On December 29, 2018, the Northern District of Illinois dismissed a case brought against Google under the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. (“BIPA”) on standing grounds. Plaintiffs, Lindabeth Rivera and Joseph Weiss, alleged that Google violated BIPA by failing to obtain informed consent from users prior to collecting, storing, and utilizing their biometric information to create “face-geometry scans” from photos uploaded on Google Photos.

The Google Photos’ default user settings enable the service to detect facial images in uploaded photos and to create face templates based on individuals featured in the photos. The face templates are subsequently used to help Google Photos users organize their photos based on the individuals contained in them. Weiss and Rivera both alleged that, in failing to obtain their informed consent prior to creating face templates, Google violated their privacy interests under BIPA.

Plaintiffs brought suit separately in March of 2016, but their claims were subsequently consolidated a year later. Following several months of discovery, Google filed for summary judgment on April 23, 2018.

In deciding Google’s Motion for Summary Judgment, the court focused on the requirements of Article III standing as outlined in the Supreme Court decision Spokeo, Inc. v. Robins. According to Spokeo, to satisfy the requirements of Article III standing plaintiffs must demonstrate, among other things, that they have suffered (or will soon suffer) a concrete and particularized injury.

As a preliminary matter, the court found that the existence of statutory standing under BIPA does not necessarily confer a plaintiff with Article III standing. Procedural, statutory violations alone—according to the court—are insufficient to satisfy the standing requirement.

Instead, the court considered Google’s collection and retention of face scans to determine whether either practice rose to the required level of injury. With respect to the latter, the court turned to the retention-based theory of injury under the 2016 7th Circuit case Gubala v. Time Warner Cable, Inc. Gubala held that in the absence of information disclosure or sufficient risk of disclosure, retention of individual information did not confer Article III standing, even where the retention of information violated the Cable Communications Policy Act.

The court described the initial creation of face scans as “[t]he more difficult question.” To resolve this issue, the court considered two sources. First, a similar case in the Northern District of California, and second, common law tort analogues. The Northern District of California case, Patel v. Facebook Inc., involved a plaintiff who alleged that Facebook’s use of facial recognition for photo tagging on the site violated BIPA’s notice and consent requirements. The California court declined to dismiss the action, finding that plaintiff had alleged a concrete injury for the purposes of satisfying standing requirements. Despite the similarity of the two cases, the Illinois court ultimately declined to follow the Patel court’s reasoning based on the determination that Weiss and Rivera’s claims lacked evidence of a “substantial risk” of identity theft. In the absence of a risk of identity theft, the court reasoned, there was an insufficient showing that the Illinois legislature intended to create a cause of action that would arise from the violation of BIPA’s notice and consent requirements alone.

When considering common law tort analogues, the court turned to both intrusion upon seclusion and misappropriation torts as actions that would “bear a close relationship to the alleged injury.” The court found that the intrusion upon seclusion tort was incompatible with the harms alleged by Weiss and Rivera because the templates Google created were based on faces, which are regularly publicly exposed. The misappropriation tort was also discarded as a potential basis for establishing standing, based on the fact that Google’s purpose for creating face templates did not adequately align with the harms typically associated with misappropriation claims. Specifically, the face templates were not publicly available, and they were not used by Google for commercial purposes.

Based on the foregoing, the court concluded that neither Weiss nor Rivera claimed any injury that would support Article III standing. Accordingly, the court dismissed the claim.

What’s Next for BIPA?

In May, the Ninth Circuit granted cert on the class certification order in Patel and in November, the Illinois Supreme Court heard oral argument on BIPA’s statutory standing requirements. A number of BIPA actions also remain pending in federal and state courts. The effect of these other actions and whether other courts will agree with the Northern District of Illinois on the unavailability of BIPA claims that are based solely on procedural violations of the Act is yet to be seen.