A group of five Illinois residents is suing Pimeyes, which offers a publicly available facial recognition tool, under the state’s privacy law. They say the company violated their privacy by collecting and using their photos in face search results.

The lawsuit alleges “intentional or reckless” violations of their privacy.

They are also asking for Pimeyes to change its practices going forward to comply with Illinois’s Biometric Information Privacy Act (BIPA). The 2008 law makes it illegal for companies to collect or store data, including data about Illinois residents’ faces, without their consent.

The complaint, filed in the Madison County Third Judicial Circuit Court, claims that when Pimeyes made photos and information of the residents available in search results, allowing unauthorized people to view and use them, the company caused “great and irreparable injury.” The complaint doesn’t detail specific incidents of harm.

Pimeyes acts as a search engine that uses an input picture to locate other pictures of that person online. It can be used as a digital hygiene tool for yourself, or as a weapon for stalkers.

[…]

Multiple tech companies have been sued under BIPA and been forced to make major settlements and concessions.

In 2020, Meta (then still called Facebook) paid $650 million to settle a class action BIPA lawsuit that alleged its automatic face-tagging system, powered by facial recognition, violated the law. The facial recognition company Clearview AI, known for making a database from billions of scraped photos from the open web, settled a BIPA lawsuit in 2022. It escaped paying millions in fines, but had to agree to remove Illinois residents from its database and to restrict businesses and private actors from using its database (though Clearview can sell other products to private customers).

The Pimeyes complaint, which seeks $15,000 for each victim harmed, names the company, its Polish cofounders Lucasz Kowalczyk and Denis Tatina, and its current CEO Giorgi Gobronidze as defendants. It also names EMEARobotics and Carribex LTD, companies Gobronidze registered in Dubai and Belize while acquiring Pimeyes in 2021.

The case also names “Public Mirror,” a company that appears to have been founded by Kowalczyk and Tatina in 2020, shortly before they sold Pimeyes. The company, which advertised itself as the “next generation of media monitoring,” had almost identical features to Pimeyes, but it also allowed users to get email notifications about each new time a face appeared on the internet.

Unlike Pimeyes, which allows users to search for anyone’s face, Public Mirror asked that users only searched for their own face. To do so, it asked users to verify their identities by uploading three photos of themselves at different angles before searching. Similar systems have been bypassed using methods such as 3D printing. The company dissolved and began liquidation in May 2023, according to a Polish business registry, but public documents don’t indicate what led to its dissolution.

Kowalczyk and Tatina went on to found Expertum LTD, which sells a facial recognition algorithm to clients without a facial recognition database. Several former Public Mirror employees appear to have joined Expertum LTD, according to their LinkedIn profiles.

The Pimeyes lawsuit in Illinois had a hearing on Wednesday. The lead attorney on the case, Brandon Wise [of Peiffer Wolf], told Business Insider that Pimeyes has not been officially served yet. The Wednesday hearing focused on updates of the attempts to serve papers to the Pimeyes-related business entities around the world, which has to be done in that country and in its native language.

Kowalczyk and Tatina did not respond for comment. Reached by email, Gobronidze said Business Insider’s request for comment was the first time he had heard of the lawsuit.

“Unfortunately I have absolutely no information related to the lawsuit, I have read it in your email for the first time and honestly I am [a] bit surprised,” Gobronidze said in an email to Business Insider. “I will hesitate to give any official comment, till we receive any official information related to the lawsuit.”

The complaint argues that under BIPA, Pimeyes did not obtain permission from Illinois residents before collecting and storing their information.

Pimeyes notes on its website that its database doesn’t contain photos, but “faceprints” of photos. “Faceprints,” sometimes called “facial geometry,” refers to the data derived from a face photo, such as the distances between different parts of the face. Facial recognition systems identify people by making matches between those mathematical measurements.

However, under BIPA, both photos of a person’s face and facial geometry data from a picture are protected as biometric information.

Wise told Business Insider that he believes Pimeyes exemplifies “a pretty clear violation” of BIPA. He added that there’s an additional risk because Pimeyes, whose headquarters is in the country Georgia, is not based in the US.

“Especially when it’s a foreign company, we don’t know who has access to this data, what’s going on, how it’s being used,” he said.

Full Story: Business Insider December 13 2023