A State of Surveillance: The Laws Governing Facial Recognition Technology at Madison Square Garden

by Audrey Rotman, Associate Member, University of Cincinnati Law Review Vol. 92

I. Introduction

In late 2022, attorneys from several law firms that were engaged in active litigation against Madison Square Garden Entertainment Corporation (“MSGE”)—the owners of venues like Madison Square Gardens (“MSG”) and Radio City Music Hall—found themselves banned from attending shows and events at the venues.¹ However, MSGE was not refusing to sell the attorneys tickets.² Rather, MSGE was using biometric technology to track their attendance at the venues—specifically facial recognition software similar to that used to unlock the iPhone.³ This software, prevalent at airports and other high security facilities across the globe, has now found its way into sporting and music venues and frequently used by many grocery stores and shopping malls.⁴

While providing a benefit for enhanced security, private spaces can also use the data to selectively prevent patrons from entering based on personal conflict, as well as potentially keep the data for later use.⁵ This issue that attorneys and MSGE are still battling in the courts speaks to a broader issue of data privacy in an age that heavily relies on biometric data usage and in which many laws have not yet caught up to.

This article will discuss the different approaches cities, states, and the federal government have taken in regulating the private use of biometric technology in relation to private businesses and citizens. Part II will provide background on the history of biometric data collection and the original lawsuits against MSGE. Part III will discuss current and future legislation, including Illinois’ ban on the use of the technology, New York City’s notice requirement, the Federal Trade Commission’s (“FTC”) 2023 policy statement on biometric data misuse, and how these three approaches could apply to the MSGE lawsuit.

II. Background

Biometric data is any technology that collects unique, distinctive, and measurable characteristics, like fingerprints, iris scans, voice, or facial images to quickly identify an individual accurately.⁶ While the average person usually thinks of biometric data as facial recognition technology, fingerprinting is an early form of the technology, as seen with widespread use of fingerprint by law enforcement in the 1960s through the 2013 iPhone unlocking feature.⁷ Since the early 2000s, biometric authentication recognition systems have been patented and sold commercially, eventually expanding use to large scale public events operated by private companies.⁸

A. History of Biometric Data Use

The first widely noted large event that used facial recognition technology was Super Bowl XXXV in Tampa Bay in 2001.⁹ The publicity of its use resulted in backlash of criticism, calling the technology a violation of the Fourth Amendment’s protection against unreasonable search and seizure.¹⁰ Despite the critics, facial recognition continued to be widely used by government agencies and private entities throughout the early 2000s.¹¹ Airports have increasingly implemented the software for travelers, not only using it in expediting security procedures, but also boasting a 98% accuracy rate in traveler identification.¹² However, amid ongoing protests against police brutality in 2020, tech giants IBM, Amazon, and Microsoft stopped selling general purpose facial recognition software to police until more legislation is passed on the technology’s usage.¹³

B. Madison Square Garden v. Attorneys

MSG and its parent company, MSGE, have been longtime users of facial technology in screening patrons for security risks. Combined with metal detectors and bag screenings, the technology is justified as another safety tool for high-traffic venues located in high-risk areas.¹⁴ However, two of MSGE’s venues, MSG and Radio City Music Hall, are using the technology to identify attorneys of several law firms who are currently embroiled in active litigation against MSGE.¹⁵ Once identified by the facial recognition system, the banned list of attorneys are forbidden entrance into the venue to see any show or sporting event.¹⁶

The attorneys filed a suit against MSGE, citing a New York state “anti-discrimination law that prohibits ‘wrongful refusal of admission’ to places of public entertainment or amusement.’”¹⁷ Initially, the suit led to a preliminary injunction that lifted the ban against the lawyers.¹⁸ However, an appeals court ultimately lifted the injunction in late March 2023.¹⁹ In June 2023, the attorneys of several firms filed a class action lawsuit against MSGE, alleging that the company violated New York City’s biometric privacy ordinance and a state privacy law.²⁰ The New York City Biometric Law, a July 2021 administrative code, “prohibits private companies from selling or otherwise profiting from the use of biometric information they collect.”²¹ The New York privacy law “prohibits the use of a person’s image for commercial purposes without their consent.”²² The attorneys argue that MSGE is abusing facial recognition technology for its own “financial” gain, violating fundamental rights to privacy and the New York City Biometric Law.²³

IV. Discussion

Cities, states, and the federal government have all taken varying levels of action in terms of regulating and monitoring biometric data collection by private entities. Most sweeping is Illinois’ 2008 Biometric Information Privacy Act.²⁴ As data technology becomes more profitable and prolific, it has become harder to pass legislation reforming the technology, as seen with New York City’s stalled legislation that seeks to limit the use of facial recognition technology. The question that remains in resolving the issues associated with the MSG ban is whether local, state, or federal law is best to regulate and which already existing or proposed law could serve as the best model going forward, as well as in the case resolution.

A. State Law Approach: Illinois’s BIPA

While all venues owned by MSGE in New York use the technology, its event venue in Chicago—Chicago Theatre—cannot use the technology due to an Illinois state law.²⁵ The Biometric Information Privacy Act of Illinois (“BIPA”) was passed in 2008—way before biometric scanning was “mainstream”—and prohibits companies from using biometric details like voice or photos without written consent from those whose data is being collected.²⁶ The law regulates private entities, excluding financial institutions and governmental entities, and covers retina scans, fingerprints, voiceprints, information collected in a health care setting, and more.²⁷ BIPA is also based on a private right of action, meaning that private citizens can bring litigation under BIPA.²⁸

If the BIPA law were applied to this case, there most likely would not even be a case to begin with as facial recognition software could not be used at MSG and Radio City Music Hall without written consent, something that is nearly impossible to obtain from every patron. BIPA has become the “gold standard” of data privacy laws, from a personal privacy perspective, and would mean that MSGE could not discriminate against the lawyers via the technology. The venue could refuse to sell tickets or “manually” identify patrons at security, but private spaces have the right to refuse entry, as long as they comply with anti-discrimination laws. However, its current conduct would be barred under BIPA.

However, if MSGE did not comply with the law, New York could see an uptick in litigation under a theoretical BIPA, as BIPA guarantees a private right to action. ²⁹ Recent cases in Illinois like Tims v. Black Horse, which held that BIPA claims have a five year statute of limitations, and Cothron v. White Castle, which held that every biometric scan taken of an individual is a separate claim, have further expanded the scope of BIPA.³⁰

While the courts might see a rise in litigation when private right of action laws are rolled out, once clear guidelines are established by the courts, companies and citizens will better understand their rights and the correct procedures to follow. Despite the potential for more litigation as the details of the law are sorted out, BIPA, with over fifteen years in practice, proves to be the most comprehensive approach to regulating facial recognition technology, and gives citizens the most power in enforcing it, making it the most comprehensive way to resolve the MSGE issue.

B. City Approach: New York City’s Notice Law

In 2021, New York City passed a law that requires that all public places using biometric technologies to notify patrons of its usage via conspicuous signage, which MSGE venues like Radio City Music Hall comply with.³¹ The law also bans the sale of any of this collected data or any use of it for profit.³² Citizens have a private right of action, with statutory damages of up to $500 for each negligent violation and up to $5,000 for each intentional violation if businesses do not comply with the thirty-day cure notice requirement.³³

This law differs from BIPA in that it does not require signed consent for biometric data collection.³⁴ As BIPA requires informed written consent, it is nearly impossible to use facial recognition software in commercial establishments in Illinois due to the requirement. However, by only having a notice requirement, patrons of New York City venues and spaces don’t have a way to opt out of data collection, other than by not attending, leaving them with few privacy protection options.³⁵

In April 2023, the New York City Council introduced bills to stop the usage of facial recognition by private entities, partly in response to MSGE’s venue bans.³⁶ The first bill aims to ban businesses from using biometric technology, like facial recognition, to identity customers.³⁷ If businesses want to collect this information, they would be required to obtain written consent, similar to BIPA.³⁸ The second bill would prohibit residential landlords from using biometric technology to identify residents or guests.³⁹ As of May 2023, the proposed amendment was laid over in committee.⁴⁰[1] In late September 2023, several digital and civil rights groups restarted calls urging the New York City Council to push through the stalled bills.⁴¹ Citing the dangers of biometric data storage for an undefined period, the groups also cite bias and errors in the software when identifying Black, Latino, non-binary, and transgender individuals.⁴²

The MSGE case was filed under New York’s Notice Law, however, it does little to protect privacy. By nature, notice requirements fail to curb the use of the facial recognition technology. While the law does notify patrons of an event center, there is little people can do to opt out other than not patronizing a particular place. However, as facial recognition technology becomes more prolific, it will become harder and harder to avoid spaces that utilize the technology. Ultimately, this is not enough protection for private citizens, especially in such a diverse metropolitan city where minority groups face the risk of errors and biases in the software.

The proposed legislation for 2023, currently still pending in city council, is the standard a city like New York needs to apply. San Francisco has had success with a similar law in 2019 in which it was able to ban the use of the technology by city agencies. ⁴³ In its ban, the city acknowledged the importance of the technology in spaces like airports and border crossings (both governed by federal law and not subject to the city legislation), but cited fears of government surveillance at a distance in the legislation’s passing.⁴⁴

If facial recognition technology is allowed to continue unregulated and unrestricted, New York City could morph into a big brother space—one where a resident’s every move is tracked by both public and private entities. The 2023 legislation would bring privacy inside private spaces, while preserving some technology use in areas governed by federal law. If the MSGE case were to be decided under the proposed legislation, which is very similar to BIPA, MSGE would most likely lose for its actions, hence why this legislation is being proposed partly in response to MSGE’s actions.

C. Federal Government: FTC Regulation

In spring 2023, the FTC warned against the increasing usage of consumer biometric information and the potential for data security concerns, privacy, and potential for bias and discrimination in violation of Section 5 of the FTC Act.⁴⁵ Fears over sensitive healthcare and religious information, as well as access by third parties, were some of the main concerns for the FTC in its policy statement.⁴⁶ In its statement, the FTC outlined several factors it will use in evaluating whether a business’s use of biometric information violates the FTC Act, including, but not limited to, failing to address foreseeable harms, failing to implement tools to reduce foreseeable risks, and failing to evaluate third parties with access to biometric information.⁴⁷

If the FTC’s policy were applied to the MSGE case, the balancing factors provide insight into MSGE’s usage of facial recognition technology. In looking at the guidelines, the FTC would investigate to see if MSGE failed to address foreseeable harms and if they failed to implement tools to reduce foreseeable risks.⁴⁸ In this case, the attorneys could argue an unfairness to the collection and use of biometric information, in that it caused substantial injury. There is another argument under the FTC guidelines for “engaging in surreptitious and unexpected collection of use of biometric information.”⁴⁹

Another application to note is that the policy does not require equal harm to all consumers, but it could affect different groups disproportionately and still be in violation of Section 5 of the FTC Act.⁵⁰ The FTC would have a case to bring against MSGE if it can prove the harm to consumers and MSGE’s motives and collection strategies. If they were to bring a complaint and ultimately issue a Commission order, which if later violated, could result in civil penalties.⁵¹ The FTC could also seek redress for the harm already done.⁵² Instead of a law prohibiting the behavior, the FTC seeking redress for MSGE’s actions would set an example for others and for future MSGE behavior on a very public stage. In its policy statement, the FTC calls on businesses to “continually assess whether their use of biometric information…is likely to cause consumer injury.”⁵³ Based on MSGE’s actions and response, they are intending to cause injury and are aware of their impact, making their conduct a prime target for FTC involvement.

V. Conclusion

BIPA is arguably the model of privacy laws in the United States and would solve a majority of the issues created under the MSGE case. However, the law’s passage was much easier in 2008 than it will be in 2023, due to the changes and understanding of the benefits of the technology, as well as the economic and business motivations businesses have from selling and utilizing facial recognition technology. As other states, cities, and the federal government seek to provide regulation and guidance on the everchanging biometric landscape, both advocates and opponents of the facial recognition software cite security risks and financial impact for private citizens and businesses involved.

Cover Photo by Kal Omari on Flickr

Audrey Rotman

Audrey Rotman graduated from Furman University with a degree in German Studies and Communication Studies. Prior to law school, she worked in project management and journalism. Audrey is primarily interested in pursuing labor and employment litigation but is always open to expanding her knowledge in other areas of the law as well.

References

1
Kashmir Hill & Corey Kilgannon, Madison Square Garden Uses Facial Recognition to Ban Its Owner’s Enemies, N.Y. TIMES (Dec. 22, 2023), https://www.nytimes.com/2022/12/22/nyregion/madison-square-garden-facial-recognition.html.
2
Id.
3
Id.
4
Id.
5
Id.
6
Practitioner’s Guide: Biometric Data, THE WORLD BANK https://id4d.worldbank.org/guide/biometric-data (last visited Oct. 26, 2023).
7
A Brief History of Biometrics, BIOCONNECT (Dec. 8, 2021), https://bioconnect.com/2021/12/08/a-brief-history-of-biometrics/.
8
Id.
9
Thorin Klosowski, Face Recognition Is Everywhere. Here’s What We Can Do About It., N.Y. TIMES (July 15, 2020), https://www.nytimes.com/wirecutter/blog/how-facial-recognition-works/.
10
Id.
11
Id.
12
Francesca Street, How Facial Recognition is Taking Over Airports, CNN (Oct. 8, 2019), https://www.cnn.com/travel/article/airports-facial-recognition/index.html.
13
Isobel Asher Hamilton, Outrage Over Police Brutality Has Finally Convinced Amazon, Microsoft, and IBM to Rule Out Selling Facial Recognition Tech to Law Enforcement. Here’s What’s Going On, Business Insider (June 13, 2020), https://www.businessinsider.com/amazon-microsoft-ibm-halt-selling-facial-recognition-to-police-2020-6.
14
Hill, supra note 1.
15
Id.
16
Id.
17
Kashmir Hill, Lawyers Barred by Madison Square Garden Found a Way Back In, N.Y. TIMES (Jan. 16, 2023), https://www.nytimes.com/2023/01/16/technology/madison-square-garden-ban-lawyers.html.
18
Id.
19
Jack Ahern, Dolan Wins A Round In The Facial Recognition Battle, THE SPIRIT(Apr. 3, 2023), https://www.westsidespirit.com/news/dolan-wins-a-round-in-the-facial-recognition-battle-KB2461185.
20
Christopher Brown, Madison Square Garden Sued Over Facial ID Technology at Venues, BLOOMBERG LAW (June 29, 2023), https://news.bloomberglaw.com/privacy-and-data-security/madison-square-garden-sued-over-facial-id-technology-at-venues.
21
Id.
22
Id.
23
Kelsey McCroskey, Madison Square Garden Owner Facing Class Action Over Alleged Use of Biometric Data to Ban Rival Attorneys from NYC Venues, Classaction.org (Apr. 25, 2023), https://www.classaction.org/blog/madison-square-garden-owner-facing-class-action-over-alleged-use-of-biometric-data-to-ban-rival-attorneys-from-nyc-venues.
24
Shira Ovide, The Best Law You’ve Never Heard Of, N.Y. TIMES (Feb. 23, 2021), https://www.nytimes.com/2021/02/23/technology/the-best-law-youve-never-heard-of.html.
25
Hill, supra note 1.
26
Ovide, supra note 24.
27
Lydia de la Torre, Elliot Golding & India K. Scarver, The Illinois Biometric Privacy Act (”BIPA”): When Will Companies Heed the Warning Signs?, THE NAT’L LAW REV. (Feb. 17, 2020), https://www.natlawreview.com/article/illinois-biometric-information-privacy-act-bipa-when-will-companies-heed-warning.
28
Niya T. McCray, Sensitive to the Touch: The Evolution of U.S. Biometric Privacy Law, FOR THE DEF. (May 2018), https://www.bradley.com/insights/publications/2018/05/the-evolution-of-us-bio metric-privacy-law.
29
In the first four months of 2023, over 180 BIPA suits were filed in the state of Illinois. Howard P. Goldberg, BIPA Decisions Illustrate Challenges Facing Companies and Insurance Providers, REUTERS (Sept. 5, 2023), https://www.reuters.com/legal/legalindustry/bipa-decisions-illustrate-challenges-facing-companies-insurance-providers-2023-09-05/.
30
Joseph Duball, The Rise of US State-Level BIPA: Illinois Leads, Others Catching Up, IAAP (Mar. 28, 2023), https://iapp.org/news/a/the-rise-of-us-state-level-bipa-illinois-leads-others-catching-up/.[/mfn] In order to streamline business practices, the strictest guidelines might become the de facto law across the country as private businesses work to maintain compliance with biometric BIPA-style laws.³⁰Tara L. Trifon, Brian I. Hayes, and Brianna Dally, Are You Ready for the BIPA Tsunami? The New Wave of Biometric Statutes, Locke Lorde (July 2022), https://www.lockelord.com/newsandevents/publications/2022/07/are-you-ready-for-the-bipa-tsunami.
31
Administrative Code of the City of New York §§ 22-1201-1205.
32
New York City’s Biometrics Law Has Teeth, JD SUPRA (Apr. 17, 2023), https://www.jdsupra.com/legalnews/new-york-city-s-biometrics-law-has-teeth-3771489/.
33
Id.
34
Id.
35
Id.
36
Jaclyn Jeffery-Wilensky, After MSG debacle, NYC Considers Facial Recognition Ban for Businesses, Landlords, GOTHAMIST (May 3, 2023), https://gothamist.com/news/nyc-council-facial-recognition-biometric-ban-businesses-landlords.
37
Id.
38
Patrick Reilly and Bernadette Hogan, NYC Lawmakers Introduce Bill to Ban Businesses From Using Facial Recognition Tech, N.Y. POST (Apr. 12, 2023), https://nypost.com/2023/04/12/nyc-lawmakers-introduce-bill-to-ban-businesses-from-using-facial-recognition-tech/.
39
Id.
40
Council of City of New York Intro No. 1014-2023, proposing amendment to Administrative Code § 22-1201-04 (Apr. 27, 2023), https://perma.cc/7YFN-RQUR.
41
Id.
42
Id.
43
Kate Conger, Richard Fausset & Serge F. Kovaleski, San Francisco Bans Facial Recognition Technology, N.Y. TIMES (May 14, 2019), https://www.nytimes.com/2019/05/14/us/facial-recognition-ban-san-francisco.html.
44
Id.
45
Id.
46
Id.
47
Id.
48
Id.
49
Fed. Trade Comm’n, Policy Statement of the Federal Trade Commission on Biometric Information and Section 5 of the Federal Trade Commission Act, at 10 (May 18, 2023) https://www.ftc.gov/system/files/ftc_gov/pdf/p225402biometricpolicystatement.pdf.
50
Jon Frankel, Steve Lane & Kandi Parsons, FTC Warns About Misuses of Consumers’ Biometric Information, ZWILLGENBLOG (June 1, 2023), https://www.zwillgen.com/ftc-state-ag/ftc-warns-about-misuses-of-consumers-biometric-information/.
51
Fed. Trade Comm’n Act § 3; 15 U.S.C. § 43.
52
Id.
53
Policy Statement, supra note 50.