SAN FRANCISCO (CN) — Seeking to rescue a landmark data privacy deal from the brink of failure, Facebook agreed to add $100 million to a $550 million settlement over its use of facial recognition technology that a federal judge previously shot down as woefully inadequate.
U.S. District Judge James Donato had a laundry list of complaints about the prior deal, including that it provided only a fraction of the potential $35 billion in damages for which Facebook could be liable.
Three consolidated class actions filed in 2015 and 2016 accused the social network of creating templates of Illinois users’ faces for its “Photo Tag Suggest” function starting in 2011 without consent and failing to tell users how long their data would be stored in violation of the Illinois Biometric Information Privacy Act of 2008.
The Illinois statute carries civil penalties of $1,000 for each negligent violation and $5,000 for each knowing violation. With a class of millions of Illinois Facebook users, damages could have reached tens of billions of dollars.
Donato scolded lawyers for Facebook and the plaintiff class during a June 4 hearing for failing to explain why the settlement amount was so low compared to potential damages, why Facebook’s sister companies like Instagram, WhatsApp and Oculus were being released from liability and how the social network’s data privacy practices will significantly change as a result of the settlement.
Responding to the judge’s concerns, the lawyers filed a revised proposed settlement agreement Wednesday night that boosts the settlement amount to $650 million and no longer releases the tech giant’s affiliated companies from liability for the social network’s alleged transgressions.
“It looks like most of my concerns were addressed,” Donato said of the revised settlement during a video-conference hearing Thursday.
Lead class counsel Paul Geller of Robbins Geller Rudman & Dowd said getting Facebook to pledge more money in further negotiations after the June 4 hearing was no easy task. He noted the prior $550 million deal was already larger than any known data privacy settlement on record, including the $117 million Yahoo data-breach settlement, $195 million Home Depot data breach settlement and the Equifax data breach settlement, valued at $380 million mostly in credit monitoring services with only $31 million in cash.
“I think it’s a great result for the class,” Geller said. “Privacy class actions don’t pay money like this.”
Under the revised settlement, class members will receive $200 to $400 each. The class will include all Facebook users in Illinois for whom Facebook created and stored a face template between June 7, 2011 and the date the settlement is preliminarily approved.
Lawyers for the plaintiff class agreed not to seek fees from the additional $100 million and to limit their request for fees to 20% of the original $550 million, down from their prior commitment to seek no more than 25%. In total, plaintiffs’ lawyers will request a fee award of no more than 16.9% of the total $650 million settlement, or $110 million.
“It was sort of part of the negotiation that if Facebook was going to kick in more money, so was class counsel,” Geller said.
Also on Thursday, the head of Facebook’s facial recognition program, Gene McCoy, explained via video testimony how Facebook’s privacy practices will change going forward as a result of the settlement.
Under the terms of the deal, new and existing Facebook users, including those in Illinois, will have the platform’s facial recognition feature automatically disabled unless they affirmatively opted in after September 2019.
That differs from a prior 2019 settlement with the Federal Trade Commission, which required Facebook to automatically deactivate facial recognition for users who did not migrate from a pre-2017 version of its facial recognition feature, McCoy said.
“The majority of people in Illinois had already gone through the migration prior to this,” McCoy said. “We’re going to go back and retroactively address all those people.”
Facebook attorney Michael Rhodes of Cooley LLP said this change will affect approximately 80% of Illinois Facebook users not covered by the prior FTC settlement.
The settlement also requires Facebook to delete the face templates of users who are inactive on the social network for three years as required by the Illinois privacy law.
Donato said he also wants to ensure that Facebook uses the best practices to notify all class members of the settlement so they can receive money.
“I want to see a record breaking claims rate,” Donato said.
Facebook plans to use jewel notifications, or Facebook alerts, and notifications at the top of users’ Facebook feeds in addition to emails, advertisements in major Chicago newspapers and other targeted online ads to reach class members.
The judge said he would review the revised settlement proposal in more detail before deciding whether to grant approval or request additional changes.
Before Facebook agreed to settle the case in January, it had argued users lacked standing to sue because they suffered no “concrete harm,” such as a loss of money, resulting from the alleged violation.
In August 2019, a three-judge Ninth Circuit panel rejected those arguments, finding the loss of control over one’s private information is a real-world injury. The San Francisco-based appeals court later denied Facebook’s request for an en banc rehearing.