Court Decides Plaintiff Alleging Violation of Illinois Biometric Act Has Not Suffered Concrete Injury and Has No Standing to Bring Suit
March 1, 2017
by Jerry Glover
A New York federal trial recently heard a case involving several plaintiffs who alleged that Take-Two Interactive Software had violated the Illinois Biometric Information Privacy Act, 740 ILCS Sec. 14/1 et seq. (the Act) by indefinitely retaining the plaintiffs’ facial scan which the plaintiffs created while playing Take-Two’s NBA 2K15 and NBA 2K16 video games. Vigil v. Take-Two Interactive Software, Inc., 2017 WL 398404 (S.D.N.Y. January 30, 2017). Ultimately, the court ruled that the plaintiffs had not suffered a concrete injury as result of Take-Two’s retention of their facial scans and dismissed the case for lack of standing on the plaintiffs’ parts.
The basketball video games in question contained a feature which allowed players to scan their faces to create personalized virtual basketball players. The facial scanner used in the Take-Two video games required the user to stare up-close at the built-in camera for about 15 minutes while also turning the user’s head from side-to-side at regular intervals. So the user was very aware that a facial scan was being created. That person’s face then becomes part of a basketball avatar for in-game play. The person whose face has been scanned had to acknowledge and agree that the scan could be recorded or screen captured during game play.
What does the Act require? The Act requires facial scans and other biometric data (e.g., retina scan, iris scan, fingerprint, voiceprint, scan of hand) to be protected. The entity that possesses this data must develop “a written policy, available to the public, that establishes a retention schedule and guidelines for permanently destroying biometric data when the initial purpose for collecting it has been satisfied or within three years of the individual’s last interaction with the party in possession of the date, whichever first occurs.” The Act also requires the party in possession of the data to protect it from disclosure.
In addition, the Act requires the party in possession of the data to inform the subject of that data in writing that (i) biometric data is being collected; (ii) the purpose and length of the collection and storage; and (iii) receive a written release from the subject. Parties in possession of the data cannot sell it and cannot otherwise disseminate it without the written permission of the subject.
The plaintiffs alleged, among other things, that Take-Two stored facial scans indefinitely and did not provide to the public a written retention schedule of the face scans contrary to the Act, that the company failed to inform plaintiffs in writing that their face scan would be collected, did not get a written release form the plaintiffs, and that Take-Two markets and advertises the scan feature. The plaintiffs, however, admitted they had agreed to the game’s terms and conditions.
Take-Two claimed that the plaintiffs lacked what is known as “standing” under Article III of the U.S. Constitution to bring the lawsuit. In any federal lawsuit, the plaintiff must show that the plaintiff has suffered an actual or imminent injury which is concrete and particularized, that there is a causal connection between the injury and the defendant’s actions and that it is likely that a favorable decision in the case will redress the injury. A statute creating legal rights can be the basis for arguing that a legally protected interest exists in the plaintiff. But the plaintiff must still prove the plaintiff has suffered an injury.
The district court relied heavily on a recent U.S. Supreme Court decision, Spokeo v. Robin, 136 S. Ct. 1540 (2016), which held that for an injury to be “particularized” it must affect the plaintiff in a personal and individual way while a “concrete” injury must be real and not abstract. That court also noted that a bare procedural violation of a federal statute, divorced from any concrete harm does not satisfy the injury requirement.
The district court also pointed to a 2016 case from another judge in the Northern district of Illinois which was presented with a case in which the plaintiff also argued that the defendant had violated several requirements of the Act. The defendant in that case also raised this same Article III standing question , McCollough v. Smarte Carte, Inc., 2016 WL 4077108 (N,.D, Ill. August 1 2016). That district court dismissed the plaintiff’s claims because they were merely bare procedural and technical violations of the Act.
The Take-Two court agreed applied that earlier decision to this case and concluded the same thing: even though Take-Two may not have followed all of the Act’s requirements, the plaintiffs did not show how those violations harmed them. The plaintiffs did not show that Take-Two had disseminated or sold their biometric information to third parties or that it was used for anything other than the creation of personalized basketball avatars for in-game play. Therefore the plaintiffs lacked Article III standing.
The plaintiff’s also failed to show that there was an imminent risk of harm that Take-Two’s storage and dissemination of their facial scans could compromise that data protection interest of the Act noting that all the plaintiff’s could muster as an argument was that Take-Two failed to store and transmit their scans with a reasonable degree of industry-standard scanner thus raising the specter that the data could fall into the wrong hands. The court found this argument merely speculative and abstract. Take-Two’s failure to get plaintiff’s written consent was also considered merely a procedural violation and that plaintiff was well aware in advance that their faces would be scanned which were used for the purpose they expected—as basketball avatars.
Since the plaintiff’s could not show concrete, particularized harm as a result of Take-Two’s violations of the Act, the court dismissed the case.