Patel, et al. v. Facebook, Inc., No. 3:15-cv-03747-JD (N.D. Cal. Aug. 8, 2019), hosted by the Electronic Privacy Information Center (EPIC).
On October 20, 2019, the Ninth Circuit granted Facebook a motion to stay in Patel v. Facebook, pursuant to Federal Rule of Appellate Procedure 41(d)(2), to allow Facebook to file a petition for writ of certiorari in the Supreme Court of the United States. If the Supreme Court hears the case and affirms the Ninth Circuit’s ruling that the plaintiffs have standing, it could provide a clear path for plaintiffs to bring statutory privacy claims in all federal courts.
In 2010, Facebook launched facial recognition technology that scans user-posted photos to create a database of facial signatures matched to users. In August 2015, Illinois residents Adam Pezen, Carlo Licata, and Nimesh Patel brought a class-action lawsuit against Facebook in the Northern District of California, alleging that Facebook’s facial recognition technology violates the Illinois Biometric Information Privacy Act (“BIPA”), 740 Ill. Comp.Stat. 14/5(e). In August 2019, the Ninth Circuit Court of Appeals affirmed the district court’s decision to recognize the class’s Article III standing, ruling that intangible harms, like the violation of a statutory privacy right, can be grounds for bringing such claims.
Currently, there is a circuit split on the extent to which plaintiffs must show harm in order to bring privacy and data breach causes of action. For instance, the Second Circuit only accepts evidence of tangible harm. And in Spokeo, Inc. v. Robins, the Supreme Court held that Article III standing is not always satisfied “whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right. Article III standing requires a concrete injury even in the context of a statutory violation.”
In this case, plaintiffs allege that they suffered a concrete injury-in-fact because Facebook violated Sections 15(a) and 15(b) of BIPA, which require that companies delete biometric data within a certain timeframe and that they provide notice or receive consent for the use of biometric data. In June 2016, Facebook moved to dismiss the claim for lack of Article III standing. The Ninth Circuit acknowledged that, under Spokeo, a statutory violation is not in itself sufficient to create standing if the injuries are not concrete. However, the court reaffirmed that intangible injuries can be concrete, creating a two-step approach to evaluate whether a violation of a statute causes a concrete injury. A statutory violation may cause a concrete injury if (1) the statutory provisions were established to protect the plaintiff’s concrete interests and (2) the violations alleged actually harm, or present a material risk of harm, to such interests. The court stated that the Illinois General Assembly enacted BIPA because “public welfare, security and safety will be served by the regulation” of biometric information. Further, the court found that Facebook’s retention of biometric data harmed plaintiffs’ substantive privacy interests.
Facebook had also argued on appeal to the Ninth Circuit that the district court erred in granting class certification to the plaintiffs. It argued that class certification violated Rule 23(b)(3) of the Federal Rules of Civil Procedure because the events necessary to the cause of action did not occur “primarily and substantially within” Illinois, so a common question did not “predominate” within the class. The Ninth Circuit affirmed the district court’s certification of the class. It held that the question of whether a substantial part of the events occurred in Illinois does not defeat predominance because the question must be answered over time, and the court can always decertify the class if it deems necessary.
While the Ninth Circuit did not rule on the merits of the case, this case is the first certified BIPA class action. The significance of the Ninth Circuit’s ruling for future privacy ligation is debated. Some suggest that the ruling will encourage more privacy lawsuits. However, others claim that the case is inconsequential—at least for proceedings in Illinois courts—because further interpretation of BIPA is necessary. The motion to stay allows Facebook to avoid expending extra costs on a lengthy trial and paying damages when the ruling may eventually be overturned. If the plaintiffs prevail, Facebook is looking at billions in damages because Illinois law allows statutory damages from $1,000 to $5,000 per plaintiff, and the class could potentially contain millions of plaintiffs.