到底要等到什么時候，才能要求企業在獲得許可后方可采集指紋或面部等生物數據？最近該話題在美國伊利諾伊州成了熱門，因為一項有爭議的法律可能導致Facebook和谷歌等科技巨頭為面部識別工具賠償數十億美元。

上周聯邦法院發現，谷歌照片工具為同一用戶創建相冊而掃描面部并未違反法律，谷歌也稍微得以喘息。美國地區法官張宜民在一份長達28頁的裁決中表示，谷歌確實未經許可掃描了面部，但沒有造成傷害，不支持原告根據法律要求每次違規賠償1,000至5,000美元。

表面來看，該判決對Facebook來說是個好兆頭，去年Facebook因用戶上傳照片時可標注面部的“標簽”工具敗了官司。目前Facebook正在上訴，理由與谷歌類似，即起訴者只證明生物信息未經許可被使用還不夠，要證明受到某種傷害。

為什么Facebook和谷歌的判決不同？部分原因可能是兩家公司使用掃描結果的方式不一樣。谷歌的照片工具只是幫助用戶整理照片，而Facebook的“標簽”工具可為第三方識別用戶。更重要的原因可能是2016年美國最高法院的Spokeo v. Robbins案例，其中規定了用戶可就隱私侵犯提起訴訟的情形。

法律學教授埃里克·戈德曼就最近谷歌案判決發表了一篇博文，其中稱Spokeo一案判決簡直是“司法上的胡鬧”，導致法院理解伊利諾尼州生物識別法時出現混亂。

在Spokeo案中，最高法院駁回了涉及身份經紀人服務的裁決，起因是該項服務在數據庫中錯誤識別了某位客戶的幾個特征。最高法院發現，下級法院草率認定客戶受到了必要傷害便提起訴訟，將判決駁回并要求進一步審理。

由于缺乏最高法院的具體指導，到底出現哪些類型的隱私侵權可以要求經濟賠償方面不斷出現混亂。

在伊利諾斯州生物識別法方面，州最高法院將就六旗游樂園收集指紋案作出裁決。爭論焦點是根據法律規定，如何才算“受害”一方。支持保護隱私權的人們說，立法者出臺法律的初衷是生物信息未經許可被利用時便達成“受害”的構成要件，但企業堅持認為一定要出現特定形式的傷害方可成立。

杰伊·埃德爾森認為上周張宜民法官的裁決不會影響此案，他旗下的律師事務所正組織針對Facebook的集體訴訟。

“我們認為谷歌案的裁決不會產生重大影響。大家都在等待伊利諾伊最高法院的判決，最終結果關系重大。”埃德爾森發電子郵件對《財富》雜志稱，還補充說堅信Facebook照片標簽顯然違反了法律保護的隱私權。

Facebook沒有立即就有關此案的發表評論。谷歌案的原告律師拒絕透露是否會提起上訴。

隨著各企業越來越多利用面部識別和其他生物識別技術，短期內與之有關的法律爭議應該不會消失。圍繞伊利諾伊州生物識別法的爭議也會持續，2016年科技業曾大力游說過一輪但只是徒勞。（財富中文網）

譯者：Charlie

審校：夏林

When must companies receive permission to use biometric data like your fingerprints or your face? The question is a hot topic in Illinois where a controversial law has ensnared tech giants Facebook and Google, potentially exposing them to billions in dollars in liability over their facial recognition tools.

Google got a reprieve last week when a federal court found that a Google Photos tool, which scans faces in order to create galleries of the same individual, did not violate the law. In a 28-page ruling, U.S. District Judge Edmond Chang said Google did indeed scan faces without permission—but that the people affected didn’t suffer any harm and therefore didn’t qualify to collect under the law, which provides victims $1,000 to $5,000 per violation.

On its surface, the ruling is encouraging for Facebook, which lost a case last year over a “tag” tool that identifies faces when people post photos. Facebook is currently appealing the ruling, and using an argument akin to the one Google made: It’s not enough for someone to show their biometric data was used without permission; the person must also demonstrate some sort of harm.

So why the different rulings in the Facebook and Google cases? Part of the reason may lie in the different ways the companies used the scans. Google’s Photos tool only helps someone organize their own photos, while the Facebook “tags” identify people to third parties. But a bigger cause may lie in the ongoing fallout from an important 2016 Supreme Court decision, Spokeo v. Robbins, that attempted to define when people can sue over privacy violations.

In a blog post on the recent Google decision, law professor Eric Goldman described the Spokeo ruling as a “judicial clusterfuck” that has complicated courts’ attempts to make sense of the Illinois biometric law.

In Spokeo, the top court overruled a decision involving an identity broker service who misidentified several attributes of a man in its database. It found that a lower court had been too quick in concluding the man had suffered the necessary harm to bring a lawsuit, and sent the decision back for further review.

The lack of specific guidance from the Supreme Court has since produced ongoing confusion over what type of privacy violations can let people seek financial damages.

In the case of the Illinois biometrics law, the state’s Supreme Court is set to rule on a case involving fingerprints collected by Six Flags amusement park. The case turns on who counts as “aggrieved” under the statute. Privacy advocates say legislators wrote the law intending for anyone whose biometrics were used without permission to be considered “aggrieved,” while companies have insisted there must be some specific form of harm.

Jay Edelson, whose law firm is leading the class action against Facebook, believes Judge Chang’s ruling last week will not affect the case.

“We don’t think the Google ruling will have any significant impact. Everyone is waiting for the Illinois Supreme Court to rule and that will be a significant event,” Edelson tells Fortune by email, adding that he believes the Facebook photo tags are clearly a privacy violation covered by the law.

Facebook did not immediately reply to a request for comment about the case. Lawyers for the plaintiffs in the Google case declined to say whether they will file an appeal.

As companies expand the use of facial recognition and other biometrics, the legal controversies are unlikely to go away anytime soon. Those include those surrounding the Illinois biometrics law, which the tech industry lobbied unsuccessfully to change in 2016.