Google awarded summary judgment in BIPA class action

In December, the Northern District of Illinois granted Google's summary judgment motion thereby shielding Google from potentially millions in damages for its alleged violations of the Illinois Biometric Privacy Act. Rivera v. Google, Inc., 16C02714 (N.D. Ill. Dec. 29, 2018). This decision raises unresolved questions about how to appropriately balance consumers' control over their personal information while limiting their ability to enforce violations of privacy statutes.

Google BIPA Class Action

After years of dormancy, savvy class action attorneys began in 2016 to exploit the then-relatively unknown BIPA statute. BIPA requires that a private entity provide notice and obtain consent before it collects, stores, and/or retains biometric information. 740 ILCS 14/15. It defines "biometric information" as "any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual." The act in turn defines "biometric identifier" as "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry." 740 ILCS 14/10. Because BIPA authorizes a minimum $1,000 liquidated damages penalty -- per violation -- social media giants such as Google and Facebook were obvious early targets.

In March 2016, plaintiffs Lindabeth Rivera and Joseph Weiss filed suit against Google based on Google Photos. When a user uploads a photo to Google Photos, Google Photos detects images of faces from the uploaded photograph, creates a face template of the detected faces (face scans), and then uses the created face scans to compare them to an existing database of face scans within that user's Google Photos account. Their suit alleged that Google, through its operation of Google Photos, collected and stored their biometric information (their face scans) without consent in violation of BIPA.

In May 2016, Google filed a motion to dismiss Rivera and Weiss's complaint based on BIPA's definition of "biometric information." BIPA excludes from its definition of "biometric information" any information derived from photographs. 740 ILCS 14/10. Google's motion to dismiss argued that because the alleged biometric information (Rivera and Weiss's face scans) is derived from photographs, their face scans do not constitute biometric information under BIPA, and therefore, Rivera and Weiss cannot allege a BIPA cause of action. The district court denied Google's motion to dismiss. The court held that Google's argument that only in-person face scans constitute a "biometric identifier" lacks textual support.

Nearly two years later, in April 2018, Google filed a summary judgment motion. Google's summary judgment motion focused on Article III standing. Article III standing requires: (i) an injury in fact; (ii) that is fairly traceable to the defendant's challenged conduct; and (iii) that is likely to be addressed by a favorable judicial decision. BIPA authorizes a private right of action to any party that is "aggrieved" by a BIPA violation. Google argued, however, that neither Rivera nor Weiss was an aggrieved party under BIPA because neither provided evidence of any injury -- financial, physical or emotional -- beyond the alleged injury to their privacy interests caused by Google's failure to comply with BIPA's notice and consent requirements.

The court's summary judgment analysis focused on the threat of whether Rivera and Weiss's biometric information would be compromised. The court first questioned whether Google's retention -- without prior consent -- of such biometric information could establish Article III standing. The court held that absent any threat that the retained biometric information would be compromised, its mere retention without more does not satisfy Article III's standing requirements.

The court then inquired whether Google's collection of Rivera and Weiss's biometric information, without any threat that such collected biometric information would be compromised, could establish Article III standing. To answer this question, the district court examined other 7th Circuit decisions on Article III standing and a factually analogous BIPA class action against Facebook pending in the Northern District of California. In that Facebook action, the district court denied Facebook's motion to dismiss for lack of standing even though the plaintiff failed to allege any injury other than the violation of BIPA.

The district court concluded that because there is no substantial risk that Rivera and Weiss's face scans will result be compromised, there is no justification for "an across-the-board conclusion that all cases involving any private entity that collects or retains individuals' biometric data present a sufficient risk of disclosure that concrete injury has been satisfied in every case." (Emphases in original.)

Implications

On the surface, the impact of this decision would appear to temper the onslaught of BIPA class action filed in federal court where the only alleged injury is the BIPA violation. Arguably, tempering such suits would further BIPA's purpose because it will disincentivize BIPA class actions that seek to capitalize off of BIPA per violation penalties as opposed to protecting individuals' privacy rights. Indeed, here, Rivera was not even a Google Photo user and any Google Photo user can turn off the face-grouping feature, thereby bypassing the collection and storage of face scans. And the biometric information at issue is a face scan of a photograph -- that arguably is not even protected under BIPA -- and Fourth Amendment case law rejects an expectation of privacy in one's face.

However, this decision can also be viewed to promote non-compliance with BIPA's notice-and-consent provisions. Those provisions are intended to give the consumer a choice--whether to allow for the collection of biometric information in the first instance, regardless of whether that collection and retention may be compromised at a later date. Arguably, the notice-and-consent provisions are even more necessary for BIPA because biometric information cannot be replaced once compromised.

Coincidentally, the current draft of California's Consumer Privacy Act does not allow for a private right of action based on a failure to comply with the CCPA's notice requirements. Instead, under the CCPA, any consumer whose non-encrypted or non-redacted personal information, which includes biometric information, is subject to -unauthorized access or disclosure as a result of the business's failure to implement and maintain reasonable security procedures, may institute a civil action. The CCPA's goal is to protect California resident's fundamental right of privacy, by affording them the ability to control the use of their personal information; yet a California consumer can only bring a private right of action for a business' failure to comply with notice-and-consent requirements under CCPA.