Meta, the parent company of Facebook and Instagram, has agreed to a $1.4 billion settlement for a lawsuit filed by the state of Texas over allegations of unlawfully using biometric data through its facial recognition technology.
The lawsuit was filed in 2022 under Texas’s Capture or Use of Biometric Identifier Act, which provides for damages of up to US$25,000 per violation. It centres on Facebook’s ‘Tag Suggestions’ feature, which Facebook rolled out automatically to users in 2011. The feature used facial recognition technology to suggest tagging people in photos and was aimed at enhancing the user experience by making it easier to tag friends. The state of Texas alleged that this feature collected biometric data from millions of Texans without user consent.
The settlement is the largest ever secured by a single US state for privacy violations, but is not “an admission or evidence of any violation of any statute or law.” As part of the agreement, Meta will pay the amount over five years.
What does this mean for Australian organisations?
In Australia, biometric information falls within the scope of ‘sensitive information’, which is afforded a higher level of protection. In general, individuals must give their prior consent before biometric information can lawfully be collected. The Office of the Australian Information Commissioner has previously made determinations regarding the collection of biometric information by Clearview AI and 7-Eleven and has an ongoing investigation into the personal information handling practices of Bunnings and Kmart, with a focus on their use of facial recognition technology in stores.
These cases are an important reminder of the importance of complying with privacy laws and ensuring valid and informed consent is obtained prior to the collection of sensitive information such as biometric information, particularly in light of the significant civil penalties that could apply under Australia’s Privacy Act.
For more information, please contact Sarah Gilkes, Sophie Bradshaw or Janice Yew.
