Illinois Federal Court Rejects Arbitration of BIPA Class Action
An Illinois federal court recently denied a motion to compel individual arbitration of a class action alleging violations of the Illinois Biometric Information Privacy Act (BIPA). In Acaley v. Vimeo Inc., the plaintiff brought a putative BIPA class action against the maker of user-created video software, alleging the defendant “violated BIPA by using facial recognition technology to scan, collect, and store his and other users’ face geometries from videos and photographs they uploaded to [the defendant’s website/app] without satisfying [BIPA’s] requirements.”
The defendant sought to stay the lawsuit and to compel individual arbitration of the plaintiff’s claims. The plaintiff resisted the defendant’s motion, contending both that no agreement to arbitrate was formed, and that the BIPA suit was beyond the arbitration agreement’s scope, because it was excluded as one of the specific exceptions to the agreement. The district court disagreed with the former, but agreed with the latter, and denied the motion to compel arbitration.
Arbitration Agreement Formation
The parties disputed whether a binding arbitration agreement had been made at all. As the court explained, “arbitration is a matter of contract.” The parties agreed that the defendant’s terms of service included an arbitration clause, but disputed whether the plaintiff had assented to the terms of service. After a “fact-intensive inquiry,” the court found that the plaintiff “received reasonable notice on at least two occasions” that he was consenting to the terms of service, and specifically noted that reasonable notice of an agreement can be given “even if [the website] does not provide an affirmative statement giving such notice on every page.”
Scope of Arbitration Agreement
As the court explained, “any doubt concerning the scope of the arbitration clause is resolved in favor of arbitration,” and arbitration should be compelled “unless it may be said with positive assurance that the arbitration clause is not susceptible of an interpretation that covers the asserted dispute.” At issue was the “Exceptions to Arbitration” clause, which exempted from arbitration, among other claims, “any Claim related to, or arising from, allegations of theft, piracy, invasion of privacy or unauthorized use.”
The court explained (and the defendant did not contest) that “BIPA claims generally relate to or arise from invasion of privacy.” The court also noted “[f]ederal district courts, including this Court, also have described the Illinois legislature as creating a ‘legal right to privacy’ in BIPA and have characterized lawsuits brought under BIPA as ‘[i]nvasion of privacy lawsuits.’”
The court rejected the defendant’s arguments that the exclusion only applied to “common-law tort claims of invasion of privacy, not other sorts of invasion-of-privacy claims,” stating that “this argument falls flat.” Regarding the defendant’s inventive argument that “the phrase ‘invasion of privacy’” must be narrowly interpreted because the word “‘invasion’ bespeaks an aggressive, even extreme act that far exceeds mere non-compliance with regulatory law,” the court explained that the Illinois Supreme Court has “used the word ‘invasion’ to describe BIPA violations.” Ultimately, the court concluded that the terms of service “are not susceptible of a reading” that the arbitration agreement covered the BIPA claim.
The wave of BIPA class actions shows no sign of abating, and Illinois naturally remains the epicenter of these cases. Arbitration agreements with class and collective action waivers can be a useful tool for defeating BIPA class actions. However, the Vimeo case serves as a reminder that at its core, BIPA is a privacy statute. In tandem with ensuring that BIPA-compliant policies and practices are in place, careful attention must be paid to the terms of any arbitration agreement, to be sure those arbitration agreements achieve their intended goals. This court’s decision also lends support to the argument that BIPA claims are subject to Illinois’ one-year limitation period for privacy causes of action.