Facebook's attempt to push a US court to a quick ruling on a class-action lawsuit over its use of facial recognition technology has been denied.
In an order issued yesterday (PDF), district judge James Donato said that the case would go to trial, with a date set for 9 July.
The lawsuit is one of the first tests of Illinois' 2008 Biometric Information Privacy Act (BIPA).
It was filed in May 2015 by three residents – Nimesh Patel, Adam Pezen and Carlo Licata – who asserted that Facebook had collected biometric data without adequate notice or consent through its Tag Suggestions product that uses facial recognition technology to analyse images uploaded to the site.
Both sides had made requests for a summary judgment in the case, but the judge said that this was impossible because of the large number of disputes between the parties on both technical and legal matters.
However, one element that is not up for debate in the judge's eyes is Facebook's suggestion that the plaintiffs needed to demonstrate "actual" injury, beyond the invasion of the privacy rights that are covered by the BIPA.
The judge said that the court was "concerned" about this theme in the biz's briefs, saying that Facebook was working on a "faulty proposition" since the court has "expressly rejected that contention in considerable detail" in a previous order.
Beyond this, district judge Donato went on to detail the areas in which there was dispute between the parties, noting that this was exemplified by their "voluminous submissions" – which amount to more than 100 pages of briefs for the cross-motions, along with several hundred pages of documents, emails, deposition testimony and other exhibits.
"The parties unleash volleys of other competing evidence," the judge observed, saying that it would be for a jury to "resolve the genuine factual disputes surrounding facial scanning and the recognition technology".
For instance, the plaintiffs' case "turns in large measure" on whether Facebook collects and stores scans of face geometry, the judge said, but the two sides offer strongly conflicting interpretations of how the software processes human faces.
Facebook's facial recognition program cannot be understood to have occurred wholly outside Illinois. The same rather metaphysical arguments about where BIPA was violated fare no better when re-packaged under the dormant commerce clause.
The plaintiffs say the technology behind Facebook Tag Suggestions has to collect scans of geometry because it uses human facial regions to process and ultimately recognise face images.
Facebook says the tech has "no express dependency" on human facial features at all – instead the biz says it "learns for itself what distinguishes different faces and then improves itself based on its successes and failures, using unknown criteria that have yielded successful outputs in the past".
Elsewhere, the firm also makes a stab at avoiding trial by questioning the meaning of "scan" as it is written in the BIPA, which the judge rejected in the order.
On legal matters, the judge took issue with some of Facebook's arguments, including an assertion that subjecting it to BIPA would violate a dormant commerce clause. This clause typically applies when a state tries to control economic conduct that is wholly outside its borders with the aim of protecting local biz from out-of-state competition.
Facebook said it should apply because it processes facial recognition on servers outside Illinois, but the judge said that its concerns "are not well taken", especially as similar arguments about extraterritoriality was rejected earlier on in the case.
"Facebook's facial recognition program cannot be understood to have occurred wholly outside Illinois," the judge said. "The same rather metaphysical arguments about where BIPA was violated fare no better when re-packaged under the dormant commerce clause."
Donato added that nothing indicates that liability under BIPA would force Facebook to change its practices with respect to residents of other states.
The judge also considered the issue of damages, in a bid to offer clarification ahead of the trial.
Under BIPA, negligent violations are subject to damages of $1,000, while intentional or reckless violations are $5,000. With potentially millions of Illinois residents able to claim for compensation, Facebook is eager to argue it isn't liable for such damages.
Its argument is that it had reasonably understood BIPA to exclude data harvested from photos, but the judge said that this isn't a sound proposition because, for a start, the firm's understanding of the BIPA is in dispute.
"In addition, a good argument can be made that Facebook's position amounts to a very questionable mistake of law defense," the judge said, noting the quote: "Ignorance of the law will not excuse any person, either civilly or criminally."
We've asked Facebook for comment and will update the story if they respond. ®
Sponsored: Webcast: Simplify data protection on AWS