BIPA in Play, Lower Courts Have Their Say

BIPA cases are filed almost daily in Illinois and other courts.  Eye-popping settlements and verdicts grab headlines.  Four key issues await decision by the Illinois Supreme Court.  The Illinois legislature has no guidance in the works.  In the meantime, lower courts, primarily federal district courts, continue to shape and define the scope and reach of this powerful Illinois statute.  Below are the five most noteworthy updates since our July 2022 newsletter.

Plaintiffs must still demonstrate standing.  While the Illinois Supreme Court’s Six Flags decision made it clear that statutory damages were available under BIPA, plaintiffs must show that they have been or will imminently be harmed.  A Northern District of California court ruled that an Illinois resident who was not a Facebook user, but whose photographs were uploaded onto Facebook, lacked standing to bring suit against Facebook for failing to maintain a publicly available written policy as required by Section 15(a) of the statute.^[1] The Court concluded that the plaintiff “did not plausibly allege, or otherwise identify in subsequent arguments, a concrete and particularized harm” due to the lack of a publicly available policy meeting the requirements of Section 15(a).^[2] Thus, at least as to Section 15(a), plaintiffs must show more than the mere technical violation of failing to make a policy conforming to BIPA publicly available. 

BIPA’s extraterritorial reach is limited.  Because BIPA does not express a “clear intent” to apply extraterritorially, it cannot reach beyond Illinois borders.  A court in the Western District of Washington dismissed two separate BIPA cases, one against Microsoft and the other against Amazon, filed by the same plaintiffs because the alleged wrongful conduct did not “occur[] primarily and substantially in Illinois.”^[3] In both cases, the plaintiffs claimed that photographs previously uploaded to their Flickr accounts were included in a research project and later shared with Microsoft and Amazon employees to further the companies’ own research projects.  After two years of litigation, the Court granted summary judgment because there was no evidence that any of the relevant conduct occurred in Illinois, “let alone [that the photographs were] downloaded, reviewed, or evaluated…in Illinois.”^[4]

The Gramm-Leach-Bliley Act (“GLBA”) exemption, codified in 740 ILCS 14/25(c), can be read broadly.  Two separate courts in the Northern District of Illinois dismissed BIPA cases brought against DePaul University and Northwestern University because the universities are “engage[d] in student aid and lending funds,” and thus qualified as financial institutions under GLBA.^[5] However, Illinois Institute of Technology discovered that dismissal is not automatic.^[6] In denying the university’s motion to dismiss, the court noted it did not have sufficient evidence before it during the motion to dismiss stage to conclude that the defendant “regularly makes and administers student loans.”^[7]

Forum and choice of law provisions can be a powerful part of terms of use agreements.  A Northern District of Alabama court recently dismissed a BIPA case brought against ProctorU, a software platform that provides online exam proctoring services.^[8] Although the case was initially filed in the Central District of Illinois, ProctorU successfully transferred the case to the Northern District of Alabama based on the forum selection clause of the ProctorU’s terms of use.^[9] The Northern District court granted to motion to dismiss because Alabama’s substantive law applies to the alleged wrongful conduct.^[10] The use of forum selection and choice of law provisions is state and fact specific. As the court noted, its analysis was based on Alabama’s substantive law on choice of law provisions and the specific language of the ProctorU’s terms of use and privacy policy.^[11]

Lastly, arbitrations pose additional risk to businesses.  We wrote in July that arbitration clauses may be useful to help businesses resolve BIPA disputes on an individual basis rather than through costly ‎and broad class actions.  Arbitration commonly requires the ‎business to pay a portion of the claimant’s filing fee, its own filing fee, and certain administrative fees ‎necessary to commence the arbitration process.  At least one ‎business, Samsung, has been on the receiving end of nearly 50,000 BIPA arbitration demands after it was the subject of a class action lawsuit alleging violation of BIPA.  The arbitrations were terminated after Samsung refused to pay the arbitration administrative fees.  Instead of advancing payment of the administrative fees, which would have advanced the arbitrations, the claimants filed a petition in the Northern District of Illinois to compel arbitration in a suit that we will continue to monitor closely.^[12] In the meantime, businesses should consider the existence and application of such clauses when comparing the cost of arbitration against litigation.

Courts in Illinois and other states remain the driving source of BIPA interpretation and scope.  While limitations stemming from litigation help rein in BIPA’s reach in ways legislation has failed to do, entities should recognize the limits in applying these decisions and compliance remains their best approach.