Court of Appeals for the Ninth Circuit: In the instant appeal against the summary judgment of the US District Court for the Northern District of California (“Trial Court”), theplaintiff, a non-user of Facebook (now Meta Platforms Inc.), alleged that Facebook had violated Illinois’ Biometric Information Privacy Act (“BIPA”), when the social media platform collected or captured his biometric identifiers by creating a “face signature” from photos uploaded by his (Facebook-user) friends to Facebook. He had further claimed that Facebook had violated BIPA by failing to publish a written policy on data retention schedule. The three-Judge Bench comprising of Ryan D. Nelson*, Danielle J. Forrest, Gabriel P. Sanchez, JJ., affirmed the Trial Court’s summary judgment, holding that face signature was not a biometric identifier, therefore there was no violation of BIPA.
Background
The plaintiff” was a non-user of Facebook (now Meta), and had sued Facebook for the alleged violations of the Illinois’ Biometric Information Privacy Act (“BIPA”), after his friends who were users of Facebook uploaded photographs of him on the social media platform. He ha alleged that Facebook had collected and captured his biometric identifiers when Facebook created a “face signature” from those uploaded photos. The plaintiff’s second claim was that Facebook allegedly failed to publish a written policy of the data retention schedule for the collected biometric data.
The Trial Court had granted summary judgment to Facebook for the first claim, stating that the relevant BIPA provisions did not protect the privacy interests of non-users; and for the second claim the Trial Court dismissed it for a lack of standing.
Court’s Analysis and Decision
The Court discussed the BIPA in detail, beginning with Section 15 (b), wherein, it has been provided that a private entity can “collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s biometric identifier or biometric information.” However, the conditions stipulated for the same are that the private entity informs the subject or their representative in writing-
-
Of the collection or storage of their biometric identifier or information.
-
Of “the specific purpose and length of term” for their use
-
The private entity receives written authorisation from their subject or representative.
The Court perused the definitions of “biometric identifier” and “biometric information”, provided under Section 10 of BIPA, and found that biometric identifiers include a retina, iris, fingerprint, voiceprint, hand or face geometry scans, but not photographs. For biometric information, the Court found that any information based on a person’s biometric identifier used to identify them, irrespective of the manner in which such information was captured, converted or stored, falls within the ambit of biometric information. However, the information derived from items excluded from the definition of biometric identifiers are also excluded from the meaning of biometric information. The Court also noted that under Section 20 of BIPA, a person aggrieved of a violation of its terms, a right of action has been granted to them against the offending party.
The Court took note of the summary judgment granted to Facebook by Trial Court, that had viewed that it would be patently unreasonable to construe BIPA to mean that Facebook was required to provide notice to and obtain consent from non-users who were practically total strangers to Facebook, with whom the latter had no relationship whatsoever.
The Trial Court had considered the interpretation of Section 15(b) “untenable” because it would have put Facebook in an impossible position of obtaining consent from every stranger whose face happened to be caught on camera and uploaded on Facebook. That Court had referred to Rosenbach v. Six Flags Entertainment Corp., 129 N.E. 3d 1197, 1207 (Ill. 2019), wherein the Supreme Court of Illinois concluded that BIPA should not impose extraordinary burdens on businesses.
The Court rejected Trial Court’s grounds for granting summary judgment to Facebook. The Court retracted to Section 15(b), stating that therein a “person” and a “customer” have been delineated, showcasing the intention of BIPA to protect non-users, regardless of a pre-existing relationship between the private entity and the individual.
The question before the Court remained at this stage, that whether a face signature is a biometric identifier or biometric information. Relying on Facebook’s contention, that BIPA applies to those biometric identifiers and information that can identify a person, the Court concluded that it was neither.
Interpretation of BIPA
The Court considered BIPA’s plain terms to find whether a face signature was a biometric identifier or information. The Court noted that something falling beyond the defined statutory definition (a photograph) could be a biometric identifier under a plain meaning, but not statutorily included in the definitions of BIPA. Alternatively, something within (a face geometry scan) the BIPA definition of “biometric identifier”, but still not covered if it cannot identify.
To further elaborate, the Court referred to Bond v. United States, 2014 SCC OnLine US SC 30, wherein the United States Supreme Court explained that in settling on a fair reading of a statute, it is appropriate to consider the ordinary meaning of a defined term, particularly when there is dissonance between the ordinary meaning and the reach of the definition.
The Court therefore concluded that the ordinary meaning of “identifier”, due to it having an ‘—er’ suffix, is the one who identifies. The Court was convinced that the ordinary meaning informs the statutory meaning, and the application of the ordinary meaning would ensure Facebook to not forcefully abandon its key services.
The Court also referred to Hazlitt v. Apple1, wherein it was recognised that if a company does not use face scans to identify a person, BIPA applies if it could. It reflected that that the broad judicial consensus is that “biometric identifiers” under BIPA must be able to identify.
Whether face signatures identify non-users
The Court noted Facebook’s submission of undisputed evidence that showed that face signatures cannot identify non-users and concluded that face signatures cannot identify non-users. The Court further noted Facebook’s submissions as to face signatures being an abstract, numerical representation of a face that is computed by millions of pixel comparisons performed by algorithms, that are incapable of being reverse-engineered, or saved or stored. Therefore, the faces of non-users that appear in user’s photos are anonymous to Facebook.
Decision
The Court concluded that the plaintiff lacked the standing to bring Section 15(a) claim because he alleged a single sentence about Section 15(a) violation- “Facebook does not publicly provide a retention schedule or guidelines for permanently destroying the biometric identifiers and/or biometric information of Plaintiff and Class members”.
However, the Court reiterated Bryant v. Compass Group, USA, Inc.2 ,wherein it was concluded that the “public provision of a data retention schedule” is a duty owed to the public generally and not to a particular person. In that regard, the Court said that the plaintiff never explained that how he and any of the proposed class members were harmed by Facebook’s violation of a general duty in a concrete and particularised manner. Further, as regards to whether face signatures are biometric identifiers or information, the Court highlighted that the plaintiff did not explain on record that face signatures infact were biometric identifiers or information.
Therefore, the Court held that Facebook’s face signature did not lead to a “very substantive harm” targeted by BIPA. Hence, the Court affirmed that Meta was entitled to the summary judgment on Section 15(b), and that the plaintiff’s Section 15(a) claim lacked standing,
[Clayton P. Zellmer v. Meta Platforms, Inc., D.C. No. 3:18-cv-01880-JD, decided on 17-06-2024]
*Opinion by: Justice Ryan D. Nelson
Advocates who appeared in this case:
For the plaintiff: John Carey, David P. Milian, Albert Y. Chang
For the defendant: Lauren R. Goldman, Michael Brandon, Lefteri J. Christos, Michael G. Rhodes, Whitty Somvichian, Joh Nadolenco
1. 500 F. Supp. 3d 738 (S.D. Ill. 2020)
2. 958 F. 3d 617, 626 (7th Cir. 2020)
