A recent Northern District of Illinois ruling calls into question the enforceability of the Illinois Biometric Privacy Act (BIPA) in Federal court when no harm can be proven by the plaintiffs. On December 29, 2018, a court in the Northern District of Illinois granted summary judgment in favor of Google after finding that the plaintiffs failed to allege a concrete injury and thus lacked Article III standing. An appeal is expected to the Seventh Circuit. Google’s current success on the matter mirrors a decision from the Illinois Second District Appellate Court finding that a “person aggrieved” by a BIPA violation must allege actual harm in order to have standing under the law. This Illinois appellate decision is now being considered by the Illinois Supreme Court on appeal. See our two previous articles:
Illinois Appellate Court Restricts BIPA Claims
Class Members have Article III Standing to Sue Facebook under the Illinois Information Privacy Act
Among other things, BIPA requires that companies provide written disclosures to and obtain written consent from individuals whose biometric information the company captures. The Google decision is representative of active litigation taking place at the Federal and State levels under which defendants assert that the private right of action in BIPA is contingent on there actually being a harm and that a mere technical violation of BIPA’s requirements is not alone sufficient for a claim.
In Rivera v. Google, Inc., the plaintiffs alleged Google’s practice of using face-recognition to organize and label pictures according to face scans in uploaded pictures violates BIPA. BIPA requires entities which collect and retain certain biometric identifiers to make disclosures and receive consent. Google moved for summary judgment, arguing (1) the plaintiffs lack Article III standing; (2) the plaintiffs are not aggrieved under BIPA; and (3) the plaintiffs suffered no harm. The court’s decision on summary judgment was based solely on the first argument, namely the plaintiffs’ lack of standing to sue. In so holding, the court performed a thorough analysis of the Supreme Court’s decision in Spokeo v. Robins.
Article III standing requires that a plaintiff suffered an injury in fact that is fairly traceable to the challenged conduct and that is likely to be redressed by a favorable judicial decision. The issue in Rivera centered on whether the plaintiffs suffered an injury in fact. The plaintiffs alleged two harms: first, Google retained “face templates” made from scans of faces in photographs, and second, Google created and collected those same templates. Google argued that neither of these harms could be considered a concrete injury sufficient to confer standing.
In assessing plaintiffs’ claims that Google’s retention and storage of face templates caused harm, the Rivera court first noted that the Seventh Circuit has already held that retention alone of private information is not a concrete injury. (See Gubala v. Time Warner Cable, Inc.) Because the face templates at issue had never been shared outside of Google and there had been no unauthorized access to the data, by a hacker or through any other means, the retention of data itself was not a concrete injury under Article III. Moreover, for any risk of harm from the retention to rise to the level of concrete harm, there must be a substantial risk of future harm. Notwithstanding the unique harms associated with unauthorized access to immutable biometrics, the court determined the plaintiffs provided no evidence of substantial risk of future harm.
The court next considered plaintiffs’ claims regarding Google’s creation of face templates. Even assuming, that the plaintiffs did not know that Google created templates from uploaded photographs, the court found no concrete-injury was sufficiently alleged. In doing so, the court noted that facts alleged in Rivera differed from the cases cited by plaintiffs–namely that there was no unauthorized disclosure of information to a third-party.
Specifically, the court distinguished Patel v. Facebook Inc., a California district court decision that considered Facebook’s facial-recognition software which was automatically applied to all uploaded photos without user consent. The Patel complaint survived a motion to dismiss for lack of standing based on two potential harms: (1) the risk of identity theft and (2) the lack of consent to collect information. Here, the Rivera court found that neither of these potential harms supported concrete injury in this case. First, consistent with the court’s decision regarding retention of face templates, there was no substantial risk of future harm. Second, the court could not understand why a lack of consent to create facial templates could give rise to an independent risk of identity theft. In other words, if there was no substantial risk that retention of facial templates would cause future harm, there is no reason to believe a user’s lack of consent to create the facial templates would cause any greater risk of future harm.
Finally, turning to common law actions, as suggested under Spokeo, the court determined that plaintiffs’ alleged injuries failed to satisfy any privacy tort, chiefly because faces are “public” information and because there was no offensive intrusion. Indeed, the court stated “we expose our faces to the public such that no additional intrusion into our privacy is required to obtain a likeness of it, unlike physical placement of a finger on a scanner or other object, or the exposure of a sub-surface part of the body like a retina.” Though there is no requirement that a federal cause of action meet every element of a common law tort to show Article III standing, the injuries alleged in Rivera were so divorced from common law that it could not provide a basis for standing. Because the court could find no other basis for concrete injury, the case was dismissed for lack of jurisdiction.
This case is likely to shape the types of intangible, nonmonetary injuries that can be alleged in federal court, making it more difficult for plaintiffs merely complaining about statutory violations to sustain causes of action. Though Spokeo said that statutory violations do not necessarily rise to the level of concrete injury, Rivera likely further limited the occasion in which a statutory violation itself could suffice.