July 11, 2020

Volume X, Number 193

July 10, 2020

Subscribe to Latest Legal News and Analysis

July 09, 2020

Subscribe to Latest Legal News and Analysis

July 08, 2020

Subscribe to Latest Legal News and Analysis

Facebook “Tagged” in Certified Facial Scanning Class Action

Recently, the Ninth Circuit Court of Appeals held that an Illinois class of Facebook users can pursue a class action lawsuit arising out of Facebook’s use of facial scanning technology. A three-judge panel in Nimesh Patel, et al v. Facebook, Inc., Case No. 18-15982 issued an unanimous ruling that the mere collection of an individual’s biometric data was a sufficient actual or threatened injury under the Illinois Biometric Information Privacy Act (“BIPA”) to establish standing to sue in federal court. The Court affirmed the district court’s decision certifying a class. This creates a significant financial risk to Facebook, because the BIPA provides for statutory damages of $1,000-$5,000 for each time Facebook’s use of facial scanning technology was used in the State of Illinois.

This case is important for several reasons. First, the decision recognizes that the mere collection of biometric information may be actionable, because it creates harm to an individual’s privacy. Second, the decision highlights the possible extraterritorial application of state data privacy laws, even those that have been passed by state legislatures intending to protect only their own residents. Third, the decision lays the groundwork for a potential circuit split on what constitutes a “sufficiently concrete injury” to convey standing under the U.S. Supreme Court’s landmark 2016 decision in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016). Fourth, due to the Illinois courts’ liberal construction and interpretation of the statute, class actions in this sphere are likely to continue to increase.

The Illinois class is challenging Facebook’s “Tag Suggestions” program, which scans for and identifies people in uploaded photographs for photo tagging. The class plaintiffs alleged that Facebook collected and stored biometric data without prior notice or consent, and without a data retention schedule that complies with BIPA. Passed in 2008, Illinois’ BIPA prohibits gathering the “scan of hand or face geometry” without users’ permission.

The district court previously denied Facebook’s numerous motions to dismiss the BIPA action on both procedural and substantive grounds and certified the class. In moving to decertify the class, Facebook argued that any BIPA violations were merely procedural and did not amount to “an injury of a concrete interest” as required by the U.S. Supreme Court’s landmark 2016 decision in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016).

In its ruling, the Ninth Circuit determined that Facebook’s use of facial recognition technology without users’ consent “invades an individual’s private affairs and concrete interests.” According to the Court, such privacy concerns were a sufficient injury-in-fact to establish standing, because “Facebook’s alleged collection, use, and storage of plaintiffs’ face templates here is the very substantive harm targeted by BIPA.” The Court cited with approval Rosenbach v. Six Flags Entertainment Corp., — N.E.3d —, 2019 IL 123186 (Ill. 2019), a recent Illinois Supreme Court decision similarly finding that individuals can sue under BIPA even if they suffered no damage beyond mere violation of the statute. The Ninth Circuit also suggested that “[s]imilar conduct is actionable at common law.”

On the issue of class certification, the Ninth Circuit’s decision creates a precedent for extraterritorial application of the BIPA. Facebook unsuccessfully argued that (1) the BIPA did not apply because Facebook’s collection of biometric data occurred on servers located outside of Illinois, and (2) even if BIPA could apply, individual trials must be conducted to determine whether users uploaded photos in Illinois. The Ninth Circuit rejected both arguments. The Court determined that (1) the BIPA applied if users uploaded photos or had their faces scanned in Illinois, and (2) jurisdiction could be decided on a class-wide basis. Given the cross-border nature of data use, the Court’s reasoning could be influential in future cases where a company challenges the applicability of data breach or data privacy laws that have been passed by state legislatures intending to protect their own residents.

The Ninth Circuit’s decision also lays the groundwork for a potential circuit split. In two cases from December 2018 and January 2019, a federal judge in the Northern District of Illinois reached a different conclusion than the Ninth Circuit on the issue of BIPA standing. In both cases, the Northern District of Illinois ruled that retaining an individual’s private information is not a sufficiently concrete injury to satisfy Article III standing under Spokeo. One of these cases, which concerned Google’s free Google Photos service that collects and stores face-geometry scans of uploaded photos, is currently on appeal to the Seventh Circuit.

The Ninth Circuit’s decision paves the way for a class action trial against Facebook. The case was previously only weeks away from trial when the Ninth Circuit accepted Facebook’s Rule 23(f) appeal, so the litigation is expected to return to the district court’s trial calendar soon. If Facebook is found to have violated the Illinois statute, it could be held liable for substantial damages – as much as $1000 for every “negligent” violation and $5000 for every “reckless or intentional” violation of BIPA.

BIPA class action litigation has become increasingly popular since the Illinois Legislature enacted it: over 300 putative class actions asserting BIPA violations have been filed since 2015. Illinois’ BIPA has also opened the door to other recent state legislation regulating the collection and use of biometric information. Two other states, Texas and Washington, already have specific biometric identifier privacy laws in place, although enforcement of those laws is accomplished by the state Attorney General, not private individuals. A similar California law is set to go into effect in 2020. Legislation similar to Illinois’ BIPA is also currently pending in several other states.

The Facebook case will continue to be closely watched, both in terms of the standing ruling as well as the potential extended reach of the Illinois law.

© Polsinelli PC, Polsinelli LLP in CaliforniaNational Law Review, Volume IX, Number 240


About this Author


Mark Olthoff looks for solutions. Whether it is help resolving a commercial dispute, responding to a financial services claim, or counseling on a corporate governance issue, Mark’s experience and knowledge guides clients to the best possible result. He has extensive litigation experience with class actions, consumer protection, banking and securities laws, and all manner of business disputes. Mark's national practice includes actions involving FDCPA, RICO, FCRA, TILA and other federal and state statutes.  Mark represents numerous financial institutions and is an author...

Russell Jones, Polsinelli Law Firm, Kansas City, Corporate and Litigation Law Attorney

Russell S. Jones, Jr. serves as Chairman of the firm's Litigation Department and is a member of the Commercial Litigation and Intellectual Property Litigation practice groups. With more than 30 years of experience, he serves clients in industries including telecommunications; software and technology; retail; consumer products; franchisors; banks and financial services; utilities; sports licensors; professionals (lawyers and accountants); not-for-profit entities; and product manufacturers.

Russ handles trials, appeals and alternative dispute-resolution proceedings in the area of business litigation including trademarks, patents, copyrights and other intellectual property; class actions; securities; directors and officers liability; business torts; civil rights; communications; and antitrust. He has represented business clients in Missouri, Kansas and other state and federal trial and appellate courts throughout the United States. Russ works with clients across Polsinelli’s nation-wide platform, handling cases from New York to California, Florida to Washington State.

Russ has handled more than four dozen class action cases in the areas of consumer fraud, securities, taxation, contract, local government and antitrust. He has served as lead enforcement counsel for a major sports licensor and has handled trademark, copyright and patent infringement cases for medium-sized and large businesses. He has tried two patent infringement cases, both to favorable verdicts, and has successfully defended favorable patent case judgments in the Federal Circuit Court of Appeals. 

Elizabth Marden Commercial Litigation Attorney Polsinelli Kansas City

Libby’s strong advocacy skills, strategic and analytical abilities, and business acumen make her a valuable asset to the firm’s litigation team. Libby is dedicated to developing outcome-driven litigation strategies that are aligned with her clients’ business goals. She takes pride in partnering with clients to achieve positive outcomes both inside and outside of the courtroom.

As a member of Polsinelli’s Commercial Litigation practice group, Libby assists clients with all stages of business disputes and methods of dispute resolution, including litigation, mediation, and arbitration...