geometry generally speaking the biometric information privacy act or requires private entities such as take two to obtain informed consent prior to collecting an individual's biometrics and also includes various procedural secret i mean maybe you thought you were you it was that the writing requirement was nonsense no it was no big secret here they were capturing the images right there was no secret they were capturing the images your honor that is correct but the face scan that's disclosed in that disclosure is not the biometric identifiers that's at issue in this in this case that the free scan that was disclosed is is an image of a picture or a rendition that appears on the basketball player's face during gameplay how is th is created what's not disclosed is that biometric identifiers specifically geometric maps of points and contras on the face that are so unique that they can identify a person just in the same we have to be allegations just follow up on that that the b is required by the statute specifically required by this action so what i want to understand what you just said are you saying that there is no risk material risk of real harm to the concrete entrance here that to the contrary your honor there's a direct harm to the concrete interest of biometric privacy because the biometric identifiers are being collected without the consent the informed consent or the written informed consent of the appellant's the fifteen minutes skin each  a sister went through with it on their computer would they think that was going on and then when it appeared on a basketball players and when they were playing games with other users were they think they got that information from the image they it were fully aware and indeed they wanted the image on their head but they didn't want was and they didn't know about was by their biometric identifiers being created in the process really talking about two different types of data here process was going to create and they were going to be visible during gameplay and there could be a screen capture of that but the dip the second type of data is the underlying building block that t two used to get there which is a biometric geometric map of the face that's not disclosed no reasonable person would have understood that to be taking place on that exposure contention you claim is that itself is a form of identity not a not correct absolutely absolutely  no private entity may collect capture or purchase or otherwise obtain a person's or a customer's biometric identifier information unless it first informs the subject in writing that the biometric identifier information is and so because there are biometrics were collected without disclosing that it was being collected that concrete interest in the privacy of that material has been violated in the process there's no gap between the violation and the harm to the concrete interest in the first instance and then it's stored there indefinitely so that it can be used down the line to create additional avatars of the same person if necessary but are you alleging that that take two is not that hearing to any of the  protocols or its internal procedures that's correct it's inadequate that's correct your honor the complaint specifically alleges that all of essentially all of the procedural vile safeguards in this in the statute are being violated including  the requirements in the statute that the data be secured in the same with the same safeguards that the company would secure its other confidential data that you are saying that they have not notified you that's not the same thing as saying that they lack protocols or that they're not adhering to protocols that's that's correct so for the initial collection just to be clear that there's no information or schools are being provided that it discloses the biometrics are going to be collected there's additionally no written release or informed consent received from the for the individual providing their biometrics and so there's absolutely no compliance with with with the core of the statute which is the authorized collection provision in terms of retention and the provision of data retention policies and destruction policies and information about the length of term for which biometrics are going to be stored that was likewise not provided to the vigils and as a result  they been left totally unaware of what where their biometrics are how long it's going to be stored on unsecured remote server and they've actually withdrawn from engaging in these types of biometrics facilitated transactions going forward in well we have absolutely no indication that there was any policy provided in terms of their adherence to the policy the complaint alleges that it's being stored indefinitely and indeed that's the way it appears based upon the way the game works at any thank you so the question is whether or not without any allegation of harm and just the bare statutory alleged violations there's sufficient article three standing for the plaintiffs to proceed and the district court did  district court did was really probe as your honour's just did the plaintiffs will what are you saying happened in this case in terms of notice and consent and authorization and this plaintiff just readily admitted again they admit there was a notice that said face scanned they admitted that they stood there themselves for fifteen minutes apiece as their face got scanned they admitted that they saw the avatars being played as they played with other people i guess the argument that we heard is that  it's one thing to be told that your faith scam will be retained it's another thing to be told that your biometric information whatever that is will be retained and collected and violation was described as oh well i guess maybe it's a violation that you didn't use the word geometry when you said face scan or maybe you didn't use the word biometric identifier now i would argue your honor i don't think the statute even says you have to use magic words but it's assume for the moment that is the violation what the district court correctly found is that's the quintessential procedural type of violation or procedural type of rule there is no indication that the illinois legislature gave some magic significance to certain words or was so concerned about the particular method of the consent that they elevate it to its own concrete interest in and of itself rather with the district court found as look these are just procedural safeguards that are put in place with  goal of making sure people get their biometric information protected and so the question that they had to confront was where's the material risk that there's any chance that that information is to be compromised particularly here where there's no allegation of any misuse or data breach whatsoever and i think what makes this case an easy case for made it easy for the district court was ultimately the concessions at the argument and the admissions in the complaint that they knew their faces were being scant and as a result everything else became sort of a technical procedural violation in terms of the mechanics of the notice i asked you about data breach i understand you to saying please correct me if i'm misunderstanding that for saying that they have to have basically reasonable means of protecting the information and my position because there has been no discovery on what protocols are in place or who are taking the allegations is true the cases are pretty clear that if the concern is compromise of private information there at least has to be a data breach before you can say there's a material risk of harm oh let's say that company decides to get rid of all of its  until there's an actual breach first of all of office land where that's not the allegation here but in that hypothetical situation i think the current case is the way the circuits a come out on this i do think would be very difficult to articulate article three standing in that instance i think most recently the third circuit in back literally just canvas the circuit split on this issue in terms of how much of a risk there has to be for identity theft before you can have standing and it acknowledge couple of circuits on one side saying look at the you have a data breach that's enough right that you don't have to show more and identified several other circuits saying even with the data breach with hackers you need more before you can have standing the one common theme on all of those cases though and every circuit that's addressed it is there at least has to have been a breach or at least some data compromised by some kind of hacker we look to we're not aware of a single circuit or district court saying you can have standing on the mere allegation that maybe you're not taking enough safeguards even though you have no allegation that anything has been stolen anything has been breached and he has been taken or that anyone's even trying right now i think that's that's why it makes this case much easier than the hypothetical your honor presents when we make a footnote five in the clapper decision that says that article three standing i'm quoting also exists where there is a substantial risk that the harm will occur which may prompt plaintiffs to reasonably incur costs to mitigate or avoid that harm is you don't cite that in your when you talk about clapper would you tell me what your understanding of footnote five is my understanding is that acknowledges certain the possibility in certain instances where you have prospect of harm that is concrete enough or i think it's reasonable to have some kind of mitigation or corrective action if that's taken that that might itself furnish anough of the harm for there to be standing without having you know looking out elaborately i do believe ports of come out all over the place on the circumstances that would warrant such standing in terms of when it's appropriate to look at monitoring or corrective or protective measures in order to furnish the concrete harm in this case because there's nothing even remotely suggesting any was even tried to break in to get this data or any suggestion that any instances even arisen that would warrant protective measures i don't think the footnote alternately gives rise to the circumstances so your your position is as i take it that with respect to the standing concerns  we don't really have to get into it very much because in your view there has not been a showing that there is any risk of harm correct i think in this instance they're basically a zero risk of harm because there's been no allegations of several key facts one as the district court made clear no allegation of data breach whatsoever there isn't even an allegation that anyone's even trying to get to this data without the allegation of any kind of effort or any risk of it being compromised we're left with a purely academic question of what might be reasonable in the abstract right and they want you to sort of the court to potentially answer wall is encrypted encryption required or not required etc etc etc i think what the standing law indicates is until you actually have a concrete or at least something that's being threatened you don't have to answer these abstract questions agree though that if the retained they would then have some standard to sue for in connection with just the collection oh john i would say even priest poky oh that kind of a situation where it's purely serve tish's collection of private data i think it to be can decide or traditional invasion of privacy i don't think you would even need to go into that kind of struble concrete interest analysis i do agree in that instance there would be standing but here what the court correctly noted was it's not really an unauthorized collection of information it's more a question of procedurally did you do it exactly the way that the statute prescribed and those instances and looking at the concrete interest you have to say ok what was that procedure designed to safeguard and is there mitchell risk of harm to that and i think in this case there is no ask you with the district were did here which was to dismiss the case with prejudice under twenty six after concluding there was no subject matter gers to be one that's unusual was it appropriate to do that we should have been dismissed without prejudice on the one grounds yeah the reason why i think it's somewhat unusual is because the court was dealing with a state statute that itself requires a person be aggrieved in order to bring a case so what was unusual about this case is it wasn't just lack of article three standing which gets you out of federal court but also from the basically the same analysis a recognition that the could never be a state claim whatsoever now i guess i would separate that question in terms of authority and ultimately should the court have done it i think it's clear one that generally if you don't have subject matter jurisdiction don't reach the merits but based on the court's steel the supreme court still code decision and this circuits following  recently there is an exception for that when we're talking about threshold questions of who is entitled to sue sometimes it's called statutory standing it's an ambiguous term people like that term but the supreme court does say threshold issues you have the discretion to to get rid of a case for that as only under certain circumstances i think it's important yes so the question then becomes i think not less a question what are those circumstances so to me i think the the standard that was adopted by this environmental renewal versus pyramid cross gates case the court held and is pointing where the parties standing arguments are based on different constructions of the governing statute plaintiff standing to bring this action turns on the merits of the action itself and therefore may not be decided without subject matters but i think that's because in those instances that's comes the dividing line between when is it really merits and when is it truly a threshold question right and the way the supreme court explained the distinction between the two is it uses the phrase it's a threshold question we're talking about who is entitled to bring suit versus is what is complained about actually something that's prescribed by the statute it's a threshold question that the court says one you have the authority and then i would argue in an re facebook the court has the discretion to choose that as the basis to get rid of the case so i think this court acted with sufficient discretion  been around for two years because the conclusion flows from the same lack of harm it's literally the same analysis on both and i think just simply in the name of judicial efficiency i don't think the court abused its discretion in reaching both issues it certainly could have just reached person ag without doing article three altogether i think it did both because it's literally the same analysis and for that reason i think the court acted appropriately in dismissing with prejudice i think my time is up thank you just briefly before i address the dismissed with prejudice issue i'd just like to go back briefly to the distinction i was drawing between the face scan and the underlying data that is the biometrics were alleging was was compromised by take two in this case page nine of of t two's brief actually articulated best where it states was disclosed and disseminated to other players to be accurate their avatars were visible to others but the underlying scan data from which their avatars were created was not so take to acknowledge the distinction exists that we're making here the underlying data indeed a face scan is visual but a biometric identifier is not and the disclosure says your face scan will be will be visible to other gamers during game play and maybe screenshot it well that could not happen with a biometric identifier and form a collect his unique bio metric identifiers and or biometric information without his informed consent he would not have purchased the n b a two k fifteen video game and i understand it that that may be true but my question really is you don't allege that the emission of the word or that take to the mission of the term geometry is what actually led plain that that is not visual that cannot be visible to others during gameplay and the other is the rendition that's used that's created from that underlying data relenting of the underlying data itself is being stored it was collected and take to put nobody on notice of that in the way that disclosure was written even though it may use the word scan with respect to the article three or the bits you need the dismissal with prejudice none of the cases cited by take to involve a situation in which the district court first court finds that a lack subject matter jurisdiction has no power to do anything except dismiss and that makes sense because article three standing is ultimately a principle of judicial restraint to avoid going into territory where it need not go into the political in the in the in the of the executive and legislative branches but that's that's what the district were did here after finding it lacks other managers direction and it was powerless to do anything but to dismiss the complaint without prejudice in the last decided to interpret a state statute that it didn't