How Patel v. Facebook Might Tee Up a Privacy Battle at the Supreme Court
Last month, the Ninth Circuit issued an important decision on privacy and Article III standing in Patel v. Facebook. And while the decision is sure to have far-reaching consequences, it may trigger a fight at a court with even farther-reaching consequences: the Supreme Court. This is because Patel appears to create a circuit split with a Second Circuit decision from 2017, Santana v. Take-Two Interactive Software, Inc.
Both cases deal with a state privacy law called the Illinois Biometric Information Privacy Act (BIPA). BIPA imposes numerous procedural obligations on organizations that collect biometric information, such as fingerprints. To name a few, it requires obtaining written consent before collecting biometric information and publishing a data retention schedule. BIPA also provides a private right of action to any person “aggrieved” by violations of the Act. In January, the Illinois Supreme Court held that merely violating the procedural provisions of BIPA—without any showing of actual harm—was sufficient to bring a suit seeking liquidated damages in state court. (Our summary of that decision is available here). The question in Patel and Santana was whether the same was true in federal courts, given the higher bar of Article III standing.
In Patel, plaintiffs alleged that the defendant violated the procedural provisions of BIPA by not taking actions like publishing a retention schedule about how long it would keep data that it collected using facial recognition software. However, the plaintiffs did not allege any substantive harm. That is, no one accused the defendant of mishandling or inadvertently releasing any information. The defendant moved to dismiss on Article III standing grounds. However, the Ninth Circuit held that merely failing to comply with BIPA’s procedural provisions is a sufficient harm for plaintiffs to satisfy Article III standing. (For more information, our full summary of Patel v. Facebook is available here).
The Ninth Circuit’s decision in Patel contrasts starkly with the Second Circuit’s 2017 summary order in Santana. In Santana, the Second Circuit examined a basketball video game that scanned individuals’ faces to create custom in-game avatars. The plaintiffs sued, alleging, among other things, that the video game publisher “did not inform them of the duration that it would hold their biometric data, as BIPA requires.” The Second Circuit found that the plaintiffs lacked standing for this claim because they did not allege that this deficient notice created any material risk that would have “resulted in plaintiffs’ biometric data being used or disclosed without their consent.”
The conflict is straightforward. Patel held that mere procedural violations of BIPA—without more—are sufficient for Article III standing, but Santana held that violations of the exact same BIPA procedures—without more—are insufficient to confer Article III standing. There are also several district court opinions that appear to conflict with Patel. See e.g., Rivera v. Google, Inc., 366 F. Supp. 3d 998, 1014 (N.D. Ill. 2018) (dismissing case alleging BIPA violations for facial recognition scans because “Plaintiffs have not demonstrated an injury-in-fact sufficient to confer Article III standing”); McGinnis v. United States Cold Storage, Inc., 382 F. Supp. 3d 813, 820 (N.D. Ill. 2019) (dismissing case alleging BIPA violations for requiring employees to scan fingerprints because plantiff did not “allege[] a concrete injury sufficient to satisfy Article III”).
There are two wrinkles to this analysis, but neither affects the underlying split. First, Santana is a summary order, which does not create binding precedent in the Second Circuit. However, the Supreme Court has previously granted cert to resolve a split where one circuit’s opinion was “an unpublished order.” Second, the district court opinion in Patel tried to distinguish Santana on the ground that the plaintiffs in Santana were aware that their biometric data was being collected, allegedly unlike the plaintiffs in Patel. However, that ultimately appears to be a distinction without a difference, as the district court (and the Ninth Circuit) found that “the abrogation of the procedural rights mandated by BIPA necessarily amounts to a concrete injury.” In other words, if procedural violations of BIPA are all that is required to allege a concrete injury, then the question of notice is irrelevant under those courts’ logic.
So why does this circuit split matter? The Supreme Court’s rules enumerate a list of (non-exhaustive) reasons for what the Justices consider in determining whether to grant certiorari. One of these reasons is whether “a United States court of appeals has entered a decision in conflict with the decision of another United States court of appeals on the same important matter . . .” Since Spokeo v. Robins, the Supreme Court has been extremely reluctant to take up any privacy-related standing cases, despite the fact that the lower courts have begun to diverge—as evidenced by Patel. The split caused by the Ninth Circuit’s Patel decision may change this.
