If there is one sustaining lesson as a result of the pandemic, it is that we can conduct the majority of our professional and personal business online. With this increase in the use of the online world, come new fears and concerns about the safety and privacy of personal data. Plaintiff's firms are capitalizing on this fear, which is growing among the average consumer as they more aggressively challenge businesses' rights to use and compile their personal data in a new way- right to publicity laws. A prime example is the increase in cases this year in Illinois by way of the Illinois Right to Publicity Act. This statute is not new, but its applicability to the usage of online data is an emerging trend nationwide of which businesses should take note.

The Illinois Right to Publicity Act (IRPA)

The IRPA became effective on January 1, 1999 and replaced the common law tort of the unlawful use appropriation or likeness. The law provides for a private cause of action for the unauthorized use of an individual's identity for a commercial purpose. The statute defines identity as, ” any attribute of an individual that serves to identify him or her, including, but not limited to the individual's name, signature, photograph, image, likeness, or voice.”

A commercial purpose is defined under the law as, ” the public use or holding out of an individual's identity:

  • On or in connection with the offering for sale or sale of a product, merchandise, goods, or services.
  • For purposes of advertising or promoting products, merchandise, goods, or services, or
  • For the purpose of fundraising.

The statute provides for a private cause of action and does not require a plaintiff to prove actual damages. The IRPA views the individual's rights as property rights rather than rights of a more personal nature. Plaintiffs are increasingly bringing class actions as well as individual suits as they are emboldened by this statutory language and its new interpretations in light of advancements in how companies collect the online personal data of their customers and users of their websites.

Damages Under IRPA

The repercussions for violating IRPA are important for businesses to understand and acknowledge. A minimum of $1,000 in fixed statutory damages is recoverable by the plaintiff even if the plaintiff does not provide proof of harm. The plaintiff can also recover actual damages plus profits that the business obtained as a result of using the plaintiff's information without their consent. Finally, for willful violations, a plaintiff may recover punitive damages as well.

Theory of the Case Under IRPA

The most recent theories propagated by the plaintiffs' bar involve advocating for consumers on the theory that businesses who sell access to online databases or subscription lists that contain the personal information of individuals who have used their site, purchased their products, or used their services is a type of violation of a person's right to control how that information is used. This right to publicity, the plaintiffs argue, is violated when the businesses sell this information without the customer's written consent. Their claim centers around the idea that the person's identity is being sold to third parties for profit.

In recent litigation in Illinois, the plaintiffs alleged that the defendants violated IRPA by selling mailing lists that contained the personal data of their subscribers, including the plaintiffs, and revealed such information as their gender, age, ethnicity, religion as well as contact information. These cases are unique because they promote liability on the basis of selling of subscriber lists rather than only on searchable databases. In the past, these lawsuits were often dismissed by courts because it was difficult for plaintiffs to prove that the business disclosed any of the individual plaintiff's personal information to any third parties as others would need to type an individual's name in a search bar to pull up any information. With subscriber lists and the sale of databases with more readily available consumer information going unprotected for many years, plaintiffs are now honing into this area of relatively limited, or only recently emerging statutory space with limited protections for consumers or site users.

Relationship of Right to Publicity and Biometric Laws

The new IRPA suits cropping up around the country also reflect the increasingly tight standards many states are imposing on businesses' use of biometric information. These statutes regulate the use and dissemination of customer data collected by way of biometrics such as fingerprints, eye scans, etc. In fact, there are many key similarities between these types of laws:

  • Both provide a private right of action;
  • Both allow plaintiffs to recover $1000 even in the absence of actual damages;
  • Both allow successful plaintiffs to recover attorney fees;
  • Both allow damages to be recovered without any proof of harm or damage to the plaintiff; and
  • Under both IRPA and BIPA, plaintiffs only need to prove a violation of the statute in order to recover damages. Proof malice, intent to harm, or a showing of any harm at all is not required.

Some high profile cases involving Facebook and TikTok have already been litigated and dominated airtime in the media this year because plaintiffs are beginning to find success in claiming damages for the personal information that these big tech companies collect, store and use for their own profit. As both of these cases illustrate, the price tag for businesses found to be in violation in these class action suits can be sky high, or in Facebook's case to the tune of 650 million dollars.

Business Takeaways

  • Business should revisit their privacy practices and policies on the collection, storage and access to their customers private information;
  • While the use of the claim of the right of publicity is still a developing area, businesses should carefully monitor developments in this area including strengthening of laws regarding online consumers identity as well as biometric data; and
  • Business should take note of this potentially new path for litigants to claim liability and institute class actions against common practices that were not an issue until recently.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.