Patel ex rel. All Others Similarly Situated v. Facebook, Inc.

• Decision Date: 08 August 2019
• Docket Number: No. 18-15982,18-15982
• Citation: 932 F.3d 1264
• Parties: Nimesh PATEL, Individually and on Behalf of All Others Similarly Situated; Adam Pezen; Carlo Licata, Plaintiffs-Appellees, v. FACEBOOK, INC., Defendant-Appellant.
• Court: U.S. Court of Appeals — Ninth Circuit

932 F.3d 1264

Nimesh PATEL, Individually and on Behalf of All Others Similarly Situated; Adam Pezen; Carlo Licata, Plaintiffs-Appellees,

v.FACEBOOK, INC., Defendant-Appellant.

No. 18-15982

United States Court of Appeals, Ninth Circuit.

Argued and Submitted June 12, 2019 San Francisco, California

Filed August 8, 2019

Lauren R. Goldman (argued), Andrew J. Pincus, and Michael Rayfield, Mayer Brown LLP, New York, New York, for Defendant-Appellant.

John Aaron Lawson (argued), Rafey S. Balabanian, and Lily Hough, Edelson PC, San Francisco, California; Jay Edelson, Benjamin Richman, and Alexander G. Tievsky, Edelson PC, Chicago, Illinois; Susan K. Alexander, Shawn A. Williams, and John George, Robbins Geller Rudman & Dowd LLP, San Francisco, California; Patrick J. Coughlin, Ellen Gusikoff Stewart, Lucas F. Olts, and Randi D. Bandman, Robbins Geller Rudman & Dowd LLP, San Diego, California; Paul J. Geller, Stuart A. Davidson, and Christopher C. Gold, Robbins Geller Rudman & Dowd LLP, Boca Raton, Florida; Lawrence Sucharow, Michael P. Canty, Corban S. Rhodes, and Ross Kamhi, Labaton Sucharow LLP, New York, New York; for Plaintiffs-Appellees.

Susan Fahringer and Nicola Menaldo, Perkins Coie LLP, Seattle, Washington; Neal Kumar Katyal, Hogan Lovells US LLP, Washington, D.C.; Lauren Ruben, Perkins Coie LLP, Denver, Colorado; Thomas P. Schmidt, Hogan Lovells US LLP, New York, New York; Sara Solow, Hogan Lovells US LLP, Philadelphia, Pennsylvania; for Amicus Curiae Internet Association.

Nathan Freed Wessler, American Civil Liberties Union, New York, New York; Rebecca K. Glenberg, Roger Baldwin Foundation of ACLU, Chicago, Illinois; Jacob A. Snow, American Civil Liberties Union Foundation of Northern California, San Francisco, California; Jennifer Lynch and Adam Schwartz, Electronic Frontier Foundation, San Francisco, California; Joseph Jerome, Center for Democracy & Technology, Washington, D.C.; Michael C. Landis, Illinois PIRG Education Fund Inc., Chicago, Illinois; for Amici Curiae American Civil Liberties Union, American Civil Liberties Union of Illinois, American Civil Liberties Union Foundation of Northern California, American Civil Liberties Union Foundation of Southern California, Center for Democracy & Technology, Electronic Frontier Foundation, and Illinois PIRG Education Fund Inc.

Marc Rotenberg, Alan Butler, and John Davisson, Electronic Privacy Information Center, Washington, D.C., for Amicus Curiae Electronic Privacy Information Center (EPIC).

Kelly P. Dunbar, Reginald J. Brown, Patrick J. Carome, Jonathan G. Cedarbaum, and Samuel M. Strongin, Wilmer Cutler Pickering Hale and Dorr LLP, Washington, D.C.; Steven P. Lehotsky and Jonathan D. Urick, U.S. Chamber Litigation Center, Washington, D.C.; for Amicus Curiae Chamber of Commerce of the United States of America.

Before: Ronald M. Gould and Sandra S. Ikuta, Circuit Judges, and Benita Y. Pearson,^* District Judge.

IKUTA, Circuit Judge:

Plaintiffs' complaint alleges that Facebook subjected them to facial-recognition technology without complying with an Illinois statute intended to safeguard their privacy. Because a violation of the Illinois statute injures an individual's concrete right to privacy, we reject Facebook's claim that the plaintiffs have failed to allege a concrete injury-in-fact for purposes of Article III standing. Additionally, we conclude that the district court did not abuse its discretion in certifying the class.

I

Facebook operates one of the largest social media platforms in the world, with over one billion active users. Packingham v. North Carolina , ––– U.S. ––––, 137 S. Ct. 1730, 1735, 198 L.Ed.2d 273 (2017). About seven in ten adults in the United States use Facebook.¹

A

When a new user registers for a Facebook account, the user must create a profile and agree to Facebook's terms and conditions, which permit Facebook to collect and use data in accordance with Facebook's policies. To interact with other users on the platform, a Facebook user identifies another user as a friend and sends a friend request. If the request is accepted, the two users are able to share content, such as text and photographs.

For years, Facebook has allowed users to tag their Facebook friends in photos posted to Facebook. A tag identifies the friend in the photo by name and includes a link to that friend's Facebook profile. Users who are tagged are notified of the tag, granted access to the photo, and allowed to share the photo with other friends or "un-tag" themselves if they choose.

In 2010, Facebook launched a feature called Tag Suggestions. If Tag Suggestions is enabled, Facebook may use facial-recognition technology to analyze whether the user's Facebook friends are in photos uploaded by that user. When a photo is uploaded, the technology scans the photo and detects whether it contains images of faces. If so, the technology extracts the various geometric data points that make a face unique, such as the distance between the eyes, nose, and ears, to create a face signature or map. The technology then compares the face signature to faces in Facebook's database of user face templates (i.e., face signatures that have already been matched to the user's profiles).² If there is a match between the face signature and the face template, Facebook may suggest tagging the person in the photo.

Facebook's face templates are stored on its servers, which are located in nine data centers maintained by Facebook. The six data centers located in the United States are in Oregon, California, Iowa, Texas, Virginia, and North Carolina. Facebook's headquarters are in California.

B

Facebook users living in Illinois brought a class action against Facebook, claiming that Facebook's facial-recognition technology violates Illinois law. Class representatives Adam Pezen, Carlo Licata, and Nimesh Patel each live in Illinois. They joined Facebook in 2005, 2009, and 2008, respectively, and each uploaded photos to Facebook while in Illinois. Facebook created and stored face templates for each of the plaintiffs.

The three named plaintiffs filed the operative consolidated complaint in a California district court in August 2015. The plaintiffs allege that Facebook violated the Illinois Biometric Information Privacy Act (BIPA), 740 Ill. Comp. Stat. 14/1 et seq. (2008), which provides that "[a]ny person aggrieved" by a violation of its provisions "shall have a right of action" against an "offending party," id. 14/20. According to the complaint, Facebook violated sections 15(a) and 15(b) of BIPA by collecting, using, and storing biometric identifiers (a "scan" of "face geometry," id. 14/10) from their photos without obtaining a written release and without establishing a compliant retention schedule.³

The Illinois General Assembly enacted BIPA in 2008 to enhance Illinois's "limited State law regulating the collection, use, safeguarding, and storage of biometrics." 740 Ill. Comp. Stat. 14/5(e). BIPA defines a "biometric identifier" as including a "scan of hand or face geometry." Id. 14/10.⁴ In a series of findings, the state legislature provided its views about the costs and benefits of biometric data use. The legislature stated that "[t]he use of biometrics is growing in the business and security screening sectors and appears to promise streamlined financial transactions and security screenings," and also noted that "[m]ajor national corporations have selected the City of Chicago and other locations in this State as pilot testing sites for new applications of biometric-facilitated financial transactions." Id. 14/5(a) – (b). Nevertheless, "[b]iometrics are unlike other unique identifiers that are used to access finances or other sensitive information," because while social security numbers can be changed if compromised by hackers, biometric data are "biologically unique to the individual," and "once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions." Id. 14/5(c). Moreover, "[t]he full ramifications of biometric technology are not fully known." Id. 14/5(f). The legislature concluded that "[t]he public welfare, security, and safety will be served by regulating the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information." Id. 14/5(g).

To further these goals, section 15 of BIPA imposes "various obligations regarding the collection, retention, disclosure, and destruction of biometric identifiers and biometric information" on private entities. Rosenbach v. Six Flags Entm't Corp. , ––– Ill.Dec. ––––, ––– N.E.3d ––––, 2019 IL 123186, 2019 WL 323902, at *4 (Ill. 2019). These requirements include "establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information" the earlier of three years after the individual's last interaction with the private entity or "when the initial purpose for collecting or obtaining such identifiers or information has been satisfied." 740 Ill. Comp. Stat. 14/15(a). The statute also requires the private entity to notify the individual in writing and secure a written release before obtaining a biometric identifier. Id. 14/15(b). BIPA also provides for actual and liquidated damages for violations of the Act's requirements. Id. 14/20.

C

In June 2016, Facebook moved to dismiss the plaintiffs' complaint for lack of Article III standing on the ground that the plaintiffs had not alleged any concrete injury. While Facebook's motion to dismiss was pending, the plaintiffs moved to certify a class under Rule 23 of the Federal Rules of Civil Procedure. The district court denied Facebook's motion to dismiss, and certified a Rule 23(b)(3) class of "Facebook users located in Illinois for whom Facebook created and stored a face template after June 7, 2011." Facebook filed a timely petition for leave to appeal the district court's ruling under Rule 23(f). Fed. R. Civ. P. 23(f) (providing that "[a] ...