Data Privacy Class Actions and Biometric Legislation: Standing and Certification Issues in Facebook and Google

Businesses are increasingly using biometric data (such as voiceprints, fingerprints or facial scans) to create digital identities. The use of a digital identity to verify payment information or provide other services encourages market growth for biometric data. Many believe digital identities will replace all forms of paper identification. Accordingly, states are beginning to pass legislation to regulate the gathering, use and storage of such biometric information.

Under Illinois’ Biometric Information Privacy Act (BIPA), class actions against Facebook and Google allege privacy breaches due to face-scanning technology. Unlike prior privacy-based actions, the courts granted plaintiffs Article III standing even though neither group claimed any tangible harm from the privacy breach—a requirement for standing under Spokeo. Instead, the judges in both the Facebook and Google actions found that the violation of data privacy was enough to grant standing and move forward with the cases.

Because these rulings granted standing, plaintiffs have a glimpse into the future of privacy class actions. Companies that have business operations in states with biometric data privacy laws will benefit from reviewing and carefully monitoring their biometric data policies. Three states, including Illinois and Texas, have enacted legislation protecting biometric data privacy, and at least five other states have similar proposed bills.

Listen as our panel discusses the Illinois and Texas statutes, examines the class action certification rulings that have taken place in the Facebook and Google cases, and analyzes the implications for potential class action lawsuits both in and outside of the social media arena.