LitLand is a monthly feature that reviews developments in litigation as they relate to privacy matters and highlight any past, current, and future cases about which you should know.
On January 21 the U.S. Supreme Court denied Facebook’s petition for certiorari seeking review of the 9th Circuit’s decision in Patel v. Facebook, thus allowing to stand the Court of Appeals'determination that a violation of the Illinois Biometric Information Privacy Act (BIPA) is an injury-in-fact for the purposes of Article III standing.
The Illinois Biometric Information Privacy Act
BIPA prohibits collecting, using, and storing biometric identifiers, including scans of face geometry, without obtaining a written release from the data subjects and establishing a retention schedule in compliance with BIPA. The statute requires "establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever occurs first."
The statute also restricts private entities from selling, leasing, trading, or otherwise profiting from biometric identifiers or biometric information. The plaintiffs in Patel allege that Facebook's use of facial recognition technology violated BIPA because the social media company failed to obtain written releases or establish a BIPA-compliant retention schedule. The district court certified the class.
The 9th Circuit concluded that the alleged collection, use, and storage of the plaintiffs' face templates was "the very substantive harm targeted by BIPA," which protected their concrete privacy interests and, therefore, that plaintiffs had alleged the concrete and particularized harm required for Article III standing. The 9th Circuit also concluded that the district court had not abused its discretion in certifying the class because threshold questions of extraterritoriality could be decided on a classwide basis, and there was no indication that a large statutory damages award was contrary to the intent of the Illinois legislature.
Satisfying the Concrete Injury Requirement
The Supreme Court concluded in 2016’s Spokeo, Inc. v. Robins that although the injury-in-fact requirement for standing requires a showing of a "concrete and particularized" injury, an injury need not be "tangible" to be "concrete." The Court explained even an alleged statutory violation must be accompanied by a concrete injury, but that the "risk of real harm" could satisfy this requirement:
"Just as the common law permitted suit in such instances, the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact. In other words, a plaintiff in such a case need not allege any additional harm beyond the one Congress has identified."
It appears that the Supreme Court sees no reason to revisit this precedent. Meanwhile, in early 2019, as we have previously covered (here and here), the Illinois Supreme Court ruled that a violation of BIPA was sufficient to state a claim for relief.
Face-Off?
The Supreme Court’s refusal to consider the case meant that it would have returned to federal district court in California. However, following the denial of certiorari, Facebook settled for $550 million on January 29, 2020.