The Ninth Circuit Clears The Way For BIPA Class Actions

Originally published by Michael E. Brewer, William F. Dugan and Jenna Neumann.

As detailed in prior posts, in January, the Illinois Supreme Court held that a plaintiff need not plead an actual injury beyond a per se statutory violation to state a claim for statutory liquidated damages or injunctive relief under the Illinois Biometric Information Privacy Act (BIPA). While recent decisions applying BIPA have been largely Illinois-based, the Ninth Circuit recently applied BIPA in Patel v. Facebook to affirm a lower court’s ruling that plaintiffs in the ongoing Facebook BIPA class action alleged a concrete injury-in-fact to confer Article III standing and that the class was properly certified.

The Ninth Circuit is the first federal circuit court to conclude that a plaintiff alleging a BIPA violation has standing for purposes of Article III of the US Constitution. The ruling makes it easier for plaintiffs to certify BIPA class actions, within and outside of Illinois. 

The Ninth Circuit’s Decision in Patel v. Facebook

In Patel v. Facebook, Facebook subscribers challenged Facebook’s “Tag Suggestions” program, which scans for and identifies people in uploaded photographs for photo tagging. The class alleges that Facebook collected and stored their biometric data without prior notice or consent and without a compliant data retention schedule in violation of BIPA.

Previously, Facebook moved to dismiss the plaintiffs’ complaint for lack of Article III standing. The district court, however, denied Facebook’s motion to dismiss and certified a class. In upholding the district court’s decision, the Ninth Circuit unanimously decided:

• Injury in Fact: Facebook’s alleged use of facial recognition technology with users’ consent constituted an invasion of privacy interests. Since BIPA protects plaintiffs’ concrete privacy interests and per se statutory violations of BIPA actually harm or pose a material risk of harm to such privacy interests, the plaintiffs alleged a concrete and particularized harm sufficient for Article III standing.
• Class Certification: The district court did not abuse its discretion in certifying a class. Illinois’ extraterritoriality doctrine did not bar the California district court from finding predominance. Rather, the Ninth Circuit held that it was reasonable to conclude that the Illinois legislature contemplated BIPA’s application to individuals located in Illinois, even if some activities occur outside of Illinois.

Notably, in its discussion regarding the district court’s decision to certify, the Ninth Circuit also weighed in on a plaintiff’s ability to recoup uncapped statutory damages under BIPA. The panel ruled that nothing in the statute’s legislative history indicates that damages should be capped. Denying class certification on the basis that millions of users would be able to recoup such damages was not a sufficient reason to decertify the class.

Similar to recent Illinois decisions on which we have previously reported, Patel reaffirms courts’ willingness to continue to apply BIPA as written, rather than carving out exceptions. As the first circuit court to directly tackle BIPA, Patel sets an important precedent for future BIPA litigation.

Takeaways

The panel remanded Patel back to the district court. Pending additional appellate review, Patel is expected to be scheduled for trial. Companies should monitor Patel as it continues to move through the court system, as the rulings in this case will be particularly instructive for businesses grappling with how to remain BIPA compliant.

As we have recommended previously, companies subject to BIPA’s requirements should also take concrete measures to implement, update and maintain policies and procedures that bring them into unequivocal compliance with BIPA. Such measures include:

• Developing a clear policy that explains what information a company collects and how the information will be stored and used;
• Notifying individuals in writing before any biometric information is collected; and
• Obtaining written consent from the data subject.

Implementing these requirements can help bring a company into compliance with the Act and prevent potential claims. For more information on BIPA compliance, contact your Baker McKenzie attorney.

Curated by Texas Bar Today. Follow us on Twitter @texasbartoday.

from Texas Bar Today https://ift.tt/2ZaLz2Z
via Abogado Aly Website