• by Wendy Davis  @wendyndavis, August 31, 2015

An Illinois resident who is suing Shutterfly for allegedly compiling a "tremendous, Orwellian electronic database of face scans" is urging a federal judge to reject the company's bid to dismiss the lawsuit.

Robert Norberg argues in court papers filed on Friday that Shutterfly's faceprint database is "offensive to reasonable expectations of privacy."

Norberg, who says he never signed up for Shutterfly, alleged in a lawsuit filed in June that his faceprint was added to the company's directory after his photo was uploaded to the service, and tagged with his name, by someone else. He argues that Shutterfly's alleged practice violates the Illinois Biometric Privacy Law -- a 2008 law that prohibits companies from storing people's "biometric identifiers," including scans of face geometry, without their consent.

Shutterfly has asked U.S. District Court Judge Charles Norgle in Illinois to dismiss the lawsuit, arguing that faceprints derived from photos aren't covered by the 2008 law.

The statute itself excludes photos from the definition of "biometric identifiers," even though scans of face geometry are included in the definition. Another provision of the law says that "biometric information" doesn't include information derived from photos.

Shutterfly argues that taken together, those definitions mean that faceprints derived from photos aren't covered by the 2008 law. The company also contends that Illinois lawmakers passed the privacy law due to concerns about companies' use of data for security screenings or financial transactions, as opposed to concerns regarding scans that help consumers organize online photo albums.

But Norberg says that interpretation is incorrect.

"By Defendants’ logic, nothing would stop them from amassing a tremendous, Orwellian electronic database of face scans with no permission whatsoever so long as the data base were derived from photographs," he argues. "And indeed, that appears to be exactly what they are doing."

Norberg adds that other biometric identifiers covered by the Illinois law -- which also regulates the collection of retinal scans, voiceprints and fingerprints -- stem from "visual or audio media."

"If the intermediation of a photograph or audio recording excused all subsequent processing into a biometric identifier, defendants’ interpretation of the exception would swallow the rule," he argues.

Shutterfly isn't the only company accused of violating the Illinois privacy law. Facebook also is facing a separate potential class-action lawsuit for allegedly compiling a database of faceprints. That matter was recently transferred to federal court in the Northern District of California.