  Harms resulting from the development and deployment of facial processing
technologies (FPT) have been met with increasing controversy. Several states
and cities in the U.S. have banned the use of facial recognition by law
enforcement and governments, but FPT are still being developed and used in a
wide variety of contexts where they primarily are regulated by state biometric
information privacy laws. Among these laws, the 2008 Illinois Biometric
Information Privacy Act (BIPA) has generated a significant amount of
litigation. Yet, with most BIPA lawsuits reaching settlements before there have
been meaningful clarifications of relevant technical intricacies and legal
definitions, there remains a great degree of uncertainty as to how exactly this
law applies to FPT. What we have found through applications of BIPA in FPT
litigation so far, however, points to potential disconnects between technical
and legal communities. This paper analyzes what we know based on BIPA court
proceedings and highlights these points of tension: areas where the technical
operationalization of BIPA may create unintended and undesirable incentives for
FPT development, as well as areas where BIPA litigation can bring to light the
limitations of solely technical methods in achieving legal privacy values.
These factors are relevant for (i) reasoning about biometric information
privacy laws as a governing mechanism for FPT, (ii) assessing the potential
harms of FPT, and (iii) providing incentives for the mitigation of these harms.
By illuminating these considerations, we hope to empower courts and lawmakers
to take a more nuanced approach to regulating FPT and developers to better
understand privacy values in the current U.S. legal landscape.
