On August 8, 2019, the United States Court of Appeals for the Ninth Circuit issued the first appellate court decision allowing claims to proceed on a class-wide basis under the Illinois Biometric Information Privacy Act (“BIPA”), which requires a company collecting biometric information to provide written notice to anyone whose biometric information is collected, obtain that person’s written consent, and implement a BIPA-compliant policy for handling biometric information. Facebook was sued under BIPA for failing to provide notice and obtain consent for its “Tag Suggestions” feature, which develops and stores unique facial signatures that recognize Facebook users from photos uploaded to the website. Facebook moved to dismiss the complaint for lack of Article III standing, arguing that plaintiffs did not suffer a concrete injury because the alleged violation was merely “procedural” in nature. While Facebook’s motion was pending, plaintiffs moved for class certification. The district court denied Facebook’s motion and certified the class. Facebook appealed under Rule 23(f).
The three-judge panel from the 9th Circuit unanimously affirmed, holding that a statutory violation of BIPA creates a concrete injury for purposes of Article III standing. In reaching its conclusion, the 9th Circuit traced a 150-year lineage of privacy-related jurisprudence and determined that “an invasion of an individual’s biometric privacy rights ‘has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit.” The court also relied on the Illinois Supreme Court’s decision this year in Rosenbach v. Six Flags Entm’t Corp., 2019 IL 123186, which ruled that an individual is not required to sustain a “compensable injury beyond violation of their statutory rights” before seeking recourse under BIPA.
Facebook also argued that class certification was inappropriate under Illinois’s extraterritoriality doctrine, which requires that the “necessary elements” of a transaction—i.e., collecting plaintiffs’ facial signatures—occur “primarily and substantially” in Illinois. Facebook argued that its collection of biometric data occurred outside of Illinois, where its servers are located, and that each class member would have to prove that the necessary elements of their particular case occurred primarily and substantially in Illinois. The 9th Circuit disagreed, finding that the issue of extraterritoriality could be decided on a class-wide basis and did not require mini-trials as to each individual plaintiff.
Finally, the 9th Circuit rejected Facebook’s argument that the possibility of a large, class-wide statutory damages award would make managing the class action more difficult than if individual claims were separately adjudicated. The case will now head back to the district court on a class-wide basis.
The 9th Circuit’s decision is notable because it is the first appellate decision allowing BIPA claims to proceed on a class-wide basis. The good news is that compliance with BIPA is fairly simple. Given the significant penalties that can be imposed under BIPA, companies that interact with biometric information but have not addressed its requirements would be well served to review and update their policies for handling biometric information.