Last week, the Second Circuit Court of Appeals issued its decision in a leading putative class action case filed under the Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/1 et seq. The court held, in a summary order, that consumers whose faces had been scanned for use in a video game had not suffered an injury or risk of harm sufficient to confer Article III standing. While the summary order is not precedential, the case is significant because it is the first decision by a United States Court of Appeals to address what it takes to obtain Article III standing under BIPA.
The appeal arose from a putative class action case filed in the United States District Court for the Southern District of New York in which the plaintiffs alleged that the defendant collected scans of users’ faces to create a personalized basketball player for use in its video game. The plaintiffs filed a claim under BIPA, an Illinois statute that imposes disclosure and consent requirements for companies that collect biometric information. In Vigil, there was no allegation that the defendant had improperly disseminated or used the facial scans, or that there had been any data breach that put users’ biometric information at risk. The district court dismissed the complaint for lack of Article III standing, noting that there was no dissemination or use of the biometric data “in any way not contemplated by the only possible use of the [video game] feature: the creation of personalized basketball avatars for in-game play.” The district court also addressed the merits of the claims under BIPA, holding that the plaintiffs could not establish a statutory violation because they had not met BIPA’s requirement that a plaintiff seeking redress be “aggrieved by” a violation of BIPA.
On appeal, the Second Circuit affirmed the dismissal on Article III standing grounds. The court held that the plaintiffs had failed to plead facts showing that the alleged statutory violation of BIPA created a material risk that plaintiffs’ biometric information would be misused or disclosed. In so holding, the court relied on the fact that the gamers whose faces had been scanned were aware of how their facial scans would be used and could not plausibly assert that they would have withheld their consent had they been fully informed.
The plaintiffs also alleged violations of BIPA’s data security provisions, which the court described as creating “a somewhat thornier issue” for Article III standing. Finding no allegations that there was a material risk of biometric information being disclosed to third parties, the court held that the plaintiffs’ claims were insufficient to confer Article III standing. The court also found “unpersuasive plaintiffs’ attempts to manufacture an injury” by claiming that they suffered a fear of engaging in biometric transactions as a result of the defendant’s conduct.
Finally, the court held that the failure to allege facts sufficient to confer Article III standing deprived the district court of subject matter jurisdiction such that it could not render a decision on the merits of the claimed statutory violations. As a result, the district court’s dismissal with prejudice was improper, and the case was remanded to the district court to enter a dismissal without prejudice. A dismissal without prejudice will allow the plaintiffs to pursue their claims in state court, which may impose different standing requirements.
Over the past six months, the plaintiffs’ class action bar has been aggressively filing putative class action cases under BIPA, including numerous cases alleging that employers have violated BIPA by collecting fingerprints from employees as a timekeeping mechanism. See prior alert on the Illinois BIPA here. The Vigil decision is a welcome sign to companies that collect biometric information from Illinois residents. Nonetheless, for a number of reasons, we expect BIPA filings to continue in the short-term until the case law becomes more settled. First, the Vigil decision comes from the Second Circuit Court of Appeals whereas most BIPA cases are being filed in Illinois state courts, which are not required to follow Second Circuit precedent. Second, because it was issued as a summary order, the Vigil decision is not precedential and courts facing a similar issue will not be required to follow its holding, even within the Second Circuit. Third, even where BIPA claims fail for lack of Article III standing, the Vigil court found that those claims should be dismissed without prejudice to refiling the claims in state court, where standing requirements may differ. Fourth, the facts of Vigil were favorable to the defense because the plaintiffs clearly knew how their facial scans would be used and provided affirmative consent to the intended use through an End User License Agreement. The plaintiffs’ bar is likely to argue that Vigil is confined to this specific factual setting.
The foregoing has been prepared for the general information of clients and friends of the firm. It is not meant to provide legal advice with respect to any specific matter and should not be acted upon without professional counsel. If you have any questions or require any further information regarding these or other related matters, please contact your regular Nixon Peabody LLP representative. This material may be considered advertising under certain rules of professional conduct.
NP Privacy Partner | 12.01.17