The Privacy Class Action Review - 2023 - Report - Page 16
about the consumer under certain conditions; (iii) Right to opt-out (i.e., allows for a
consumer to opt out of the sale of personal information about the consumer to third
parties); (iv) Right of portability (allows for a consumer to request personal information
about the consumer be disclosed in a common file format); and (v) Notice and
transparency requirements (i.e., an obligation placed on a business to provide notice to
consumers about certain data practices, privacy operations, and/or privacy programs).
The approach each state attorney general takes regarding enforcement of these new
laws will provide lessons for other states looking to regulate consumer privacy in the
absence of a federal standard and almost certainly will be closely monitored by the
plaintiffs’ bar, as it attempts to draw from favorable rulings and to anticipate which state
will enact the next plaintiff-friendly data privacy laws. 28 U.S.C. §1292(b), Rule 23(f)
does not require the district court to certify an issue for appeal.
Moreover, Rule 23(f) does not include the potentially limiting requirements of § 1292(b),
under which the district court can certify an issue for appeal only where an order
“involve[s] a controlling question of law as to which there is substantial ground for
difference of opinion” and where “an immediate appeal from the order may materially
advance the ultimate termination of the litigation.”
Finally, class action litigants can appeal final orders issued by the district court under 28
U.S.C. § 1291, which states that “courts of appeals (other than the United States Court
of Appeals for the Federal Circuit) shall have jurisdiction of appeals from all final
decisions of the district courts of the United States.”
II.
Key BIPA Data And Rulings
The BIPA prompted a swell of lawsuit filings seeking to take advantage of the statute’s
relative newness, lack of clarity, and stiff statutory penalties. In terms of lawsuit filings,
for nearly a decade following enactment of the BIPA, activity under the statute was
largely dormant.
There was an average of approximately two total suits filed per year from 2008 through
2016. Those numbers grew exponentially in 2017 and 2018 and then spiked as the
plaintiffs’ class action bar filed a surge of class action lawsuits.
In 2022, companies saw more than five times as many class action lawsuit filings for
alleged violations of BIPA than they saw in 2018, and more than the number of class
action lawsuit filings that they saw from 2008 through 2018 combined.
If other states succeed in enacting similar statutes, businesses can expect similar
surges in other states, as the filing numbers in Illinois continue their upward trend.
15
© Duane Morris LLP 2023
Duane Morris Privacy Class Action Review – 2023
