Vance et al v. Microsoft Corporation, No. 2:2020cv01082 - Document 43 (W.D. Wash. 2021)
Court Description: ORDER granting in part and denying in part Defendant's 25 Motion to Dismiss. The court GRANTS the motion to dismiss Plaintiffs' injunctive relief claim but DENIES the motion as it applies to Plaintiffs' BIPA § 15(b) claim. The court DEFERS ruling on Plaintiffs' BIPA § 15(c) and unjust enrichment claims and further DIRECTS the parties to file responses on those two issues as identified above. These responses shall not exceed 15 pages and must be filed by Friday, March 26, 2021, at 5:00 p.m. Signed by Judge James L. Robart. (LH)
Download PDF
<![CDATA[
Vance et al v. Microsoft Corporation Doc. 43 Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 1 of 24 1 2 3 4 5 6 7 UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON AT SEATTLE 8 9 STEVEN VANCE, et al., 10 CASE NO. C20-1082JLR Plaintiffs, 11 v. 12 MICROSOFT CORPORATION, 13 ORDER GRANTING IN PART AND DENYING IN PART MICROSOFT’S MOTION TO DISMISS Defendant. 14 I. 15 INTRODUCTION Before the court is Defendant Microsoft Corporation’s (“Microsoft”) motion to 16 17 dismiss Plaintiffs Steven Vance and Tim Janecyk’s (collectively, “Plaintiffs”) complaint. 18 (MTD (Dkt. # 25); Reply (Dkt. # 34).) Plaintiffs oppose the motion. (Resp. (Dkt. # 37).) 19 Having considered the motion, the parties’ submissions regarding the motion, the 20 // 21 // 22 // ORDER - 1 Dockets.Justia.com Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 2 of 24 1 relevant portions of the record, and the applicable law, 1 the court GRANTS in part and 2 DENIES in part the motion to dismiss. II. 3 4 BACKGROUND Facial recognition technology uses computer artificial intelligence and machine 5 learning algorithms to “detect, recognize, verify and understand characteristics of humans 6 faces.” 2 (Compl. (Dkt. # 1) ¶ 23 (quoting Michele Merler, et al., Diversity in Faces, IBM 7 Research AI at 1 (Apr. 10, 2019)) (“Diversity in Faces”).) However, “significant 8 technical hurdles” hinder the technology’s accuracy, and improving that accuracy relies 9 upon “the use of data-driven deep learning to train increasingly accurate models by using 10 growing amounts of data.” (Diversity in Faces at 1.) In other words, practice makes 11 perfect: for artificial intelligence to more accurately recognize different faces, “vast 12 quantities of images of a diverse array of faces” must be fed to the underlying 13 machine-learning algorithms. (Compl. ¶ 24.) 14 Microsoft is one of many companies that have developed and produced facial 15 recognition products. (Id. ¶¶ 3, 52-53.) Among these products are its Cognitive Services 16 Face Application Program Interface and its Face Artificial Intelligence service that allow 17 customers to embed facial recognition technology into their applications. (Id. ¶ 53.) 18 Microsoft conducts “extensive business within Illinois” related to facial recognition, 19 20 21 22 1 Both parties request oral argument (MTD at 1; Resp. at 1), but the court finds oral argument unnecessary to its disposition of the motion, see Local Rules W.D. Wash. LCR 7(b)(4). 2 For the purposes of a motion to dismiss, the court accepts all well-pleaded allegations in Plaintiffs’ complaint as true and draws all reasonable inferences in favor of Plaintiffs. See Wyler Summit P’ship v. Turner Broad. Sys., Inc., 135 F.3d 658, 661 (9th Cir. 1998). ORDER - 2 Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 3 of 24 1 including selling its facial recognition products through an Illinois -based vendor; working 2 with an Illinois-based business to build new applications for facial recognition 3 technology; and working with Illinois entities to build a “digital transformation institute” 4 that accelerates the use of artificial intelligence throughout society. (Id. ¶ 59.) 5 Plaintiffs are Illinois residents who, starting in 2008, uploaded photos of 6 themselves to the photo-sharing website Flickr. (Id. ¶¶ 6-7, 28, 60-61, 69.) Both were in 7 Illinois when uploading the photos. (Id. ¶¶ 60, 69.) Unbeknownst to Plaintiffs, Flickr, 8 through its parent company Yahoo!, compiled hundreds of millions of photographs 9 posted on its platform, including those of Plaintiffs and other Illinois residents, into a 10 dataset (“Flickr dataset”) that it then made publicly available to “help improve the 11 accuracy and reliability of facial recognition technology.” (Id. ¶¶ 29-32.) Utilizing the Flickr dataset, International Business Machines Corporation (“IBM”) 12 13 selected one million images to create a new dataset called Diversity in Faces in an effort 14 to reduce bias in facial recognition. (Id. ¶ 40.) IBM scanned the “facial geometry” of the 15 images and created a “comprehensive set of annotations of intrinsic facial features ,” 16 including craniofacial distances, areas and ratios, facial symmetry and contrast, skin 17 color, age and gender predictions, subjective annotations, and pose and resolution. (Id. 18 ¶ 41 (citing Diversity in Faces at 2).) Ultimately, IBM utilized “19 facial landmark 19 points” to determine “68 key points for each face” and to extract “craniofacial features” 20 for each image in the dataset. (Id. ¶¶ 42-43 (citing Diversity in Faces at 9).) Again, the 21 Diversity in Faces dataset included the facial scans of Plaintiffs and other Illinois 22 // ORDER - 3 Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 4 of 24 1 residents, but like Flickr and Yahoo!, IBM did not seek or receive per mission from 2 individuals whose faces were analyzed. (Id. ¶¶ 44-45.) 3 IBM made the Diversity in Faces dataset available to other companies seeking to 4 improve their facial recognition technology. (Id. ¶ 47.) To obtain the dataset, companies 5 applied for permission via an online questionnaire, and if IBM granted access, IBM 6 would send a link for companies to download the dataset. (Id. ¶ 48.) Those with the 7 dataset, and the corresponding information, could “identify the Flickr user who uploaded 8 the photograph,” “view the Flickr user’s homepage,” and “view each photograph’s 9 metadata, including any available [information] relating to where the photograph was 10 taken or uploaded.” (Id. ¶ 51.) Microsoft applied for and downloaded the dataset from 11 IBM. (Id. ¶ 55.) Microsoft used the dataset to improve “the fairness and accuracy of its 12 facial recognition products,” which “improve[d] the effectiveness” of those products and 13 made them “more valuable in the commercial marketplace.” (Id. ¶¶ 57-58.) Once again, 14 the dataset downloaded by Microsoft contained Plaintiffs ’ information, but Microsoft did 15 not inform or obtain permission from Plaintiffs. (Id. ¶¶ 56, 65-66, 73-74.) 16 Plaintiffs bring a class action suit against Microsoft for violating Illinois’s 17 Biometric Information Privacy Act, 740 ILCS 14/1, et seq. (“BIPA”), which regulates the 18 collection, storage and use of biometric identifiers and biometric information 19 (collectively, “biometric data”). (Id. ¶¶ 4, 17.) Specifically, they allege violations of two 20 BIPA provisions: (1) Microsoft violated § 15(b) by collecting and obtaining biometric 21 data without providing the requisite information or obtaining written releases; and (2) 22 Microsoft violated § 15(c) by unlawfully profiting from individuals’ biometric data. (Id. ORDER - 4 Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 5 of 24 1 ¶¶ 93-106.) Plaintiffs additionally bring an unjust enrichment claim ( id. ¶¶ 107-16) and a 2 separate count for injunctive relief (id. ¶¶ 117-22). III. 3 4 ANALYSIS When considering a motion to dismiss under Rule 12(b)(6), the court construes the 5 complaint in the light most favorable to the nonmoving party. Livid Holdings Ltd. v. 6 Salomon Smith Barney, Inc., 416 F.3d 940, 946 (9th Cir. 2005). The court must accept 7 all well-pleaded facts as true and draw all reasonable inferences in favor of the plaintiff. 8 Wyler Summit P’ship, 135 F.3d at 661. The court, however, is not required “to accept as 9 true allegations that are merely conclusory, unwarranted deductions of fact, or 10 unreasonable inferences.” Sprewell v. Golden State Warriors, 266 F.3d 979, 988 (9th 11 Cir. 2001). “To survive a motion to dismiss, a complaint must contain sufficient factual 12 matter, accepted as true, to ‘state a claim to relief that is plausible on i ts face.’” Ashcroft 13 v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 14 570 (2007)); see also Telesaurus VPC, LLC v. Power, 623 F.3d 998, 1003 (9th Cir. 15 2010). “A claim has facial plausibility when the plaintiff pleads f actual content that 16 allows the court to draw the reasonable inference that the defendant is liable for the 17 misconduct alleged.” Iqbal, 556 U.S. at 677-78. Dismissal under Rule 12(b)(6) can be 18 based on the lack of a cognizable legal theory or the absence of sufficient facts alleged 19 under a cognizable legal theory. Balistreri v. Pacifica Police Dep’t, 901 F.2d 696, 699 20 (9th Cir. 1990). 21 22 Microsoft moves to dismiss all of Plaintiffs’ claims in its instant motion. (See MTD.) The court addresses the arguments pertaining to each claim in turn. ORDER - 5 Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 6 of 24 1 A. BIPA Claims 2 In urging the court to dismiss Plaintiffs’ two BIPA claims, Microsoft first 3 challenges the applicability of BIPA. (MTD at 6-15.) It argues that BIPA does not have 4 extraterritorial effect here and that if it did, BIPA would violate the Dormant Commerce 5 Clause. (Id.) Even if BIPA applies, Microsoft contends that Plaintiffs fail to state a 6 claim. (Id. at 16-22.) The court addresses each argument in turn. 7 1. Illinois Extraterritorial Doctrine 8 Microsoft first argues that BIPA was not intended to have exterritorial effect and 9 thus could not apply here because Plaintiffs have not established that the claim occurred 10 in Illinois. (Id. at 6-9.) The court, like many others that have considered this argument, 11 determines that at this early stage, it cannot dismiss the BIPA claims on this basis. 12 The parties agree that an Illinois statute does not have an “extraterritorial effect 13 unless a clear intent in this respect appears from the express provisions of the statute.” 14 Avery v. State Farm Mutual Auto. Ins. Co., 835 N.E.2d 801, 852 (Ill. 2005); (MTD at 6; 15 see Resp. at 4-5.) They further agree that BIPA does not have such an express provision 16 and thus is not authorized to have extraterritorial effect. (MTD at 6; see Resp. at 4-5); 17 see Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1100 (N.D. Ill. 2017). Noneth eless, 18 Plaintiffs may assert BIPA claims if they sufficiently allege that Microsoft’s purported 19 violations “occur[red] primarily and substantially in Illinois.” See Avery, 835 N.E.2d at 20 853. The parties disagree on whether Plaintiffs have done so. 21 22 There is “no single formula or bright-line test for determining whether a transaction occurs within [Illinois].” Id. at 854. Instead, “each case must be decided on ORDER - 6 Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 7 of 24 1 its own facts.” Id. Courts consider a myriad of factors, including the plaintiff’s 2 residency, the location of harm, where communications between parties occurred, and 3 where a company is carrying out the aggrieved policy. Id. For transactions occurring on 4 the Internet, courts may need to consider Internet-specific factors, such as where the site 5 or information was accessed, or where the corporation operates the online practice. See 6 Rivera, 238 F. Supp. 3d at 1101. As illustrated by these factors, whether events occurred 7 primarily and substantially in Illinois is a “highly fact-based analysis that is generally 8 inappropriate for the motion to dismiss stage.” Vance v. IBM Corp., No. 20 C 577, 2020 9 WL 5530134, at *3 (N.D. Ill. Sept. 15, 2020) (“IBM”). 10 Accordingly, the majority of courts in BIPA cases to consider the issue at this 11 stage have denied the motion to dismiss, opting instead to allow discovery for more 12 information regarding the extent to which the alleged misconduct occurred in Illinois. 13 See, e.g., Monroy v. Shutterfly, Inc., No. 16 C 10984, 2017 WL 4099846, at *6 (N.D. Ill. 14 Sept. 15, 2017); cf. In re Facebook Biometric Info. Privacy Litig., 326 F.R.D. 535, 15 547-48 (N.D. Cal. 2018) (analyzing issue in class certification context). In Rivera, the 16 plaintiffs alleged that they were Illinois residents; that their photographs were taken and 17 uploaded in Illinois; and that the defendant failed to provide the required disclosures in 18 Illinois, but they did not allege where the defendant accessed their photographs or facial 19 scans. 238 F. Supp. 3d at 1101-02. Nonetheless, the court concluded that the allegations 20 “tip[ped] toward a holding that the alleged violations primarily happened in Illinois.” Id. 21 However, the court recognized the need for discovery, highlighting the need for more 22 information regarding where the injury and the lack of consent took place. Id. at 1102. ORDER - 7 Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 8 of 24 1 The court holds the same based on Plaintiffs’ allegations. Plaintiffs, and all 2 purported class members, are Illinois residents who, while in Illinois, uploaded photos 3 that were taken in Illinois. (Compl. ¶¶ 6-7, 60-61, 69.) The required disclosures or 4 permissions would have been obtained from Illinois, and so any communication would 5 have necessarily involved Illinois. (See id. ¶¶ 65-66, 73-74.) The alleged harm to 6 privacy interests is ongoing for Illinois residents. (Id. ¶¶ 67, 75, 77.) Moreover, 7 Plaintiffs allege that Microsoft conducts “extensive business” in Illinois involving their 8 facial recognition products (id. ¶ 59), and that the Diversity in Faces dataset “improve[d] 9 its facial recognition products” (id. ¶ 58), thereby allowing the reasonable inference that 10 11 Microsoft utilized the dataset in Illinois during its business dealings. While Microsoft is correct that Plaintiffs do not allege where Microsoft obtained 12 the dataset (see MTD at 7), that fact alone may not be dispositive. See Rivera, 238 F. 13 Supp. 3d at 1102 (citing Avery, 835 N.E.2d at 853). It is certainly possible that with more 14 factual refinement around this complex issue, the circumstances around Microsoft’s 15 attainment, possession and use of the Diversity in Faces dataset will reveal that the 16 alleged violations did not occur primarily in Illinois. See IBM, 2020 WL 5530134, at *3. 17 But more information is needed to reach any determination, and so, the court agrees with 18 Rivera that “[f]or now, it is enough to say that the allegations survive the accusation that 19 the law is being applied outside of Illinois.” See 238 F. Supp. 3d at 1102. 20 Microsoft attempts to distinguish those previous cases by arguing that they involve 21 plaintiffs who “uploaded a photo directly to the defendant’s systems ,” whereas Plaintiffs 22 did not upload anything directly to Microsoft’s systems. (MTD at 8 (bolding and italics ORDER - 8 Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 9 of 24 1 removed).) This argument is unavailing for two reasons. First, Microsoft’s distinction 2 does not hold true for all cases. In IBM—a suit brought by Plaintiffs against IBM for its 3 part in this chain—the court found dismissal premature even though Plaintiffs did not 4 upload anything directly to IBM’s systems. See 2020 WL 5530134, at *3; see also 5 Monroy, 2017 WL 4099846, at *1-2, 6 (identifying plaintiff as non-Illinois resident who 6 “does not use Shutterfly”). The fact that Plaintiffs did not access any IBM products had 7 no impact on how “discovery is needed in order to determine to what extent IBM’s 8 alleged acts occurred in Illinois.” IBM, 2020 WL 5530134, at *3. Second, direct upload 9 is not the only way to establish that an alleged violation occurred in Illinois, and 10 Microsoft points to no authority saying so. (See MTD.) Thus, while Microsoft is correct 11 that Plaintiffs’ connection with Microsoft—and in turn, the connection between the 12 alleged misconduct and Illinois—is not through direct use of its products, that does not 13 defeat the need for more information that may bear on this fact -laden analysis. 14 The authority Microsoft relies upon are easily distinguishable. In Neals v. PAR 15 Tech. Corp., 419 F. Supp. 3d 1088 (N.D. Ill. 2019), the plaintiff did not allege that her 16 biometric information was collected in Illinois, and thus, the court could not reason ably 17 infer any connection with Illinois. 3 Id. at 1091. Plaintiffs here have explicitly pleaded 18 their connection with Illinois. (Compl. ¶¶ 6-7, 60-61, 69.) Similarly, in Tarzian v. Kraft 19 // 20 21 22 3 Like Microsoft, the defendant in Neals was a non-resident corporation with no allegations that it had property or stored data in Illinois. 419 F. Supp. 3d at 1091. The court made clear that the defendant’s “physical location and property holdings, the location of its servers, and the identity of its customers [who used its technology to collect biometric information] are not determinative of [BIPA’s] application.” Id. ORDER - 9 Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 10 of 24 1 Heinz Foods Co., No. 18 C 7148, 2019 WL 5064732 (N.D. Ill. Oct. 9, 2019), the court 2 dismissed consumer fraud claims brought by non-resident plaintiffs when the only 3 connection to Illinois was that the deception scheme allegedly originated there. Id. at *3. 4 Notably, the same claims brought by resident plaintiffs survived. See id. Plaintiffs here 5 have pleaded many more allegations than the non-residents in Tarzian, including their 6 own residency and Illinois as the place of harm. (Compl. ¶¶ 60-62, 68-70, 77.) 7 In sum, more discovery is needed to explore whether and to what extent 8 Microsoft’s alleged acts involving the Diversity in Faces dataset occurred in Illinois. For 9 now, Plaintiffs’ allegations are sufficient to withstand dismissal. 10 2. Dormant Commerce Clause 11 Building on its extraterritoriality argument, Microsoft next argues that applying 12 BIPA as Plaintiffs allege here would violate the Dormant Commerce Clause. (MTD at 13 9-15.) Specifically, because Microsoft maintains that it has not “engaged in any relevant 14 conduct in Illinois,” it contends that Plaintiffs’ BIPA claims would allow Illinois law to 15 control transactions outside its boundaries. (Id. at 10 (bolding and italics removed).) 16 The Commerce Clause has “long been understood to have a ‘negative’ aspect that 17 denies the States the power unjustifiably to discriminate against or burden the interstate 18 flow of articles of commerce,” known as the Dormant Commerce Clause. Or. Waste 19 Sys., Inc. v. Dep’t of Env’t Quality of State of Or., 511 U.S. 93, 98 (1994); Daniels 20 Sharpsmart, Inc. v. Smith, 889 F.3d 608, 614 (9th Cir. 2018). A state statute runs afoul of 21 the Dormant Commerce Clause if it “directly regulate[s]” interstate commerce by 22 “affect[ing] transactions that take place across state lines or entirel y outside the state’s ORDER - 10 Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 11 of 24 1 borders.” Daniels Sharpsmart, 889 F.3d at 614. Thus, the Dormant Commerce Clause 2 prohibits “the application of a state statute to commerce that takes place wholly outside of 3 the State’s borders, whether or not the commerce has effects within the State.” Healy v. 4 Beer Inst., 491 U.S. 324, 336 (1989). 5 As many courts have observed, the Dormant Commerce Clause argument is 6 directly related to the extraterritoriality effect argument, as both hinge on where the 7 alleged misconduct takes place. See In re Facebook, 2018 WL 2197546, at *4. Thus, 8 unsurprisingly, most courts in this context have found that the Dormant Commerce 9 Clause argument is “more properly addressed on a motion for summary judgment.” See, 10 e.g., IBM, 2020 WL 5530134, at *4. In IBM, the court concluded that it “need[s] more 11 detailed facts regarding IBM’s processes to know the extent to which IBM’s actions 12 occurred in Illinois and whether the Dormant Commerce Clause bars this suit.” Id.; see 13 also Rivera, 238 F. Supp. 3d at 1104 (“Whether the [BIPA] is nevertheless being 14 summoned here to control commercial conduct wholly outside Illinois is not possible to 15 figure out without a better factual understanding of what is happening in the Google 16 Photos face-scan process.”); Monroy, 2017 WL 4099846, at *8 (stating that “important 17 information is lacking regarding how Shutterfly’s technology works”). 18 Again, the court agrees with those that have previously considered the issue. At 19 this point, the court needs more information about the technology behind how Microsoft 20 obtained, stores, or uses the Diversity in Faces dataset to conclude that applying BIPA 21 would run afoul of the Dormant Commerce Clause. Nor does the court have an adequate 22 basis for determining whether applying BIPA here would, as Microsoft argues, displ ace ORDER - 11 Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 12 of 24 1 the policies of other states. (See MTD at 12-15.) As discussed above, the fact that 2 Plaintiffs did not directly interact with Microsoft’s systems does not affect the need for 3 more detailed facts about Microsoft’s processes. See IBM, 2020 WL 5530134 at *3-4. 4 Accordingly, the court denies Microsoft’s motion to dismiss on applicability grounds. 5 3. Failure to State a Claim 6 Finally, Microsoft contends that Plaintiffs fail to state a claim for three reasons. 7 (MTD at 16-22.) Microsoft first maintains that BIPA does not apply to photographs, and 8 thus, Plaintiffs cannot bring a claim under either §§ 15(b) or 15(c) for facial scans derived 9 from their photographs. (Id. at 16-19.) Alternatively, Microsoft argues that § 15(b) only 10 applies to “entities who actively ‘collect’” biometric data and that § 15(c) only applies to 11 “the direct provision of biometric data in exchange for money” —neither of which are 12 alleged here. (Id. at 19-22.) The court disagrees and reviews each contention in turn. 13 14 a. BIPA’s Applicability to Photographs BIPA prohibits private entities from gathering or using “biometric identifier[s]” or 15 “biometric information” without notice and consent. 740 ILCS 14/15. A “[b]iometric 16 identifier” is “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face 17 geometry.” 740 ILCS 14/10. Biometric identifiers “do not include writing samples, 18 written signatures, photographs, human biological samples used for valid scientific 19 testing or screening, demographic data, tattoo descriptions, or physical descriptions such 20 as height, weight, hair color, or eye color.” Id. “Biometric information” means “any 21 information . . . based on an individual’s biometric identifier used to identify an 22 individual” but “does not include information derived from items . . . excluded under the ORDER - 12 Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 13 of 24 1 definition of biometric identifiers.” Id. Microsoft reasons that because photographs are 2 not “biometric identifiers,” and “biometric information” does not include information 3 derived from photographs, Plaintiffs’ facial scans created from their photographs do not 4 qualify as either biometric identifiers or biometric information. (MTD at 16.) The court 5 disagrees and holds that the facial scans are “biometric identifiers” under BIPA. 6 This is not the first—or second, or third, or even fourth—time that defendants 7 have challenged BIPA’s applicability to facial scans derived from photographs. Every 8 court has rejected Microsoft’s argument. 4 See, e.g., Monroy, 2017 WL 4099846, at *3 9 (calling defendant’s reading “sensible enough at first blush” but concluding “it begins to 10 unravel under scrutiny”). The reason lies in the statute’s plain language, where the 11 statutory interpretation analysis must begin. See Lacey v. Village of Palatine, 904 N.E.2d 12 18, 25 (Ill. 2009). The court gives the language its plain and ordinary meaning. Hadley 13 v. Ill. Dep’t of Corrections, 864 N.E.2d 162, 165 (Ill. 2007). When the language is clear, 14 it will be given effect without resort to other aids of construction. Id. The court may not 15 “under the guise of construction, supply omissions, remedy defects, annex new 16 provisions, substitute different provisions, and exceptions, limitations or conditions, or 17 otherwise change law so as to depart from the language employed in the statute.” DeWig 18 v. Landshire, Inc., 666 N.E.2d 1204, 1207 (Ill. App. Ct. 1996). 19 20 21 22 4 Recognizing the weight of authority against it, Microsoft maintains that all those cases were wrongly decided. (MTD at 17-18.) For instance, Microsoft states that Rivera did not “properly account for BIPA Section 5,” which lists only in-person transactions as examples that are regulated. (Id. at 18.) Not so. See Rivera, 238 F.3d at 1098 (analyzing Section 5 and its list of example transactions). Microsoft has not offered persuasive arguments that Rivera and other cases were wrongly decided. ORDER - 13 Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 14 of 24 1 Here, the “comprehensive set of annotations of intrinsic facial features” (Compl. 2 ¶ 41) is one of the biometric identifiers listed in BIPA’s plain text: a “scan of . . . face 3 geometry,” 740 ILCS 14/10; see, e.g., Rivera, 238 F. Supp. 3d at 1095 (“[E]ach face 4 template . . . [features] a set of biology-based measurements (‘biometric’) that is used to 5 identify a person (‘identifier’).”). Plaintiffs “do not claim that simply possessing a 6 photograph of a face violates BIPA,” and thus the exclusion of photographs as biometric 7 identifiers has little bearing. (See Resp. at 15 n.4.) And while these facial scans may not 8 qualify as biometric information—because they are “derived from items . . . excluded 9 under the definition of biometric identifiers,” namely, photographs—there is no textual 10 support for the contention that these scans could not be biometric identifiers themselves. 11 See 740 ILCS 14/10; In re Facebook, 185 F. Supp. 3d at 1171 (finding “digital 12 representation of the face . . . based on geometric relationship of their facial features” to 13 be a “scan of face geometry”). 14 At base, Microsoft takes issue with how these scans are captured. It argues that 15 only scans taken in-person, not from photographs, are biometric identifiers. (See MTD at 16 18.) Put another way, Microsoft wishes to apply the same limitation that is placed on 17 biometric information to biometric identifiers. See 740 ILCS 14/10. But the Illinois 18 legislature chose not to use terms such as “derived from” when defining biometric 19 identifier. See Rivera, 238 F. Supp. 3d at 1097 (“It would have been simple enough for 20 the Illinois legislature to include similar ‘based on’ or ‘derived from’ language in the 21 definition of ‘biometric identifier’ but it did not.” ); see also Dana Tank Container, Inc. v. 22 Hum. Rts. Comm’n, 687 N.E.2d 102, 104 (Ill. App. Ct. 1997) (“Where the legislature ORDER - 14 Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 15 of 24 1 uses certain words in one instance and different words in another, it intended different 2 results.”). “The bottom line is that a ‘biometric identifier’ is not the underlying medium 3 itself, or a way of taking measurements, but instead is a set of measurement s of a 4 specified physical component . . . used to identify a person.” Rivera, 238 F. Supp. 3d at 5 1097. The facial scans here fall squarely within that definition. 5 Accordingly, the court 6 denies Microsoft’s motion to dismiss the BIPA claims on this ground. 7 b. Obtaining Biometric Data Under § 15(b) 8 Microsoft argues next that § 15(b) of BIPA is only triggered by those who 9 “actively ‘collect’” biometric data, whereas it “merely ‘possess[es]’” the data. (MTD at 10 19-21.) Plaintiffs respond that the complaint contains sufficient allegations to establish 11 how Microsoft obtained and used their biometric data, contending that Microsoft “could 12 not have used the [data] unless it first collected or obtained it.” (Resp. at 18.) The court 13 agrees with Plaintiffs. 14 Again, the analysis begins, and ends, with BIPA’s plain language. The protections 15 under § 15(b) are triggered whenever a private entity “collect[s], capture[s], purchase[s], 16 receive[s] through trade, or otherwise obtain[s]” biometric data. 740 ILCS 14/15(b). The 17 catch-all phrase “otherwise obtain” is not defined by BIPA. See 740 ILCS 14/10. Where 18 a term is undefined, “[i]t is entirely appropriate to employ the dictionary as a resource to 19 ascertain [its] meaning.” Lacey, 904 N.E.2d at 26. “Obtain” is defined as “[t]o come into 20 21 22 Because the text is “plain and unambiguous,” the court need not consider Microsoft’s legislative history arguments. See Ultsch v. Ill. Mun. Ret. Fund, 874 N.E.2d 1, 10 (Ill. 2007). Even if the court considered them, it finds persuasive the Rivera court’s analysis and ultimate rejection of similar arguments. See 238 F. Supp. 3d at 1098-100. 5 ORDER - 15 Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 16 of 24 1 the possession of,” or “to get, acquire, or secure.” Obtain, Oxford English Dictionary, 2 https://www.oed.com/view/Entry/130002 (last visited Mar. 9, 2021). “Otherwise” means 3 “[i]n a different manner; in another way, or in other ways.” Black’s Law Dictionary 4 1101 (6th ed. 1990); see also Otherwise, Oxford English Dictionary, 5 https://www.oed.com/view/Entry/133247 (last visited Mar. 9, 2021). Accordingly, in 6 context, § 15(b) is triggered whenever a private entity acquires biometric data in the 7 enumerated ways—collecting, capturing, purchasing, receiving through trade —or gets 8 the biometric data in some other way. 9 Plaintiffs have sufficiently alleged that Microsoft got its biometric data in some 10 other way—namely by applying for and downloading the data set from IBM. ( See 11 Compl. ¶¶ 55-57.) Moreover, Plaintiffs allege that Microsoft used the biometric data to 12 “improve its facial recognition products and technologies.” ( Id. ¶¶ 57-58.) Contrary to 13 Microsoft’s contentions, these allegations establish more than “passive ‘possession .’” 14 (See MTD at 20.) Indeed, Microsoft does not explain how it could have come into 15 possession of or used Plaintiffs’ facial scans without having first obtained it. See 16 Figueroa v. Kronos Inc., 454 F. Supp. 3d 772, 784 (N.D. Ill. 2020) (“[T]o have [stored or 17 used] the data, [the defendant] necessarily first had to ‘obtain’ the data.”). Thus, it makes 18 no difference that § 15(b) does not contain the word “possession” whereas the other 19 provisions do, because even accepting Microsoft’s argument that “only actions trigger 20 [§] 15(b),” Plaintiffs have sufficiently alleged such actions.6 (See MTD at 20.) 21 Obtaining biometric data via a download could also qualify as “collecting” that data. See Collect, Oxford English Dictionary, https://www.oed.com/view/Entry/36263 (last visited 6 22 ORDER - 16 Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 17 of 24 Nor will the court adopt Microsoft’s proposal that § 15(b) only applies when an 1 2 entity acquires biometric data “directly from any individual.” (See MTD at 20.) Nothing 3 in the statute’s language supports such a narrow application. For instance, the word 4 “collect” carries no inherent limitation on who or where the information is collected 5 from. See Collect, Oxford English Dictionary, https://www.oed.com/view/Entry/36263 6 (last visited Mar. 9, 2021) (defining “collect” simply as “to gather”). Section 15(b) does 7 not add any limitation either, stating only that the protections are triggered when an entity 8 collects biometric data, regardless of how that collection occurs. See 740 ILCS § 15(b). 9 The same is true of the other methods of attainment in the provision. In essence, 10 Microsoft wishes the court to read the limitation “directly from the person” into § 15(b) 11 where none exists. The court cannot do so. See DeWig, 666 N.E.2d at 1207. 12 This straightforward reading of the text does not, as Microsoft fears, produce an 13 absurd result. (See MTD at 20-21.) BIPA obligates any private entity that obtains a 14 person’s biometric identifier to comply with certain requirements to protect th at person’s 15 privacy interests. See 740 ILCS 14/5 (recognizing public’s wariness of use of biometrics 16 and need for regulation for public welfare, security and safety). Whether that biometric 17 information comes from an individual or is part of a large datas et, there is nothing absurd 18 about requiring any entity that obtains such information to comply with the safeguards 19 // 20 // 21 Mar. 9, 2021) (defining “collect” as “to gather together”). Because the court finds that Microsoft’s actions qualify under “otherwise obtain,” it need not determine whether these actions could also fall with the meaning of the enumerated terms. 22 ORDER - 17 Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 18 of 24 1 that the Illinois legislature deemed necessary. 7 See Neals, 419 F. Supp. 3d at 1092; 740 2 ILCS 14/5(g). Although complying with BIPA requires entities like Microsoft to take 3 additional steps before acquiring biometric data, the court does not believe that “under 4 Plaintiffs’ reading of the statute, no entity could safely download any large biometric 5 dataset.” (See MTD at 21 (bolding and italics removed).) 6 Microsoft relies solely on cases in the employment context (see id. at 20), and the 7 court acknowledges that there is a “split on . . . whether BIPA governs outside vendors” 8 who provide biometric timekeeping systems to employers, see Figueroa, 454 F. Supp. 3d 9 at 783-84. Analogizing itself to these third-party vendors, Microsoft argues that it also 10 has no relationship with those whose facial scans are in the dataset. The court is 11 unpersuaded. As a preliminary matter, the court observes that most of these cases focus 12 on, as expected, circumstances specific to employment and do not purport to extend 13 beyond that context.8 See Cameron v. Polar Tech. Indus., Inc. & ADP, LLC, No. 14 2019-CH-000013 (Ill. Cir. Ct. Aug. 23, 2019) at 33:22-34:3.9 But more importantly, 15 these cases concern complaints that do not sufficiently plead the role of the third -party, 16 thus warranting dismissal. In Namuwonge v. Kronos, Inc., the plaintiff alleged that only 17 // 18 19 20 7 Indeed, it stands to reason that if the Illinois legislature were concerned about individual collection of biometric data that could compromise identity—which Microsoft seems to have no qualms with (see MTD at 20-21)—the legislature would be equally, if not more concerned about that data being shared in large swaths accessible through download. 8 21 BIPA may very well treat the use of biometric data in employment differently, as the statute defines “written release” differently in the employment context. See 740 ILCS 14/10. 22 Microsoft attaches the transcript of the Cameron court’s oral ruling as an exhibit to its motion to dismiss. (See MTD, Ex. E.) 9 ORDER - 18 Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 19 of 24 1 the employer, not the third-party vendor, obtained her fingerprints. 418 F. Supp. 3d 279, 2 286 (N.D. Ill. 2019). Similarly, in Bernal v. ADP, LLC, No. 2017-CH-12364 (Ill. Cir. Ct. 3 Aug. 23, 2019), the decision “ultimately turn[ed] on the insufficiency of [the] [p]laintiff’s 4 complaint” because he alleged only that the third-party vendor supplied the biometric 5 technology. Id. at 3. The same is not true here. To the extent that dicta in these cases 6 require some relationship to exist, the court declines to adopt that interpretation, as that 7 requirement does not appear in the statutory language , and persuasive authority exists to 8 the contrary. See, e.g., Flores v. Motorola Solutions, Inc., No. 1:20-cv-01128, 2021 WL 9 232627, at *3 (N.D. Ill. Jan. 8, 2021); Monroy, 2017 WL 4099846, at *1. 10 In sum, § 15(b) applies when a private entity collects, captures, purchases, trades 11 for, or gets biometric data in some other way. Plaintiffs allege that Microsoft got the 12 biometric data in some other way by applying for and downloading it from IBM and then 13 used that data to improve its own products. (Compl. ¶¶ 48-49, 55-58.) Such allegations 14 suffice to trigger § 15(b). 15 c. 16 Profit Under § 15(c) Lastly, Microsoft contends that § 15(c) of BIPA does not apply be cause Plaintiffs 17 have not alleged that it has exchanged biometric data for a pecuniary benefit. (MTD at 18 21-22.) Section 15(c) states that no private entity may “sell, lease, trade, or otherwise 19 profit from” the biometric data in its possession. 740 ILCS 14/15(c). Microsoft argues 20 that sell, lease, trade, and profit “all contemplate the direct provision of biometric data in 21 exchange for money,” which doesn’t reach the “indirect ‘profit’” of improving its facial 22 // ORDER - 19 Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 20 of 24 1 recognition products. (MTD at 22.) The court determines that supplemental briefing is 2 needed and thus defers ruling on the issue. The question of what “otherwise profit from” means in § 15(c) is a novel issue. 3 4 However, neither party spends more than a page briefing the issue, nor do they offer any 5 authority analyzing this provision. 10 (See MTD at 21-22; Resp. at 22-23; Reply at 6 10-11.) The parties focus instead on the doctrine of ejusdem generis and whether it 7 applies to verbs. (See MTD at 22; Resp. at 22; Reply at 11.) The court additionally 8 recognizes that the parties’ briefing was completed in the fall of 2020, and there is the 9 possibility that more recent case law has analyzed this issue since that time. Thus, the 10 court finds additional briefing would be beneficial and defers ruling on this issue. The 11 court directs the parties to file responses to this order addressing t he definition of 12 “otherwise profit from” in the context of § 15(c), including an analysis of any recent case 13 law that bears on the issue. The parties’ responses for this issue and the choice-of-law 14 issue, see infra § III.B, shall total no more than 15 pages and be filed by Friday, March 15 26, 2021, at 5:00 p.m. There shall be no replies unless otherwise ordered by the court. 16 B. Unjust Enrichment Claim 17 Microsoft next challenges Plaintiffs’ unjust enrichment claim as insufficiently 18 pleaded under Washington law. (MTD at 22-24.) Plaintiffs respond that the claim is 19 // 20 21 22 10 The court acknowledges that Plaintiffs filed a Notice of Supplemental Authority identifying a recent case that may bear on this analysis. (See Not. of Supp. Authority (Dkt. # 35).) However, neither party has had a chance to meaningfully apply the identified case to the allegations here. ORDER - 20 Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 21 of 24 1 sufficiently pleaded under Illinois law. (Resp. at 23-24.) Thus, the court must resolve a 2 choice-of-law question before determining whether the unjust enrichment claim survive s. 3 A federal court sitting in diversity applies the choice -of-law rules of its forum state 4 to determine which substantive law controls. Kohlrautz v. Oilmen Participation Corp., 5 441 F.3d 827, 833 (9th Cir. 2006). Washington employs a two-step approach. Kelley v. 6 Microsoft Corp., 251 F.R.D. 544, 550 (W.D. Wash. 2008). First, the court must 7 determine whether “an actual conflict between Washington and the other applicable state 8 law exists.” Id. (citing Burnside v. Simpson Paper Co., 864 P.2d 937, 942 (1994)). If 9 there is an actual conflict, then the court must determine which state has the “most 10 significant relationship” to the action. Id. (citing Johnson v. Spider Staging Corp., 555 11 P.2d 997, 1000 (Wash. 1976)). 12 An actual conflict between Washington and Illinois law exists over whether 13 Plaintiffs must plead that they suffered an economic expense distinct from a privacy 14 harm. An actual conflict exists when the two laws “could produc e different outcomes on 15 the same legal issue.” Id. at 550. In Washington, alleging a non-economic loss, such as a 16 loss of privacy, is insufficient because “Washington courts have not applied the doctrine 17 of unjust enrichment outside the context of an ‘exp ense’ stemming from some tangible 18 economic loss to a plaintiff.” Cousineau v. Microsoft Corp., 992 F. Supp. 2d 1116, 1130 19 (W.D. Wash. 2012). Plaintiffs make no argument why Cousineau is not controlling law 20 in Washington. (See Resp. at 23-24.) In Illinois, however, the assertion that plaintiffs are 21 “exposed to a heightened risk of privacy harm” and “have been deprived of their control 22 // ORDER - 21 Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 22 of 24 1 over their biometric data” sufficiently states an unjust enrichment claim. Vance, 2020 2 WL 5530134, at *5. Microsoft does not argue otherwise. (See MTD at 22-24; Reply at 3 12.) Because the two laws would produce different outcomes on this legal issue, the 4 court determines that there is an actual conflict between Washington and Illinois law. 5 Because there is an actual conflict, the court must apply Washington’s “most 6 significant relationship” test to determine which law governs. Coe v. Philips Oral 7 Healthcare Inc., No. C13-0518MJP, 2014 WL 5162912, at *3 (W.D. Wash. Oct. 14, 8 2014). First, the court considers the states’ relevant contacts to the cause of action, and if 9 those contacts are balanced, the court must then consider “the interests and public 10 policies of [the two] states and . . . the manner and extent of such policies as they relate to 11 the transaction in issue.” Johnson, 555 P.2d at 1001. This analysis can be complex, 12 involving an identification of the relevant contacts, assigning significance to those 13 contacts, and weighing those contacts. See Kelley, 251 F.R.D. at 551-53; Coe, 2014 WL 14 5162912, at *3-4; Restatement (Second) of Law on Conflict of Laws §§ 145-55. 15 Moreover, some of the traditionally relevant contacts, such as where the injury and 16 misconduct occurred, may concern facts that the court currently lacks. See supra 17 § III.A.1-2. Despite the intricacies of this analysis, neither party meaningfully addresses 18 the issue, nor do they offer analogous case law. (See MTD; Resp; Reply.) 19 The court concludes that further briefing from the parties on this issue would be 20 beneficial. Accordingly, the court defers ruling on Microsoft’s motion to dismiss 21 Plaintiffs’ unjust enrichment claim. The court further directs the parties to file responses 22 to this order on the question of which state law should govern under Washington’s “most ORDER - 22 Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 23 of 24 1 significant relationship” test. In particular, the parties should touch on how the contacts 2 analysis differs, if at all, for an unjust enrichment claim in a privacy suit and address 3 whether further factual development is needed to analyze the states’ relevant contac ts. 4 The parties’ responses addressing the choice-of-law issue and the aforementioned § 15(c) 5 issue, see supra § III.A.3.c, shall total no more than 15 pages and be filed by Friday, 6 March 26, 2021, at 5:00 p.m. There shall be no replies unless otherwise ordered . 7 C. Injunctive Relief Lastly, Microsoft asserts that Plaintiffs’ count for injunctive relief must be 8 9 dismissed. (MTD at 24.) The court agrees that “[i]njunctive relief is a remedy, not a 10 cause of action.” Edifecs Inc. v. TIBCO Software Inc., No. C10-0330RSM, 2011 WL 11 1045645, at *3 (W.D. Wash. 2011). Plaintiffs do not argue otherwise. (See Resp.) 12 Accordingly, the court dismisses Plaintiffs’ standalone injunctive relief claim, but 13 Plaintiffs may pursue injunctive relief in connection with its other claims. 14 // 15 // 16 // 17 // 18 // 19 // 20 // 21 // 22 // ORDER - 23 Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 24 of 24 IV. 1 CONCLUSION 2 For the foregoing reasons, the court GRANTS in part and DENIES in part 3 Microsoft’s motion to dismiss (Dkt. # 25). Specifically, the court GRANTS the motion 4 to dismiss Plaintiffs’ injunctive relief claim but DENIES the motion as it applies to 5 Plaintiffs’ BIPA § 15(b) claim. The court DEFERS ruling on Plaintiffs’ BIPA § 15(c) 6 and unjust enrichment claims and further DIRECTS the parties to file responses on those 7 two issues as identified above. These responses shall not exceed 15 pages and must be 8 filed by Friday, March 26, 2021, at 5:00 p.m. 9 Dated this 15th day of March, 2021. 10 11 A 12 JAMES L. ROBART United States District Judge 13 14 15 16 17 18 19 20 21 22 ORDER - 24
]]>
Some case metadata and case summaries were written with the help of AI, which can produce inaccuracies. You
should read the full case before relying on it for legal research purposes.
This site is protected by reCAPTCHA and the Google
Privacy Policy and
Terms of Service apply.
