Ninth Circuit Allows Class Action Against Facebook under Illinois' Biometric Information Privacy Act to Proceed in California
ABSTRACT: The Ninth Circuit has acknowledged the extraterritorial reach of Illinois' Biometric Information Privacy Act, opening the door to a class action in California for violations of the statute as against persons using Facebook from locations in Illinois.
Those on Facebook know the site is quite good at recognizing others in posted photos and suggesting friends to tag. Most click on the tag suggestion and move on with little to no thought on just how this happens behind the scenes. A class action filed in the Northern District of California will be allowed to proceed to consider whether Facebook’s behind-the-scenes face-recognition technology violates Illinois’ Biometric Information Privacy Act (BIPA). Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019).
Nimesh Patel, individually and on behalf of all others similarly situated, filed a purported class action against Facebook alleging Facebook subjected the named plaintiffs and the purported class to facial-recognition technology without complying with BIPA, which is intended to safeguard their privacy. BIPA, 740 ILCS 14/1 et seq. (2008), prohibits the collecting, using, and storing of biometric identifiers, including a “scan” of “face geometry”. Plaintiffs alleged Facebook used scans of their photos without obtaining a written release and without establishing a compliant retention schedule.
For years, Facebook has allowed its users to “tag” their Facebook friends in photos. In 2010, Facebook launched a feature called “Tag Suggestions.” This feature uses facial-recognition technology to analyze whether the user’s Facebook friends are in photos and then “suggest” a tag. It does so by scanning the photo, extracting various geometric data points that make a face unique, and creating a face signature or map. It then compares the face signature to other faces in Facebook’s database and matches it to other user profiles. These user templates are stored on Facebook servers in nine data centers, none of which is in Illinois. The named Plaintiffs are all Illinois residents who uploaded photos to Facebook while in Illinois. Facebook created and stored face templates for each of them.
Facebook moved to dismiss the complaint for lack of standing on the ground that the Plaintiffs had not alleged any concrete injury. Plaintiffs, in turn, moved to certify the class. The district court denied the Motion to Dismiss and certified a class of “Facebook users located in Illinois for whom Facebook created and stored a face template after June 7, 2011.”
On appeal of the standing issue, the 9th Circuit noted standing is established where a plaintiff has suffered an “injury-in-fact” defined as an invasion of a legally protected interest which is: (a) concrete and particularized; and (b) actual or imminent, not conjectural or hypothetical. It is not enough for a plaintiff to allege that a defendant has violated a statutory right without also showing that the plaintiff suffered a concrete injury-in-fact due to the statutory violation.
In terms of BIPA, the appellate court noted that the Illinois General Assembly found that the development and use of biometric data presents risks to Illinois’ citizens. Citing to the Illinois Supreme Court’s opinion in Rosenbach v. Six Flags Entm’t Corp., 2019 IL 123186, which we previously discussed here, the court concluded that the statutory provisions at issue in BIPA were established to protect an individual’s “concrete interests” in privacy, not merely his procedural rights related to how his biometric information was stored and used.
The question then became whether the specific statutory violations alleged by the Plaintiffs in this case actually harmed or presented a material risk of harm to such privacy interests. The relevant conduct according to Plaintiffs was Facebook’s collection, use and storage of biometric identifiers without a written release and a failure to maintain a retention schedule or guidelines for destroying biometric identifiers. Plaintiffs asserted this allows Facebook to create and use a face template and retain it indefinitely. The court noted that because the privacy right protected by BIPA is the right not to be subject to such collection and use, Facebook’s alleged violation would necessarily violate the Plaintiffs’ substantive privacy interests. It concluded, therefore, that Plaintiffs have alleged a concrete injury-in-fact sufficient to confer standing.
On the class certification issue, Facebook argued the district court erred in certifying the class because the Illinois legislature did not intend for BIPA to have extraterritorial effect. Because Facebook’s collection, storage, and template creation took place on its serves outside Illinois, Facebook argued the district court would have to consider whether each relevant event took place inside or outside Illinois. The Court of Appeals disagreed. It is reasonable to infer that the General Assembly contemplated BIPA’s application to individuals located in Illinois, even if some relevant events occurred outside the state. The court held that these are threshold questions of BIPA’s application which can be decided on a class-wide basis.
Facebook also argued that the possibility of a large class-wide statutory damages award defeats the superiority requirement for a class action. Again, the appellate court disagreed. The question of whether the potential for enormous liability can justify a denial of class certification depends on legislative intent. Here, there is nothing in BIPA’s text or legislative history indicating a large statutory damages award would be contrary to the intent of the Illinois General Assembly. The court, therefore, affirmed the district court’s order certifying the class.
The law surrounding BIPA continues to develop, which is unsurprising considering the speed with which relevant technological capabilities develop. With this opinion, the extraterritorial reach of BIPA is established and may well lead to more litigation outside the confines of the Illinois state and federal courts.
About Illinois Law Blog
Baker Sterchi's Illinois Law Blog examines significant developments, trends and changes in Illinois law on a broad range of topics that are of interest to Illinois practitioners and to businesses evaluating risks under Illinois law or managing litigation subject to Illinois law. Learn more about the editor, Lisa Larkin.
Subscribe via email
Subscribe to rss feeds
RSS FeedsABOUT baker sterchi blogs
Baker Sterchi Cowden & Rice LLC (Baker Sterchi) publishes this website as a service to our clients, colleagues and others, for informational purposes only. These materials are not intended to create an attorney-client relationship, and are not a substitute for sound legal advice. You should not base any action or lack of action on any information included in our website, without first seeking appropriate legal or other professional advice. If you contact us through our website or via email, no attorney-client relationship is created, and no confidential information should be transmitted. Communication with Baker Sterchi by e-mail or other transmissions over the Internet may not be secure, and you should not send confidential electronic messages that are not adequately encrypted.
The hiring of an attorney is an important decision, which should not be based solely on information appearing on our website. To the extent our website has provided links to other Internet resources, those links are not under our control, and we are not responsible for their content. We do our best to provide you current, accurate information; however, we cannot guarantee that this information is the most current, correct or complete. In addition, you should not take this information as a promise or indication of future results.
Disclaimer
The Illinois Law Blog is made available by Baker Sterchi Cowden & Rice LLC for educational purposes only as well as to give you general information and a general understanding of the law, not to provide specific legal advice. Your use of this blog site alone creates no attorney client relationship between you and the firm.
Confidential information
Do not include confidential information in comments or other feedback or messages related to the Illinois Law Blog, as these are neither confidential nor secure methods of communicating with attorneys. The Illinois Law Blog should not be used as a substitute for competent legal advice from a licensed professional attorney in your state.