Aftermath of $650 million settlement could result in more targeted legislation
In 2015, Facebook was hit with a class action lawsuit alleging that the social media giant’s ‘Tag Suggestions’ feature – which identifies individuals in images using facial recognition software – ran afoul of Illinois’ Biometric Information Privacy Act (BIPA).
After the suit was filed, Facebook moved to have the case dismissed, claiming that although there may have been mere technical violations of the law, the plaintiffs did not suffer any type of injury or harm stemming from the use of the company’s facial recognition software – meaning they had no standing under Article III of the act.
After its motion to dismiss was denied, Facebook appealed to the Ninth Circuit Court of Appeals. However, it fared no better before the appellate court, which held that the plaintiffs had asserted a “concrete and particularized” injury that satisfied the requirements for Article III standing.
RECOMMENDED Vermont amends data breach notification law with focus on biometric data protection
This ruling that any violation of BIPA’s requirements amounts to a violation of a plaintiff’s substantive privacy rights significantly expanded the ability of complainants to pursue claims for mere technical violations of the law.
And for Facebook in particular, this significant setback left the social media titan in a precarious and vulnerable position in terms of how to move forward with defending the class litigation.
Reaching a deal
In late January 2020, Facebook agreed to a $550 million settlement to end the longstanding biometric privacy dispute. But that was not enough for the federal district court judge overseeing the litigation, who refused to approve the settlement.
This prompted Facebook to increase its offer to $650 million, while at the same time also agreeing to implement remedial measures that would strengthen the privacy rights and protections of its users.
Just recently, the judge approved this enhanced settlement due to the increased offering and Facebook’s apparent willingness to improve its privacy practices.
Clause and effect
Since the Illinois ruling that plaintiffs can pursue claims even where no actual harm or damage is sustained, class action litigation pursued under BIPA has proliferated.
Combined with the high statutory damages figures made available under the law – ranging between $1,000 and $5,000 “for each violation” of the statute – BIPA is quickly becoming the next privacy class action battleground in the US as attorneys look to cash in on quick paydays that require minimal work.
The staggering figure that Facebook was willing to pay to extricate itself from the BIPA litigation will only give attorneys more motivation to pursue BIPA class action litigation.
Read more of the latest data privacy news
Thus, although BIPA suits have been filed at a high volume for some time, the number of BIPA and related biometric privacy class action suits may increase as we head into 2021.
Takeaways
Although the size of the Facebook settlement is by no means indicative of typical settlements in BIPA cases, the plaintiff’s lawyers will almost certainly use it as a measuring stick by which to value other BIPA disputes.
This will likely cause settlement values to spike, at least for the foreseeable future, further underscoring the need for companies to maintain comprehensive, flexible biometric privacy compliance programs to minimize potential liability exposure.
Finally, the eye-catching settlement figure may also drive an acceleration in new biometric privacy legislation across the US as a whole.
At present, only Illinois, Texas, and Washington have targeted privacy laws that provide direct requirements and limitations on the use of biometric data. Many states have introduced bills similar to BIPA, but none have successfully been introduced into law.
Combined with growing concerns over the problems and risks associated with facial recognition technology, the Facebook settlement may cause American lawmakers to focus more of their attention on making targeted biometric privacy laws a reality in their respective jurisdictions. This, in turn, may lead to greatly increased regulation over biometrics in the near future.
READ MORE Online security advice fails to help users prioritize problems, report warns
