The recent flurry of Biometric Information Privacy Act (BIPA) activity in California and elsewhere has called into question the effectiveness of an increasingly common defense to BIPA litigation in Illinois: that federal courts in Illinois do not have personal jurisdiction over companies headquartered and incorporated in other states, and conducting business nationally.
A federal court in Illinois that finds it has no personal jurisdiction can no longer entertain the suit. But Illinois is not the only state in which plaintiffs can bring a suit under BIPA. In January of this year, a federal court in California approved a $650 million settlement between Facebook and approximately seven million Illinois residents over claims that the social media giant violated plaintiffs’ rights under BIPA. Since then, two proposed BIPA class actions against Google over its use of facial recognition technology have also landed in the U.S. District Court for the Northern District of California.
In this Insight, we review these recent developments. While this discussion requires a perhaps tedious foray into civil procedure, this deep dive is important to understand why companies need to continue to take BIPA seriously.
Personal jurisdiction has been a hurdle to plaintiffs pursuing BIPA claims in Illinois against national companies.
First, a quick refresher on jurisdiction. For a case to move forward in any U.S. court, the court must have “personal” jurisdiction over the defendant – meaning that the court has the ability to compel the defendant to face the lawsuit in that court. There are two types of personal jurisdiction that a court can exercise: (1) “general” jurisdiction, which at a high level means that the defendant can be sued in that court on any claim, and (2) “specific” jurisdiction, which allows for the court to hear claims against the defendant only if the defendant has “purposefully directed” his activities at residents of the forum, and the litigation results from alleged injuries that “arise out of or relate to” those activities.
Jurisdiction is key for a case to move forward; without it, defendant companies can dispose of lawsuits at an early stage in litigation. By and large, Illinois-based courts do not have general jurisdiction over companies headquartered and incorporated outside of Illinois. So, they must have specific personal jurisdiction over these companies to decide BIPA class actions brought in Illinois.
Illinois courts have repeatedly failed to find personal jurisdiction over companies that merely offer services in Illinois. The Seventh Circuit (of which Illinois is a part) found that an online merchant’s operation of a national interactive website was insufficient for courts to exercise specific jurisdiction over the company in every state from which the site can be accessed, reasoning that doing so would open a defendant up to personal jurisdiction in every spot on the planet where that website is accessible.
Federal courts in Illinois have been increasingly friendly to specific jurisdiction challenges over BIPA defendants. In January, the U.S. District Court for the Northern District of Illinois applied this Seventh Circuit precedent in Gullen v. Facebook to find that the court had no specific jurisdiction over Facebook in connection with the company’s alleged collection of biometric data from Illinois residents in violation of BIPA.
The court ruled that allegations that Facebook targets its facial recognition technology at millions of Illinois residents with the help of a sales team located in Illinois were insufficient to support specific personal jurisdiction. The court reasoned that plaintiffs’ allegation that Facebook uses facial recognition technology on every user-uploaded photo suggests that the activity is not targeted at Illinois residents. While that logic is favorable to national company defendants, it’s important to understand that Illinois courts are not saying that there is no BIPA violation – just that Illinois is not the right place to adjudicate those claims.
By filing BIPA suits in companies’ home states and arguing that Illinois law applies, plaintiffs (even those based in Illinois) may be able to work around the Illinois courts’ lack of personal jurisdiction, and successfully sue for BIPA damages.
While lack of personal jurisdiction may make it hard to sue national companies for BIPA violations in Illinois, Illinois residents may still be able to sue those companies for BIPA violations in those companies’ home states. When filing these suits outside of Illinois, plaintiffs must argue that Illinois law (e.g., BIPA) should still apply.
A company can typically prevent plaintiffs from suing it in the company’s home state under another state’s law by including standard choice of law provisions in the company’s terms of service or another contact with the consumer. However, courts can override these provisions when the application of the contractually-agreed law would be contrary to a fundamental policy of a state that has a materially greater interest in the dispute.
In the Facebook BIPA case that settled in California, the federal court found that BIPA applied despite Facebook’s contrary contractual choice of law provision. The court applied BIPA because it found that the law embodies a fundamental policy of the state of Illinois, as it “manifests Illinois’ substantial policy of protecting its citizens’ right to privacy in their biometric data.” Enforcing the contractual choice of California law “would be contrary to this policy in the starkest way possible,” the court said, because “if California law is applied, the Illinois policy of protecting its citizens’ privacy interests in their biometric data . . . would be written out of existence.” The Court therefore declined to apply California law – which has no BIPA-equivalent that would require consent for the collection of biometric data – and applied Illinois law, entitling plaintiffs to damages.
California is not the only non-Illinois jurisdiction to hear BIPA claims – courts in New York have also heard them. For example, in Vigil v. Take-Two Interactive Software, the U.S. District Court for the Southern District of New York ruled on a BIPA suit between Illinois residents and a New York-based corporation.
Our Take
Following Facebook’s California settlement and the dismissed cases in Illinois, class action lawyers will likely increase pursuit of BIPA suits in companies’ home jurisdictions to avoid personal jurisdiction issues in Illinois. Because the regulation of biometric data is an uncommon and important protection, federal courts outside of Illinois will likely continue to apply BIPA, despite choice of law contractual provisions to the contrary.
As a result, companies should view their BIPA obligations broadly by implementing BIPA-compliant consent notices for the collection and use of biometric information in circumstances in which Illinois residents can access the company’s services or if the data is stored or processed in Illinois.
At the same time, even though courts may not follow contractual choice of law provisions, companies should include choice of law provisions in their consumer-facing terms that are favorable to the company and, specifically, do not specify Illinois law. This approach will leave fewer potential avenues for plaintiffs to argue that BIPA applies to the defendant.
Author(s)Joshua R. Fattal
David S. Kantrowitz
Natalie Perez