Ruling against Facebook could propel additional biometric lawsuitsPosted On: Aug. 20, 2019 7:00 AM CST
A federal appeals court decision allowing a class action lawsuit accusing Facebook of violating Illinois’ biometric law through its facial recognition technology to proceed could trigger more litigation, experts say.
An increase in biometric-related lawsuits could create significant liabilities for policyholders and their insurers under commercial general liability and professional liability policies, according to one policyholder attorney.
The 9th U.S. Circuit Court of Appeals in San Francisco affirmed a lower court ruling when it held in its Aug. 8 decision in Nimesh Patel v. Facebook Inc. that plaintiffs could proceed with their litigation on the basis that they had alleged “concrete and particularized harm” sufficient to confer standing under Article III of the Constitution, when Facebook used its facial-recognition technology to have its users’ Facebook friends tagged without their consent.
The 9th Circuit ruling follows a January ruling by the Illinois Supreme Court in Rosenbach v. Six Flags Entertainment Corp., which unanimously held plaintiffs can sue firms under Illinois’ Biometric Information Privacy Act for allegedly failing to properly notify people about their policies, even if no actual harm is claimed.
Under BIPA, violators are subject to fines of $1,000 for each violation and $5,000 for intentional or reckless violations. “The statutory liability under BIPA presently is one that’s significant enough that companies are trying to push back against these lawsuits,” said Marc S. Voses, a New York-based partner with the cybersecurity and data privacy practice group of Goldberg Segalla LLP.
The 9th Circuit did not rule on the merits of the case but rather on the question of standing and whether a class action can be certified, said Steven J. Pearlman, a Chicago-based partner with the labor and employment law practice of Proskauer Rose LLP. “There’s no finding that Facebook did anything that was unlawful,” he said.
But the ruling is significant as the first certified class action in a BIPA case “so it’s certainly not a positive development for the defense bar of the cases, but not entirely unexpected, either,” given that the ruling affirmed a lower court’s judgment, said Richard H. Tilghman IV, a partner with Nixon Peabody LLP’s commercial litigation practice in Chicago.
The 9th Circuit ruling is significant because the appeals court could have concluded, but did not, “that these alleged violations were insufficient to confer standing and therefore dismiss the case entirely,” and because Facebook is now faced “with a class of claimants, rather than just named plaintiffs,” said Gregory P. Abrams, a partner representing companies on employment litigation matters with Faegre Baker Daniels LLP in Chicago.
“Parties are gaining more clarity into what plaintiffs need to allege in order to survive certain dispositive motions concerning their claims,” said Mr. Voses. The ruling means that “these types of lawsuits are not going to be disposed of early on in the process, that plaintiffs that have their biometric information collected are most likely going to be able to get over certain hurdles if the facts are similar to those in the Facebook case.”
It is significant that the 9th Circuit, as did the Illinois Supreme Court, also rejected arguments that these were only procedural violations, but found them to be substantive right violations, said Carlos S. Arévalo, a partner representing companies on employment law matters with SmithAmundsen LLC in Crystal Lake, Illinois.
“If there was to be a verdict or even a settlement” in the Facebook case, “we’re talking huge money,” he added.
The 9th Circuit ruling could lead to more litigation, observers say.
It “could open up significant avenues of liability, both for underlying policyholders as well as their insurance companies,” said Keith McKenna, a principal with McKool Smith LLP in New York who represents policyholders.
The ruling “could implicate two types of insurance policies, potentially,” commercial general liability, which usually have some coverage for alleged violations of rights to privacy, and professional liability, he said.
“We’re going to see a continued proliferation of BIPA cases, said Mr. Pearlman. “I don’t see this letting up.”
“I don’t think it will lead to a flood of litigation against Facebook, but it just might encourage other, similar efforts to bring BIPA lawsuits” based on similar technology, said Mr. Abrams. As a pro-plaintiff decision, “it won’t stem the tide, anyway.”
“It’s too early to tell whether it’s going to encourage more litigation,” Mr. Voses said. “We need to wait and see what happens with regard to any potential settlement that arises subsequent to the decision or whether it’s going to proceed to trial.”
However, Todd M. Rowe, a partner with Tressler LLP in Chicago focusing on insurance coverage matters, said he does not believe the case will be significant insofar as Illinois courts are concerned, where further interpretation of BIPA is needed.
Over the past two years, five to six lawsuits have been filed daily in Illinois under BIPA, with “virtually 99.9%” of them class actions, said Gerald L. Maatman Jr., a partner with the labor and employment practice of Seyfarth Shaw LLP in Chicago. No one, though, has charged they have suffered any harm from its violation. Rather, it is a matter of people not being warned of biometrics’ use, he said.
He said he is not sure more lawsuits will be filed as a result of the 9th Circuit ruling, “but certainly a contrary ruling might have slowed it down a little.”
The ruling is not going to hinder this litigation and makes it easier for the plaintiffs bar to file such lawsuits and gives them additional support for their arguments once they file them, he said.
The 9th Circuit ruling is not binding with federal appeals courts in Illinois, which is within the 7th Circuit, but they will look at it because “it’s the only one of its kind,” said Mr. Tilghman.
Most of the Illinois litigation is in state court, however.
“Ultimately, the 7th Circuit is likely, perhaps in the long term, to decide whether it agrees with the 9th as it relates to the violations of BIPA being enough to constitute a concrete injury under Article III, although this is obviously hard to predict,” said Stefan R. Dandelles, Chicago-based chair of Kaufman Dolowich & Voluck LLP’s fidelity and surety practice group. “I don’t think it creates a nationalization of any particular standard. Other circuits may disagree.”
“It’s also a situation where, in my opinion, not all BIPA violations are created equal as it relates to Article III standing,” he said.
In the Facebook case, Facebook was using the facial recognition data as part of its social media platform, not just collecting it.
“That’s different, arguably, than a violation where someone stores or collects biometric information but doesn’t use it,” he said. “I think courts will have to look at each situation on a case-by-case basis.”