Google emerged victorious in Rivera v. Google  on December 29, 2018, obtaining a win in the long-running privacy class action involving technology that allows users of the Google Photos service to organize their photos by grouping the photographs in their accounts based on whether they contain visually similar faces. Plaintiffs alleged that Google’s technology violated the Illinois Biometric Information Privacy Act (BIPA), a statute that governs “scans” of “face geometry” and other “biometric information” and “biometric identifiers.” Google moved for summary judgment, arguing that plaintiffs had not suffered an injury-in-fact sufficient to confer standing under Article III of the U.S. Constitution. Judge Edmond Chang of the U.S. District Court for the Northern District of Illinois agreed, granted Google’s motion and dismissed the case for lack of subject matter jurisdiction. Google was represented by Perkins Coie attorneys Susan Fahringer, Debra Bernard, Ryan Spear, Sunita Bali, Nicola Menaldo and Erin Earl, as well as attorneys from Hogan Lovells LLP.

The lawsuit involved “face grouping,” a feature that enables Google Photos to automatically sort and group the photographs in a user’s private account, based on visual similarities between the images of faces in the photos. When a user uploads a photo to Google Photos, Google Photos detects images of faces, then creates a face template for each face in the photo that allows Google to compare the visual similarity of the faces in that photo with other photos within the user’s private Google Photos account. This allows Google Photos to automatically organize the photos in a user’s private account based on the people in them.

Plaintiffs Joseph Weiss and Lindabeth Rivera sued Google in March of 2016, alleging that, through the Google Photos face grouping feature, Google had collected and retained their “biometric identifiers” and “biometric information” (as defined by BIPA) without informed, written consent and a public retention schedule, as required by BIPA. Joseph Weiss was a Google Photos user who uploaded photos of himself to the service. Lindabeth Rivera did not use Google Photos, but a friend of hers did, and uploaded photos of Ms. Rivera to Google Photos. Weiss and Rivera sought up to $5,000 per violation in statutory damages on behalf of themselves and purported classes of everyone “who had their biometric identifiers, including scans of face geometry, collected, captured, received or otherwise obtained by Google from photographs uploaded within the state of Illinois.”

Google moved for summary judgment on the basis that the plaintiffs had no evidence that they suffered an injury-in-fact sufficient to confer Article III standing. Both Weiss and Rivera contended that they did not consent to Google’s collection of their “biometric identifiers” and that the collection and retention of their data without their consent constituted an injury in and of itself. They did not, however, claim any financial, emotional, reputational or other harm. The court, relying heavily on the U.S. Supreme Court’s 2016 Spokeo, Inc. v. Robins decision, granted Google’s motion.

The court recognized that the parties had “agreed to defer argument on and resolution of other issues, such as liability under the Act (whether face templates qualify as “biometric identifiers” or “biometric information” under the Act, and whether Google provided sufficient disclosures or obtained sufficient consent), Google’s defense under the Dormant Commerce Clause, whether the Act applies extraterritorially, and choice of law.” The court assumed, for purposes of summary judgment only, that the face templates Google created qualified as “biometric identifiers” under BIPA and that Google had not obtained BIPA-compliant consent to collect or retain those face templates. It then considered whether Google’s alleged improper collection and retention constituted an injury-in-fact sufficient to meet the U.S. Constitution’s Article III standing requirements. It held that Google’s alleged retention of the face templates did not result in an injury because there was no genuine dispute that Google used the face templates solely to organize users’ own photos and had not shared them with any person or entity outside of Google. Relying heavily on the U.S. Court of Appeals for the Seventh Circuit’s decision in Gubala v. Time Warner Cable, 846 F.3d 909 (7th Cir. 2017), the court held that mere retention did not constitute an imminent risk of harm absent evidence of a data breach or other third-party disclosure.

The court next turned to the “closer question” of whether the collection of face templates constituted an injury. As instructed by Spokeo, the court considered both whether the Illinois legislature had effectively codified a real-world harm through its enactment of BIPA, and whether the injury alleged by plaintiffs mirrored the kinds of injuries historically recognized by the courts as sufficient to support Article III standing. The Court held that the injury was insufficient under both analyses. First, although BIPA’s legislative findings discussed that biometrics were “immutable” and could not be easily changed, they also suggested that harm would only result from a disclosure, not from its mere collection. The court rejected the opposite holding reached by Judge James Donato of the U.S. District Court for the Northern District of California in Patel v. Facebook.

Second, the alleged injury resulting from Google’s purported collection of “biometric identifiers” did not bear any close resemblance to common law harms that historically have supported a finding of Article III injury. The court rejected the plaintiffs’ argument that a BIPA violation was akin to an intrusion upon seclusion, noting that individuals do not have a reasonable expectation of privacy with respect to the likeness of their face, which is displayed publicly on a daily basis. Moreover, there was no reasonable dispute that plaintiff Weiss had willingly uploaded photos of himself to Google Photos, and Rivera had allowed her friend to upload photos of Rivera, even after initiating the lawsuit. Therefore, there was no “private place” upon which Google could have allegedly intruded when it collected data from photographs voluntarily uploaded to its service. The court also rejected plaintiffs’ argument that a BIPA violation was analogous to the common law tort of misappropriation of likeness because, among other reasons, there was no evidence that Google sought to commercially benefit from the image of plaintiffs’ faces.

The court concluded that plaintiffs had failed to demonstrate an injury-in-fact sufficient to confer Article III standing and dismissed the case. In its concluding remarks, it also noted that the case presented close legal questions, which are “not uncommon when it comes to technological advances.” It cautioned that “[t]he difficulty in predicting technological advances and their legal effects is one reason why legislative pronouncements with minimum statutory damages and fee-shifting might reasonably be considered a too-blunt instrument for dealing with technology.”

The Rivera v. Google decision demonstrates that, even in the context of claims arising out of privacy statutes, like Illinois’ BIPA, a defendant can prevail on a challenge to subject matter jurisdiction if it can demonstrate that the alleged violation did not result in any concrete injury to the plaintiffs. Some states impose similar requirements to bringing suit in state court. As states continue to enact privacy legislation, corporations that collect private information can mitigate risk by considering and enhancing their available Article III defenses, including by documenting how they protect potential plaintiffs’ information from disclosure.