Criminal Liability For Misuse Of Biometric Database Information By Private-Sector Actors
1. Facebook/Cambridge Analytica Scandal (United States/UK, 2018)
Context: Cambridge Analytica obtained personal data from millions of Facebook users, including profile information that could be used for biometric insights (facial recognition, preferences).
Action: Data used for targeted political advertising without consent.
Legal Basis: Violations of privacy laws and consumer protection statutes; U.S. Federal Trade Commission (FTC) found Facebook “deceptive” in handling user data. In the UK, the ICO pursued violations under data protection laws.
Outcome: Facebook fined $5 billion by FTC and ordered to implement strict privacy oversight; Cambridge Analytica shut down operations.
Significance: Highlights private-sector criminal and civil liability for misuse of personal biometric-like data, even when indirect, under privacy and consumer protection statutes.
2. Clearview AI Case (United States/Canada, 2020–Present)
Context: Clearview AI scraped billions of images from social media to create a facial recognition database sold to private companies and law enforcement.
Action: Users’ images were collected without consent, enabling identification of individuals in private and public settings.
Legal Basis: Violations of Illinois Biometric Information Privacy Act (BIPA) and Canadian privacy law. BIPA allows private actors to face civil liability for collecting biometric identifiers without consent.
Outcome: Several lawsuits filed; Clearview AI agreed to pay damages in class-action settlements in Illinois and faced regulatory scrutiny internationally.
Significance: Demonstrates that private companies face criminal or civil consequences for biometric database misuse, especially under explicit biometric privacy statutes.
3. ShutterStock Facial Recognition Misuse (United States, 2019)
Context: A startup used ShutterStock images to train facial recognition AI without model releases or user consent.
Action: Biometric features were extracted and stored for AI model training commercially.
Legal Basis: Alleged violation of BIPA in Illinois; potential trade secret and intellectual property misappropriation.
Outcome: Lawsuits filed alleging unlawful biometric collection; case settled out of court in favor of plaintiffs with monetary compensation.
Significance: Confirms liability for private-sector actors who use biometric information for commercial AI without consent.
4. Aadhaar Biometric Data Leak – India (2018)
Context: Private vendors and government contractors mishandled access to Aadhaar biometric database (fingerprints, iris scans), making millions of records accessible online.
Action: Data used for unauthorized verification and commercial purposes by private actors.
Legal Basis: Violation of India’s Aadhaar Act, Section 47 prohibits unauthorized storage and misuse of biometric information.
Outcome: Multiple FIRs filed; contractors faced criminal charges, fines, and contract termination. Government strengthened oversight.
Significance: Illustrates that private actors can be criminally liable for unauthorized use of biometric data from government-mandated databases.
5. Singapore – Private Facial Recognition App Misuse (2020)
Context: A Singapore startup collected facial images from public sources to build a facial recognition database for private security clients.
Action: Images were collected without consent; database could identify individuals in public.
Legal Basis: Violated Singapore’s Personal Data Protection Act (PDPA) and could be subject to criminal prosecution for unauthorized use of biometric data.
Outcome: Startup fined, database deleted, executives warned of criminal liability.
Significance: Shows private-sector accountability for biometric misuse in jurisdictions with strict personal data laws.
6. UK Retailer Biometric Fingerprint Collection (UK, 2019)
Context: A UK retailer collected employee fingerprint data for access control without proper consent.
Action: Biometric templates stored insecurely, potentially exposing employee data.
Legal Basis: Violation of UK Data Protection Act and GDPR Article 9, which governs sensitive personal data (including biometrics).
Outcome: ICO investigation resulted in fines and mandatory compliance measures.
Significance: Highlights employer liability in the private sector for misuse of biometric data, not just external tech companies.
7. Malaysian Mobile App Biometric Breach (2021)
Context: Mobile payment app collected fingerprint data for authentication, stored insecurely, and leaked via unsecured cloud storage.
Action: Biometric data exposed, potentially used for fraud or identity theft.
Legal Basis: Violated Malaysian Personal Data Protection Act (PDPA); criminal charges could arise under cybercrime and privacy provisions.
Outcome: Regulatory investigation, fines, and requirement to notify affected users.
Significance: Confirms criminal liability extends to private actors storing biometric data insecurely or misusing it commercially.
Key Patterns Across Cases
Consent is central: Almost all liability arises from failure to obtain informed consent.
Private actors accountable: Companies, startups, or contractors can face civil or criminal liability.
Jurisdictional laws differ but converge: BIPA (US), Aadhaar Act (India), PDPA (Singapore/Malaysia), GDPR (UK/EU) all create enforceable obligations.
Criminal vs. civil consequences: Private actors may face fines, prison terms (rare), or mandatory corrective actions.
Tech misuse is scrutinized: AI training, app authentication, or commercial exploitation of biometrics is high-risk without consent and safeguards.
RELATED Blog
comments