On August 8, 2019, the United States Court of Appeals for the Ninth Circuit again weighed in on Article III standing.  Unlike its previous ventures into standing, however, it did so this time in the context of the Illinois Biometric Information Privacy Act, 740 ILCS § 14, et seq. (“BIPA”).  In Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019), the Ninth Circuit held that the plaintiffs’ allegations of a BIPA violation based on the collection of consumer biometric data using facial recognition technology constituted a concrete harm for purposes of Article III standing pursuant to the standard set forth in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016) (“Spokeo II”).  This ruling adds to the confusion surrounding Article III standing in BIPA litigation, where a Circuit split has developed. 

The BIPA

The BIPA, which was enacted on October 3, 2008, regulates the retention, collection, disclosure, and destruction of “biometric identifiers” and “biometric information”.  The BIPA was the first, and remains the only, biometric privacy statute to provide a private cause of action to those “aggrieved” by a violation.  See 740 ILCS § 14/20.  The Illinois General Assembly stated, when enacting the BIPA, that “[t]he full ramifications of biometric technology are not fully known” and “[a]n overwhelming majority of members of the public are weary of the use of biometrics when such information is tied to finances and other personal information.”  See id. at § 14/5.

The BIPA defines a “biometric identifier” as a retina scan, iris scan, fingerprint, voiceprint, or scan of hand or face geometry.  “Biometric information” is defined as “any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual.”  See id. at § 14/10.

The BIPA generally requires that an entity possessing, collecting, capturing, purchasing, receiving through trade, or otherwise obtaining a “biometric identifier” or “biometric information”:

• comply with and “develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information”;
• inform a person “in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used”;
• receive “a written release” before collecting, capturing, purchasing, receiving through trade, or otherwise obtaining a “biometric identifier” or “biometric information” (in certain situations); and
• “store, transmit and protect from disclosure all biometric identifiers and biometric information using the reasonable standard of care within the private entity’s industry” and “in a manner that is the same as or more protective than the manner in which the private entity stores, transmits, and protects other confidential and sensitive information.”

See id. at § 14/15 (a), (b)(1)-(3), (e)(1)-(2). 

Article III Standing

Article III standing requires (1) an injury-in-fact, (2) fairly traceable to the challenged conduct, (3) that is likely to be redressed by a favorable judgment.  Spokeo, 136 S. Ct. at 1547.  To establish an injury-in-fact, a plaintiff must establish that he or she suffered “an invasion of a legally protected interest” that is “concrete and particularized” and “actual or imminent, not conjectural or hypothetical.”  Id. at 1548.

Both tangible and intangible injuries can meet the standard for concreteness, though tangible injuries are easier to spot.  Intangible injuries—such as those often resulting from BIPA violations which cause no actual harm to a plaintiff, particularly where the biometric information is not misappropriated, or at risk of being misappropriated, by a third party, published, or used against a plaintiff in a harmful manner—are more difficult to identify and assess.  Under Spokeo, however, a plaintiff does not “automatically” satisfy “the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.”  Id. at 1549.  A plaintiff must instead still establish a “concrete” injury tied to harm that has “traditionally been regarded as providing a basis for a lawsuit in English or American courts.”  Id.  Exactly what this means has been a continued subject of litigation in federal courts—a subject on which the Supreme Court declined to provide additional guidance when it denied a subsequent writ of certiorari in Spokeo in January 2018.

Facebook – The District Court Case

The Facebook litigation began in the U.S. District Court for the Northern District of California in May 2015 when social networking users brought a putative class action against Facebook.  The plaintiffs alleged that Facebook had “unlawfully collected and stored biometric data derived from their faces” without their consent in connection with Facebook’s “Tag Suggestions” program, which functions by scanning uploaded photographs, identifying the faces that appear in those photographs, and suggesting an individual’s name to “tag” in a photograph or automatically “tagging” that person by putting the recognized person’s name on the photograph.  As in most other BIPA cases, the plaintiffs sought statutory liquidated damages and injunctive relief, rather than actual damages.

Facebook moved to dismiss the suit, arguing that the plaintiffs lacked Article III standing because the alleged statutory violation of the BIPA was not a concrete injury under Spokeo.  The District Court disagreed and held that the plaintiffs had established a concrete injury.  Patel v. Facebook, Inc., 290 F. Supp. 3d 948, 954-55 (N.D. Cal. 2018).  Relying on cases brought under the Video Privacy Protection Act and the Telephone Consumer Protection Act, the District Court held that a statutory violation of the BIPA alone, without any actual harm to the plaintiff, is a “quintessential” intangible harm that constitutes a concrete injury-in-fact for purposes of Article III standing because the BIPA codified a substantive right to privacy in biometric data that was consistent with the common law right to privacy.  Id.

Facebook – The Appeal

A 3-judge panel in the Ninth Circuit subsequently unanimously affirmed the ruling of the District Court.  The panel held that the BIPA was enacted to protect the plaintiffs’ concrete interests in their biometric data and that the BIPA violation alleged in the Facebook case harmed such concrete interests.  In reaching that conclusion, the Ninth Circuit found that:

• The Ninth Circuit’s two-step approach for whether a statutory violation causes a concrete injury is: “(1) whether the statutory provisions at issue were established to protect [the plaintiff's] concrete interests (as opposed to purely procedural rights), and if so, (2) whether the specific procedural violations alleged in this case actually harm, or present a material risk of harm to, such interests.” Facebook, 932 F.3d at 1270-71.
• The BIPA provisions with regard to the collection and retention of biometric data were codified to protect individuals’ concrete biometric privacy rights, which have a close relationship to the common law right to privacy. Specifically, the Ninth Circuit held that the invasion of biometric privacy is closely related to the common law invasion of privacy claim for unreasonable intrusion upon the seclusion of another.  Id. at 1271-72.
• The judgment of the Illinois General Assembly in adopting the BIPA supports the conclusion that the protection of biometric privacy is a concrete interest because the statute was adopted to address risks to Illinois’ citizens presented by the use of their biometric data. Id. at 1273.
• The collection and retention of biometric data in violation of the BIPA will “necessarily” harm an individual’s concrete interest in the privacy of that data. Id. at 1274.

As of the date of this Client Alert, the plaintiffs have not yet sought a rehearing or en banc determination of the Ninth Circuit’s decision.  Their deadline to do so is this month.

Takeaways

Facebook muddies the BIPA litigation waters and furthers the splits that exist among the various federal Circuits and Districts.

At a macro-level, Facebook furthers a Circuit split that has developed with regard to Article III standing in BIPA cases.  Before Facebook, the Second and Seventh Circuit Courts of Appeals previously addressed Article III standing in the context of BIPA litigation, albeit involving different types of alleged BIPA violations.  In 2017, the Second Circuit held in an unpublished opinion that an alleged BIPA violation based on the defendant’s development of a video game that allowed gamers to create personalized basketball player avatars using a 3-D rendition of their faces did not constitute a concrete harm for Article III standing because the defendant did not disseminate the biometric data to third parties.  See Santana v. Take-Two Interactive Software, Inc., No. 17-303, 2017 WL 5592589, **3-4 (2d Cir. Nov. 21, 2017) (unpublished).  More recently, in June 2019, the Seventh Circuit held that an alleged BIPA violation based on the collection and retention of employee fingerprint data can constitute a concrete harm for Article III standing when the violation implicates “workers’ terms and conditions of employment.”  See Miller v. Sw. Airlines Co., 926 F.3d 898, 902-03 (7th Cir. 2019). 

At a micro-level, Facebook also furthers the split between courts that have addressed Article III standing to assert BIPA claims specifically based on the collection and retention of facial biometric data.  For instance, in Rivera v. Google, Inc., an Illinois federal district court held that Google’s alleged collection and retention of the plaintiff’s facial biometric data from photos uploaded to its website (allegedly in violation of the BIPA) was not a concrete harm for purposes of Article III standing.  The court held that the collection of facial biometric data was not a concrete harm in the first instance since faces are shown in public every day and thus are not sufficiently private to constitute a privacy violation, and the subsequent retention of facial biometric data alone is not a concrete injury absent dissemination to a third party.  See 366 F. Supp. 3d 998, 1110-12 (N.D. Ill. Dec. 29, 2018).  Conversely, in Monroy v. Shutterfly, Inc., another photo “tagging” case, another Illinois federal district court held that the BIPA violation can be sufficiently concrete for purposes of Article III when the defendant accessed the plaintiff’s biometric data without the plaintiff’s knowledge.  See No. 16 C 10984, 2017 WL 4099846, *8 n.5 (N.D. Ill. Sept. 15, 2017).  Notably, the Google decision is presently on appeal and would give the Seventh Circuit the opportunity to address Article III standing under similar facts to Facebook.

It is also possible that Facebook tells us more about the Ninth Circuit than it does the future of BIPA litigation.  In the immediate aftermath of Spokeo, the Ninth Circuit has found a concrete injury in a number of close calls.  These decisions include Robins v. Spokeo, Inc., 867 F.3d 1108 (9th Cir. 2017), Syed v. M-I, LLC, 853 F.3d 492 (9th Cir. 2017), and Eichenberger v. ESPN, Inc., 876 F.3d 979 (9th Cir. 2017).  Time will tell if Facebook is an aberration, a new trend, or the impetus for the U.S. Supreme Court to again review federal standing principles in light of the court splits left in Facebook’s wake.

[View source.]