Facebook will need to face a class action under Illinois’ biometrics privacy law for its face-tagging technology, as a federal appeals court in California rejected both the social media giant’s attempt to argue the plaintiffs couldn’t prove they were actually harmed by the program, and Facebook’s contention a class action would dissolve into a pool of “mini-trials” over individual Illinois residents’ claims.
On Aug. 8, a three-judge panel of the U.S. Ninth Circuit Court of Appeals in San Francisco upheld the rulings of U.S. District Judge James Donato, who had determined the plaintiffs could sue Facebook under the Illinois Biometric Information Privacy Act and had certified lawsuits from three individual plaintiffs into a single class action.
“Facebook’s alleged collection, use, and storage of plaintiffs’ face templates here is the very substantive harm targeted by BIPA,” the judges said.
Ninth Circuit Judge Sandra Ikuta
| Youtube screenshot
The opinion was authored by Ninth Circuit Judge Sandra S. Ikuta. Circuit Judge Ronald M. Gould and District Judge Benita Y. Pearson concurred in the judgment.
While the decision centered on how to interpret Illinois state law, it had landed in California federal court four years ago at Facebook’s request.
The lawsuits were launched in 2015, beginning with an action filed in Cook County Circuit Court by named plaintiff Carlo Licata, through attorneys with the firm of Edelson P.C., of Chicago. Facebook removed that action to Chicago federal court about a month later.
Licata’s action was joined quickly by two other lawsuits, brought by plaintiff Adam Pezen, who was represented by the firm of Labaton Sucharow, of New York, and Nimesh Patel, represented by attorneys with the firms of Robbins Geller Rudman, of San Francisco.
The cases all accuse Facebook of violating the Illinois BIPA law when it introduced a new photo tagging system. The system uses facial recognition technology to map the facial geometry of people in photos – such as the distance between their eyes, nose and mouth – to identify specific individuals across the hundreds of millions of photographs uploaded by users to Facebook. When recognized, Facebook then uses the system to ask users if they wish to “tag” their friends – attaching a marker to the photo to identify people in the photos they may know.
The plaintiffs argue Facebook uses the program to secretly collect, store and share the so-called biometric identifiers of those pictured in the images. For Illinois residents, this would stand as a violation of the Illinois BIPA law, which they say requires companies collecting such biometric information to first secure a written authorization from users.
They contend Facebook did not secure that authorization, and so should be made to pay damages of up to $5,000 per violation, across potentially millions of Illinois residents who either use Facebook or whose likenesses are in photos posted to Facebook and stored in its system. In a tweet following the Ninth Circuit's ruling, the Edelson firm asserted the case could be worth "tens of billions of dollars" in damages.
The cases were transferred to San Francisco federal court in August 2015.
In court filings, Facebook has argued the plaintiffs cannot prove they were actually harmed by the face scans, or the resulting tag suggestions from Facebook.
Facebook also argued the case should not be allowed to proceed as a class action, because it would require the company to challenge millions of individual claims, resulting in a series of “mini-trials” over such questions as whether a photo was taken in Illinois, posted in Illinois or even scanned while the person in the photo was in Illinois, among other concerns.
Those contentions were rejected in a 2016 ruling from Judge Donato, prompting Facebook to appeal.
The company, however, found a cool reception from the Ninth Circuit, as judges rejected all of Facebook’s arguments on appeal.
The Ninth Circuit judges relied heavily on a recent Illinois Supreme Court ruling, which ruled plaintiffs don’t need to prove they were actually harmed before they should be allowed to sue a company accused of violating the BIPA law.
The Ninth Circuit judges similarly determined the BIPA law was written specifically to forbid the collection of biometric information at all, without first obtaining written consent from those whose biometrics were being collected. The collection of the information itself is a violation of rights established under BIPA, they said, removing the need for those suing to prove they suffered a “concrete” injury, such as a stolen identity.
The Ninth Circuit judges particularly cited the language of Illinois Supreme Court Chief Justice Lloyd A. Karmeier, who, in his opinion in the case docketed as Rosenbach v Six Flags, found violations of BIPA aren’t a “mere technicality.”
The Ninth Circuit judges particularly noted the risk of future harm from biometric data collection, such as from technology which could identify a “face-mapped individual” in surveillance footage, or could use a face scan to unlock a person’s smartphone.
“… The procedural protections in BIPA ‘are particularly crucial in our digital world’ because ‘when a private entity fails to adhere to the statutory procedures … the right of the individual to maintain his or her biometric privacy vanishes into thin air,’” the Ninth Circuit judges said, citing Karmeier in Rosenbach.
The judges also rejected Facebook’s against allowing the case to move forward as a class action.
The judges said they believed Illinois lawmakers intended the law to apply to companies based outside Illinois, removing the need for so-called “mini-trials.”
“If the violation of BIPA occurred when the plaintiffs used Facebook in Illinois, then the relevant events occurred ‘primarily and substantially’ in Illinois,” the judges said.
In its tweet following the release of the Ninth Circuit's opinion, the Edelson firm said the case is set for trial and would be "the largest and most significant privacy case in our nation's history to before a jury."
Facebook has been represented in the action by attorneys Lauren R. Goldman, Andrew J. Pincus and Michael Rayfield, of the firm of Mayer Brown LLP, of New York.
The plaintiffs have been represented by attorneys John Aaron Lawson and Rafey S. Balabanian, of Edelson PC, of Chicago and San Francisco; Susan K. Alexander and Shawn A. Williams, of Robbins Geller Rudman & Dowd LLP, of San Francisco; and Michael P. Canty and Corban S. Rhodes, of Labaton Sucharow LLP, of New York.
The case has drawn widespread interest from elsewhere, with additional briefs filed in support of each side, from an array of organizations, including the Internet Association, U.S. Chamber of Commerce and American Civil Liberties Union.
Editor’s note: The Cook County Record is owned by the U.S. Chamber of Commerce’s Institute for Legal Reform.