Seyfarth Synopsis: In light of the uncertainties surrounding lawsuits alleging violations of the Illinois Information Biometric Privacy Act (BIPA), the Northern District of California has taken a firm position on a plaintiff's Article III standing. U.S. District Judge James Donato delivered opinions in In re Facebook Biometric Info. Privacy Litig., Case No. 15-CV-03747; 2018 U.S. Dist. LEXIS 30727 (N.D. Cal. Feb. 26, 2018) and Gullen v. Facebook Inc., Case No. 16-CV-00937; 2018 U.S. Dist. LEXIS 34792 (N.D. Cal. March 2, 2018), denying Facebook's motions to dismiss for lack of subject matter jurisdiction in both cases. The court held that plaintiffs' Article III standing was satisfied through mere collection of biometric information.
The decisions provide plaintiffs the ability to get their feet in the door and threaten businesses and employers alike. The court dismissed Facebook's argument that Article III standing requires "real-world harms," stating that the argument exceeds the law. Instead, the court held that a plaintiff has standing when they are deprived of procedures that protect statutorily protected interests, similar to the procedures outlined in the BIPA.
The In Re Facebook Decision
In In Re Facebook, plaintiffs allege that Facebook violated the BIPA when it unlawfully collected and stored biometric data on Facebook users without prior notice or consent. 2018 U.S. Dist. LEXIS 30727, *4. Plaintiffs' claims arise out of Facebook's "Tag Suggestions," which identifies other Facebook users through scanning uploaded photographs. Id. Plaintiffs allege that Facebook creates and stores digital representations of people's faces based on the geometric relationship of facial features unique to each individual. Id. Facebook moved to dismiss the class action, asserting that plaintiffs lacked standing under Article III because the collection of biometric information without notice or consent did not result in "real-world harms," "such as adverse employment or even just anxiety." Id. at *13.
The court denied Facebook's motion to dismiss, holding that Facebook's standing argument exceeds the law. Id. In support of its decision, the court looked to the plain language of the BIPA stating, "BIPA expresses the judgments of the Illinois legislature about the rights of Illinois citizens with respect to the collection of personal biometric data by corporations and businesses." Id. at *10. There, the court pointed to the subsections of the BIPA in so much that it "vested in Illinois residents the right to control their biometric information by requiring notice before collection and giving residents the power to say no by withholding consent." Id. at *11. Since the plaintiffs in this case were never offered the opportunity to withhold consent, the court rejected Facebook's argument and found standing satisfied under the allegations. Id. at *12.
The Gullen Decision
The Gullen case was consolidated with In Re Facebook. The primary difference between the two actions is that the Gullen plaintiff is not a Facebook user, and he challenges Facebook's practices as to non-users. See 2018 U.S. Dist. LEXIS 34792, *2. Similar to the In Re Facebook plaintiffs, the Gullen plaintiff alleges that Facebook stores non-user biometric data when it scans photographs to recommend additional user "tags." Id. In denying Facebook's motion to dismiss for lack of standing, the court relied on the reasoning in In Re Facebook, holding that standing is satisfied when there is an unconsented storage of biometric data. Id.
Analysis And Implications
Judge Donato's disregard for real-world harm creates uncertainty on an otherwise untested statute. His decisions are inapposite to recent Illinois Appellate Court decision Rosenbach v. Six Flags Entertainment Corp., 2017 IL App (2d) 170317, which found that actual, real-world harm must be established to be considered an "aggrieved person" under the BIPA. Id. at ¶ 23. Where, Rosenbach closed the door to claims that did not involve some sort of actual, real-world harm, Judge Donato seems to have reopened that door (for purposes of Article III standing), leaving businesses and employers vulnerable to BIPA claims for collection of biometric data, regardless of whether the plaintiff is aggrieved. It is possible, though, that other courts may blunt the practical impact of Judge Donato's opinions by holding that they do not address whether real-world harm is required to state a claim. While a mere technical violation of the BIPA may open the courthouse doors (at least in federal court), BIPA's "aggrieved person" language may require a plaintiff to show a real-world harm to remain in court and state a claim under the statute.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.