In November, we identified an emerging trend
involving Article III standing in cases brought under Illinois' Biometric Information Protection
Act ("BIPA"). The Northern District of
California's recent decision in Patel v. Facebook
Inc., No. 3:15-cv-03747-JD, 2018 U.S. Dist. LEXIS 30727 (N.D.
Cal. Feb. 26, 2018), denying Facebook's motion to dismiss for
lack of subject matter jurisdiction, demonstrates that the trend is
persisting.
BIPA's Requirements
BIPA
requires entities collecting, using, and storing biometric data
(such as face, retina, and fingerprint scans) to, among other
things, inform and obtain consent from the owners of the data. BIPA
also requires the entity to establish a retention schedule such
that the biometric data is destroyed when the purpose for its use
has been satisfied or within three years, whichever occurs first.
Users must be informed of this retention schedule.
