Ryanair, the popular Irish airline, is facing legal action over its use of facial recognition technology. The lawsuit has been filed by the European Center for Digital Rights, also known as Noyb, a Vienna-based digital rights group. The complaint alleges that Ryanair has violated the privacy rights of some of its customers.
The issue at hand revolves around Ryanair’s practice of requiring customers who book flights through third-party online agents to undergo an additional identity verification process. The quickest option available to customers is to use facial recognition technology for identity verification. However, those who do not wish to use this method must either arrive at the airport at least two hours prior to their flight or submit their identification documents to Ryanair and wait for up to a week for their signatures to be vetted.
Ryanair has defended its additional verification process, stating that it is necessary because third-party agents often fail to provide accurate contact information and payment details. The airline claims that this verification process is essential to ensure compliance with safety and security requirements. However, Noyb argues that the use of facial recognition technology in this context is unnecessary and poses a significant privacy risk for customers. The group points out that Ryanair outsources the verification process to a third-party company named GetID, which means that customers are required to entrust their biometric data to a company they have never had a contract with or heard of before.
Noyb contends that Ryanair’s true motive behind the additional verification is to discourage customers from using third-party agents for future bookings. The group argues that verifying contact details through biometrics does not make sense, as email addresses are not printed on faces or passports. Noyb claims that Ryanair’s requirement violates Europe’s General Data Protection Regulation (GDPR) and has requested that the company be fined approximately $210 million.
This lawsuit adds to the growing list of legal challenges against the use of facial recognition technology in recent years. Ryanair itself uses this technology to verify and authenticate the identity of individuals. Facial recognition technology has seen rapid growth in various use cases, such as matching faces to photo ID documents, security and surveillance, photo tagging, and as an alternative to traditional forms of authentication like signatures, PIN codes, and passwords.
Privacy and digital rights groups have expressed concerns about the increasing use of facial recognition technology and are calling for regulations to protect individuals’ privacy. Some of the major concerns include the lack of informed consent, potential data breaches and misuse of facial recognition data, spoofing, and the possibility of misidentification due to inaccuracies.
In the United States, there have been numerous lawsuits challenging the use of facial recognition technology. Many of these cases have invoked the Illinois Biometric Information Privacy Act (BIPA), which is considered one of the strictest laws in the country. BIPA requires organizations to obtain informed written consent and disclose the collection, storage, and use of biometric data. It also sets limits on data retention and provides for substantial fines per violation.
Notable cases filed under BIPA include a lawsuit against Facebook for its use of facial recognition in its photo-tagging app. Facebook settled the lawsuit by agreeing to pay a record-breaking $550 million to Illinois residents. Similarly, TikTok was ordered by a federal judge to pay a $92 million settlement for its use of facial recognition technology in photo-tagging. The settlement imposed restrictions on TikTok’s collection and storage of biometric data without user consent. Shutterfly, a photo-sharing app, also faced a $6.76 million class action settlement for violating BIPA.
As the use of facial recognition technology continues to expand, it is crucial for organizations like Ryanair to address privacy concerns and ensure compliance with existing regulations. The outcome of the lawsuit against Ryanair will likely have implications for the wider use of facial recognition technology in the travel industry and beyond.