Lawyers hail 'superb result' in Facebook biometric privacy battle: They'll get 25% of $550m, Illinois gets the rest

Sure, they should have got more, but let’s not get greedy here

Got Tips? 17 Reg comments
Screen with one new Facebook friend request

The lawyers who successfully sued Facebook for breaking Illinois’s biometric privacy law on behalf of citizens in the US state have hailed the “superb result” that will see them receive a quarter of the settlement.

"From any angle, the proposed settlement is a superb result for the certified class, and represents a fair, reasonable, and adequate resolution of the case," reads a motion in front of the federal district court in northern California seeking approval for the deal.

That settlement [PDF], announced in January, will put aside $550m for the estimated six million Illinois residents whose pictures and names were stored by Facebook as part of its face-tagging photo feature. Under a privacy law the state passed in 2008 – BIPA – a company has to seek explicit permission from people before it can store their biometric data.

Three users sued the company in 2015, and their lawsuits were combined into one and moved from Illinois to California, where Facebook is headquartered. They have cost the social network roughly one week of its $7.3bn Q4 2019 profit.

The lawyers are planning to award themselves 25 percent of the settlement, meaning that users will split $412.5m of the $550m six million ways, or about $70 each, minimum. Because everyone will have to apply to receive the money, the lawyers expect that as little as a fifth of those eligible will actually do so.

This is extraordinary, the plaintiffs’ lawyers promise. “In absolute monetary terms, the settlement is historic. It dwarfs every previous settlement in a BIPA class action, but it also stands out on a per-class-member basis. The settlement provides cash relief that far outstrips what class members typically receive in privacy settlements, even in cases in which substantial statutory damages are involved.”

So, this BIPA...

The law used to sue Facebook, Illinois’s Biometric Information Privacy Act (BIPA) includes a figure for violations: $1,000 for each negligent violation and $5,000 for each intentional violation.

Did Facebook intentionally violate the law? Well, it added the feature and actively encouraged people to tag people in their photos and then stored that information despite knowing of the law’s existence, so there could be a strong case to answer. And $5,000 would be a very heavy fine.

But what’s this tucked away in the footnotes? “More recent employment BIPA settlements have settled for $1,000 or more per person," the court documents state.

"E.G: Edmond v. DPI Specialty Foods (fund constituting $1,000 per person with direct checks); Watts v. Aurora Chicago Lakeshore (fund constituting $1,000 per person with direct checks); Lloyd v. Xanitos (fund constituting $1,300 per person with direct checks). In all these cases, and the others noted below, the class were at most a few hundred or few thousand people for whom the defendant had U.S. Mail addresses.”

Ah, so because this case was far, far larger, it makes sense that a company should haven’t to pay the same amount per person. After all, Facebook only made $18.5 billion in profit last year on revenues of $71bn. If it had to pay $1,000 per person in Illionois, that would be $6bn and it would see its profits cut by a third. No one wants that.

Besides, the plaintiffs' lawyers note, Facebook has so much money that it can afford to stretch the case out. And indeed it has already fought the case bitterly, appealing repeatedly, all the way up to the US Supreme Court.

Mistake of law, indeed

Hang on. It’s already been up to the Supreme Court and Facebook lost its appeal? Yes, the lawyers note, but, even so the case could still go on a long time and there’s no guarantee they would win.

“As this court’s summary judgment order noted, the evidence regarding whether Facebook was negligent in violating the BIPA did not permit judgment as a matter of law to either party. The court also allowed that Facebook’s ‘mistake of law’ defense might well foreclose any finding that Facebook acted intentionally, especially in light of the fact that Plaintiffs tendered no evidence showing that Facebook did not genuinely misapprehend BIPA’s scope.”

Plus there’s, you know, the COVID-19 coronavirus: “Finally, given the context of a global pandemic, the timely distribution of settlement funds is also a benefit to the class. Courts and litigants often consider the time-value of money as a factor favoring settlements over lengthy trials and appeals… That consideration is particularly acute in the present climate.”

The lawyers have one last stab – a jury trial, but it would be especially risky. How so? Because “notwithstanding recent public dialogue concerning Facebook’s privacy approach, the ubiquitous social media platform remains very popular, and it will be impossible to empanel jurors that have not already formed opinions about Facebook.”

Hippies

But that’s not all. You have to think about the kind of people that would be on a jury in – gasp! – San Francisco. “A jury, especially a jury in San Francisco, might well reject liability in light of positive attitudes regarding Facebook or its features, or might equate continued use and enjoyment with consent, with the potential to either defeat Plaintiffs’ claims outright or create individualized issues of fact.”

That’s right, one of the first cities in the world to ban the use of facial recognition technology is going to overlook the fact that Facebook took and stored people’s biometric data with asking permission because… they like the company?

Or it just might be a combination of two entirely different factors. First that the $137.5m the lawyers are due to receive without even having to go to trial is a pretty sweet deal, especially given the five years of litigation that have already occurred.

And then second there is the real power behind the case: the insurance carrier. Insurance companies typically cover litigation expenses and after five years, with Facebook threatening to drag the case out still further, the “historic” settlement may be the perfect moment to cut and run rather than expose themselves to tens of millions of dollars in additional risk.

And now for something completely different

Facebook’s generosity seemingly knows no bounds. It also announced today that it was settling another case, with another incredibly generous $52m.

In a tremendous irony, this time the plaintiffs will actually get $1,000 per person, as a minimum. And they could get up to $50,000. Wow. What was this one for?

Ah yeah, to pay off former Facebook moderators who have suffered mental health issues for manually enforcing the company’s policies on violent and graphic content while earning just above minimum wage through a third-party contractor because Facebook doesn’t want to put any pre-posting limits on its users.

All 12,500 mods will get the $1,000 but if Facebook’s policies have resulted in them being really adversely affected and they can get a doctor to diagnose them with post-traumatic stress disorder, they could come out of it with a decent sum. Enough for years of therapy. ®

Sponsored: Webcast: Simplify data protection on AWS

SUBSCRIBE TO OUR WEEKLY TECH NEWSLETTER


Biting the hand that feeds IT © 1998–2020