SAN FRANCISCO (CN) — A federal judge on Thursday refused to sign off on a $550 million data privacy settlement with Facebook, saying lawyers must first explain why the deal provides only a small fraction of damages to which class members may be entitled.
Lead plaintiff Nimesh Patel sued Facebook in 2015 in one of three consolidated class actions, claiming the social network started mapping users’ faces for its “Photo Tag Suggest” function in 2011. The plaintiffs say Facebook did so without their consent and failed to inform them how long their data would be stored as required by the Illinois Biometric Information Privacy Act (BIPA) of 2008.
“The Illinois Legislature said this is meant to be an expensive violation,” U.S. District Judge James Donato said during a preliminary settlement approval hearing held via video Thursday.
The Illinois statute carries civil penalties of $1,000 for each negligent violation and $5,000 for each knowing violation. With a class of millions of Facebook users who had photos of themselves uploaded in Illinois, damages could have reached tens of billions of dollars.
Donato demanded lawyers for Facebook and the plaintiff class explain why the higher damages amount of $5,000 per violation was taken off the table.
Last year, Facebook paid a $5 billion fine to the Federal Trade Commission to settle claims that it violated a 2012 FTC order by allegedly deceiving users about their ability to control private information. Donato said that settlement could provide adequate evidence to support a push for higher damages.
“It looks to me that what Facebook did to violate the BIPA may also have been a violation of that prior FTC consent decree, in which case you have a pretty good argument that this is an intentional or reckless violation of BIPA that would warrant $5,000,” Donato said.
Representing the plaintiff class, attorney Rafey Balabanian of Edelson PC in San Francisco argued that the $5,000-per-violation benchmark was unrealistic because evidence suggests that Facebook genuinely believed uploaded photographs were exempt from the Illinois law. The fact that Facebook pushed for the Australian government to adopt BIPA’s definition of “biometric information” supports that argument, Balabanian insisted.
“Maximum recovery is potentially $47 billion,” Balabanian said. “In our view, it is almost a certainty that the court would cut that damage award down.”
Donato replied: “I don’t find that a particularly persuasive argument.”
Even accepting $47 billion as the maximum recovery for the class, Donato said $550 million is still an extreme discount. The class will only receive about 1.25% of the maximum $47 billion, he said.
“They’re taking what is essentially a 98.75% discount off what the Illinois Legislature said should be the damages,” Donato said.
The judge also demanded that both sides explain how the requirement that Facebook delete class members’ face templates unless it obtains affirmative consent from users differs from the requirements of its 2019 agreement with the FTC.
“I want to hear more about why this is something that’s actually a benefit to the class and not just slapping on obligations that Facebook is already required to do,” the judge said.
The judge further insisted that Facebook engineers explain how the company will handle class members’ facial geometry data after the settlement is final.
“I want a clear explanation about how it worked before and how it will work going forward,” Donato said.
Despite the judge’s misgivings about the deal, Facebook attorney Michael Rhodes of Cooley LLP in San Francisco argued the settlement provides “extraordinary economic recovery” for the class, especially given Facebook’s defense that the technology used to identify users relies more on photographic elements such as lighting than it does on users’ facial geometry.
“The outputs are clearly being driven by something other than geometry,” Rhodes said.
Under the current settlement proposal, each class member would receive $150 to $300 each, depending on how claims are submitted. Lawyers for the plaintiff class are requesting up to 25% of the settlement fund, or $137.5 million, and $981,000 in litigation expenses.
Donato ordered lawyers on both sides to address his concerns within the next few weeks. He also warned them that the settlement is far from a done deal, and a jury trial is still on the table.
Before it agreed to settle the case, Facebook had argued users lacked standing to sue because they suffered no “concrete harm,” such as a loss of money, resulting from the alleged violation.
In August 2019, a three-judge Ninth Circuit panel rejected those arguments, finding the loss of control over one’s private information is a real-world injury. Writing for the panel, U.S. Circuit Judge Sandra Ikuta, a George W. Bush appointee, wrote that “a concrete injury need not be tangible.”
The San Francisco-based appeals court later denied Facebook’s request for an en banc rehearing.