In a ruling with implications for data privacy litigation nationwide, the Ninth Circuit recently stayed its decision allowing a biometric privacy class-action suit to proceed against Facebook, thus permitting the social media company to appeal the decision to the Supreme Court. The outcome of Facebook’s appeal could affect the law of standing with respect to data privacy litigation.
The lawsuit arose from Facebook’s “Tag Suggestions” feature, which used facial recognition technology to match known user faces to unknown faces in uploaded pictures. If the technology recognized a match, then Facebook would notify the person who uploaded the picture and suggest that the uploader “tag” the person recognized. If the uploader followed the suggestion, Facebook would link the recognized person to the picture. Facebook enabled this feature by default, although users could opt out.
In 2015, Illinois plaintiffs challenged this feature under the state’s Biometric Information Privacy Act (“BIPA”). BIPA defines “biometric information” to include a scan of “face geometry,” among other things. BIPA requires private entities that “collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s biometric identifier” to
- inform the subject of the collection or storage;
- inform the subject of the specific purpose or length of term for which a biometric identifies or biometric information is being collected, stored, and used; and
- receive a written release from the subject.
The plaintiffs filed a class-action lawsuit alleging that Facebook’s facial recognition program collected “biometric information”—that is, its users’ “facial geography”—without the users’ consent or release, in violation of BIPA. Facebook moved to dismiss the complaint for lack of standing, arguing that, under Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), the plaintiffs had not alleged a sufficiently concrete injury.
In Spokeo, the Supreme Court considered whether a procedural violation of the Fair Credit Reporting Act qualified as an injury sufficient to maintain a case under Article III. The Court held that “a plaintiff [does not] automatically satisf[y] the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” Spokeo, 136 S. Ct. at 1549. Because many data privacy statutes protect rights that can be considered purely “procedural,” some courts have applied Spokeo to bar data privacy litigation, particularly class actions, although other courts have not. Facebook’s motion to dismiss put this idea to the test.
In February 2018, the district court denied Facebook’s motion. Patel v. Facebook Inc., 290 F. Supp. 3d 948 (N.D. Cal. 2018). In October, the Ninth Circuit affirmed. Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019). Like the district court, the Ninth Circuit ruled that “the statutory provisions at issue in BIPA were established to protect an individual’s concrete interests in privacy” and that the complaint therefore “alleged a concrete injury-in-fact sufficient to confer Article III standing.” Id. at 1274.
On October 30, the Ninth Circuit granted Facebook’s motion to stay issuance of its mandate, to allow Facebook to appeal the ruling. Facebook’s appeal could clarify Spokeo’s applicability to data privacy litigation.