Updated on October 18th, 2019:
On August 8, 2019, the United States Court of Appeals for the Ninth Circuit held that the plaintiffs have constitutional standing to sue Facebook for violating statutory privacy rights under the Illinois Biometric Information Privacy Act of 2008. Facebook had filed a motion to dismiss arguing that plaintiffs lacked standing on the ground because the plaintiffs had not alleged any concrete injury.
Under Article III of the United States Constitution, federal courts are limited to hearing actual cases or controversies. In Spokeo, Inc. v. Robins, the United States Supreme Court held that a person whose rights under a statute whose rights have been violated by a corporation is not automatically granted a private right of action to sue that company under the violated statute. Spokeo, Inc. has become a barrier to the enforcement of consumer data privacy laws.
Nonetheless, the trial court denied Facebook’s motion to dismiss and recognized a class of Facebook users. The Court of Appeals affirmed the decision of the lower court, stating that Illinois’s Biometric Information Privacy Act was designed to protect individuals’ “concrete interests in privacy”. The court also noted that the alleged unauthorized use of the face recognition technology by Facebook “invades an individual’s private affairs and concrete interests.” In doing so, the court explained the hazards of face recognition surveillance and the importance of the Biometric Information Privacy Act’s privacy protections.
Therefore, the class action lawsuit was returned to the United States District Court and continues to wait for a possible trial.
For more information see Patel et al v Facebook Inc. (18-15982)
In December 2018 several amicus curiae, such as EFF, ACLU, CDT, and PIRG, filed briefs before the Ninth Circuit Court of Appeals to review a class certification order against Facebook’s treatment of personal biometric data. The case on appeal is In re Facebook Biometric Information Privacy Litigation, also known as Patel v. Facebook.
The class comprises of Facebook users located in Illinois for whom Facebook created and stored a face template. The Plaintiffs/Appellees challenge the social media “Tag Suggestions” program. The program scans for and identifies people in uploaded photographs to promote user tagging. Plaintiffs allege that Facebook collects and stores their biometric data without prior notice or consent in violation of the Illinois Biometric Information Privacy Act (BIPA). The BIPA regulates “the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information” and it allows consumers to sue and demand pecuniary relief without proving that any actual damage occurred. Certification of the class could include upwards of 6 million members. This potentially exposes the social media company to billions of dollars in liability.
For more information and assistance on privacy, data protection, and biometric privacy, Francesca Giannoni-Crystal.