.png)
Apple will face a class action suit under Illinois’ 2008 Biometric Information Privacy Act (“BIPA”) in federal court. Illinois was the first state to pass a law focusing on biometrics, with several other states later following suit by similarly imposing statutory penalties for any individual or entity that stores, collects, or uses the biometric identifiers of another without informed written consent or for a period longer than absolutely necessary (if not otherwise restricted by state law).
In Hazlitt v. Apple Inc., Case No. 3:20-CV-421-NJR, Judge Nancy Rosenstengel agreed to adjudicate certain class action claims against Apple pending in the Southern District of Illinois. Specifically, Plaintiffs alleged that Apple violated sections 14/15(a)-(c) of BIPA by collecting, possessing, and profiting from their facial geometries, which qualify as protected biometric information. BIPA prohibits private entities from selling, leasing, trading, or otherwise profiting from a person's or customer's biometric identifier or information in their possession. BIPA creates a private right of action for its citizens and imposes statutory penalties that range based on the level of malfeasance.
According to Plaintiffs’ claims, Apple’s facial recognition software “uses biological characteristics to verify an individual's identity by extracting an individual's face geometry data in order to confirm a subsequent match of the individual's face.”
These geometric attributes include the “distance between the eyes, width of the nose, and other features.” Apple's devices then use the same facial recognition technology to add frequently detected faces to the user's "People" album within the Photos app on all its devices (phones, tablets, and computers), which cannot be removed or modified by the consumer. Plaintiffs further “allege that the Photos app applies an algorithm to specifically identify the Apple device user…” and stores the information “on each Apple device locally in a facial recognition database in the solid-state memory on the device.”
According to the Plaintiffs, “this conduct presents an imminent threat of serious harm to Plaintiffs and the proposed class, as Apple does not delete the biometric data it collects on the devices, even discarded Apple devices.”
Two issues were presented to the Court: 1) Federal Jurisdiction; and 2) Validity of the Claims. On the question of jurisdiction, the Southern District of Illinois stated that while Apple's purported failure to publicize a retention and destruction policy (as required by BIPA) constituted a public harm, it did not directly harm Plaintiffs. Therefore, “this violation …does not create the type of concrete, particularized injury necessary” rendering Plaintiffs without standing to bring this claim in federal court. The Plaintiffs’ claims that Apple may have profited from the sale of their biometric information also failed to satisfy standing requirements. Plaintiffs do not, nor could they, claim to be personally or individually affected by Apple selling devices based on the facial recognition technology in its Photos app.
However, with regard to Plaintiffs’ allegation that Apple failed to adhere to BIPA’s informed consent provisions, such violations were “concrete” injuries because personal information was “substantive and personal” and may change a person's actions with regard to how he or she uses the device. And Plaintiffs allege that Apple never requested or received informed consent before collecting face geometries from their photos within the Photos app.
With Plaintiffs’ claims regarding informed consent surviving the jurisdictional question, they next faced the question of validity (should they face early dismissal). Confronting Apple’s Motion to Dismiss, Plaintiffs demonstrated that the facial scans were indeed biometric identifiers. Although BIPA excludes photographs from the definition of biometric identifier, scans of photographs for facial geometry can qualify under the definition of biometric identifier. Coupled with Apple’s refusal to provide users with information on how it creates, gathers, harvests, and accesses facial scans, while simultaneously denying users the ability to disable the function, the Judge determined that Plaintiffs’ claims proceed in the Southern District of Illinois.
This may be the most interesting case to watch as it will create copycat suits in Texas, Washington, California, New York, and Arkansas – Plaintiffs’ Attorneys: Grab your briefcases!