Not Enough in Estee Lauder BIPA Suit: Chicago Federal Judge Rules Make-Up "Try On” Technology Doesn't Meet Definition of Biometric Information

A Chicago federal judge has provided further insight into how Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. (“BIPA”) claims will be reviewed.  In a January 10th ruling, a U.S. District Court dismissed a proposed class action lawsuit against Estee Lauder which claimed the cosmetic company’s “virtual try-on” tool violated BIPA.  The tool in question allows customers to “try on” products from the comfort of their own home.  Similar technology has spawned a spate of BIPA cases in recent years.

In Castelaz v. Estee Lauder Companies, Inc., the Court held that a plaintiff must adequately connect the biometric information collected to the ability of defendants to use it alone, or in conjunction with other available methods or sources, to identify individuals.[1]

As BIPA continues to be one of the most highly litigated biometric privacy statute in the nation, recent rulings are rapidly establishing the statute’s requirements and applicability. This ruling continues that trend, providing further guidance on how courts are interpreting its requirements.

The Castelaz Dismissal

The Court in Castelaz signals another example of the newly establishing pleading standard for BIPA claims. Relying on a requirement outlined in two recent BIPA cases, that a plaintiff must plausibly allege that the collection of biometric data made the defendant capable of determining the individual’s identity,[2] the Court emphasized the importance of this requirement, calling it “the most foundational aspect of a BIPA claim.”[3] 

In the referenced ruling, Daichendt v. CVS Pharmacy, Inc., the court forced the plaintiff to establish the “real-world” connection of the collected biometric information to other identifying information, such as names and e-mail address. In Daichendt II, the plaintiff returned with an amended complaint that linked the collected “real-world” information to an ability of the defendant to identify them with their biometric identifiers, and the judge denied the motion to dismiss.[4]

Combined, these cases lay out a clear framework for how courts will analyze BIPA claims moving forward, and shine a light on what elements are required to plausibly plead a claim under the statute.

Paul Hastings’ Data Privacy and Cybersecurity practice regularly advises on compliance with data privacy requirements at the federal, state, and international levels, including BIPA.  If you have questions concerning BIPA compliance and emerging case law, please do not hesitate to contact a member of our team.