Class Action

Actual Injury Required for Biometric Suits

Consumer Class Action, Title III, , ,

** Biometric Plaintiffs Face Significant Setback in Illinois **                                                                                                                                                                                                             

By: Brent E. Johnson

In a growing number of states, biometric information has become a new type of protected data.  This form of information has been of particular concern to legislators spurred by its adoption in everyday uses — for example, in fingerprint scanners and facial recognition technology in smart phones — and its increasing use by employers tracking and verifying their employees’ hours.  The use of biometric information poses unique privacy and security challenges, not the least of which is that — unlike other types of personal identifiers (like a PIN or Social Security Number) — biometric information is permanent and cannot be changed if it falls into the wrong hands.

Background: Illinois was the first state to enact biometric data protections.  Its Biometric Information Privacy Act (740 ILCS 14) (BIPA) passed in 2008, created a “notice and consent” regime wherein: (i) private entities may collect, use or store biometric information only after obtaining a written release by the persons whose biometric information is sought; (ii) private entities are required to notice persons in writing about the specific purposes for and the length of time during which their biometric information will be collected, used or stored; and (iii) private entities must follow notice and consent requirements before disclosing a person’s biometric information to a third party.  Under BIPA, individuals have the right to sue private party violators and recover a minimum of $1,000 for a negligent violation and $5,000 for each violation recklessly or intentionally committed. Plaintiffs may also collect attorneys’ fees and costs.  Texas passed a similar law in 2009 (Capture or Use of Biometric Identifier Act) (Bus & Com § 503.001), and in 2017, Washington state passed a biometric law (H.B. 1493).  During the 2017 legislative session, bills dealing with biometric notice and consent regimes similar to BIPA were introduced in several states, including Alaska (H.B. 72), Arizona, Connecticut (H.B. 5522), Massachusetts (H.B. 1985 ), Montana (H.B. 518), Missouri, New Hampshire (H.B. 523) and New York – but all failed to pass.  The Washington and Texas statutes only allow for enforcement by the attorney general’s office.  Accordingly, Illinois remains the only state with a biometric statute that includes a private right of action – and it is thus the only state that has so far caught the attention of the class action bar.

While the Illinois statute has been in force since 2008, it received little attention until the last two years.  In 2016 and 2017, BIPA actions were brought against companies that use facial-recognition technology, such as Facebook, Shutterfly, Google, Snapchat, and others, as well as companies that use fingerprint scans, such as L.A. Tan.  Employee suits have also become popular, stemming from the use of biometric information in the workplace, such as fingerprint-operated time clocks.  Hotel chain InterContinental Hotels Group, broadband company Zayo Group, and convenience store chain Speedway LLC have all been the subject of employee lawsuits under BIPA.

For the defense bar dealing with BIPA claims, two major questions have been: (i) Can a company be sued for technical violations of the Act where no damages were sustained by the plaintiffs’ class? and (ii) Does BIPA have extraterritorial application?

The first question recently received attention by the Illinois Court of Appeals.  In Rosenbach v. Six Flags Entm’t Corp., 2017 WL 6523910 (Il. Ct. App., Dec. 21, 2017), Stacy Rosenbach, whose son’s thumbprint was taken by Six Flags after he purchased a season pass for one of its Great America theme parks, sued the company for violating BIPA based on her allegation that it failed to properly obtain written consent or disclose Six Flag’s plan for the collection, storage, use or destruction of her son’s biometric identifiers or information.  Six Flags moved to dismiss, arguing that under Section 20 of BIPA any right of action is limited to a “person aggrieved,” which excludes Plaintiff because she failed to allege any actual injury.  The lower court denied the theme park company’s motion to dismiss, but later certified to the appellate court two questions relating to whether individuals “aggrieved by a violation of the act” can rely solely on alleged violations of the notice and consent requirements or whether they must allege some actual harm.  In answering these questions, the Court of Appeals held that in order to meet the definition of an aggrieved person under the statute, plaintiffs must claim some actual harm. The Court noted, “if the Illinois legislature intended to allow for a private cause of action for every technical violation of the Act, it could have omitted the word ‘aggrieved’ and stated that every violation was actionable.  A determination that a technical violation of the statute is actionable would render the word ‘aggrieved’ superfluous. Therefore, a plaintiff who alleges only a technical violation of the statute without alleging some injury or adverse effect is not an aggrieved person under section 20 of the Act.”  2017 WL 6523910 at ¶ 23. The court rejected Plaintiff’s argument that biometric privacy, itself, is a right that is injured by violation of the statute.  Id. at ¶ 20.  This decision has the potential to foreclose on scores of current BIPA class actions – specifically those that have recently been filed and are seeking statutory penalties for naked violations of BIPA without a clear nexus to any consequential harm or injury.

The second question remains unsettled. To be sure, courts appear clear that an Illinois “statute is without extraterritorial effect unless a clear intent in this respect appears from the express provisions of the statute” (Avery v. State Farm Mut. Auto. Ins. Co., 835 N.E.2d 801, 852 (2005)) and recognize that none of BIPA’s express provisions indicate that the statute was intended to have extraterritorial effect (see Monroy v. Shutterfly, Inc., No. 16 C 10984, 2017 WL 4099846, at *5 (N.D. Ill. Sept. 15, 2017) (finding that BIPA does not apply extraterritorially). But what does that mean in the internet age?  For example, in Monroy, Plaintiff was acknowledged to be a resident of Florida and Defendant Shutterfly was acknowledged to be a Delaware Corporation – but the allegations of the Complaint were that Plaintiff’s friend, located in Illinois, uploaded his photo to Shutterfly’s servers triggering the alleged biometric violation.  In those circumstances, was the Florida resident entitled to the protections of BIPA?  The federal district court could not decide, noting that it was unclear where the actual scan of plaintiff’s face geometry took place, where the scan was stored once it was obtained, and, when stored in cyberspace, how physical location is to be determined – thus finding that the ultimate answer to the extraterritorial question raised a question of fact not suited for dismissal under Rule 12.

Supreme Court Skips on Ascertainability

Consumer Class Action, False Advertising, Food, Supreme Court, , , , ,

** High Court Won’t Weigh in on Whether “All Natural” Class Requires Ascertainability **                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               

By: Brent E. Johnson                                                                                                                      

In federal court, Civil Procedure Rule 23 governs the question of whether a class may be certified.  The rule specifically identifies four primary requirements for certification: numerosity, commonality, typicality and adequacy.  But many courts have added a further requirement – whether the putative class is “ascertainable.”  While the question posed by this requirement is phrased differently from court to court, it can be distilled to this:  Is there a reasonable and reliable way to identify the members of the proposed class?  The Ninth Circuit recently rejected the application of this standard.  And, on  request for certiorari, the Supreme Court has refused to weigh in on this important issue.

Many federal courts were quick to adopt the ascertainability standard after it found its way into case law, particularly some of the district courts of California, which bear the brunt of the dramatic rise in consumer class actions.  See, e.g., Lukovsky v. San Francisco, No. C 05–00389 WHA, 2006 WL 140574, *2 (N.D.Cal. Jan. 17, 2006) (“‘Although there is no explicit requirement concerning the class definition in FRCP 23, courts have held that the class must be adequately defined and clearly ascertainable before a class action may proceed”) (quoting Schwartz v. Upper Deck Co., 183 F.R.D. 672, 679–80 (S.D.Cal.1999)); Thomas & Thomas Rodmakers, Inc. v. Newport Adhesives & Composites, Inc., 209 F.R.D. 159, 163 (C.D.Cal.2002) (“Prior to class certification, plaintiffs must first define an ascertainable and identifiable class. Once an ascertainable and identifiable class has been defined, plaintiffs must show that they meet the four requirements of Rule 23(a), and the two requirements of Rule 23(b)(3)” (citation and footnote omitted)).  Generally speaking, a class is sufficiently defined and ascertainable if it is “administratively feasible for the court to determine whether a particular individual is a member.” O’Connor, 184 F.R.D. at 319.

The ascertainability rule appeals to common sense – particularly in consumer class actions.  Courts don’t want to certify classes without some reasonable assurance that aggrieved class members will be compensated for the wrong they suffered.  Equally important, courts don’t want to create vehicles for petty fraud.  As the court observed in Sethavanish v. ZonePerfect Nutrition Co., No. 12–2907–SC, 2014 WL 580696, *56 (N.D.Cal. Feb. 13, 2014), “Plaintiff has yet to present any method for determining class membership, let alone an administratively feasible method.  It is unclear how Plaintiff intends to determine who purchased ZonePerfect bars during the proposed class period, or how many ZonePerfect bars each of these putative class members purchased.  It is also unclear how Plaintiff intends to weed out inaccurate or fraudulent claims. Without more, the Court cannot find that the proposed class is ascertainable.”

In In re ConAgra Foods, Inc., 90 F. Supp. 3d 919, 969 (C.D. Cal. 2015), consumers brought a putative class action against Con Agra, alleging that the manufacturer deceptively and misleadingly marketed its cooking oils, made from genetically-modified organisms (GMO), as “100% Natural.”  A class was certified , inter alia, on the basis that the proposed class was ascertainable.  The District Court held that:  (i) ascertainability was the law of the Circuit; and (ii) ascertainability was satisfied because membership was governed by a single, objective, criteria – whether an individual purchased the cooking oil during the class period.  Id. at 969.

ConAgra, understandably unhappy with the result, appealed the factual basis for the district court’s ascertainability determination.  It argued before the Ninth Circuit that plaintiffs did not propose any way to identify class members and could not prove that an administratively feasible method existed for doing so – because, for example, consumers do not generally save grocery receipts and are unlikely to remember details about individual purchases of cooking oil.  Briseno v. ConAgra Foods, Inc., 844 F.3d 1121, 1125 (9th Cir. 2017).  The Ninth Circuit, however — rather than analyzing whether the plaintiffs satisfied the ascertainability standard — ruled that it has no place in certification proceedings at all.  “A separate administrative feasibility prerequisite to class certification is not compatible with the language of Rule 23 . . . Rule 23’s enumerated criteria already address the policy concerns that have motivated some courts to adopt a separate administrative feasibility requirement, and do so without undermining the balance of interests struck by the Supreme Court, Congress, and the other contributors to the Rule.”  In short, according to the Ninth Circuit, Rule 23 does not mandate that proposed classes be ascertainable and the lower courts are bound to apply Rule 23 as written.

In so ruling, the Ninth Circuit joined the Sixth, Seventh, and Eighth Circuits. See Sandusky Wellness Ctr., LLC, v. Medtox Sci., Inc., 821 F.3d 992, 995–96 (8th Cir. 2016); Rikos v. Procter & Gamble Co., 799 F.3d 497, 525 (6th Cir. 2015); Mullins v. Direct Digital, LLC, 795 F.3d 654, 658 (7th Cir. 2015), cert. denied, ––– U.S. ––––, 136 S.Ct. 1161, 194 L.Ed.2d 175 (2016).  On the opposite side of the ascertainability issue are the Third, Fourth and Eleventh Circuits.  Marcus v. BMW of N. Am., LLC, 687 F.3d 583, 593 (3d Cir. 2012); EQT Production Co. v. Adair, 764 F.3d 347, 359 (4th Cir. 2014); Karhu v. Vital Pharm., Inc., — F. App’x —, 2015 WL 3560722 at *3 (11th Cir. June 9, 2015).

ConAgra petitioned the Supreme Court to grant a writ of certiorari on May 10, 2017.  It had reason to hope with the Supreme Court recently showing willingness to rule on class action and certification issues.  (See prior posts).  However, on October 10, 2017, the Supreme Court denied the petition without comment.  Conagra Brands, Inc. v. Briseno, No. 16-1221, 2017 WL 1365592 (U.S. Oct. 10, 2017).

With the circuit split still alive, this is not the last we’ll hear on ascertainability.  And no doubt defense counsel in affected jurisdictions will find ways to re-shape the reasoning applied in their ascertainability arguments to other parts of the Rule 23 analysis.  But, no doubt, with this line of defense gone (for now) in the Ninth Circuit – many more consumer class actions will have their day in California courts.