Facebook reaches largest privacy class action settlement

In what is the largest privacy class action settlement to date, Facebook Inc. announced last week that it will settle a high-profile lawsuit filed against it by a class of Illinois Facebook users who alleged that Facebook violated the Illinois Biometric Information Privacy Act (BIPA), 740 Ill. Comp. Stat. 14/1 et seq. (2008) for $550 million. In the case, Patel v. Facebook, Inc., the plaintiffs challenged Facebook's practice of utilizing facial recognition technology to create "face templates" for purposes of analyzing whether a user's Facebook friends are in photos uploaded by that user and making "tag suggestions." According to the plaintiffs, Facebook generated these face templates without their knowledge or consent, in violation of BIPA.

Prior to Patel, BIPA was a relatively unknown statute. The Illinois legislature passed the law in 2008 (nearly a decade before Patel was filed) to address the growing use of biometrics and the corresponding need to protect information that is "biologically unique to the individual" that, once compromised, leaves the individual with "no recourse," and places the individual at a "heightened risk of identity theft." 740 ILCS 14/5. The statute requires companies to provide notice and certain disclosures and obtain a written release prior to collection and disclosure of a person's biometric identifier or biometric information, as those terms are defined in the Act. 740 ILCS 14/15. BIPA also requires entities in possession of biometric identifiers or biometric information to secure that information and develop a written retention policy that it makes available to the public. Id.

The fact that Facebook opted to finally settle the case is not surprising given the facts that the district court had already certified a class, the case was heading to trial, and, with statutory damages of $1,000 to $5,000 per violation at stake, Facebook was facing billions of dollars in potential liability. Facebook had also lost its strongest arguments on appeal, leaving it with limited options.

Facebook loses 9th Circuit Appeal

In August 2019, the 9th U.S. Circuit Court of Appeals affirmed the district court's decision that the plaintiffs had standing under Article III of the U.S. Constitution, as well as its decision to certify a class of Illinois Facebook users. Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019). In determining whether the plaintiffs had standing, the 9th Circuit applied the two-step approach it developed on remand in the Robins v. Spokeo case, which calls on the court to inquire "(1) whether the statutory provisions at issue were established to protect [the plaintiff's] concrete interests (as opposed to purely procedural rights), and if so, (2) whether the specific procedural violations alleged in this case actually harm, or present a material risk of harm to, such interests." 867 F.3d 1108, 1113 (9th Cir. 2017) (quoting Robins v. Spokeo, Inc., 867 F.3d 1108, 1113 (9th Cir. 2017).

With respect to the first step, the 9th Circuit concluded that "the development of a face template using facial-recognition technology without consent (as alleged here) invades an individual's private affairs and concrete affairs." Patel, 867 F.3d at 1273. The court found that this notion was consistent with the legislative history of BIPA, and supported the conclusion that BIPA was not meant to protect a pure procedural right. Id. at 1273-74.

With respect to the second step, the 9th Circuit concluded that the alleged violation of BIPA's requirements would "necessarily violate the plaintiffs' substantive privacy interests," resulting in a concrete injury-in-fact sufficient to confer Article III standing. Id. at 1274. The court noted that its decision was consistent with its prior decisions, which found standing in cases alleging violation of privacy rights under statutes that are similar in nature to BIPA, such as the Video Privacy Protection Act (VPPA), 18 U.S.C. Section 2710. Id. at 1274-75.

In addition to concluding that the plaintiffs had alleged sufficient injury for purposes of Article III standing, the 9th Circuit also concluded that there were no grounds to decertify the class. In urging decertification, Facebook argued that the Illinois extraterritoriality doctrine precluded a finding of predominance as required under Rule 23(b)(3) of the Federal Rules of Civil Procedure. Specifically, Facebook contended that common questions do not predominate because each class member would need to offer individualized proof that the violation occurred "primarily and substantially within" Illinois. The 9th Circuit rejected the argument, concluding that this was really a threshold question of whether BIPA would apply to the plaintiff class. The court determined that this threshold question could be decided on a class-wide basis, without resort to individualized evidence. Id. at 1275-76.

The 9th Circuit also rejected Facebook's claim that "the possibility of a large, class-wide statutory damages award ... defeats superiority." The 9th Circuit noted that "the potential for enormous liability can justify a denial of class certification," but only if that was the legislature's intent. The court concluded that the district court did not err in concluding there was superiority because "nothing in the text or legislative history of BIPA indicates that a large statutory damages award would be contrary to the intent of the General Assembly." Id. at 1276-77.

After Facebook's bid for rehearing en banc was denied, Facebook filed a petition for writ of certiorari seeking review of the 9th Circuit's decision on standing and extraterritoriality. Less than a week ago the U.S. Supreme Court denied the petition, clearing the case for trial.

A Cautionary Tale

Given the significant statutory damages available, plaintiffs' lawyers took note of Patel when it was filed. The case spawned hundreds of class actions across the country against companies that use biometrics in their products and services and employers who utilize biometrics as a mechanism for security and timekeeping. Nevertheless, many companies continued to be oblivious to BIPA's requirements and the draconian penalties it authorizes against violating companies. It remains to be seen whether this settlement will change that, but there can be no question that it will certainly serve as a cautionary tale for companies that collect biometric information from individuals without consideration of BIPA or similar biometric privacy laws. 

Amanda Fitzsimmons is a partner in DLA Piper's San Diego office. She provides legal and strategic advice to domestic and multinational clients, both publicly and privately held, in a broad range of industries, including technology, healthcare, pharmaceutical, apparel, and consumer products regarding privacy, cybersecurity, antitrust and competition, and class action issues.