Court rules companies can be sued for collecting biometric data without consent

A reminder of how quickly the technology world evolves; it’s not only regulations which need to catch-up, but business practices too, as a Supreme Court opens the door for privacy lawsuits.

In an interesting case, the Supreme Court of Illinois has set precedent for its Biometric Information Privacy Act (BIPA). Companies who have not appropriately obtained consent from individuals before storing biometric data can now be sued under the BIPA without said individual being damaged, fraud for example, by the scenario. The ruling makes BIPA a dangerous piece of paper, as effective use of the Freedom of Information Act could put a few in precarious positions.

This case, Rosenbach versus Six Flags, has pinned a 14-year-old against the amusement park for collection and storage of thumbprint data without informed consent. The BIPA prohibits companies from gathering, using, or sharing biometric information without informed opt-in consent, though the issue which the Supreme Court has been considering is whether there are grounds for a lawsuit without damage being inflicted to the user.

“Contrary to the appellate court’s view, an individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under the Act, in order to qualify as an ‘aggrieved’ person and be entitled to seek liquidated damages and injunctive relief pursuant to the Act,” stated Chief Justice Lloyd Karmeier in his decision.

But why is this a dangerous decision for businesses locating or operating in Illinois? Because business practises are not keeping up with the tsunami of data which emerging, and many companies do not have fully visibility into the data which they hold.

One of the problems we saw in the build up to General Data Protection Regulation (GDPR) in Europe was an understanding of what data companies actually had their hands on. With the 21st century’s version of a land-grab seeing companies scrap for as much information as possible through the last decade, few companies actually managed to effectively store and categorize.

Before any company can consider calling themselves complaint (under GDPR, BIPA or any new data-orientated regulations) a full data audit would have to be completed; this discovery process was a critical step in the process. In conversations over coffee, a few consultants told us this was a significant issue for UK companies. During the audit, some were finding they were holding onto sensitive data, which they had no idea existed, and were in violation of data privacy and protection regulations.

BIPA is a no-where near as wide-ranging as some data protection and privacy regulations, though we suspect there will certainly be numerous companies who are now non-compliant under this new ruling and precedent. This is the issue with technology; it’s moving so much faster than the red-tape bureaucrats. Technology is implemented before regulations governing the usage, or business practises to ensure compliance, can be deployed. It creates a dangerous position where companies could be non-compliant without even realising.

In Illinois, as there no-longer needs to be proof of damages to individuals anymore, effectively placed Freedom of Information Acts could see similar cases brought in-front of the courts. In the rush to remain relevant through embracing technology, few have considered the boring aspect of regulation. Who would, considering how long it takes the courts to catch-up? But this is a case where being cutting-edge technology is a two-edged sword.

Supreme Court ruling threatens tax raid on eCommerce

A ruling in the US Supreme Court may force internet based businesses to collect sales tax in States where the company does not have a physical presence, killing off any advantage which may exist over brick-and-mortar businesses.

The Supreme Court ruled 5-4 to overturn a law dating back to 1992, potentially offering states the opportunity to collect billions in sales tax from eCommerce. The ruling in question, Quill v. North Dakota, focused specifically on mail-order and catalogue purchases stating a business must have a physical presence in the state for purchases to be subject to sales taxes.

While the 1992 ruling has been used as precedent for many other decisions throughout the US, two years ago South Dakota challenged the precedent, passing a law which required any business which has more than $100,000 in annual sales or engages in 200 or more separate transactions, pay a 4.5% tax on all sales. The Quill v. North Dakota was brought to the Supreme Court by South Dakota as a means to reconcile its own law, with the latest 5-4 ruling set to cause chaos for the digital economy. While the individual states generally operate somewhat independently, there should be little surprise if the internet players start getting taxed from all directions.

In terms of justification, Justice Anthony Kennedy was quite plain when delivering the opinion of the court; times have changed and therefore so should laws.

As you can see from the above tweet, there are certainly some supporters for the move. President Trump has made no secret for his dislike for the Amazon business model, though only philosophical thinkers will be able to determine whether this is a hatred of eCommerce on the whole, or simply a distain for Amazon CEO Jeff Bezos. Amazon has been the focal point of Trump’s attacks to date, but the Supreme Court ruling will not be as laser focused; every eCommerce business will be hit.

Although not exactly the same, the effort to hold online retailers accountable to greater taxation is very similar to the work taking place in Europe to get the internet giants, such as Facebook, Amazon and Google, to pay more taxes in the European Union. The message across the world seems to be quite simply; we’re going to stop you from taking advantage of the grey areas in the law.

While the man on the street might revel in the thought of big business being held accountable, we suspect this elation might be short lived. The cost is likely going to be passed onto the consumer with goods increasing in prices to compensate for the extra tax. Trump and his cronies might preach about a victory for Americans, tackling injustice as crafty lawyers circumnavigate the murky waters of legislation and regulation, but ultimately the consumer will end up with less money in the bank account.