Facial Recognition Application in the Workplace

By Anthony Kaylin, courtesy of SBAM Approved Partner ASE

Facial recognition software is becoming less niche and more prevalent in everyday life. Facial recognition is a biometric technology that uses distinguishable facial features to identify a person.  The issue is whether our rights to privacy are outweighed by images found on the internet. 

A major player in facial recognition is Clearview AI, an American technology company that provides facial recognition software primarily for law enforcement agencies. The company has developed technology that can match faces to a database of more than three billion images scraped from the Internet, including social media applications.

The imagery of traditional facial recognition programs has been considered insufficient to make IDs of individuals.  Clearview AI has such an expansive database that matches are proven more correct than the traditional IDs.  And if traveling to various countries such as China or Great Britain, it is assumed that there is an implicit agreement that personal images are publicly usable by government authorities.

Why is this an issue for employers?  Because employees put so much out there on the internet, and employers often have employee photos and headshots on their website.  These facial recognition programs are datamining the images.  States are now stepping in to protect employees from employers use of this type biometric data.  Just like the National Labor Relations Act protects employee speech if concerted effort, biometric laws are now being passed by states to protect employee imagery. 

Illinois has one of the strictest biometric laws in the country.  Although the Biometric Information Privacy Act (BIPA) was passed in 2008, biometric litigation floodgates were opened by the Illinois Supreme Court’s decision in Rosenbach v. Six Flags Entertainment Corp., 2019 Ill. Lexis 7 (Ill. Jan. 25, 2019).  Although this is an Illinois law, Michigan is currently considering similar legislation.

Rosenbach’s son visited the Six Flags Great America amusement park in Gurnee, Illinois on a school field trip when he was 14 years old. In advance of the trip, Rosenbach purchased a season pass for her son online, but the process could not be completed until Alexander appeared in person at the amusement park. When he did appear, Alexander was asked to scan his thumb into Six Flags’ biometric data capture system, and after he did so, he was provided a season pass card.   Rosenbach won a class action lawsuit for her son and all those similarly situated.

Rosenbach claimed she did not know of the fingerprinting requirement and that her son was never informed about the purpose and term for which the fingerprints were collected. Rosenbach also alleged they never signed any written release regarding the son’s fingerprints, and neither of them consented in writing “to the collection, storage, use[,] sale, lease, dissemination, disclosure, redisclosure, or trade of, or for [Six Flags] to otherwise profit from, Alexander’s thumbprint or associated biometric identifiers or information.”

Currently, there is a class action pending against Facebook for inappropriate uses of images.

Biometrics is used by employers in different ways, for example, time keeping and security access.    Biometrics is also used by employers in wellness programs.  Under Illinois law, the biometrics obtained must be stored with an expectation of confidentiality and privacy.

The BIPA has the following requirements:

Where employers can specially have trouble are the use of thumbprints on time check in and outs, use of retina scanning technology, not only for room entrance (James Bond anyone?) but also for computers and cell phones.  

If Michigan passes such a law, it will be very important for employers to review policies and practices with their legal counsel.  It could be very costly otherwise.  And for those with operations in Illinois, it is almost mandatory to have done so already, and if not yet, as soon as practicable.