In a putative class action against Facebook, a federal district court in California has determined that "[i]ntrusion on privacy alone can be a concrete injury" for purposes of establishing standing to bring suit in federal court. Patel v. Facebook Inc., 290 F. Supp. 3d 948, 954 (N.D. Cal. 2018). In reaching that conclusion, the court applied the concreteness analysis laid out by Justice Alito in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016).
The judicial power of the United States resides in the federal courts and extends only to "Cases" and "Controversies." U.S. Const. art. III, § 2. Standing to sue is a doctrine "rooted in the traditional understanding of a case or controversy," and limits the category of litigants who can maintain an action in federal court. Spokeo, 136 S. Ct. at 1547. To have standing, a plaintiff must plead and prove three elements: (1) an injury in fact that is (2) fairly traceable to the defendant's conduct and (3) likely to be redressed by a judicial decision in the plaintiff's favor. Id. The first and foremost of these three elements is injury in fact, which requires the plaintiff to show that he or she suffered an invasion of a "concrete" and "particularized" legal interest. Id. at 1548.
The Supreme Court focused its attention in Spokeo on the concreteness requirement. The Court indicated that a "concrete" injury must actually exist and be real, not abstract. Id. That does not mean that the injury has to be tangible; rather, even an intangible injury may be concrete under the right circumstances. See id. at 1549. Congress's judgment plays an important role in determining whether an intangible harm constitutes injury in fact, as Congress may identify and elevate intangible harms to the status of legally cognizable injuries, so long as the harms are sufficiently concrete. Id. In some circumstances, even the violation of a merely procedural right granted by statute can be sufficient to constitute injury in fact, without the requirement of "any additional harm beyond the one Congress has identified." Id. (Court's emphasis).
In Patel, the district court applied these principles in determining whether the plaintiff had standing to maintain his putative class action against Facebook, which, Patel alleged, had collected his biometric data (facial features unique to each individual user) secretly and without his consent in violation of the Illinois Biometric Information Privacy Act ("BIPA"), 740 Ill. Comp. Stat. Ann. 14/1 et seq. The BIPA was enacted by the Illinois legislature to address public concerns over the collection, use, and storage of biometric data, which are "uniquely sensitive identifiers" that, once compromised, cannot be changed, unlike a social security number. Patel, 290 F. Supp. 3d at 953. The BIPA requires written notice to, and the written consent of, a subject before his or her biometric data may be collected and stored. 740 Ill. Comp. Stat. Ann. 14/15. The BIPA provides a private right of action in favor of any person aggrieved by a violation of the statute. 740 Ill. Comp. Stat. Ann. 14/20.According to Patel, Facebook collected millions of users' (including Patel's) biometric data without their knowledge and consent in violation of the BIPA. The district court concluded that Patel had standing to maintain his action, because the precise harm the Illinois legislature sought to prevent—the violation of an individual's right to maintain his or her biometric privacy—was realized when Facebook allegedly disregarded the BIPA's procedures. Patel, 290 F. Supp. 3d at 954. That harm, though intangible, constitutes a concrete injury in fact to the individual's privacy rights. Id. Under those circumstances, Facebook's intrusion on Patel's privacy could alone be a concrete injury, without the allegation of any additional harm by Patel. Id. Therefore, Patel had standing, and the district court denied Facebook's motion to dismiss for lack of subject-matter jurisdiction.