California Federal Court To Decide Whether The Absence Of A Public Facing Retention Policy Constitutes A Single Violation Of BIPA Or Whether Multiple Violations Are Possible.

• Published date: 08 July 2022
• Subject Matter: Litigation, Mediation & Arbitration, Privacy, Privacy Protection, Class Actions
• Law Firm: Tactical Law Group LLP
• Author: Ms Pamela Fulmer

Unique among state laws, the Illinois Biometric Information Privacy Act ('BIPA') creates a private right of action for "any person aggrieved" by a violation of the statute and provides for statutory damages of $1,000 for a negligent violation to $5,000 for an intentional or reckless violation, in addition to reasonable attorneys' fees and costs. Liquidated damages can also be awarded under the statute. The potential to aggregate these penalties on a class-wide basis and the availability of attorneys' fees has made BIPA an attractive statute for the plaintiffs' class action bar. Because of this recovery scheme, BIPA has made Illinois a national litigation magnet.

However, BIPA cases are not just limited to Illinois. Instead, Plaintiffs have filed several BIPA related consumer class action cases in the Northern District of California, and have targeted tech companies, including Facebook in particular, and its photo tagging technology, which Facebook has since discontinued using. One of those cases, In re Facebook Biometric Info. Priv. Litig.., 185 F. Supp. 3d 1155 (N.D. Cal. 2016), affirmed by Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019), addressed directly whether BIPA covers the method Facebook used in its photo "Tag Suggestions" program. Judge Donato ruled it did and certified the class. Facebook appealed and the Ninth Circuit affirmed Judge Donato's ruling. Facebook later settled that case for $650 million, after the U.S. Supreme Court declined to grant certiorari.

Now another consumer class action case, Zellmer v. Facebook Inc., case number 3:18-cv-01880, is again before Judge Donato. However, unlike the previous case, Zellmer consists of a class of non-Facebook users who had their photos uploaded to Facebook by other Facebook users. In an April 2022 ruling, Judge Donato found that it would be "patently unreasonable" to hold Facebook liable for claims that it failed to inform nonusers in Illinois who were strangers to Facebook, about its collection and storage of their facial scans, and ruled against Plaintiffs on their Section 15(b) claim requiring notice and consent. However, the court allowed the claims under Section 15(a) to proceed, finding that factual issues abounded as to whether Facebook had a 'written policy, made available to the public' that established data retention policies and related practices for biometric identifiers or information as required by 740 Ill. Comp. Stat. 14/15(a).

What is BIPA?

BIPA passed by the Illinois state...