On February 26, 2018, a California federal court denied Facebook’s motion to dismiss claims under Illinois’s Biometric Information Privacy Act, finding the plaintiff had Article-III standing despite the absence of tangible injury. Patel v. Facebook, Inc., 2018 WL 1050154 (N.D. Cal. Feb. 26, 2018). The court distinguished the claim from other BIPA cases finding no Article-III standing under the Supreme Court’s 2016 decision in Spokeo v. Robins, 136 S. Ct. 1540 (2016). The decision is a reminder that despite recent defense victories in BIPA cases, defendants continue to face substantial potential liability even where plaintiffs incurred no discernible injury from alleged technical violations of BIPA’s requirements.

A wave of class actions have been filed against companies under BIPA.
BIPA prohibits private entities from obtaining or using individual’s biometric information without first providing defined notices and obtaining written consent to do so. 740 ILCS 14/15(a), (b). BIPA allows any “person aggrieved” by a BIPA violation to sue for either actual damages or “liquidated damages” of between $1,000 and $5,000, plus attorneys’ fees and injunctive relief. 740 ILCS 14/20.

The availability of liquidated damages has prompted dozens of recent class-action filings, mostly in Illinois state court, alleging BIPA violations. These cases have mostly been filed against employers who allegedly collected and used employee fingerprints for time clocks. Significantly, plaintiffs in these cases typically do not allege any tangible injury (e.g., identity theft); plaintiffs simply allege the violation of BIPA’s notice-and-consent requirements and seek to collect the $1,000 to $5,000 liquidated damages for themselves and all other putative class members.

Several courts have dismissed BIPA claims for lack of a tangible injury.
Three significant decisions have dismissed BIPA claims where the plaintiff did not allege any injury beyond an alleged violation of BIPA’s notice-and-consent requirements. In Vigil v. Take-Two Interactive, the U.S. Court of Appeals for the Second Circuit affirmed the dismissal of a BIPA claim because the plaintiff’s failure to allege a concrete injury deprived the plaintiff of Article-III standing under Spokeo. No. 17-303, 2017 WL 5592589 (2nd Cir. Nov. 21, 2017). Plaintiffs in Take-Two played a video game made by defendant; the game scanned plaintiffs’ faces to create in-game avatars. While plaintiffs knew their faces were being scanned and used, they claimed they didn’t receive the notice or provide the written consent required by BIPA. Because plaintiffs knew their biometric information was being taken and used, the Second Circuit affirmed the dismissal because there was “no material risk that Take-Two’s procedural violations have resulted in plaintiffs’ biometric data being used or disclosed without their consent.”Take-Two, 2017 WL 5592589, at * 2. 

In Rosenbach v. Six Flags Entertainment Corp., the Illinois Appellate court held that a BIPA plaintiff cannot state a claim under the statute without a resulting injury beyond a statutory violation. 2017 IL App (2d) 170317. There, defendant collected plaintiff’s fingerprints when plaintiff bought a season pass to the defendant’s theme park and allegedly failed to provide the notice and obtain the written consent required by BIPA. Id. at ¶¶ 7-10. Because plaintiffs did not allege any injury beyond the alleged violations, the appellate court held that plaintiffs were not “aggrieved” by the violation, as required by the statute, and thus had no statutory standing to sue. Id. at ¶ 23 (“A determination that a technical violation of the statute is actionable would render the word ‘aggrieved’ superfluous.”).

Finally, a federal district court dismissed a BIPA claim based on lack of Article III and statutory standing in McCollough v. Smarte Carte, Inc., 2016 WL 4077108, at *1 (N.D. Ill. Aug. 1, 2016). There, the defendant was a locker-rental company that collected plaintiff’s fingerprints to use in lieu of a key to get into the locker. The court found the absence of any consequential injury beyond the alleged lack of notice and consent deprived plaintiff of both constitutional standing under Article III and Spokeo and statutory standing under BIPA.

In Patel, the court found the alleged collection and use of biometric information without plaintiff’s knowledge was a sufficient injury to satisfy Spokeo.
Plaintiffs in Patel sued based on Facebook scanning uploaded photos and creating a digital representation and “template” of each face in the photos, including faces of non-Facebook users. Facebook does this to allow users to “tag” (i.e. identify) people in uploaded photos, which Facebook can then use to identify those people in other photos based on the biometric information Facebook extracts from the photos. Plaintiffs claimed Facebook violated BIPA’s notice-and-consent requirements.

The court in Patel denied defendant’s motion to dismiss under Spokeo and found plaintiff had alleged a sufficient injury. 2018 WL 1050154, * 1. The court found that Illinois’s passage of BIPA gave plaintiff a right to protect their biometric information and that the violation of that right was a sufficiently concrete harm to satisfy Spokeo. Id. * 4 (“the abrogation of the procedural rights mandated by BIPA necessarily amounts to a concrete injury.”). The court distinguished Take-Two and McCollough because plaintiffs there “indisputably knew that their biometric data would be collected before they accepted the services ….” Id. at * 5. By contrast, plaintiff in Patel alleged “Facebook afforded plaintiffs no notice and no opportunity to say no” to the data collection. Id.

Patel can be distinguished but should cause defendants to be wary of BIPA litigation.
Many defendants in the current wave of BIPA class actions have moved to dismiss based on a lack of actual injury, and plaintiffs in those cases will undoubtedly cite Patel in response. But Patel’s facts were unique: plaintiffs there allegedly did not know their biometric information was being taken from uploaded photos and used to identify them. By contrast, most plaintiffs in pending BIPA cases knew their biometric information (typically fingerprints) was taken and used, and thus should not be able to use Patel to fight dismissal. But defendants will need to carefully distinguish Patel to defeat no-injury BIPA cases.