In two recent, related decisions, U.S. District Judge James Donato from the Northern District of California allowed plaintiffs to proceed on claims against Facebook under the Illinois Biometric Information Privacy Act (“BIPA”), finding that non-compliance with BIPA’s notice and consent requirements provided sufficient injury for federal Article III standing. The decisions are Patel v. Facebook Inc., 2018 U.S. Dist. LEXIS 30727 and Gullen v. Facebook, Inc., 2018 U.S. Dist. LEXIS 34792. While these decisions add another arrow in the quiver of plaintiffs’ attorneys filing BIPA class actions, as federal courts continue to reach different conclusions about the sufficiency of such allegations for Article III standing purposes, the fact that the plaintiffs do not allege any tangible injuries may still prove problematic for them as the cases progress.
BIPA is intended to protect Illinois residents’ biometric information, defined as information derived from “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” Companies collecting such information must, among other requirements, provide notice to residents that the information is being collected and explain how it will be used and how long it will be stored. The company must obtain a written release from the resident for collection and subsequent use. BIPA provides residents with a private right of action whereby individuals can seek liquidated damages of $1,000 per negligent violation or $5,000 for intentional or reckless violations. Since 2008, there have been several federal and state cases filed by plaintiffs with mixed results, including on the question of whether alleged non-compliance with BIPA’s notice and consent provisions are sufficient “injuries in fact” for Article III standing. Courts finding that such allegations are not sufficient include McCollough v. Smarte Carte, Inc., No. 16 C 03777, 2016 WL 4077108 (N.D. Ill. Aug. 1, 2016) and Vigil v. Take-Two Interactive Software, Inc., 235 F. Supp. 3d 499, 513 (S.D.N.Y, 2017). In McCollough, the court reviewed allegations that the defendant failed to notify or receive consent prior to scanning fingerprints used to lock and unlock a storage locker. The court found that allegations about such technical violations were not sufficient and that there would be no injury if the company held the fingerprints for longer than the duration of the rental, unless such data was disclosed or at risk of disclosure. The court in Vigil reached a similar conclusion, finding that plaintiffs did not allege injury in fact where they scanned and uploaded their faces to create an online avatar for a video game but did not receive notice that the facial scans would be stored.
In rejecting Article III standing in both cases, the courts described the purpose of the statute to protect against misuse or disclosure of biometric...
