谷歌、Facebook的面部识别技术遇上大麻烦

到底要等到什么时候，才能要求企业在获得许可后方可采集指纹或面部等生物数据？最近该话题在美国伊利诺伊州成了热门，因为一项有争议的法律可能导致Facebook和谷歌等科技巨头为面部识别工具赔偿数十亿美元。

上周联邦法院发现，谷歌照片工具为同一用户创建相册而扫描面部并未违反法律，谷歌也稍微得以喘息。美国地区法官张宜民在一份长达28页的裁决中表示，谷歌确实未经许可扫描了面部，但没有造成伤害，不支持原告根据法律要求每次违规赔偿1,000至5,000美元。

表面来看，该判决对Facebook来说是个好兆头，去年Facebook因用户上传照片时可标注面部的“标签”工具败了官司。目前Facebook正在上诉，理由与谷歌类似，即起诉者只证明生物信息未经许可被使用还不够，要证明受到某种伤害。

为什么Facebook和谷歌的判决不同？部分原因可能是两家公司使用扫描结果的方式不一样。谷歌的照片工具只是帮助用户整理照片，而Facebook的“标签”工具可为第三方识别用户。更重要的原因可能是2016年美国最高法院的Spokeo v. Robbins案例，其中规定了用户可就隐私侵犯提起诉讼的情形。

法律学教授埃里克·戈德曼就最近谷歌案判决发表了一篇博文，其中称Spokeo一案判决简直是“司法上的胡闹”，导致法院理解伊利诺尼州生物识别法时出现混乱。

在Spokeo案中，最高法院驳回了涉及身份经纪人服务的裁决，起因是该项服务在数据库中错误识别了某位客户的几个特征。最高法院发现，下级法院草率认定客户受到了必要伤害便提起诉讼，将判决驳回并要求进一步审理。

由于缺乏最高法院的具体指导，到底出现哪些类型的隐私侵权可以要求经济赔偿方面不断出现混乱。

在伊利诺斯州生物识别法方面，州最高法院将就六旗游乐园收集指纹案作出裁决。争论焦点是根据法律规定，如何才算“受害”一方。支持保护隐私权的人们说，立法者出台法律的初衷是生物信息未经许可被利用时便达成“受害”的构成要件，但企业坚持认为一定要出现特定形式的伤害方可成立。

杰伊·埃德尔森认为上周张宜民法官的裁决不会影响此案，他旗下的律师事务所正组织针对Facebook的集体诉讼。

“我们认为谷歌案的裁决不会产生重大影响。大家都在等待伊利诺伊最高法院的判决，最终结果关系重大。”埃德尔森发电子邮件对《财富》杂志称，还补充说坚信Facebook照片标签显然违反了法律保护的隐私权。

Facebook没有立即就有关此案的发表评论。谷歌案的原告律师拒绝透露是否会提起上诉。

随着各企业越来越多利用面部识别和其他生物识别技术，短期内与之有关的法律争议应该不会消失。围绕伊利诺伊州生物识别法的争议也会持续，2016年科技业曾大力游说过一轮但只是徒劳。（财富中文网）

译者：Charlie

审校：夏林

When must companies receive permission to use biometric data like your fingerprints or your face? The question is a hot topic in Illinois where a controversial law has ensnared tech giants Facebook and Google, potentially exposing them to billions in dollars in liability over their facial recognition tools.

Google got a reprieve last week when a federal court found that a Google Photos tool, which scans faces in order to create galleries of the same individual, did not violate the law. In a 28-page ruling, U.S. District Judge Edmond Chang said Google did indeed scan faces without permission—but that the people affected didn’t suffer any harm and therefore didn’t qualify to collect under the law, which provides victims $1,000 to $5,000 per violation.

On its surface, the ruling is encouraging for Facebook, which lost a case last year over a “tag” tool that identifies faces when people post photos. Facebook is currently appealing the ruling, and using an argument akin to the one Google made: It’s not enough for someone to show their biometric data was used without permission; the person must also demonstrate some sort of harm.

So why the different rulings in the Facebook and Google cases? Part of the reason may lie in the different ways the companies used the scans. Google’s Photos tool only helps someone organize their own photos, while the Facebook “tags” identify people to third parties. But a bigger cause may lie in the ongoing fallout from an important 2016 Supreme Court decision, Spokeo v. Robbins, that attempted to define when people can sue over privacy violations.

In a blog post on the recent Google decision, law professor Eric Goldman described the Spokeo ruling as a “judicial clusterfuck” that has complicated courts’ attempts to make sense of the Illinois biometric law.

In Spokeo, the top court overruled a decision involving an identity broker service who misidentified several attributes of a man in its database. It found that a lower court had been too quick in concluding the man had suffered the necessary harm to bring a lawsuit, and sent the decision back for further review.

The lack of specific guidance from the Supreme Court has since produced ongoing confusion over what type of privacy violations can let people seek financial damages.

In the case of the Illinois biometrics law, the state’s Supreme Court is set to rule on a case involving fingerprints collected by Six Flags amusement park. The case turns on who counts as “aggrieved” under the statute. Privacy advocates say legislators wrote the law intending for anyone whose biometrics were used without permission to be considered “aggrieved,” while companies have insisted there must be some specific form of harm.

Jay Edelson, whose law firm is leading the class action against Facebook, believes Judge Chang’s ruling last week will not affect the case.

“We don’t think the Google ruling will have any significant impact. Everyone is waiting for the Illinois Supreme Court to rule and that will be a significant event,” Edelson tells Fortune by email, adding that he believes the Facebook photo tags are clearly a privacy violation covered by the law.

Facebook did not immediately reply to a request for comment about the case. Lawyers for the plaintiffs in the Google case declined to say whether they will file an appeal.

As companies expand the use of facial recognition and other biometrics, the legal controversies are unlikely to go away anytime soon. Those include those surrounding the Illinois biometrics law, which the tech industry lobbied unsuccessfully to change in 2016.