Chicago, Ill. (January 22, 2020) - On January 21, 2020, the U.S. Supreme Court denied Facebook’s petition for a writ of certiorari to review whether a group of potentially millions of Facebook users have constitutional standing to pursue claims brought under the Illinois Biometric Information Privacy Act (BIPA) for alleged violations of the statute’s notice and consent mandates. BIPA is the only statute in the nation that provides for a private right of action for the improper collection, retention, disclosure, or destruction of biometric identifiers and information, providing for statutory damages of $1,000 per negligent violation or $5,000 per reckless or intentional violation.
Patel v. Facebook, Inc. involves claims for damages under BIPA relating to Facebook’s “tag suggestions” feature. When enabled, Facebook uses facial recognition software to analyze newly uploaded photos and then suggests that friends “tag” their friends in the photo. A class of Illinois Facebook users filed suit in the U.S. District Court of the Northern District of California claiming that this feature violates BIPA because the facial recognition software collects and uses their biometric identifiers or information without providing them proper notice. The class is comprised of potentially millions of users, and the claimed damages are billions of dollars.
Facebook moved to dismiss in the district court, arguing that the tag feature was clearly exempt under the photograph exception to BIPA. The district court denied the motion, reasoning that BIPA only excluded “paper prints,” not “digitized images.” After the Supreme Court decided its seminal Article III standing opinion on privacy claims, Spokeo v. Robins, Facebook again moved to dismiss for lack of subject matter jurisdiction for lack of standing, specifically that plaintiffs had not demonstrated that that they suffered a concrete and particularized injury to confer standing in federal court under Spokeo. The district court denied the motion, concluding that “the abrogation of the procedural rights mandated by BIPA necessarily amounts to a concrete injury,” and no “real-world harm” is required. The district court then certified a class of users, and Facebook filed an interlocutory appeal on the motion to dismiss and class certification in the Ninth Circuit Court of Appeals.
The Ninth Circuit sided with the Facebook users, affirming that
the class had Article III standing to sue for procedural violations
of BIPA even though the plaintiffs had not alleged actual harm from
Facebook’s conduct. The court concluded that “the
privacy right protected by BIPA is the right not to be subject to
the collection and use of biometric data” and thus
“Facebook’s alleged violation of these statutory
requirements would necessarily violate the plaintiffs’
substantive privacy rights.” Regarding class
certification, Facebook argued that a significant issue in the case
involves whether class members can show that the violation of BIPA
occurred within Illinois (since the statute only applies to
Illinois), thus requiring an individualized, fact-dependent inquiry
to determine where any individual class member used
Facebook’s tagging feature or if users in certain locations
were pinged to different servers located throughout the country.
Accordingly, Facebook argued, the district court wrongfully decided
that the case satisfied the predominance requirement under Federal
Rule of Civil Procedure 23. The Ninth Circuit disagreed and
affirmed class certification, reasoning that “if future
decisions or circumstances lead to the conclusion that
extraterritoriality must be evaluated on an individual basis, the
district court can decertify the class.” Facebook moved for
rehearing en banc, which was denied on October 18,
On December 2, 2019, Facebook petitioned the Supreme Court for a writ of certiorari, presenting the following questions for review and citing authority regarding splits in the Circuit Courts of Appeal:
Whether a court can find Article III standing based on its conclusion that a statute protects a concrete interest, without determining that the plaintiff suffered a personal, real-world injury from the alleged statutory violation;
Whether a court can find Article III standing based on a risk that a plaintiff’s personal information could be misused in the future, without concluding that the possibility of misuse is imminent;
Whether a court can certify a class without deciding a question of law that is relevant to determining whether common issues predominate under Rule 23.
The denial of certiorari on these questions leaves in place the Ninth Circuit’s decision on standing to pursue BIPA claims under Spokeo and will undoubtedly further embolden plaintiffs in bringing BIPA claims. It also widens the door for plaintiffs to bring BIPA lawsuits against businesses located outside of Illinois for potential violations of BIPA, as in the case of Facebook, which could include pay vendors and other third parties that work with businesses located within the state.
Nearly one year ago, the Illinois Supreme Court in Rosenbach v. Six Flags held that a mere statutory violation of BIPA is sufficient to confer standing to sue in Illinois state court.
Lewis Brisbois founded the first specialized BIPA Practice Group in the country and is chaired by Chicago Partners Mary Smigielski and Josh Kantrow. Mary, Josh, and the BIPA team act as defense counsel and monitoring counsel to employers, insurers and other defendants in BIPA litigation and provide BIPA-related counseling services.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.