Ninth Circuit Affirms Class Certification Win in Facebook Biometric Information Privacy Action

On August 8, 2019, the United States Court of Appeals for the Ninth Circuit published a precedential opinion and order decisively affirming an April 16, 2018 order by the Honorable James Donato of the United States District Court for the Northern District of California certifying a class of “Facebook users located in Illinois for whom Facebook created and stored a face template after June 7, 2011.”  Patel v. Facebook, Inc., No. 18-15982, slip op. at 10 (9th Cir. Aug. 8, 2019) (“Facebook”).

The case, centered on the Illinois Biometric Information Privacy Act (“BIPA”), alleges that Facebook unlawfully extracted biometric information from millions of users’ photographs without their consent.  As the case was previously only weeks away from trial when the Ninth Circuit accepted Facebook’s appeal, the litigation is expected to soon return to Judge Donato’s trial calendar.

In addition to affirming class certification, the Ninth Circuit also determined that Facebook’s collection of biometric data in alleged violation of BIPA was a sufficient “injury-in-fact.”  The Ninth Circuit’s reasoning followed United States Supreme Court guidance in Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1549 (2016), where the Supreme Court recognized that intangible harms, such as invasions upon a person’s privacy rights – here the alleged unlawful collection and storage of biometric data – can be redressed in federal court without any allegations of additional harm.

The Ninth Circuit acknowledged the Illinois Supreme Court’s recent decision in Rosenbach v. Six Flags Entm’t Corp., 2019 IL 123186 (Ill. Jan. 25, 2019), finding that BIPA was intended to prevent the risks associated with using Illinois citizens’ biometric data, that “[t]he public welfare . . . w[ould] be served by regulating [its] collection, use . . . [and] storage,” and that any violation of BIPA’s terms constitutes an invasion of that statutory right therefore, no additional compensatory harm need be established.  Facebook, at 17-18.  Accordingly, the Ninth Circuit rejected Facebook’s arguments and found that its alleged collection, use and storage of Plaintiffs’ biometric face templates is the very substantive harm to concrete privacy interests that the Illinois legislature intended to prevent when it enacted BIPA.

The Plaintiffs are also represented by two other law firms that are known leaders in class and mass action litigation, Edelson PC and Robbins Geller Rudman & Dowd LLP.  

Michael P. Canty, a partner at Labaton Sucharow LLP, stated “we are pleased with the decision from the Ninth Circuit and are confident that we will prevail in proving that Facebook violated the privacy rights of our clients when it collected their sensitive biometric data in violation of the law."

Mr. Canty, a former Assistant United States Attorney, who served in the Office’s National Security and Cybercrimes Section, co-leads the case for the Firm along with Labaton Sucharow Of Counsel Corban Rhodes, who focuses on consumer data privacy and securities litigation, and associate Ross Kamhi.