More than a decade ago Steve Spielberg’s Minority Report contemplated a future in which facial recognition would be ubiquitously used for targeted advertising. Now, a California court will decide whether to dismiss a class-action suit against Facebook based on its use of facial recognition software.
Plaintiffs allege that Facebook collects, stores and uses biometric information of its users, in particular, their “face templates,” without their consent and in violation of Illinois’s Biometric Information Privacy Act (“BIPA”). In May—after determining that plaintiffs had contractually agreed via user agreements to a California choice of law provision— the court declined to enforce it. The choice of law provision was contrary to a fundamental policy of Illinois, which has a greater interest in the determination of this case. BIPA was enacted in the first place because of Illinois’s concern that major corporations would collect user data that is unlike any other. In many instances, unique identifying information, like a password, can be altered as needed. But once biometric data is compromised, the horse is out of the barn.
Following the Supreme Court’s Spokeo decision, Facebook filed a second motion to dismiss, arguing that plaintiffs lack Article III subject matter jurisdiction because they had not alleged an “injury in fact” that was both particularized and concrete.
In Facebook’s view, Plaintiffs’ make unfounded assumptions in order to articulate an injury. Namely, Plaintiffs assume that biometric identifiers have an inherent value. And Plaintiffs also assume that they could, and would, sell their biometric data to (unidentified) third-party buyers for more money, if Facebook only discontinued its current activities.
Facebook also argues that Plaintiffs’ claims do not resemble any historically recognized, common law claim—which may be more tenable—such as
- Unreasonable intrusion upon the seclusion of another;
- Misappropriation of the name or likeness of another;
- Unreasonable publicity given to the private life of another; or
- Publicity that unreasonably places another in a false light before the public.
Plaintiffs oppose the motion. Under Spokeo, an injury may be “concrete” even when it is intangible, and Facebook’s BIPA violations constitute an informational injury. Specifically, Facebook failed to disclose that it was collecting and storing biometric information, and also failed to inform its users of its purpose in gathering the information, or how long the information would be retained. Although the BIPA cause of action is not identical to a traditional tort, it is squarely within the type of case that could be brought under the common law, which has “long recognized a right to personal privacy” that “encompass[es] the individual's control of information concerning his or her person.”
To date, plaintiffs in other cases have had varied success asserting a concrete injury under the Fair Credit Reporting Act, state statutes regulating mortgage companies, federal and state wiretap statutes, and the Telephone Consumer Protection Act.
Stay tuned to see whether privacy claims based on Illinois’s BIPA survive the pleading stage. As privacy laws evolve, the application of Spokeo has potential implications for billions of us.
Follow me on Twitter: @sroberg_perez
