The U.S. Court of Appeals for the Ninth Circuit recently held that the class plaintiffs alleged a concrete and particularized harm sufficient to confer Article III standing where the defendant company’s alleged collection, use, and storage of the plaintiffs’ biometric information was the substantive harm targeted by the Illinois Biometric Information Privacy Act (“BIPA”), which statute protects the plaintiffs’ concrete privacy interests.
The Ninth Circuit further held that the district court did not abuse its discretion in certifying the class.
Accordingly, the Ninth Circuit affirmed the district court orders certifying the class, and denying the defendant’s motion to dismiss.
A copy of the opinion is available at: Link to Opinion
Facebook, Inc. (“Facebook”) operates one of the largest social media platforms in the world, with over one billion active users. When a new user registers for a Facebook account, they must create a profile and agree to Facebook’s terms and conditions, which permit Facebook to collect and use data in accordance with Facebook’s policies.
In 2010, Facebook launched a feature called Tag Suggestions. When Tag Suggestions is enabled, Facebook may use facial-recognition technology to analyze whether the user’s Facebook friends are in photos uploaded by that user.
Facebook users living in Illinois brought a class action in a federal district court in California against Facebook claiming that Facebook’s facial-recognition technology violates Illinois law. Specifically, the Plaintiffs alleged that Facebook violated BIPA by collecting, using, and storing biometric identifiers from their photos without obtaining a written release and without establishing a compliant retention schedule.
Under BIPA, “[a]ny person aggrieved” by a violation of its provisions “shall have a right of action” against an “offending party.”
Facebook moved to dismiss the complaint for lack of Article III standing on the ground that the Plaintiffs had not alleged any concrete injury. While the motion to dismiss was pending, the Plaintiffs moved to certify a class under Rule 23.
The district court denied Facebook’s motion to dismiss, and certified a Rule 23(b)(3) class of “Facebook users located in Illinois for whom Facebook created and stored a face template after June 7, 2011.” The matter was then appealed.
On appeal, the Ninth Circuit addressed the issue of Article III standing, noting that to establish standing a plaintiff “must have suffered an ‘injury in fact’ – an invasion of a legally protected interest which is (a) concrete and particularized; and (b) actual or imminent, not conjectural or hypothetical.”
A concrete injury need not be tangible, but in determining whether an intangible injury is concrete, courts consider both history and legislative intent.
In determining whether the violation of a statute causes a concrete injury, the Ninth Circuit has adopted a two-step approach: “(1) whether the statutory provisions at issue were established to protect [the plaintiff’s] concrete interests (as opposed to purely procedural rights), and if so (2) whether the specific procedural violations alleged in the case actually harm, or present a material risk of harm to, such interests.”
In considering the first factor, the Ninth Circuit noted that “[p]rivacy rights have long been regarded as providing a basis for a lawsuit in English or American courts.” Moreover, in recent Fourth Amendment jurisprudence, “the Supreme Court has recognized the potential for unreasonable intrusions into personal privacy” related to enhanced technology.
In light of this background, the Ninth Circuit “conclude[d] that an invasion of an individual’s biometric privacy rights has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.”
Moreover, “[t]he judgment of the Illinois General Assembly, which is ‘instructive and important’ to our standing inquiry, . . . supports the conclusion that the capture and use of a person’ biometric information invades concrete interests.”
The Ninth Circuit therefore concluded that “the statutory provisions at issue” in BIPA were established to protect an individual’s “concrete interests” in privacy, not merely procedural rights.
The Court next turned to whether the specific procedural violations alleged actually harm, or present a material risk of harm to, such interests.
In concluding that they did, the Ninth Circuit noted that the Plaintiffs alleged that a violation of the BIPA requirements allowed Facebook to create and use a face template and retain that template for all time. Thus, “[b]ecause the privacy right protected by BIPA is the right not to be subject to the collection and use of such biometric data, Facebook’s alleged violation of these statutory requirements would necessarily violate the plaintiffs’ substantive privacy interests.”
Accordingly, the Ninth Circuit held that “plaintiffs’ have alleged a concrete injury-in-fact sufficient to confer Article III standing.”
The Court next turned to Facebook’s argument that the district court abused its discretion by certifying the class. Specifically, Facebook argued that class certification was not compatible with Rule 23(b)(3), which requires that “questions of law or fact common to class members predominate over any question affecting only individual members.” Facebook further argued that the Illinois extraterritoriality doctrine precludes the district court from finding predominance.
The Ninth Circuit disagreed, determining that the “threshold questions of BIPA’s applicability can be decided on a class-wide basis,” by deciding if the violation of BIPA occurred when plaintiffs used Facebook in Illinois, or if they occurred when Facebook’s servers created a face template.
Facebook additionally argued that the district court abused its discretion by certifying a class because a class action is not superior to individual actions, because the possibility of a large, class-wide statutory damages award defeats superiority.
The Ninth Circuit rejected this argument, ruling that “nothing in the text or legislative history of BIPA indicates that a large statutory damages award would be contrary to the intent of the General Assembly.”
Thus, the Ninth Circuit held that “the district court did not abuse its discretion in determining that a class action is superior to individual actions in this case.”
Eric Tsai
Maurice Wutscher LLP
71 Stevenson Street, Suite 400
San Francisco, CA 94105
Direct: (415) 529-7654
71 Stevenson Street, Suite 400
San Francisco, CA 94105
Direct: (415) 529-7654
Fax: (866) 581-9302
Mobile: (714) 600-6000
Email: etsai@MauriceWutscher.com
Admitted to practice law in California, Nevada and Oregon
.png){kind=small}
ALABAMA | CALIFORNIA | FLORIDA | ILLINOIS | MARYLAND | MASSACHUSETTS | NEW JERSEY | NEW YORK | OHIO | PENNSYLVANIA | TEXAS | WASHINGTON, D.C.
