The Ninth Circuit just became the first federal appellate court to recognize that Illinois’s Biometric Information Privacy Act (BIPA) protects a concrete right to privacy that is injured when a defendant fails to comply with the statute’s procedures intended to safeguard privacy.
The opinion comes in a high-profile case styled Patel v. Facebook Inc., on appeal from the U.S. District Court for the Northern District of California’s ruling granting certification of a class of individuals claiming that the social media company’s creation of face templates constitutes an unlawful capture of biometric information under BIPA.
The federal litigation against Facebook has fueled several recent decisions, including the Illinois Supreme Court’s January 2019 ruling in Rosenbach v. Six Flags, which cited to the federal district court’s holding in the Patel case to support its conclusion that a mere violation of BIPA’s notice and consent procedures constitutes an actual injury under the law.
The Ninth Circuit opinion then cites extensively to Rosenbach, thereby completing a feedback loop that is unhelpful to defendants’ arguments that a technical violation of BIPA does not automatically constitute a concrete harm for the purposes of Article III standing in federal court, at least in the Ninth Circuit.
The issue of standing in federal court for privacy claims has been well trodden in recent years, after the U.S. Supreme Court’s 2016 decision in Spokeo v. Robins (Spokeo I).
Compiling its own precedent, the Supreme Court opined that a violation of intangible harms protected by a statute could constitute actual injury for standing purposes when: (1) the statutory violation is closely related to a traditionally recognized harm, or (2) when Congress’ judgment indicates that the intangible harm should be considered concrete for standing purposes.
Ninth Circuit Two-Step Approach
On remand in Robins v. Spokeo (Spokeo II), the Ninth Circuit applied the guidance of Spokeo I and developed a two-step approach to determine whether the violation of a statute causes a concrete injury.
First, it asks whether the statutory provisions at issue were established to protect the plaintiff’s concrete interests (as opposed to purely procedural rights), and if so, then whether the specific procedural violations alleged in the case actually harm, or present a material risk of harm to, such interests.
Applying its two-step analysis to the class claims under BIPA, the Ninth Circuit held that the capture and use of a person’s biometric information invades concrete interests in an individual’s private affairs and that the statutory provisions of BIPA constitute more than mere procedural rights.
Because the privacy right protected by BIPA is the right not to be subject to the collection and use of such biometric data, failure to comply with the statute’s protections necessarily violates an individual’s substantive privacy interests. Thus consistent with the Illinois Supreme Court’s ruling in Rosenbach, no additional injury is required for a plaintiff to have standing to pursue a claim under BIPA in federal court (in the Ninth Circuit).
Opinion Important Beyond Immediate Holding
While that result may have been predictable based on Spokeo II and other Ninth Circuit precedent, of particular interest is the opinion’s discussion of the impact of the future development of technology on its present assessment of concrete harm to privacy rights.
Also noteworthy is its deference to the Illinois state legislature—rather than Congress as mentioned by the Supreme Court in Spokeo I—in defining intangible rights the violation of which results in actual harm.
The extent to which those ideas find their way into BIPA and other cases litigating newly created state rights to privacy could grow the importance of the opinion beyond its immediate holding.
The impact of the Ninth Circuit’s opinion on the standing analysis of other federal courts dealing with BIPA claims will be of interest in the coming months. The Supreme Court’s 2019 opinion in Frank v. Gaos remanded another privacy case under the Stored Communications Act to the Ninth Circuit, expressing skepticism as to whether the plaintiffs representing the certified class had alleged violations that were sufficiently concrete and particularized to support Article III standing.
For district courts outside of the Ninth Circuit not bound by its precedent, the Supreme Court’s ongoing resistance to finding standing in privacy claims, particularly on a class-wide basis, should fuel continued argument by defendants that BIPA violations do not constitute actual injury.
On the other hand, adoption of the Ninth Circuit’s analysis by other jurisdictions could narrow the options for defendants.
One thing remains clear: until the issue is resolved by the Supreme Court, parties must be prepared to argue standing at every level of BIPA litigation, particularly in cases outside the Illinois state courts and the Ninth Circuit.
This column does not necessarily reflect the opinion of The Bureau of National Affairs, Inc. or its owners.
Torsten Kracht is a partner at Hunton Andrews Kurth in the firm’s Washington, D.C., and New York offices. He represents clients from the U.S. and abroad in complex commercial litigation and arbitration.
Bennett Sooy is a litigation associate at the firm in the Washington, D.C., office.
Special thanks to summer associate Mike Dingman for his research on the issue.