California District Court construes Illinois's statute more broadly than Illinois's own courts do.
On April 16, 2018, the court in In Re Facebook Biometric Info. Privacy Litigation, 3:15-cv-03747 (N.D. Cal.), certified class action claims under Illinois' Biometric Information Privacy Act (BIPA). This lawsuit involves Facebook's Tag Suggestions feature. The plaintiffs in that case claim that Facebook's "Tag Suggestions" performs facial recognition on Facebook users' photos to identify them, without providing advance notice or obtaining their consent. Facebook has contested these allegations throughout the litigation and contends that it has not violated BIPA. We previously posted about this lawsuit, and the court's finding that plaintiffs' allegations of procedural violations of BIPA's information and consent provisions were sufficient to confer standing.
The certified class includes "Facebook users located in Illinois for whom Facebook created and stored a face template" since June 2011. While the certification factors in Rule 23 do not cover new ground, the Facebook opinion's apparent rejection of the Illinois Appellate Court decision in Rosenbach v. Six Flags Entertainment Corp. 2017 IL App (2d) 170317 (Dec. 21, 2017), certainly does so. In finding the Facebook plaintiffs met Rule 23's commonality and predominance factors, the court essentially rejected Rosenbach's holding that the "aggrieved person" language in BIPA requires actual injury, not simply assertions of BIPA procedural violations.
Reducing Rosenbach to a "non-binding data point for ascertaining Illinois law," the Facebook court concluded that BIPA's language codified a "privacy right," such that a procedural violation of BIPA could be sufficient to establish an invasion of privacy. The Facebook court does cite an Illinois Circuit Court holding in Rottner v. Palm Beach Tan, in which broad allegations of privacy rights were deemed insufficient to state claims under BIPA because the plaintiff expressly allowed a finger scan. This portion of the Facebook holding, which indicates that invasion of privacy claims do not exist under BIPA for those plaintiffs who allow finger scans, should provide some comfort to the 60 or more employers and timekeeping technology companies that are facing BIPA class actions in Illinois from plaintiffs who acknowledge that they repeatedly used their fingers, hands or photos in order to clock in and out of work.
The Facebook court cited its prior opinion for support that BIPA codifies a privacy right. However, since the Rosenbach decision was issued late last year, no Illinois court has held that BIPA codifies a privacy right. Additionally, Illinois common law has not recognized a right to privacy in personal data, even in situations where a data breach occurs. Maglio v. Advocate Health & Hosps. Corp., 2015 IL App (2d) 140782, ¶ 27, appeal denied, 396 Ill. Dec. 177 (Ill. 2015); Cooney v. Chicago Public Schools, 407 Ill. App. 3d 358, 365-66 (1st Dist. 2010).
The Facebook opinion's interpretation of the "aggrieved person" language in BIPA is premised primarily on American Surety Co. v. Jones, 384 Ill. 222, 229, an opinion issued in 1943, which did not involve BIPA. According to the Facebook court, Jones concludes that "an individual is 'aggrieved' when 'a legal right is invaded by the act complained of.'" However, a deeper analysis of Jones reveals that the plaintiffs' claims were rejected because they were unable to allege an actual injury beyond a purported procedural violation of a licensing code.
Ultimately, the impact of the Facebook opinion on the numerous BIPA class actions pending in Illinois courts may be limited. The Rosenbach court reached its determination based on BIPA's express reference to the term "person aggrieved" and analyzed the term, as it was required to do, not only in light of the entire statute but also to give the term "aggrieved" meaning within the statute. After doing so, the Rosenbach court concluded that allegations of actual injury are required in BIPA cases in order to give the term "aggrieved" its intended meaning. The Illinois Supreme Court requires Illinois circuit courts to follow Illinois Appellate Court opinions. In turn, the U.S. Supreme Court has instructed circuit courts to view state court appellate opinions as persuasive authority, which generally should be followed. Given such deference, the Facebook opinion, issued by an out-of-state federal district court that elected not to follow Rosenbach, and which assigned a different meaning to the term "aggrieved person," may itself be only a "non-binding data point" in ongoing Illinois-based BIPA litigation.
The bottom line: Employers with any employees in Illinois need to learn about BIPA fast.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.