SAN FRANCISCO (CN) – Rejecting arguments that Facebook users suffered no “concrete harm” by having their facial data mapped and stored, the Ninth Circuit advanced a $35 billion class action against the social media giant Thursday.
Facebook sought to swat down the lawsuit last year after U.S. District Judge James Donato ordered it to alert users about an upcoming trial on claims that it harvested facial data in violation of an Illinois privacy law. The Ninth Circuit granted Facebook’s eleventh-hour request for a stay pending appeal in May 2018.
A lawyer representing a class of Facebook users said the ruling sends a strong message that Facebook can be held accountable for failing to protect people’s private information.
“This biometric data is very sensitive. It’s as unique as a fingerprint,” said attorney Shawn Williams, of the firm Robbins Geller Rudman & Dowd in San Francisco.
Lead plaintiff Nimesh Patel sued Facebook in 2015 in one of three consolidated class actions, claiming the social network did not obtain consent or tell users how long their facial data would be stored when it started mapping their faces for its “Photo Tag Suggest” function in 2011.
Facebook argued users lacked standing to sue because the mapping of their facial data did not cause them to lose money or suffer any economic injury.
Writing for the three-judge panel, U.S. Circuit Judge Sandra Ikuta, a George W. Bush appointee, wrote that “a concrete injury need not be tangible.”
Citing the rapid pace of technology advances, Ikuta said it “seems likely” that a face-mapped person could be identified from a surveillance camera or have their face map used to unlock a private cellphone.
“We conclude that the development of a face template using facial-recognition technology without consent (as alleged here) invades an individual’s private affairs and concrete interests,” Ikuta wrote.
Williams said he believes the Illinois Supreme Court’s January 2019 ruling in Rosenbach v. Six Flags had a major impact on the Ninth Circuit’s decision. In Rosenbach, the state’s high court held a mere violation of the Illinois Biometric Privacy Act (BIPA) constitutes an invasion of privacy that satisfies standing to sue.
“The Illinois Supreme Court is the ultimate authority on interpreting Illinois law,” Williams said.
Turning to the issue of class certification, the Ninth Circuit rejected the technology giant’s attempt to dismantle a class of potentially 7 million Facebook users in Illinois. Facebook argued that each class member must prove they uploaded photos in Illinois because the law does not cover conduct that occurred out of state.
Facebook also maintains that because facial data was scanned and stored on servers outside of Illinois, it cannot be sued for violating the state law.
Whether the violation occurred when out-of-state Facebook servers scanned users’ faces or when users uploaded photos in Illinois is a question that can be decided on a class-wide basis, the Ninth Circuit concluded.
Williams said a federal jury will likely answer that question.
“Our view is that the violation occurred immediately when Facebook applied its facial recognition technology to the photos,” Williams said. “That happens when people upload their photos.”
Facebook could be liable for $1,000 for each negligent violation and $5,000 for each knowing violation of the Illinois law. With a class of potentially 7 million Facebook users, the damages could exceed $35 billion.
The Menlo Park-based tech giant argued that users should not be allowed to bring a class action that could make it liable for an absurd amount of damages.
The Ninth Circuit refused to accept that argument, finding no indication that the Illinois legislature “intended to place a cap on statutory damages.”
U.S. Circuit Judge Ronald Gould and U.S. District Judge Benita Pearson, sitting by designation from the Northern District of Ohio, joined Ikuta on the panel. Gould was appointed by Bill Clinton. Pearson was appointed by Barack Obama.
Facebook attorneys from the firm Mayer Brown and Facebook’s press team did not immediately return emails seeking comment Thursday morning.