and marketing departments continue to see how far they can push before we snap.

And then push a little further since we don't really have a choice even after we snap -- not using the internet isn't really an option anymore for a significant majority of the population.

As for throwaway email services.. You can always just register for a real email service (with fake credentials obviously) and simply never check it again. I used to have one or two dummy addresses that I used purely to (avoid) signing up for shitty services that insist I should care about their crap offers (and their partners' crap offers and whatnot.)

I've gotten lazier in my old age though.. there's very few sites that don't just get the red X treatment if they try to pull that shit on me nowadays. Sometimes if they do the hover-overs I'll spend a couple minutes attempting to delete nodes and see if I can uncover the actual information but I rarely spend a whole lot of time on it. Their crap just isn't that important for a very very wide selection of "they."

New York

[sexconker]

Why are you suing over a violation of Illinois law in New York?

Regardless, the judge's reasoning is absurd - if Take Two violated the law the plaintiff's don't need to prove further harm. Violation of the law is the harm. The law exists to prevent such use of a person's biometric data because the state of Illinois has determined such use to be harmful.

The extent to which damages can be awarded can be decided in part by looking at harm caused, punitive assessments set forth in the law, potential harm caused (once the biometric cat spills the beans, you can't get the digital Humpty Dumpty back in the lamp), etc. A ruling on the violation of the law is a separate issue.

Re:New York

[bws111]

They sued in federal court. The court is in New York, because that is where the defendant is.

Re:New York

[RatherBeAnonymous]

In their complaint, "the Plaintiffs analogize this practice of facial scanning to the collection of fingerprint data without the consent of the users." My understanding of the process is that the player must deliberately allow their face to be scanned, "Gamers get close to the camera and slowly turn their heads to the left and right while the camera scans their face. The face scanning process takes about 15 minutes to complete, according to the biometric data class action lawsuit." It seems unlikely that the user did not consent to this, only that they see an opportunity and are trying to cash in on it. Is Take-Two's scan data detailed enough or precise enough to the level of sophistication to where it can be used to fool facial recognition?

http://heitnerlegal.com/2016/0...
https://topclassactions.com/la...

Furthermore, the law is stupid. Who used facial recognition data for security? Retinal scans? Sure. Iris? Maybe. But facial geometry? A handful of pictures of any person is enough to extrapolate their facial geometry.

Re:New York

[sexconker]

You expect me to read? This is Slashdot. Okay, so it's a federal court. That still doesn't make the judge's reasoning sane. You don't need to show monetary harm, physical harm, or even potential harm to have standing to file a suit or to get an award. Violation of the law IS the harm. Plenty of states have punitive damages built into laws ranging from data retention to the timely return of security deposits. If you're in the right state and your landlord doesn't give you your security deposit and an itemized list of what they withheld within 30 days, you can win it all back and then some on day 31.

Re:New York

[sexconker]

For some asinine reason when the government takes you to court for criminal charges there doesn't have to be any demonstration of harm based on your actions. When you take someone to court for their malicious actions against you, you do have to provide evidence of harm. This conveniently allows the government to practice malicious prosecution while disallowing the peasants.

The law in question has built-in punitive values. Violation of the law in this case is itself harmful, per the state of Illinois. That's why the law exists.
The same goes for many other laws, including things without explicit punitive values. You can sue for all sorts of civil rights violations without concrete proof of harm beyond the violation itself. The violation alone is harmful.

It's a mere question of fact as to whether or not the law was violated, then it's a separate issue to find out who gets what money as a result. The law has it as a question of whether it was negligent or malicious/reckless, and the court has to decide that, determine who was affected, and how many times.

Re:New York

[sexconker]

Then the judge should throw the suit out with a simple finding of fact that they gave permission to have their data used in that way.

Not showing direct harm is irrelevant as the law clearly has punitive values built in. If the law was violated, then the defendant has to pay up, regardless of any harm. To find out if the law was violated, how many times, etc., you go to court and have your day. This judge denied the plaintiff's their legal recourse on irrelevant grounds.

Punitive damages exist because actions themselves are harmful beyond their direct and immediate effects and need to be discouraged beyond a mere restorative monetary assessment. This is why that guy goes around suing every business in every town he goes to for ADA violations. This dude isn't harmed in any way, yet he takes people to court (and wins) over such issues. This is the same reason we punish people who commit violent crimes not by committing the same crimes against them, but by throwing them in jail to rot.

Punishment scales in response to harm, but direct and immediate harm is not necessary for punishment to be inflicted by a court.

Re:New York

[bws111]

Your example makes no sense, because in the case of the security deposit you ARE harmed (they have your money).

Your ridiculous interpretation of the law would mean that I could sue you, and be entitled to an award, because I saw you exceeding the speed limit. Now, if your speeding harmed me (like you crashed into me), THEN I could sue you, but I sure as hell can't sue you just because I think you broke some law.

Re:New York

[bws111]

First, you seem to be confusing civil and criminal law. In CRIMINAL law all that needs to be shown is a violation of the law. Criminal law is prosecuted by the state, not individuals. In CIVIL law you have to show you were harmed, always. You have no standing to sue otherwise.

For your ADA example, there are only two possibilities: the guy is himself harmed by ADA violations (ie he has a disability and has been denied access), or he is actiing on behalf of someone else who is being harmed (n that case, the someone else would be the one receiving the damages). In either case, harm must be demonstrated. In this case, not only was no harm demonstrated (to anyone), the plaintiffs don't even try to CLAIM there was harm.

Re:New York

[bws111]

You keep repeating the same thing, and it is completely wrong. Direct quote from federal law:

For an injury-in-fact to be "concrete", it must be "real, and not abstract" and that a "bare procedural violation" under a federal statute, "divorced from any concrete harm" that "may result in no harm" would not "satisfy the injury-in-fact requirement" Id. at 1549

In other words, merely breaking the law (the bare procedural violation), in the absense of any REAL harm, does not entitle you to sue.

Please wait until after you're screwed.

[fahrbot-bot]

... saying the plaintiffs didn't show "concrete" harm from the way the gaming company stores and uses their biometric data.

Since the current and future potential problems are not known and biometric data can't really be changed, seems like it would be prudent to want to protect your biometric data *before* something bad happens, and not wait until *after* something bad happens -- you know that "concrete" harm -- that cannot really be undone.

Re:Please wait until after you're screwed.

[Luthair]

Its pretty clear these two are attempting to misuse the law. Seems obvious the law was meant to protect users from companies who incorrectly store data, instead these two were paid to appear in a video game and decided they want more money later.

Re:Please wait until after you're screwed.

[bws111]

They weren't paid to be in the game. They bought the game, and used a feature of the game to create personalized avatars. Then apparently they hatched some get-rich-quick scheme with a shyster who brought a class-action suit.

Re:Please wait until after you're screwed.

[redmid17]

Their biometric data was incorrectly stored. It was completely unencrypted. That particular law is equating, really elevatingto a higher level, biometrics to PII. Read the intent of the law. It's clearly meant to prevent companies from unsafely storing the data and punishing them if any number of things happen. Storing a face/avatar unencrypted easily falls afoul of the intent of the law. Abridged intent of law: (c) Biometrics are unlike other unique identifiers that are used to access finances or other sensitive information. For example, social security numbers, when compromised, can be changed. Biometrics, however, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.

(g) The public welfare, security, and safety will be served by regulating the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.

IL courts have already ruled, quite correctly, in similar cases in the plaintiffs defense. Unencrypted biometric is inherently unsafe and against commercial practices. PII like SSNs, card numbers, and passwords are kept encrypted. The statute puts the level of care required at least as high as PII.
https://www.illinoispolicy.org...

Re:Please wait until after you're screwed.

[bws111]

And none of that is ACTUAL HARM, which is what is required. Furthermore, they don't even CLAIM that the data was incorrectly stored, only that 'it might be'.

Re:Please wait until after you're screwed.

[Solandri]

Isn't that the way it has to be? If you can successfully sue someone for doing something which might cause you harm, that's going to stop the economy cold. The ambulance chasers would have a field day suing everyone and everything for near-misses, potential risks, negligence which had no consequences (like rolling stops, driving over the speed limit), etc.

Re:Please wait until after you're screwed.

[avandesande]

then you sue the service provider

Re:Please wait until after you're screwed.

[redmid17]

Read the attached settlement from the Illinois lawsuit before speaking. It doesn't require "actual damages."

Seriously read the settlement. Since you won't I'll paste part of the summary here:

The plaintiffs in the L.A. Tan case alleged that the company, which used customers’ fingerprint scans in lieu of key fobs for tanning membership ID purposes, violated the BIPA by failing to obtain the customers’ written consent to use the fingerprint data and by not disclosing to customers the company’s plans for storing the data or destroying it in the event a tanning customer terminated her salon membership or a franchise closed. The plaintiffs did not claim L.A. Tan illegally sold or lost customers’ fingerprint data, just that it did not handle the data as carefully as the BIPA requires.

HUH NO ACTUAL DAMAGES. Just that they were an aggrieved party whose information wasn't being stored according to the statutory requirements. Mind blowing

Re:Please wait until after you're screwed.

[bws111]

That might actually mean something if Illinois law meant anything in FEDERAL court (where this case was). Federal law is:

For an injury-in-fact to be "concrete", it must be "real, and not abstract" and that a "bare procedural violation" under a federal statute, "divorced from any concrete harm" that "may result in no harm" would not "satisfy the injury-in-fact requirement"

Here's the full text of the article

[xxxJonBoyxxx]

US Judge Rejects Suit Over Face Scanning for Video Game
Mark Hamblett, New York Law Journal
January 31, 2017 | 0 Comments
Two athletes whose images were scanned for a video game have been bounced from court on their claim that the game maker violated a law protecting biometric information.
Brother-and-sister video basketball players Ricardo and Vanessa Vigil were leading a class action that claimed Take-Two Interactive, which manufactured the NBA 2K15 game, ran afoul of an Illinois law that governs biometric identifiers such as retina or iris scans, fingerprints, voiceprints, or scans of hand and face geometry.
The Vigils agreed to have their faces scanned to create digital avatars for NBA 2K15, but said they didn't know their images would be available in unencrypted form online. They tried to hold Take-Two liable under the Illinois Biometric Information Privacy Act (BIPA) in Vigil v. Take-Two Interactive Software, 15-cv-8211.
Southern District Judge John Koeltl, in a ruling issued Monday, said the Vigils lacked standing to sue under the act because they had not alleged a concrete injury, and also failed to state a claim.
Illinois passed the BIPA in 2008 to encourage the use of biometric identifiers in commercial transactions and safeguard their use. The law governs disclosure, consent and retention requirements. Violators can pay up to $1,000 per violation, $5,000 in the case of recklessness.
The plaintiffs bar recently has been stepping up suits under the act. In 2016, a judge in the Northern District of California refused to dismiss a class action against Facebook; Six Flags is defending a lawsuit over its use of fingerprints, or finger scans, for season pass members in state court in Illinois; and Shutterfly is a defendant in an action in the Northern District of Illinois.
The Vigils said they didn't understand that Take-Two would collect and retain their images, and the company set no retention schedule for guidelines for permanently destroying biometric identifiers. They also said Take-Two failed to obtain a meaningful release.
Koeltl, however, called the purported violations of the act "at best, marginal."
"There is no allegation that the plaintiffs did not understand that the only purpose of the MyPlayer feature was to create a personalized basketball avatar for in-game play, including in multiplayer mode," he wrote. "And there is no allegation that the plaintiffs' face scans have been disseminated in any form other than to the gamers who played in multiplayer games with the plaintiffs."
Koeltl also said the heart of the complaint was that, while the Vigils agreed to have their faces scanned, they didn't explicitly consent to have their identifiers scanned and retained, a violation of their "biometric privacy."
"Regardless of whether the plaintiffs understood the ins-and-outs of the face scanning technology, or knew that their faces were 'biometric identifiers' under the BIPA, the plaintiffs plainly understood that the MyPlayer feature had to collect data based upon their unique faces to create the personalized basketball avatars," he wrote.
Robert Schwartz, a partner at Irell & Manella, said Monday that Koeltl's opinion was welcomed in a burgeoning field with little case law.
"The good thing is he gave this a comprehensive analysis," Schwartz said. "It's a road map which can guide other judges facing this novel statute."
The plaintiffs were led by John Carey and David Milian of Carey Rodriguez Milian Gonya. They did not return calls seeking comment.
Mark Hamblett can be reached via email or on Twitter @Mark_Hamblett.

Re:New York Judge/Court arguing Illinois State Law

[Anonymous Coward]

Well the idea that a New York judge is hearing a case about Illinois State Law is already suspicious but the Illinois Law does state:

He's not a New York state judicial officer, he's a Federal Judge whose court is in New York.

Which is why they can sue in Illinois

[raymorris]

They can potentially sue in Illinois, under Illinois law.
They tried to sue under federal law, which has already been explained by courts in other cases as follows:
--
For an injury-in-fact to be
`âoeconcrete,â it must be âoereal, and not abstract,â and that a
`âoebare procedural violationâ under a federal statute, âoedivorced
`from any concrete harm,â that âoemay result in no harm,â would not
`âoesatisfy the injury-in-fact requirement.â Id. at 1549
--

The federal law allows a federal suit if "concrete injury" comes from violating a state law.

the NCAA says you get nothing and yes joke classes

[Joe_Dragon]

the NCAA says you get nothing and yes joke classes are needed when the team needs 40-60 hours a week you don't have time for class.

Damn curly quotes

[raymorris]

Federal law:

For an injury-in-fact to be "concrete", it must be "real, and not abstract" and that a "bare procedural violation" under a federal statute, "divorced from any concrete harm" that "may result in no harm" would not
"satisfy the injury-in-fact requirement" Id. at 1549

Re:All judges are corrupt dumbfucks

[negRo_slim]

I'm sorry but if what passes for biometrics security can be put at risk by 3D modeling of your likeness than it would seem current biometrics is what should get fucked.

Uhhh

[Seng]

So, you scan your face to use in a game playable online, then bitch that the image of your face can be seen online?

What kind of box of rocks did those two crawl out of?

Our States has a Constitutional Right of Privacy

[WillAffleckUW]

If they lived in Washington State, they could sue.

And win.

Re:sounds like a contract dispute

[SumDog]

Yea, I mean they agreed to do the scan. I suspect they got paid for it. I'm sure the game company told them they'd have full rights, and could probably do what they want after.

I mean even if they didn't make the 3D data available, people could just dig through the game blobs and find them anyway.

Re:All judges are corrupt dumbfucks

[Penguinisto]

Worse than that, really...

A 3-D scan usually results in a very messy pile of vertices/polygons that resemble the human face. The modeler (for the game) then takes that slop and dumps approximately a zillion polys and vertices from it, creating a mesh that has at least some sort of symmetry (for ease of rendering) and a *lot* less polygons (a typical game engine used today would explode if it had to simultaneously render, on-the-fly, two full basketball teams of figures at various distances, each with 50-75k-poly meshes just for their heads, let alone the additional burden of bodies, fabric dynamics, scenery, oh, and the meshes for the refs, etc.)

Usually when the modeler is done, the head might have up to 1k polygons on it (and that's really pushing things). Add Subdividing Surfaces, and you can squeeze the polycount way the hell down, even from that. The likeness is made-up for by texture (skinning), vertex placement (which will by necessity involve a lot of movement from original), displacement/bump texturing, and perhaps (if you have the GPU cycles to spare) a bit of animation that resembles the personality of the dude being scanned (say, a trademark smile).

Meanwhile, biometric data on a human face only calculates a relatively smaller number of points (that are not as easily affected by small variations in emotion, muscular movement, etc), and has fuck-all to do with what a human would expect to see. Neither one will resemble the other in any way, shape, or form, because they're made for two totally different purposes. For example: biometrics will have, say, vertices marking the center of each pupil, whereas a game mesh doesn't give a flying frig about the eyes beyond telling subdivision make them spheres and by the way here's the UV Map image to set the texture on them.

TL;DR: You cannot (as a practical matter) make a usable mesh of the guy from biometric data, nor can you make usable biometric data from the mesh used in-game.

Re:All judges are corrupt dumbfucks

[Penguinisto]

Oh - forgot...

For the console players? Yeah, no. They most likely have pre-baked meshes to work with (to account for different-but-common facial shapes), and slap a texture on one made from a photograph. That's even more useless as a biometric base...

How about a link we can READ, numbnuts?

[wonkey_monkey]

To continue reading, become a free ALM digital reader.

Eh... no.

Are you allowed to copy/paste from a paywalled article? I guess we could ask ALM, they'd know.

Two athletes

Brother-and-sister video basketball players

They're video basketball players? That's not very athletic.

Re:sounds like a contract dispute

[bws111]

Where are people getting the idea they got paid? They are game PLAYERS who used a feature of the game to make personalized avatars. Even the plaintiffs don't make the claim that the scans ever were disseminated. Their entire case is based on speculation that the data is stored 'somewhere' and could 'fall into the wrong hands'. There is no claim that any of that actually happened.

Re:completely off topic

[DonaId Trump]

No can do, I have a YUGE tower in Mumbai and they can't afford to stay there. It serves the best curry and has the cleanest designated shitting streets!

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:sounds like a contract dispute

[Rakarra]

Where are people getting the idea they got paid? They are game PLAYERS

The summary is misleadingly-phrased. "The Vigils agreed to have their faces scanned to create digital avatars for NBA 2K15.." I think most people upon reading that, not knowing about the game feature, thought they went to the studio, sat down for a facial scanner, signed the contract, and now their likeness is in the video game, as opposed to a casual feature to create custom avatars at home.

Re:New York Judge/Court arguing Illinois State Law

[drinkypoo]

Definition of aggrieved: feeling resentment at having been unfairly treated

I don't in fact think that is the legal definition of "aggrieved". I think it's that under this law, you have claim to a grievance against you, that is, harm done as defined under the letter of the law. Hmm, yep, teh goog say "An aggrieved party can be any person whose financial, personal, or property rights or interests are adversely affected by an act of another or an order, judgment or statute. An aggrieved party is entitled to challenge the adverse decisions." It's not feeling butt-hurt. It's being able to show harm due to someone's physical or legal action. Of course, IANAL, but I do know how to internet.

Bullshit

[JustAnotherOldGuy]

"The Vigils agreed to have their faces scanned to create digital avatars for NBA 2K15, but said they didn't know their images would be available in unencrypted form online."

What? How could their images be used in any meaningful way if they aren't visible/available?

I must be missing something, this sounds like they either don't know what they're talking about OR that they were too dumb to understand that after scanning their faces (!!) their likenesses would be used for display purposes in the game. I mean, why the hell else would they be having their faces scanned??

Re:Bullshit

[Lehk228]

yup, the plaintiffs were fucking stupid. this is very common, that and "the defendant was fucking stupid" are the top two causes of lawsuits in this country

Can't sue for money in a federal class action

[raymorris]

> By that interpretation, "attempted" murder isn't a crime either, so long as you completely miss your shot, swing, swerve..

The definition is for a "crime", crimes are defined mostly in state laws. The definition has to do with what actions you have a federal class action for, suing for money due to harm caused to many people. If no harm is caused, you can't sue as a federal class action.