Take-Two Didn't Violate Illinois Privacy Laws By Storing Facial Biometric Data, Court Rules

A lawsuit against video game publisher Take-Two Interactive alleged that the company violated Illinois’ Biometric Information Privacy Act (BIPA) by storing (with consent) the 3D facial profiles of customers that played the NBA 2K15 and 2K16 games.

The court ruled that the two people who brought the lawsuit weren’t affected by the storing of this data, especially considering they gave the company their consent to capture their face profiles and store them. Therefore, Illinois’ biometrics privacy law wasn’t violated, according to the court.

Illinois' Biometric Information Privacy Act

Illinois’ BIPA passed in 2008 because the state anticipated early on that companies, especially financial institutions, would begin to collect biometric data to better identify their customers. However, given the extremely sensitive nature of biometric profiles, due to how unique and (mostly) irreplaceable they are, the legislature worried that people would not even want to use services that require biometric IDs. In their view, this would harm the economic potential of adopting biometric identification for financial services.

Therefore, the legislature thought it would be best to establish some safeguards into law, to ensure that the biometric data is kept safe and to assure customers of services that require biometric identification that their data wouldn’t be misused.

BIPA requires companies to treat biometric data as sensitive and confidential information and to handle it with the “reasonable standard of care.” The law also prohibits private entities from disseminating biometric data without written consent, and it allows aggrieved persons to seek monetary damages.

In-Game Face Scanning

Over the past few years, several games have made use of technology that scans a player’s face and then adds it to the player’s character. The idea is that this will make the game more personalized, it will make the player more engaged, and ultimately it should make the game more fun to play.

Some of the face scanning results may not be that accurate, but as better cameras are used by owners of PCs and consoles, and as this sort of technology improves, it could become more fun to play games like this. It could be especially more interesting in virtual reality games, once the Uncanny Valley factor is eliminated.

Lawsuit Against Take-Two Interactive

The feature has been mainly appreciated by the players of such games, but not everyone agrees. The plaintiffs, Ricardo Vigil and his sister Vanessa Vigil, accused Take-Two Interactive that it failed to comply with all the provisions in the BIPA.

A few months after the lawsuit had started and after Take-Two asked the court to dismiss the lawsuit, the Supreme Court ruled in a different case that lawsuits can not be brought based on a “bare procedural violation” that doesn’t result in any real harm don’t satisfy the “injury-in-fact requirement.”

In light of this Supreme Court ruling, the plaintiffs were allowed to re-plead their case, but without much luck in the end. Ultimately, Take-Two Interactive won the lawsuit based mainly on the idea that no real harm was proven by the plaintiffs, because they had already given consent prior to using that feature and nothing bad actually happened with that biometric data.

Giving Consent

We often discover that one corporation or another has been collecting data on Internet users on a mass scale, sometimes without even telling them about it. Alternatively, some would just make the data collection “opt-out,” knowing most users won’t even look into it, so they will allow the data collection to happen by default.

However, this seems to be one of the cases where consent was actually given. To create a biometric face profile in NBA 2k15 and 2k16, users have to hold the cameras close to their face and slowly rotate their faces so the scan is done properly.

Doing this action alone, but also having to agree beforehand to create the face profile, means it would be rather difficult to give the info to Take-Two Interactive by accident.

The whole point of creating a facial profile in-game is also so your character has your face when playing the game with others. Thus, the profile data is also “shared” with others, although in a way one would already expect to happen.

The only real harm that may have come out of this is if Take-Two didn’t store this data in a secure way and allowed it to be stolen by malicious hackers. However, because that doesn’t seem to have happened yet, or at least the plaintiffs didn’t offer any evidence that something like that may have happened, the court ultimately considered there was no real harm done to the two NBA 2k15-playing plaintiffs.