Three Illinois Facebook users filed a putative class action against Facebook on behalf of an Illinois class alleging a violation of the Illinois Biometric Information Privacy Act (BIPA). Specifically, they alleged that Facebook violated the statute by “collecting, using and storing biometric identifiers (a ‘scan’ of ‘face geometry,’ …) from their photos without obtaining a written release and without establishing a compliant retention schedule.” The Illinois law was adopted in 2008 and expressly addressed scans of “face geometry.” The Illinois state legislature found that there were dangers associated with the improper collection and safeguarding of biometrics requiring the state to regulate “the collection, use, safeguarding, handling, storage, retention and destruction of biometric identifiers and information.”
Facebook moved to dismiss alleging a lack of Article III standing, contending that the plaintiffs failed to allege any concrete injury. Plaintiffs in the meantime moved to certify a class under Rule 23. The district court denied the motion to dismiss and certified a Rule 23(b)(3) class which Facebook challenged on a Rule 23(f) appeal.
In response to the Supreme Court ruling in Spokeo Inc. v. Robins, the Ninth Circuit established a two part test to determine whether a statutory violation resulted in sufficient harm to the plaintiff to withstand a standing challenge. In light of the historical roots of the right of privacy in the United States under the common law, under the First and Fourth Amendment constitutionally protected privacy zones, and “the Supreme Court’s views regarding technological intrusions on the right to privacy, we conclude that an invasion of an individual's biometric privacy rights ‘has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.’” The court further noted that once an individual’s face template is created, “Facebook can use it to identify that in any of the other hundreds of millions of photos uploaded to Facebook each day, as well as determine when the individual was present at a specific location.” The court concluded that the development of a “face template using facial-recognition technology without consent (as alleged here) invades an individual’s private affairs and concrete interests. Similar conduct is actionable at common law.”
In light of the Illinois General Assembly’s judgment regarding such information, the court concluded that “the capture and use of a person's biometric information invades concrete interests.” In addition, the Ninth Circuit concluded that its finding was consistent with the Illinois Supreme Court’s interpretation of BIPA in Rosenbach v. Six Flags Entm’t Corp., 2019 IL 123186 (IL 2019). For those reasons, the court concluded the BIPA was “established to protect an individual’s ‘concrete interests’ in privacy, not merely procedural rights.” Having met the first test for Article III standing, the court then also relied upon the Illinois Supreme Court’s interpretation of the statute to find whether there was either an actual harm or a material risk of harm created by the violation alleged. The court found there was an alleged violation of the “plaintiff’s substantive privacy interest.” Accordingly, the court concluded “that the plaintiffs have alleged a concrete injury-in-fact sufficient to confer Article III standing.”
The court then turned to the issue of whether the district court abused its discretion when it granted class certification. Facebook challenged the predominance finding contending that allowing the case to proceed as a class action would violate Illinois’s rule against giving its state statutes an “extraterritorial effect” when the statute did not clearly show such an intent. The Ninth Circuit concluded that if the BIPA violation occurred when the Illinois Facebook users used it in Illinois, then obviously the relevant events took place in Illinois. If, however, the district court later concluded that the violations took place outside Illinois, causing the extraterritorial doctrine to preclude application of BIPA, the district court could decertify the class; class certification rulings are interlocutory.
Facebook also argued that the case should not have been certified as a class action because “the class action is not superior to the individual claims.” Facebook argued “the possibility of a large, class wide statutory damages award here defeats superiority.” The Ninth Circuit disagreed stating that whenever “neither the statutory language nor legislative history indicates that the legislature intended to place a cap on statutory damages, denying class certification on that basis would ‘subvert [legislative] intent.’” The court found there was nothing in either the legislative text or history which indicated “that a large damages award would be contrary to the intent of the General Assembly. Therefore, the district court did not abuse its discretion in determining that a class action is superior to individual actions in this case.” Accordingly, the Ninth Circuit affirmed the standing and class certification rulings.
The Patel case further clarifies the meaning of BIPA, confirms it is likely to withstand future standing challenges, and suggests that future BIPA cases will be certified as class actions. This ruling needs to be watched for future developments on remand, especially in light of the superiority/statutory damages issue Facebook raised and the 8th Circuit’s treatment of a similar, but successful, challenge in a TCPA case. We will discuss that case, Golan v. FreeEats.com, Inc., 930 F.3d 950 (8th Cir. 2019), in an upcoming post.
Case citation: Patel v. Facebook, Inc., 2019 WL 3727424 (9th Cir. 2019)