Ninth Circuit Declines to Shelve Lawsuit Alleging Facebook Violated Illinois Biometric Privacy Statute
Illinois enacted a biometric privacy statute which restricted the collection of biometric identifiers. Plaintiffs, Illinois residents and Facebook users, alleged that Facebook violated this statute by collecting, storing, and processing their face-scans without their consent and without establishing the requisite retention schedule.
Facebook moved to dismiss for lack of Article III standing. Plaintiffs moved to certify a class. The district court rejected Facebook’s standing argument and certified a class of all Illinois users for whom Facebook created and stored a face template after June 2011. Facebook sought permission to appeal to the Ninth Circuit, which it granted. On appeal, the court affirms.
The court focuses on the nature of the harm asserted by plaintiffs and whether this is sufficient to satisfy standing under the Supreme Court’s ruling in Spokeo (and on the Ninth Circuit’s ruling on remand). The court reads Spokeo to mean that an alleged violation of a statutory right that protects against “the risk of real harm” may satisfy standing. On the other hand, violation of a “mere procedural rule” would not. As an example of this latter, the court pointed to dissemination of an incorrect zip code. The court also looks to its own decision on Spokeo (on remand) and asks the same two questions:
[w]hether the statutory provisions at issue were established to protect [the plaintiff’s] concrete interests (as opposed to purely procedural rights), and if so, (2) whether the specific procedural violations alleged in this case actually harm, or present a material risk of harm to, such interests.
The court notes that privacy rights have a strong basis in the common law. These common law rights are intertwined with constitutional interests. The court points to recent Fourth Amendment cases where the Court recognizes that advances in technology can result in denigration of personal privacy. The court concludes:
[i]n light of this historical background and the Supreme Court’s views regarding enhanced technological intrusions on the right to privacy, we conclude that an invasion of an individual’s biometric privacy rights has a close relationship to a harm that has traditionally been regarded as providing a bass for a lawsuit in English or American courts.
The collection of a face-scan can have far-reaching consequences for an individual. It can allow identification of an individual from a surveillance photo or could be used to unlock an individual’s phone. The court also credits the Illinois legislature’s motivations in enacting the statute.
The court concludes that given the nature of the safeguards in question, Facebook’s possible violations would present a material harm to the interests in question. The court quotes from the Illinois Supreme Court’s ruling in a case involving Six Flags:
[w]hen a private entity fails to adhere to the statutory procedures . . . the right of the individual to maintain his or her biometric privacy vanishes into thin air.
Having concluded that plaintiff’s satisfy Article III standing, the court affirms, finding the certification decision an appropriate exercise of the district judge’s discretion.
___
The Supreme Court’s ruling in Spokeo was not particularly useful in resolving standing questions when raised by privacy plaintiffs. The Ninth Circuit struggled on remand and came to the same conclusion it initially did. Spokeo’s language is not of much use here in figuring out whether an asserted harm is “merely procedural” or whether it presents the risk of real harm that has traditionally been protected and is protected by the statute in question. At a minimum, the Court’s ruling in Spokeo has not been shown to be antagonistic to privacy plaintiffs.
A big question is how likely Facebook is to fight this lawsuit to the bitter end. While it was quick to resolve some early privacy lawsuits (most notably, Beacon), something tells me, it is willing to sink significant resources into fighting this case. Highlighting the importance of this lawsuit for the industry, the US Chamber of Commerce has also weighed in and is urging the full Ninth Circuit to rehear this case. Of course, Facebook is only raising a threshold defense, and has numerous others that it will assert as the lawsuit progresses (including the alleged excessiveness of the statutory damages).
Case citation: Patel v. Facebook, No. 18-15982 (9th Cir. Aug. 8, 2019), petition for rehearing filed (U.S. Chamber’s amicus brief in support of en banc petition)
Related posts:
Google Photos Defeats Privacy Lawsuit Over Face Scans–Rivera v. Google
Illinois Users’ Face-Scanning Privacy Lawsuit Against Facebook Headed to Trial
Face Scanning Lawsuit Against Shutterfly Survives Motion to Dismiss
Pingback: News of the Week; September 25, 2019 – Communications Law at Allard Hall()