到底要等到什么時(shí)候，才能要求企業(yè)在獲得許可后方可采集指紋或面部等生物數(shù)據(jù)？最近該話題在美國(guó)伊利諾伊州成了熱門(mén)，因?yàn)橐豁?xiàng)有爭(zhēng)議的法律可能導(dǎo)致Facebook和谷歌等科技巨頭為面部識(shí)別工具賠償數(shù)十億美元。

上周聯(lián)邦法院發(fā)現(xiàn)，谷歌照片工具為同一用戶創(chuàng)建相冊(cè)而掃描面部并未違反法律，谷歌也稍微得以喘息。美國(guó)地區(qū)法官?gòu)堃嗣裨谝环蓍L(zhǎng)達(dá)28頁(yè)的裁決中表示，谷歌確實(shí)未經(jīng)許可掃描了面部，但沒(méi)有造成傷害，不支持原告根據(jù)法律要求每次違規(guī)賠償1,000至5,000美元。

表面來(lái)看，該判決對(duì)Facebook來(lái)說(shuō)是個(gè)好兆頭，去年Facebook因用戶上傳照片時(shí)可標(biāo)注面部的“標(biāo)簽”工具敗了官司。目前Facebook正在上訴，理由與谷歌類似，即起訴者只證明生物信息未經(jīng)許可被使用還不夠，要證明受到某種傷害。

為什么Facebook和谷歌的判決不同？部分原因可能是兩家公司使用掃描結(jié)果的方式不一樣。谷歌的照片工具只是幫助用戶整理照片，而Facebook的“標(biāo)簽”工具可為第三方識(shí)別用戶。更重要的原因可能是2016年美國(guó)最高法院的Spokeo v. Robbins案例，其中規(guī)定了用戶可就隱私侵犯提起訴訟的情形。

法律學(xué)教授埃里克·戈德曼就最近谷歌案判決發(fā)表了一篇博文，其中稱Spokeo一案判決簡(jiǎn)直是“司法上的胡鬧”，導(dǎo)致法院理解伊利諾尼州生物識(shí)別法時(shí)出現(xiàn)混亂。

在Spokeo案中，最高法院駁回了涉及身份經(jīng)紀(jì)人服務(wù)的裁決，起因是該項(xiàng)服務(wù)在數(shù)據(jù)庫(kù)中錯(cuò)誤識(shí)別了某位客戶的幾個(gè)特征。最高法院發(fā)現(xiàn)，下級(jí)法院草率認(rèn)定客戶受到了必要傷害便提起訴訟，將判決駁回并要求進(jìn)一步審理。

由于缺乏最高法院的具體指導(dǎo)，到底出現(xiàn)哪些類型的隱私侵權(quán)可以要求經(jīng)濟(jì)賠償方面不斷出現(xiàn)混亂。

在伊利諾斯州生物識(shí)別法方面，州最高法院將就六旗游樂(lè)園收集指紋案作出裁決。爭(zhēng)論焦點(diǎn)是根據(jù)法律規(guī)定，如何才算“受害”一方。支持保護(hù)隱私權(quán)的人們說(shuō)，立法者出臺(tái)法律的初衷是生物信息未經(jīng)許可被利用時(shí)便達(dá)成“受害”的構(gòu)成要件，但企業(yè)堅(jiān)持認(rèn)為一定要出現(xiàn)特定形式的傷害方可成立。

杰伊·埃德?tīng)柹J(rèn)為上周張宜民法官的裁決不會(huì)影響此案，他旗下的律師事務(wù)所正組織針對(duì)Facebook的集體訴訟。

“我們認(rèn)為谷歌案的裁決不會(huì)產(chǎn)生重大影響。大家都在等待伊利諾伊最高法院的判決，最終結(jié)果關(guān)系重大?！卑５?tīng)柹l(fā)電子郵件對(duì)《財(cái)富》雜志稱，還補(bǔ)充說(shuō)堅(jiān)信Facebook照片標(biāo)簽顯然違反了法律保護(hù)的隱私權(quán)。

Facebook沒(méi)有立即就有關(guān)此案的發(fā)表評(píng)論。谷歌案的原告律師拒絕透露是否會(huì)提起上訴。

隨著各企業(yè)越來(lái)越多利用面部識(shí)別和其他生物識(shí)別技術(shù)，短期內(nèi)與之有關(guān)的法律爭(zhēng)議應(yīng)該不會(huì)消失。圍繞伊利諾伊州生物識(shí)別法的爭(zhēng)議也會(huì)持續(xù)，2016年科技業(yè)曾大力游說(shuō)過(guò)一輪但只是徒勞。（財(cái)富中文網(wǎng)）

譯者：Charlie

審校：夏林

When must companies receive permission to use biometric data like your fingerprints or your face? The question is a hot topic in Illinois where a controversial law has ensnared tech giants Facebook and Google, potentially exposing them to billions in dollars in liability over their facial recognition tools.

Google got a reprieve last week when a federal court found that a Google Photos tool, which scans faces in order to create galleries of the same individual, did not violate the law. In a 28-page ruling, U.S. District Judge Edmond Chang said Google did indeed scan faces without permission—but that the people affected didn’t suffer any harm and therefore didn’t qualify to collect under the law, which provides victims $1,000 to $5,000 per violation.

On its surface, the ruling is encouraging for Facebook, which lost a case last year over a “tag” tool that identifies faces when people post photos. Facebook is currently appealing the ruling, and using an argument akin to the one Google made: It’s not enough for someone to show their biometric data was used without permission; the person must also demonstrate some sort of harm.

So why the different rulings in the Facebook and Google cases? Part of the reason may lie in the different ways the companies used the scans. Google’s Photos tool only helps someone organize their own photos, while the Facebook “tags” identify people to third parties. But a bigger cause may lie in the ongoing fallout from an important 2016 Supreme Court decision, Spokeo v. Robbins, that attempted to define when people can sue over privacy violations.

In a blog post on the recent Google decision, law professor Eric Goldman described the Spokeo ruling as a “judicial clusterfuck” that has complicated courts’ attempts to make sense of the Illinois biometric law.

In Spokeo, the top court overruled a decision involving an identity broker service who misidentified several attributes of a man in its database. It found that a lower court had been too quick in concluding the man had suffered the necessary harm to bring a lawsuit, and sent the decision back for further review.

The lack of specific guidance from the Supreme Court has since produced ongoing confusion over what type of privacy violations can let people seek financial damages.

In the case of the Illinois biometrics law, the state’s Supreme Court is set to rule on a case involving fingerprints collected by Six Flags amusement park. The case turns on who counts as “aggrieved” under the statute. Privacy advocates say legislators wrote the law intending for anyone whose biometrics were used without permission to be considered “aggrieved,” while companies have insisted there must be some specific form of harm.

Jay Edelson, whose law firm is leading the class action against Facebook, believes Judge Chang’s ruling last week will not affect the case.

“We don’t think the Google ruling will have any significant impact. Everyone is waiting for the Illinois Supreme Court to rule and that will be a significant event,” Edelson tells Fortune by email, adding that he believes the Facebook photo tags are clearly a privacy violation covered by the law.

Facebook did not immediately reply to a request for comment about the case. Lawyers for the plaintiffs in the Google case declined to say whether they will file an appeal.

As companies expand the use of facial recognition and other biometrics, the legal controversies are unlikely to go away anytime soon. Those include those surrounding the Illinois biometrics law, which the tech industry lobbied unsuccessfully to change in 2016.