In Federal Court, Article III Standing Remains A Defense To Illinois Biometric Privacy Claims

Last Friday, the Illinois Supreme Court ruled in the long-awaited Rosenbach case that an individual does not have to plead an actual injury or harm, apart from the statutory violation itself, in order to have statutory standing to sue under the Illinois Biometric Information Privacy Act (BIPA). The Illinois Supreme Court ruling will allow procedural BIPA violations to proceed (and multiply) in state court - and has reportedly already prompted parties to settle such actions. However, recent rulings in federal court have offered a divergent interpretation of the related, but different Article III standing issue.

For example, several weeks prior to the Rosenbach decision, two decisions from the District Court for the Northern District of Illinois offered insight into the federal standing threshold for BIPA claims. While largely limited to their facts, the decisions present a defensive strategy for fending off BIPA claims in federal court. Faced with this latest batch of rulings, expect forum shopping by plaintiffs with more cases filed in state court and some careful calculations from defendants in deciding on removal and other litigation strategies.

To recap:

Rivera v. Google, No. 16-02714, 2018 WL 6830332 (N.D. Ill. Dec. 29, 2018), a dispute we covered previously, involved claims that Google's free service, Google Photos, collected and stored face-geometry scans of uploaded photos in order to aid users in grouping and organizing their photos. The claims hinged on two purported violations: unlawful collection and creation of faceprints and unlawful retention of faceprints. One named plaintiff was a Google Photos user who had uploaded a number of photos before realizing that the facial scanning feature was on (the feature defaults on, but users can turn it off). The other named plaintiff was not a Google Photos user, but her face entered the scanning system when a friend uploaded photos that included her. While the case presented a "close question," the Illinois district court held merely retaining an individual's private information (without any third-party disclosure), on its own, is not a sufficiently concrete injury to satisfy Article III under Spokeo. In dicta, however, the court did note that Google could possibly monetize such biometric information in the future, a non-consensual use that "might very well constitute a concrete injury."

Several days after Rivera was decided, the same district court judge, Judge Chang, issued his opinion...