By: Jeffrey Almonte
Have a favorite coffee shop or local bakery you love going to? One where you always strike up a conversation with the barista or cashier, while the “Your Favorite Coffeehouse” playlist from Spotify plays your favorite mellow acoustic music from behind the counter? Sadly, that business might have just shared your conversation with Amazon through its Echo device or other Amazon products. Also unbeknownst to you, your commute to the local convenience store was shared with Amazon through the store’s Ring Camera.
Biometrics pose one of the biggest risks to privacy in the twenty-first century. Society enjoys a phone’s ability to unlock just by using one’s face, computers opening with a swift fingerprint read, and devices recognizing gestures for certain functions. However, individuals worry that companies who develop and produce these devices will sell or share these identifying pieces of information, especially to or with law enforcement; privacy assurances from tech companies are always the “main priority,” when announcing these features.
A commonly misunderstood biometric is voice. Voice recognition is what helps devices and artificial technology (“AI”), understand what an individual is saying, while voice identification is what helps devices understand who is saying these commands. Devices and AI, like people, attribute vocal cues to a specific person; unconsciously, people know the sound of a dear friend, a family member, or a favorite artist. Thus, like people, devices and AIs create profiles of people based on their physiological and behavioral characteristics; collectively this information is one’s biometric identification.
States and local governments have long recognized the need to secure and regulate access to identifiable information and to prevent companies from abusing their technological capabilities. As technological advancements continue to grow and user data becomes increasingly valuable, legislation must also follow in its wake. Expanding on Illinois’ Biometric Information Privacy Act (“BIPA”), other governments, like the City of New York, seek to provide more protections and provide a private right of action for individuals against commercial establishments illegally sharing biometric information.
Section 22-1202 of New York City’s Administrative Code, prohibits commercial establishments, like retail stores, or food and drink establishment, and entertainment venues, like stadiums and other public attractions from unlawfully selling, leasing, trading or sharing, in exchange of value for an individual’s information, without proper consent and disclosure. This recently enacted law could expose businesses to litigation and substantial costs, ranging from “$500 for each negligent violation”; and “$5,000 for each ‘intentional or reckless’ violation.” However, this law might not prevent giant tech companies, like Amazon from using business as a medium to collect and send biometric information.
Amazon is known for producing a wide array of products that provide a useful and convenient handsfree experience, like the Echo Dot and Echo Show. However, it is commonly known that these products collect user information through voice recognition and build identity profiles—it is how these devices know it’s the primary user and not a stranger. The Echo Dot, is a convenient personal assistant that is utilized beyond the home. Smart offices are also utilizing these personal assistants to create tasks, schedule reminders, and make calls, while still listening to every conversation it can capture. Despite these privacy concerns, Amazon continues to venture forward into the world of data capturing.
Amazon’s latest platform, Sidewalk, utilizes several of its products to create a “mesh network,” that will extend the range of products using an individual’s own devices and unowned neighboring devices from someone across the street or adjacent neighbor if you live in an apartment. In short, the Sidewalk mesh network could encapsulate an entire neighborhood or various city blocks, by being connected to each other and transmit information to Amazon servers. Immediately, as concerns over privacy arose after this release, skeptics became worried because “the eligible products include not only Amazon’s Echo device, but also Ring Security Cams, outdoor lights, and motion sensors.”. Skeptics further stated that this platform could be problematic because it could track an individual’s movement, speech, and location within a mesh area. The primary issue concerning the Sidewalk platform is that it is opt-out only, meaning individuals who already own these devices are automatically included in the mesh network. Individuals who do not want to participate have to voluntarily opt-out.
The Sidewalk’s opt-out feature has already given rise to litigation against Amazon. A Florida couple, the Streets, sued individually and collectively as a class against Amazon, alleging the Sidewalk implementation is theft of internet usage, violates Washington’s Consumer Protection Act, and unjustly enriches Amazon. As the case is still pending, one can only speculate as to whether this would halt Amazon’s Sidewalk platform or make significant changes so that it is opt-in by default.
Experts have provided their own concerns and reassurances on the Sidewalk platform and its limitations. Stating that the encryption features seem “promising” and that any security flaws are likely to be caught early on. Amazon published a whitepaper, stating that the information being sent is minimal. Amazon analogized this system to function like that of the “post office,”; a letter is sent, never read while traveling through the medium, and delivered to its intended target. However, Amazon acknowledges in the appendix, that it is possible for third-party programmers and developers to abuse of the system, making the privacy concerns and financial consequences a real issue for individuals and business owners.
The automatic opt-in feature into Amazon’s Sidewalk platform should worry business owners in biometric regulated states and cities. Because businesses are unaware of the opt-out feature on their Amazon devices, the unawareness defense for sharing customers biometric information with Amazon and their affiliates is unlikely to prevail. This regulation could incur substantial costs onto businesses, possibly bankrupting them. However, there is also a chance that law could be amended to allow recovery against tech giants, who are responsible for implementing these platforms. In the meantime, it would be recommended for businesses to put customers and potential patrons on notice that biometric information is potentially being shared. Providing notice is one measure to stay compliant with the regulatory law; while having this shield against liability, businesses and patrons should write to the City’s council to make appropriate changes and target the tech companies that are benefiting from data sharing.
Student Bio: Jeffrey Almonte is a second-year law student at Suffolk University Law School and serves as a Staff Member on the Journal of High Technology Law. Jeffrey holds a Bachelor of Arts Degree in Political Science from University at Buffalo.
Disclaimer: The views expressed in this blog are the views of the author alone and do not represent the views of JHTL or Suffolk University Law School.
