Facebook's woes continued this week as the Ninth Circuit rejected the company's efforts to dismiss and/or de-certify the class in a case brought by users who alleged that Facebook violated the Illinois Biometric Information Privacy Act (BIPA), 740 Ill. Comp. Stat. 14/1 et seq. (2008), by unlawfully collecting and storing biometric data derived from their faces without prior notice or consent.
The Ninth Circuit is the first federal circuit court to conclude that a plaintiff alleging a BIPA violation has standing for purposes of Article III of the US Constitution, and its ruling is at odds with an unpublished decision in the Second Circuit and numerous district court opinions across the country. The opinion continues the Ninth Circuit's trend of liberally interpreting the confines of Article III and confirms that the Ninth Circuit will continue to be a hotbed of privacy litigation for years to come.
Facebook's "tag suggestions" feature leads to litigation
In Patel v. Facebook, Case No. 18-15982 (9th Cir. Aug. 8, 2019), the plaintiffs challenged Facebook's practice of utilizing facial recognition technology to create "face templates" for purposes of analyzing whether a user's Facebook friends are in photos uploaded by that user. If a face template matches the photo and the user has enabled Facebook's "Tag Suggestions" feature, Facebook may suggest "tagging" the person in the photo. According to the plaintiffs, Facebook utilized this technology without user consent and without a compliant retention schedule in violation of BIPA, which prohibits the collection, use and storage of biometric identifiers, including a "scan" of "facial geometry."
In determining whether the plaintiffs had Article III standing, the Ninth Circuit applied the two-step approach it developed on remand in the Robins v. Spokeo case, which calls on the court to inquire "(1) whether the statutory provisions at issue were established to protect [the plaintiff’s] concrete interests (as opposed to purely procedural rights), and if so, (2) whether the specific procedural violations alleged in this case actually harm, or present a material risk of harm to, such interests." 867 F.3d 1108, 1113 (9th Cir. 2017).
With respect to the first step, the Ninth Circuit concluded that "the development of a face template using facial-recognition technology without consent (as alleged here) invades an individual's private affairs and concrete affairs." The court found that this notion was consistent with the legislative history of BIPA, and supported the conclusion that BIPA was not meant to protect a pure procedural right.
With respect to the second step, the Ninth Circuit concluded that the alleged violation of BIPA’s requirements would "necessarily violate the plaintiffs' substantive privacy interests," resulting in a concrete injury-in-fact sufficient to confer Article III standing. The court noted that its decision was consistent with its prior decisions, which found standing in cases alleging violation of privacy rights under statutes that are similar in nature to BIPA, such as the Video Privacy Protection Act (VPPA), 18 U.S.C. § 2710.
In addition to concluding that the plaintiffs had alleged sufficient injury for purposes of Article III standing, the Ninth Circuit also concluded that there were no grounds to decertify the class. In urging decertification, Facebook argued that the Illinois extraterritoriality doctrine precluded a finding of predominance as required under Rule 23(b)(3) of the Federal Rules of Civil Procedure. Specifically, Facebook contended that common questions do not predominate because each class member would need to offer individualized proof that the violation occurred "primarily and substantially within" Illinois. The Ninth Circuit rejected the argument, concluding that this was really a threshold question of whether BIPA would apply to the plaintiff class. The court determined that this threshold question could be decided on a class-wide basis, without resort to individualized evidence.
The Ninth Circuit also rejected Facebook's claim that "the possibility of a large, class-wide statutory damages award . . . defeats superiority." The Ninth Circuit noted that "the potential for enormous liability can justify a denial of class certification," but only if that was the legislature's intent. The court concluded that the district court did not err in concluding there was superiority because "nothing in the text or legislative history of BIPA indicates that a large statutory damages award would be contrary to the intent of the General Assembly."
Up until a few years ago, BIPA was a relatively unknown statute. In 2016, plaintiffs filed the Patel v. Facebook case, starting a wave of cases in Illinois, California, and elsewhere (reports estimate that more than 200 BIPA cases have been filed in the last two years). The Patel v. Facebook opinion demonstrates that BIPA is a powerful weapon in the statutory arsenal of plaintiffs' lawyers, and with statutory damages of $1,000 to $5,000 per violation, poses a severe trap for the unwary.
In addition, although the Ninth Circuit's opinion in Patel was one about statutory standing, the Ninth Circuit's discussion of evolving technologies, their implication on privacy rights, and the Supreme Court's developing Fourth Amendment jurisprudence suggests that the Ninth Circuit may be willing to find Article III standing in cases involving privacy violations that are not grounded in statutes exhibiting the strong legislative history of BIPA.
Finally, while the court's rejection of Facebook's decertification arguments seems at first blush to be troubling to corporate defendants, the court's ruling appears to have been premised on the fact that the Patel case "involve[d] only plaintiffs who are located in Illinois, and the claims are based on the application of Illinois law to the use of Facebook mainly in Illinois." Defendants seeking to avoid class certification based on arguments regarding extraterritorial application of state laws may have more traction in privacy cases that seek to certify nationwide classes or classes comprised of residents of multiple states.