The Illinois Biometric Information Privacy Act (BIPA) governs the “collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” 740 ILCS 14/5(g). Under BIPA, “biometric identifier” means “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry” and “biometric information” means “any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual.” 740 ILCS 14/10. BIPA allows plaintiffs to seek $1,000 for each negligent violation, and $5,000 for each intentional or reckless violation, plus attorneys’ fees and costs. In light of the financial benefit that can be sought through statutory damages, within the last several years, there have been numerous lawsuits, usually class actions, in which individuals assert that a company has violated BIPA by retaining fingerprints or by using facial recognition technology without the individuals consent or proper notice as required under BIPA.
Three such BIPA class actions were consolidated into In Re Facebook Biometric Information Privacy Litigation; Case No. 15-cv-03747 (N.D. Cal.), which is currently pending in the Northern District of California. The complaint against Facebook alleges that Facebook’s “tag suggestion” program, which uses “state-of-the-art facial recognition technology” to extract biometric identifiers from photographs, associates names with faces in photos, prompts users to tag those people, and collects biometric data in violation of BIPA. With the case in federal court, Facebook moved to dismiss the claims arguing that the plaintiffs lacked Article III standing under the Constitution because they had failed to allege an injury in fact, i.e., that a concrete and particularized harm resulted from the invasion of a legally protected interest. In other words, plaintiffs lacked Article III standing because they had only alleged procedural violation of BIPA as opposed to some “real-world harms” like an adverse employment impacts or even “anxiety.”
In an opinion released on February 26, 2018, the District Court for the Northern District of California disagreed with Facebook’s argument and found that plaintiffs had Article III standing because “the abrogation of the procedural rights mandated by BIPA necessarily amount to a concrete injury.” The district judge explained that under the Supreme Court’s decision in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016) and post-Spokeo cases applying the reasoning articulated in Spokeo, Congress or state legislatures can, in certain instances, create statutory rights that allow procedural violations of the statute to rise to the level of a concrete injury under Article III.
Turning specifically to BIPA, the district court found that the Illinois legislature enacted BIPA to address concerns poised by the collection, use, and storage of biometric data and to protect the rights of its residents to control their biometric information. The district court found that there was “little question that the Illinois legislature codified a right of privacy in personal biometric information” and “little doubt about the legislature’s judgment that a violation of BIPA’s procedures would cause actual and concrete harm.” Thus, “the abrogation of the procedural rights mandated by BIPA necessarily amount to a concrete injury” satisfying Article III standing.
The district court explained that the allegations against Facebook were sufficient to provide standing because “[w]hen an online service simply disregards the [BIPA] procedures, as Facebook is alleged to have done, the right of the individual to maintain her biometric privacy vanishes into thin air. The precise harm the Illinois legislature sought to prevent is then realized.” Moreover, according to the district court, other cases cited by Facebook, where courts had found no Article III standing to sue for procedural violations of BIPA, were factually different from the case at hand because in those cases the plaintiffs would have known that biometric data was being collected whereas Facebook gave no notice or opportunity to users to deny consent to obtaining and use of their biometric data. Accordingly, Facebook’s motion to dismiss was denied.
This case is a new addition to the BIPA jurisprudence that is certain to ignite the Plaintiff’s bar. Until this opinion was released other cases, including those cited in the Northern District of California judge’s opinion, had found no Article III standing to sue under BIPA for purely procedural violations of the statute. However, the decision in this case was highly fact-specific. Thus, it is yet to be seen how impactful it will be in permitting plaintiffs’ BIPA claim to survive Article III scrutiny.
If you are interested in discussing how Michael Best can assist you in handling class action lawsuits, or lawsuits related to biometric data please contact your Michael Best attorney, or Albert Bianchi, Jr. and Michelle Dama.