Comment 17 for bug 773617

Hm...
If I place GROUP= definition in libsane rules (instead or alongside setfacl rule), it works.

Other devices in ubuntu, such as disk, cdrom, audio, video are handled by both standard GROUP= rules and udev-acl.

$ getfacl /dev/sda1
getfacl: Removing leading '/' from absolute path names
# file: dev/sda1
# owner: root
# group: disk
user::rw-
group::rw-
other::---

I would suggest fixing /lib/udev/rules.d by replacing:
ENV{libsane_matched}=="yes", RUN+="/bin/setfacl -m g:scanner:rw $env{DEVNAME}"
with
ENV{libsane_matched}=="yes", GROUP="scanner"
and restoring scanner group

That way both group and acl rules will work for scanners.