Class action lawsuits alleging violations of the Illinois Biometric Information Privacy Act (BIPA) continue to flood courts’ dockets. In a case against Facebook related to use of an alleged facial recognition technology in its photo “tagging” feature, a federal appellate court just greenlighted a class action trial based on procedural violations of BIPA. With potential statutory damages of $1,000 for each negligent violation or $5,000 for each intentional or reckless violation, and over one billion active Facebook users, the potential damages are staggering.
BIPA imposes a series of procedural requirements, including notice and consent, in order to collect an individual’s so-called biometric identifiers or biometric information. The technology at issue in Patel v. Facebook relates to Facebook’s “Tag Suggestion” functionality. According to the Ninth Circuit’s opinion, Tag Suggestion uses facial recognition technology to suggest the identity of individuals appearing in photographs posted to Facebook. This technology extracts geometric data points to create a face signature or map that is then compared to faces in Facebook’s database of face templates. If there is a match, Facebook may suggest tagging that person in the photograph.
In 2015, three individuals sued Facebook, alleging it violated BIPA by utilizing its Tag Suggestion functionality without complying with BIPA’s procedural requirements (the cases were originally filed in Illinois and later consolidated and transferred to the California federal court). In April 2018, the United States District Court for the Northern District of California certified a class of plaintiffs that includes Facebook users in Illinois who had their facial data analyzed and collected by Facebook. Facebook appealed to the Ninth Circuit.
On August 8, 2019, the Ninth Circuit affirmed class certification. The Court first concluded that procedural violations of BIPA were sufficient privacy violations to give plaintiffs “standing” to sue. The Court then concluded that, at least for now, a class action was appropriate for this dispute and therefore affirmed the class certification order.
Absent further review, the Patel case against Facebook will continue to trial on a class action basis, presenting what would be one of the largest consumer class action trials in history. With recent BIPA cases filed against Google, Amazon and Shutterfly over the technology used in their products, the efforts to “tag” companies with BIPA liability are likely to continue at what has been a frenetic pace.
Companies that use information that may implicate biometrics, whether in the consumer or employment context, therefore should continue to evaluate their technology and whether implementation of BIPA-compliant policies are necessary.
