Vigil v. Take-Two Interactive Software, Inc.
17-303
| 2d Cir. | Nov 21, 2017Background
- Plaintiffs Ricardo and Vanessa Vigil used Take-Two’s NBA 2K15 MyPlayer feature, which creates a 3-D avatar from a face scan captured by a camera during a ~15-minute process requiring close proximity and head turns.
- Before using MyPlayer, users saw an on-screen notice that a “face scan” would be visible to others and might be recorded; users had to press “continue” to proceed.
- Plaintiffs sued under the Illinois Biometric Information Privacy Act (BIPA), alleging failure to obtain informed consent, improper dissemination, inadequate written notice of retention purpose/term, failure to publish a destruction schedule, and insufficient data-security measures.
- District court dismissed the second amended complaint with prejudice for lack of Article III standing and for failure to state a statutory claim; plaintiffs appealed.
- Second Circuit held plaintiffs lacked Article III standing but concluded the district court erred in dismissing the statutory claim with prejudice; remanded with instruction to dismiss without prejudice.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Article III standing for procedural BIPA violations | Vigil: procedural violations alone (notice, retention, security) create a concrete risk of harm and injury-in-fact | Take-Two: disclosures and omission do not create a material risk of misuse; no concrete injury absent misuse or breach | No Article III standing; procedural defects here do not present a material risk of harm |
| Adequacy of on-screen notice that a “face scan” was collected | Vigil: notice was inadequate because it omitted the statutory term “face geometry” and lacked specifics | Take-Two: the “face scan” notice communicated the operative conduct; users were informed and consented | Held adequate for standing purposes; omission of the term “geometry” was not material given the invasive scan process |
| Risk from alleged deficient retention/disposal notice | Vigil: lack of written retention period and public destruction schedule creates risk of misuse | Take-Two: absence of those notices alone does not show likely misuse or disclosure | No material risk shown; bare procedural omission insufficient for injury-in-fact |
| Data-security allegations (unencrypted transmission and identity association) | Vigil: alleged insecure transmission and identity-linked templates create a real risk of disclosure | Take-Two: alleged prophylactic failures without an actual breach do not establish a substantial risk | Court: plaintiffs failed to plead a material risk of improper access; no standing established |
| Dismissal with prejudice on statutory-cause-of-action grounds | Vigil: dismissal extinguished statutory rights despite lack of jurisdiction | Take-Two: contested statutory “aggrieved party” status justified dismissal on merits | Court: district court’s merits ruling on statutory cause of action was improper without subject-matter jurisdiction; dismissal must be without prejudice |
Key Cases Cited
- Strubel v. Comenity Bank, 842 F.3d 181 (2d Cir.) (procedural-right/standing framework)
- Crupar‑Weinmann v. Paris Baguette Am., Inc., 861 F.3d 76 (2d Cir.) (application of standing for procedural statutory violations)
- Katz v. Donna Karan Co., L.L.C., 872 F.3d 114 (2d Cir.) (two-step standing test for procedural violations)
- Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016) (concrete-harm requirement for Article III standing)
- In re Facebook, Inc. Initial Pub. Offering Derivative Litig., 797 F.3d 148 (2d Cir.) (when statutory standing may be considered before Article III)
- Alliance for Envtl. Renewal, Inc. v. Pyramid Crossgates Co., 436 F.3d 82 (2d Cir.) (statutory‑standing vs. merits distinction)
- Atl. States Legal Found. v. Eastman Kodak Co., 12 F.3d 353 (2d Cir.) (standing that turns on merits of statutory construction)
- Clapper v. Amnesty Int’l USA, 568 U.S. 398 (2013) (substantial-risk standard for standing)