Slashdot Mirror
Illinois Supreme Court Rules Against Six Flags in Lawsuit Over Fingerprint Scans, Says Actual Harm Unnecessary For Biometric Case (chicagotribune.com)
The family of a teenager whose fingerprint data was collected in 2014 when he bought a season pass to Six Flags Great America had the right to sue the amusement park company under an Illinois privacy law, the state Supreme Court ruled Friday. Chicago Tribune reports: The case is being closely watched by tech giants such as Facebook, who have pushed back against the Illinois Biometric Information Privacy Act (BIPA). The law requires companies collecting information such as facial, fingerprint and iris scans to obtain prior consent from consumers or employees, detailing how they'll use the data and how long the records will be kept. It also allows private citizens to sue, while other states let only the attorney general bring a lawsuit.
The opinion, which overturns an appeals court ruling in favor of Six Flags, has the potential to effect biometrics lawsuits playing out in courtrooms across the country. The Illinois law is one of the strictest of its kind in the nation and has turned the state into a hotbed of lawsuits over alleged misuses of biometric data. Privacy experts say protecting that type of information is critical because, unlike a credit card or bank account number, it's permanent. The National Law Review adds: In short, individuals need not allege actual injury or adverse effect, beyond a violation of his/her rights under BIPA, in order to qualify as an "aggrieved" person and be entitled to seek liquidated damages, attorneys fees and costs, and injunctive relief under the Act. Potential damages are substantial as the BIPA provides for statutory damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation of the Act. To date, no Illinois court has interpreted the meaning of "per violation," but the majority of BIPA suits have been brought as class actions seeking statutory damages on behalf of each individual affected.
The opinion, which overturns an appeals court ruling in favor of Six Flags, has the potential to effect biometrics lawsuits playing out in courtrooms across the country. The Illinois law is one of the strictest of its kind in the nation and has turned the state into a hotbed of lawsuits over alleged misuses of biometric data. Privacy experts say protecting that type of information is critical because, unlike a credit card or bank account number, it's permanent. The National Law Review adds: In short, individuals need not allege actual injury or adverse effect, beyond a violation of his/her rights under BIPA, in order to qualify as an "aggrieved" person and be entitled to seek liquidated damages, attorneys fees and costs, and injunctive relief under the Act. Potential damages are substantial as the BIPA provides for statutory damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation of the Act. To date, no Illinois court has interpreted the meaning of "per violation," but the majority of BIPA suits have been brought as class actions seeking statutory damages on behalf of each individual affected.
Good.
A law saying it's illegal to collect such information without consent would be completely worthless you were not allowed to sue the company for violating it.
http://www.geoffreylandis.com
..."Someone's lookin' to get PAID".... that's all this BS is good for..... They didn't have their rights violated......probably a lawyer cold-called the plaintiff looking for a fat payday....
with letting the FBI arrest a man for a non violent process crime in a pre dawn raid while heavily armed and armored. While CNN was tipped off and is filming so they get the perp walk. Like this is some 20th century dictatorship.
But we freak out if an amusement park takes a fingerprint.
Priorities people. Your desire for revenge is your undoing.
This is going to be overturned by the Conservative Scotus. "No damage required for standing" is a long-debunked trope in that credibly-devolved "august" body. No question or doubt, they will blow this ruling away.
I have a pass at that very Six Flags, and I have to fight almost every time to not do the fingerprint scan. This ruling may change that.
A hair and saliva sample later.
Seriously, why would anyone have thought this was a good idea?
What constitutional grounds would justify SCOTUS hearing such a case regarding Illinois state law?
On what grounds? They don't get to interpret or apply an Illinois statute, they merely get to determine if the statute violates the *federal* Constitution. If you've got a theory, let's hear it.
That article sure left lots of questions unanswered, anyhow here are the details
The mother of the kid purchased season pass, for the kid, at Six Flags.
The kid, age 14, went to six flags and picked up his ticket and at that time was fingerprinted, per standard policy for season tickets.
Mother sued six flags since she had not given premission and him being a minor.
Various courts have tossed it back and forth on the bases that the mother could show no type of injury.
This time the Illinois Supreme Court ruled against six flags. The reason being that the state law does not require them to sure injury.
You're joking right? Someone ask this guy if he's joking for me, I'm still busy trolling the idiotic liars pretending Roger Stone is Fred Rogers. SCOTUS > State law.
Supremacy clause and the 10th Amendment being basically ignored.
What constitutional grounds would justify SCOTUS hearing such a case regarding Illinois state law?
"constitutional grounds"?
The Supremes operate on nothing but "muh feels" these days, bucko!
Maybe it's important to somebody's understanding of their place in the universe ... that's apparently enough to strike down laws these days.
Photography is protected by the first amendment as affirmed by federal courts. The collection of facial biometrics can be defended based on that. Furthermore, the collection of fingerprints can be argued to be a form of photography.
"They don't get to interpret or apply an Illinois statute" Yes, they do, when they find standing to because they want to. Biometrics isn't an Illinois only thing, Federal interstate commerce is still their bailiwick. It's 98% their discretion.
It may not progress off this individual case to get to them, that's true, but it will get to them one way or another if they want that. There are plenty of legal tanks ready to float test cases on every legally controversial topic.
Watch and learn.
The 10th Amendment says exactly that the States can do this.
Supremacy clause always has let States make stricter rules, additional rules. There has to be a Federal Statute that directly contradicts the State law in the first place, you can't just wave your hands and say that something isn't allowed in Federal courts and have that mean it isn't allowed in State courts. Supremacy clause resolves conflicts between State and Federal law, it doesn't contradict the 10th Amendment.
Most people would see this as a good thing. If you have a problem with it, don't bother going to Disney either.
No it can't. No, they can't.
First, if it's speech at all, it's commercial speech. Moreover, Illinois has a substantial government interest in protecting the privacy of its citizens' biometric information, and the statute is not overly broad.
Perhaps you mean to argue that the consent aspect of the law is impermissibly compelled speech? That way it might actually relate to the case before the court instead of whatever you're reaching for about photography.
Can i someone in Illinois sue google for allowing google photo to identify there face in a picture they didn't upload?
âoeTolerance applies only to persons, but never to truth. Intolerance applies only to truth, but never to persons.
Purchasing the passes is you granting them consent
reminds me of that game we'd play in jr high on friends/little brothers.... we'd barely whisper something like "say 'huh'/'what' if you want me to punch you in the arm"
of course, being barely audible, the little brother would say "huh?" and we'd then proceed to punch him in the arm stating that he asked for it cuz he said 'huh'
it was an 'agreement' done in bad faith then and it's the same thing here
Scott McNealy: You have zero privacy anyway. Get over it.
If Privacy is really dead, then Scott should publish his Name, Address, Account Numbers and passwords, location schedule, and DNA profile and always keep them all current. Until then, it's NOT.
It's one thing to lose my credit card number. Annoying, but I can get another. Same for my throw-away online accounts.
It's slightly harder for more important accounts, like my slashdot account -- I'd lose all my Karma standing and have to start over! Other accounts are the same: VERY annoying but not Earth shattering.
Getting doxed - the info used to be in the physical phone book, but now it's easy to tie "a fact" to "someone" and "know where they live." Now bother becomes heightened senses if not outright fear, and possibly having to actually uproot and move. Across the street, across town, across the country.
Now you lose my name and reputation with Identity Theft. Inverse doxing, I'm still me but so is someone ELSE. I _COULD_ change my name, but I don't want to. And it's Hell trying to prove what's actually you and what isn't.
FINALLY, you lose my biometrics? Movie hacker: "Computer: 'Override.' We're in." I _CAN'T_ change those, period. At all.
Just because I have nothing to hide doesn't mean that I want you to see.
If the universe is someone's simulation -- does that mean the stars are just stuck pixels?
I'll watch and learn once you learn some legal basics.
Standing relates to the ability of the ability of plaintiffs to have their case heard at all. Clearly, the Illinois court found that the plaintiff does indeed have standing.
If you're telling me the US Supreme Court would accept a ham sandwich's standing to sue to have this law declared federally unconstitutional, fine. But they still need an actual rationale about why it's unconstitutional. Your view about interstate commerce is oversimplified and wrong: the commerce clause prevents states from regulating commerce only in certain ways, in others the states and Congress retain concurrent power. The situation at hand is simply not one of those areas, and Congress certainly hasn't pre-empted action in this sphere with its own regulation.
Bonus tirade: the Illinois courts decide standing in Illinois courts. The federal concept of a standing requirement comes from the grant of power FROM the states TO the federal judicial branch to decide 'cases and controversies' of certain types. (A lack of standing means that the courts have no power to hear the case or order an outcome, because there is no 'case or controversy.') The Court could indeed decide there is a case or controversy between my dog and the enforcement of this statute, but they'd still need a reason to find in favor of my dog.
hopefully that trend will start to reverse as we get more Justices who actually believe that words have meanings at the time they are spoken and the meaning of a sentence doesn't change over time because it means what it was intended to mean, not what you want it to mean today.
Of course the SCOTUS has always picked cases based on the perception that the case actually has a valid constitutional issue that is important and unresolved. So it might not help much in which cases they decide to pick up. It should help in the consistency of their decisions however.
âoeTolerance applies only to persons, but never to truth. Intolerance applies only to truth, but never to persons.
This assertion is being challenged and you can go right around it if state law touches interstate commerce. Sorry, you don't understand how this works. The 10th is not the only law and you didn't interpret it properly.
The fact that 6-flags is a multi-state company alone probably is enough to get around this notion of yours that states can do whatever they want.
well, if you don't want to be identified, reasonably they don't want to do business with you. Basically the reason they collect this info is because they don't accept you r possession of the ticket as proof you are who you claim to be. It is an anti counterfeit, anti scam measure that they wouldn't implement unless they thought it saved them money. I'm all for a law saying they have to tell you what they collect and what they do with it so you can consent, however, there is no reason to expect them to sell things to people who don't consent. ( is that part of this law?)
âoeTolerance applies only to persons, but never to truth. Intolerance applies only to truth, but never to persons.
The 10th Amendment says exactly that the States can do this.
The 10th Amendment is routinely ignored by justices on both the left and right.
If the 10th Amendment were interpreted literally, most of the federal government would have to be dismantled.
He's a deregulating, "pro business", small gubmnt, nutjob who thinks anything a corporation does is above-board by default and in no way shape or form exploitational....ever.
He needs a one way bus pass to any south american banana republic and a lengthy stay in the areas supplying his drugs to be forced to see why he is so horribly wrong. He's not intelligent enough to be dissuaded otherwise...
Photography is protected by the first amendment as affirmed by federal courts.
Photography in public, where there is no expectation of privacy, for noncommercial purposes is protected. Most people would not consider a fingerprint scanner to be collecting public information.
The collection of facial biometrics can be defended based on that.
Quite likely. But they didn't scan the kid's face. They scanned his fingerprints. Most people would consider that a greater impingement on privacy.
Furthermore, the collection of fingerprints can be argued to be a form of photography.
Maybe. But that is the point of this ruling: they have to make that argument in court. They can't just have the case dismissed with a lack of standing argument. The court didn't say the plaintiff win, just that the case can proceed.
Six Flags may also argue that they didn't store the fingerprint, but only a hash. Since there are many ways to generate a hash, and not every hash is unique, they could argue a hash is not "personally identifying information". Not sure if the court would agree.
The 10th Amendment says exactly that the States can do this.
The post you were replying to was only nine words long, yet you only managed to read two-thirds of it?
If you place your finger in the scanner, isn't that consent?
We are working on it.
--The Constitutionalists
How many people look like you AND would lend an ID? Inside-the-family fraud like that is a drop in the bucket of what they're trying to guard against anyway, it's tiny fish compared to the real scammers to stop.
Legally inside-the-family sharing is probably legal, considering we're likely talking about guardians and sibling minors in your scenario anyway.
In our State Constitution.
As does the entire nation of Canada.
And most of the EU.
Ooh, going to be a lot of suits.
-- Tigger warning: This post may contain tiggers! --
hopefully that trend will start to reverse as we get more Justices who actually believe that words have meanings at the time they are spoken and the meaning of a sentence doesn't change over time because it means what it was intended to mean, not what you want it to mean today.
We can hope, but I think we're stuck with this new definition of the second amdendment.
Why is Illinois the only state with a common sense bio-metric law? We need the same in every state if we are to have any hope of avoiding facial recognition and bio-metric data abuse by corporations and government. My gym tried to get me to give a thumb scan to access the gym, but at least they had a practice of allowing showing ID at entry as an alternative, else it would have turned into a rather unpleasant conversation. My wife wants me to get TSA pre-check or Global Entry to speed up our travels, but I'm not sure I can stomach sharing full fingerprint data with the U.S. government.
Uh, no. Just because a company is a mult-state entity has nothing to do either the 10th amendment or interstate commerce. In fact, a multi-state entity that has an actual presence within the state grants the state courts both personal and original jurisdiction, and based upon the 10th amendment, Illinois may definitely introduce legislation restricting the usage of biometrics data. There's nothing in the Constitution that specifically reserves the power to regulate biometrics data to the Federal Government. Whether biometrics data usage is considered "commerce" and therefore will allow for some type of original jurisdiction under the commerce clause is open for debate. In practice the Federal Government has broad powers to regulate anything it wants (either through the Commerce Clause or the Necessary and Proper clause). However, barring specific statutes enacted by Congress (or derivative thereof) or agencies that have been empowered by Congress that have oversight in this area, the supremacy clause would not apply.
" Illinois may definitely introduce legislation restricting the usage of biometrics data" - Never said otherwise. I said the SCOTUS could overrule them, and will. Pay attention stupid. You misread.
" Your view about interstate commerce is oversimplified and wrong " I never stated my view of interstate commerce, I just mentioned that in passing as a single over-broad series of legal arguments that could be brought.
And then the SCOTUS would choose to hear such a case and rule broadly about biometrics, affecting or destroying the state laws that would conflict in various complicated ways I didn't go into nor would I unpaid.
LEARN TO READ PLEASE, you aren't quoting or paraphrasing me at all, you're making shit up and trying to say I said that. Fuck you very much for doing so, it's very clear you are not involved in the legal profession at all.
The 10th Amendment is routinely ignored by justices on both the left and right.
If the 10th Amendment were interpreted literally, most of the federal government would have to be dismantled.
As it should. It has grown too much.
Please, please stop opining about IP, it makes my head hurt to find you constantly modded up.
First, copyright protects the particular expression of an artistic idea. Period. So no biometrics is protectable at all. Perhaps you believe the phone book is copyright-protected? That the fake numbers inserted somehow are artistic? Then look that stuff the fuck up so you'll realize it doesn't work that way.
Photography in public, where there is no expectation of privacy, for noncommercial purposes is protected.
WTF? Photography in private for commercial purposes is protected too. What the living fuck could this possibly mean? You show me the artistic choices being made in a fingerprint scan, and I'll show you how it's subject to copyright. We'll both come up empty.
In fairness, I realize now you mean subject to the protections of the First Amendment. But you still don't understand it.
Yes, you can take a picture, but you can't use it to defame me. Or, in this case, invade my privacy- as defined by Illinois statute.
Where did you go to law school?
I understand your larger point, and I quite agree that anyone who claims they don't care about privacy is lying, but you'll understand if I don't want someone else's choices determining the value of my privacy. I say privacy matters to us all even if someone claims otherwise (as glib sycophants on /. sometimes claim without challenge or evidence).
Actually, everyone has something to hide. And that's not even the strongest reason why we all need privacy.
Glenn Greenwald was discussing privacy with Noam Chomsky and Ed Snowden and Greenwald brought up his email account just to put the lie to people who argue that they have nothing to hide (around 29m37s). He tells them to email him the credentials of every account they have—not just the nice accounts like work, email, bank, and phone, he said—all of the accounts including the accounts people keep secret from their spouses and significant others. He tells them he intends to snoop around on those accounts to see what they've been doing, and so that he can become their impostor. After all, if they have nothing to hide then they have nothing to fear by telling him what they're really up to.
The result? Greenwald said:
This also gets into why privacy matters most—a far stronger reason to value privacy both in the abstract and in one's own life is that "Privacy protects us from abuses by those in power, even if we're doing nothing wrong at the time of surveillance." as Bruce Schneier points out in an essay he posted:
Digital Citizen
This just in: people are static entities that never change over the course of several decades! Language never evolves either! Both are true if they support leftie AC's agenda! NEWS AT 11!
Fuck off with your retardation.
By your internet lawyer standards, medical records are not protectable because they are not "the particular expression of an artistic idea." Copyright is not the only thing that can protect data. Your legal prowess seems to be suffering from a bout of Dunning-Kruger. ShanghaiBill is incorrect in the "non-commercial" aspect because commercial public photography is granted the same First Amendment protections as non-commercial public photography. You are correct that private photography is also protected generally, but there are several exceptions to that protection related to a person's reasonable expectation of privacy. None of that has anything to do with a fingerprint scan which is collection of unchangeable biometric data.
As it is commonly pointed out on Slashdot, fingerprints are usernames, not passwords.
So what if an amusement park uses them? They are less privacy invading than a simple picture, and very convenient.
The ones who should be sued are not companies who collect them but the ones who use them for reasons others than checking your physical presence. The way Six Flags uses them is exactly how they are meant to be used.
Of course, they are still personal data but why focus specifically on fingerprints when they are not too different from your full name or birth date.
You're can only argue that a fingerprint is photography if the method used to collect it appears as such. Please note that you cannot use your phone's camera as a fingerprint scanner. Nor can this be done with "normal" processing of film. Yes there exist cameras which can acquire an image with enough detail that one can aquire someone's fingerprints even at some distance. However, this is not something you would expect to see on current consumer grade equipment. So currently we need special equipment to get finger print data. This may change in the future, but as of now the argument is invalid.
As to the hash argument. By definition a hash is never guaranteed to be unique. (I accidently corrupted a hash table once when I thought I could get away with not compensating for this.) But this does not create an exemption, as even your biometrics are not guaranteed to be unique to you. Identical DNA has been found in humans, similar Iris paterins, and don't get me started on the number of cases which were in error due to relying on fingerprints. A hash can point to you as much as any other known biometric data.
Yes, a picture can be used to defame you. Yes, a picture can be used to invade your privacy, assuming your expectation of privacy was unreasonable. The First Amendment allows both of those things. The civil right to sue for defamation is not part of the First Amendment and has a very high bar to clear. A lot of things that people assume are private aren't actually considered to be private; if someone standing in the street can see (through the front window of your house that faces the street, for example) you getting dressed or boffing a tranny or handing money to a politician and takes a picture of it and shows it to people, that's fair game and totally legal and you can't do anything about it.
It is clear that you DIDN'T go to law school because this stuff isn't even advanced material. Any lawyer knows this. If you're a lawyer, you're a really shitty one.
Fine.
And then the SCOTUS would choose to hear such a case and rule broadly about biometrics, affecting or destroying the state laws that would conflict in various complicated ways I didn't go into nor would I unpaid.
They can't "affect or destroy" laws they have no jurisdiction over. First, they'd have to find that it implicates interstate commerce more than it is an expression of the police power of Illinois. Then they'd have to find that Congress intended to and DID regulate the activity. There is simply no such law, and it's the equivalent of arguing that a state can't outlaw murder with guns because some companies sell guns across state lines.
The "ways" aren't that "complicated," and frankly I'm shocked anyone would pay you to analyze anything.
Maybe you're fixated on the nominal limits of the Supreme Courts' power being just empty words. OK. Then you'll permit me to observe that the city councilman sitting next to me has just impeached and convicted the President. Long live President Pence, no?
No, that's if the 10th Amendment was interpreted in an insane and inconsistent manner, as explained to you on AM radio.
If it is just, the thing that has existed for 250+ years, then no, it would literally just be the status quo.
The 10th Amendment is why California has stricter air standards than the Federal government. It has always been this way.
Belief that the 10th Amendment contradicts the existence of the Federal Government is just stupid-sauce that defeats itself; surely the founding fathers didn't think those few words invalidated the rest of the words, so why do you think so? Stupid sauce.
If you mean those things aren't subject to prior restraint, you should say so instead of arguing that the first amendment "protects" such things. We could lower the standards to prove libel defamation etc at any time and not run afoul of the first amendment. Perhaps you think the NYT and public figures somehow sets the bar for random individuals and private citizens.
Who's a shitty lawyer?