Gorgas v. Amazon.Com, Inc.

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION BENITA GORGAS and NELSON ) GORGAS, individually and on behalf of ) similarly situated individuals, ) ) Plaintiffs, ) ) v. ) No. 22 CV 5159 ) AMAZON.COM, INC., Judge John J. Tharp, Jr. ) AMAZON.COM SERVICES, LLC f/k/a ) AMAZON.COM, LLC, and AMAZON ) WEB SERVICES, INC., ) ) Defendants.

ORDER The plaintiffs’ motion to remand [28] is granted. The plaintiffs’ claims brought pursuant to 740 ILCS 14/15(c) are remanded to the Circuit Court of Cook County, Illinois. Benita Gorgas and Nelson Gorgas (“the Gorgases”), who worked as employees of the defendants (collectively, “Amazon”), brought this putative class action in the Circuit Court of Cook County, Illinois, alleging that Amazon used cameras to collect their facial geometry scans and thereafter stored, used, disclosed, and profited off the scans in violation of Sections 15(a)-(d) of the Illinois Biometric Information Privacy Act, 740 ILCS 14/1, et seq. (BIPA). Compl., ECF No. 1-1, Exh. A. After Amazon removed the case to this Court, the Gorgases moved to remand their Section 15(c) claims, arguing that they have not alleged a concrete and particularized injury supporting Article III standing. The Court agrees and grants the remand motion.

Federal courts may resolve only “cases” or “controversies.” U.S. Const. art. III, § 2, cl. 1. Standing doctrine “limits the category of litigants empowered to maintain a lawsuit in federal court” so as to “ensure that federal courts do not exceed their authority” under Article III. Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (citations omitted). Article III standing requires: (1) that a plaintiff suffered an actual or imminent, concrete and particularized injury-in-fact; (2) a causal connection between the injury and the conduct complained of; and (3) a likelihood that the injury can be redressed by a favorable decision. Thole v. U. S. Bank N.A, 140 S. Ct. 1615, 1618 (2020). “Article III standing requires a concrete injury even in the context of a statutory violation” and “a bare procedural violation, divorced from any concrete harm,” does not “satisfy the injury-in-fact requirement[.]” Spokeo, 578 U.S. at 341. A “particularized” injury is one that “affect[s] the plaintiff in a personal and individual way.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 n.1 (1992); see DaimlerChrysler Corp. v. Cuno, 547 U.S. 332, 342-44 (2006) (generalized grievance shared by all members of the public will not suffice). As the party invoking federal jurisdiction, Amazon bears the burden of establishing the Gorgases’ Article III standing. Collier v. SP Plus Corp., 889 F.3d 894, 896 (7th Cir. 2018). The Court “must resolve any doubts about jurisdiction in favor of remand.” Colon v. Dynacast, LLC, No. 20-CV-3317, 2021 WL 492870, at *5 (N.D. Ill. Feb. 10, 2021); see also Schur v. L.A. Weight Loss Centers, Inc., 577 F.3d 752, 758 (7th Cir. 2009). Importantly, though separate plaintiffs may bring claims involving similar statutory violations, “allegations matter. One plaintiff may fail to allege a particularized harm to himself, while another may assert one.” Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1246 (7th Cir. 2021).

Section 15(c) of BIPA states that “[n]o private entity in possession of a biometric identifier or biometric information may sell, lease, trade, or otherwise profit from a person’s or a customer’s biometric identifier or biometric information.” 740 ILCS 14/15(c). “Section 15(c) establishes a general regulatory rule, imposing on defendants a duty owed to the public at large ‘prohibit[ing] the operation of a market in biometric identifiers and information.’” Kashkeesh v. Microsoft Corp., No. 21 C 3229, 2022 WL 2340876, at *3 (N.D. Ill. June 29, 2022) (quoting Thornley, 984 F.3d at 1247). In Thornley, the plaintiff expressly disavowed any concrete injury by bringing her BIPA claims on behalf of a class whose members “suffered no injury from Defendant’s violation of Section 15(c) of BIPA other than statutory aggrievement . . .” 984 F.3d at 1246. The Seventh Circuit affirmed the district court’s remand of the Section 15(c) claim because the plaintiffs “described only a general, regulatory violation, not something that is particularized to them and concrete.” Id. at 1248. The court noted in dicta, however, that a Section 15(c) claim supported by different allegations might establish standing to remain in federal court. For example, a plaintiff might establish Article III standing by asserting: (1) “that by selling her data, the collector has deprived her of the opportunity to profit from her biometric information”; (2) “that the act of selling her data amplified the invasion of her privacy that occurred when the data was first collected, by disseminating it to some unspecified number of other people”; or (3) “that [the defendant] raise[d] the cost” she incurred in using social media sites. Id. at 1247. The question before this Court, therefore, is whether the Gorgases have asserted that they “suffered a particularized injury resulting from the [defendant’s] operation of such a market [in biometric information].” Kashkeesh, 2022 WL 2340876 at *3. The Gorgases contend that their complaint alleges only a statutory violation of Section 15(c), and no actual damages or particularized injury, requiring remand of the Section 15(c) claims. Predictably, Amazon characterizes the allegations differently, arguing that the Gorgases assert a concrete and particularized injury by claiming that Amazon violated their “right to control the collection, use, and storage” of their biometric data. Resp., ECF No. 32 at 1 (quoting Compl. ¶¶ 19, 21, 114). The Court agrees with the Gorgases that their allegations relating to Section 15(c) do not show that they suffered a concrete, particularized injury. The complaint alleges that “Amazon profits . . . by using this biometric data to improve the Rekognition technology that Amazon uses itself and also sells to [various organizations].” Compl. ¶¶ 16, 48 (geometric scans are “used to enhance the Rekognition software”); id. ¶ 114 (“By selling, leasing, trading, or otherwise profiting from Plaintiffs’ and the Class’s biometric identifiers and biometric information . . . Defendants violated Plaintiffs’ and the Class’s rights to privacy in their biometric identifiers or biometric information as set forth in BIPA.”). While these allegations provide some factual detail about how Amazon uses the biometric data to generate a profit—namely, that it uses the data to improve a technology that it sells—nothing in these allegations articulates how the Gorgases have suffered a personal, individual harm resulting from the commercial transaction benefiting Amazon. Further, the Gorgases seek only statutory damages rather than actual damages, bolstering the Court’s finding that the harms alleged here are of a general and not individual nature. Compl. ¶ 115. Other courts in this district have held that similar allegations warrant remand of Section 15(c) claims for failure to allege an injury-in-fact. See, e.g., Kashkeesh, 2022 WL 2340876 at *1 (the defendant allegedly “profited from receiving [biometric] information”); Hogan v. Amazon.com, Inc., No. 21 C 3169, 2022 WL 952763, at *7 (N.D. Ill. Mar. 30, 2022) (alleging that Amazon sells its Rekognition technology, which analyzes biometric identifiers to increase its accuracy, to various organizations); Patterson v. Respondus, Inc., 593 F. Supp. 3d 783, 816 (N.D. Ill. 2022) (alleging that the defendant “profited from their biometric data . . . by marketing the Respondus Monitor product”); Carpenter v. McDonald’s Corp., No. 1:21-CV-02906, 2021 WL 6752295, at *4 (N.D. Ill. Nov. 1, 2021) (allegations were “little, if any, more than a recitation of the general regulatory violation proscribed by Section 15(c).”); King v. PeopleNet Corp., No. 21 CV 2774, 2021 WL 5006692, at *4 (N.D. Ill. Oct. 28, 2021) (the plaintiff’s allegations that the defendant marketed its software and gained a “competitive advantage in the biometric timekeeping marketplace isn’t an injury particular to King”); Hazlitt v. Apple Inc., 543 F. Supp. 3d 643, 647 (S.D. Ill. 2021) (alleging the defendant profited “through marketing and selling its devices based upon claims of photograph sorting technology”). Amazon argues that the Gorgases allege at least two concrete and particularized injuries. First, it characterizes the complaint as alleging that Amazon’s profiting amplified the invasion of the Gorgases’ privacy that occurred when the data was first collected. Thornley, 984 F.3d at 1247 (noting that “a plaintiff could assert that the act of selling her data amplified the invasion of her privacy that occurred when the data was first collected, by disseminating it to some unspecified number of other people.”) (emphasis added). Amazon specifically points to the complaint’s allegation that “[b]y . . . profiting . . . Defendants violated Plaintiffs’ and the Class’s rights to privacy[.]” Compl. ¶ 114. But paragraph 114 does not assert that Amazon profited by further disseminating the Gorgases’ biometric information, thus amplifying their invasion of privacy. Thornley, 984 F.3d at 1247. Rather, the Gorgases allege that Amazon used their biometric data to improve its own technology, and profited by selling that technology; thus, Amazon’s profiting may not have caused any dissemination of the biometric data at all. King, 2021 WL 5006692 at *4 (rejecting the defendant’s amplification of invasion of privacy argument because “that’s not what the complaint says. . . . [The plaintiff] nowhere alleges . . . that the transmission or dissemination of her biometric information amplified the invasion of her privacy.”). Paragraph 114 is therefore more akin to a restatement of the general regulatory violation proscribed by Section 15(c). Second, Amazon contends that the Gorgases allege a concrete injury by asserting that Amazon infringed their “right to control the collection, use, and storage” of their biometric data. Compl. ¶ 19. But that is a general allegation that describes harms resulting from Amazon’s conduct as a whole, as opposed to harm flowing specifically from Amazon’s allegedly illegal profiting. Id. (“As a result of Defendants’ conduct, Plaintiffs . . . lost the right to control the collection, use, and storage of their biometric [data.]”). The only other allegation cited by Amazon is a mere recitation of Section 15(c)’s statutory violation. Id. ¶ 21 (Amazon continues not to “[s]top profiting from the biometric [data]”). The cases cited by Amazon are also inapposite or unpersuasive. It cites Bryant v. Compass Grp. USA, Inc. for the proposition that an allegation of loss of control of biometric data supports Article III standing, but that case did not at all involve Section 15(c). 958 F.3d 617 (7th Cir. 2020). Rather, the court held that the plaintiff’s Section 15(b) claim could proceed in federal court because she alleged that the defendant did not obtain her informed written consent before collecting her fingerprints, and thereby “inflicted the concrete injury BIPA intended to protect against, i.e. a consumer’s loss of the power and ability to make informed decisions about the collection, storage, and use of her biometric information.” Id. at 626-27. Section 15(c) separately prohibits the profiting from biometric information, so Bryant does not support Amazon’s contention that the Gorgases have standing to bring their Section 15(c) claim. Amazon also relies on Warmack-Stillwell v. Christian Dior, Inc., No. 22 C 4633, 2023 WL 1928109, at *5 (N.D. Ill. Feb. 10, 2023) (denying motion to dismiss Section 15(c) claim for lack of standing). In that case, the plaintiff alleged “that defendant profits from the process of collecting, storing, and using consumers’ facial geometry scans because it improves customers’ experiences purchasing eyewear from defendant online.” Id. at 1. The court found that the plaintiff established standing by pleading that the defendant deprived her of the opportunity to profit from her biometric information. The court reasoned: In addition to alleging that defendant violated section 15(c) by using customer biometric data to “improve the customers’ experience on Dior’s website, and increase sales of its [e]yewear,” Complaint ¶ 87; see also id. ¶¶ 88, 131–36, plaintiff alleges that she and the other class members “have been injured by Dior’s conduct” including through “the unknowing loss of control of their most unique biometric identifiers” and “violation of their rights in and ownership of their unique biometric identifiers and biometric information through Dior’s profiting from the same.” Id. ¶ 137. In other words, by using her biometric data for its own profit, defendant impacted plaintiff’s ownership over and ability to control that data for her own purposes. That type of allegation is lacking from cases like Thornley in which courts found plaintiffs lacked standing to bring a section 15(c) claim. Id. at 2-3 (“Drawing all reasonable inferences in plaintiff’s favor, the allegation in paragraph 137 of the complaint makes it plausible that defendant’s use of plaintiff’s biometric information for profit ‘deprived her of the opportunity to profit from her biometric information.’”) (quoting Thornley). This Court does not read the present complaint as alleging that the commercial transactions allegedly undertaken by Amazon deprived the Gorgases of the opportunity to profit from their biometric data. Unlike the plaintiff in Warmack-Stillwell, the Gorgases allege that they lost only “the right to control the collection, use, and storage” of their biometric data (Compl. ¶ 19)—not the “opportunity to profit” from it. Thornley, 984 F.3d at 1247. Put another way, the Gorgases do not allege that Amazon’s violations of Section 15(c) caused them a loss of control of their biometric data. Nor do they allege, for example, that Amazon’s profiting has prevented them from successfully selling their own biometric data. Instead, they merely allege that Amazon used their biometric data to improve its own technology, which it sells, and thereby “violated [their] . . . rights to privacy.” Compl. § 114. Finally, Amazon attempts to distinguish Thornley on the grounds that the plaintiffs there explicitly disavowed any injury beyond the statutory violation. But as other courts have repeated after Thornley, the Seventh Circuit “did not find express disavowal of individual harm to be a requirement [for a court to find that a plaintiff lacks standing.]” Hazlitt, 543 F. Supp. 3d at 652. Because the Gorgases have not alleged a personal, concrete, or particularized harm flowing from Amazon’s profiting off their biometric data, the Court holds that they lack Article III standing to bring their Section 15(c) claim in this Court. If a district court lacks subject matter jurisdiction over a removed claim, the only remedy is remand of the claim to state court, absent the application of supplemental jurisdiction. 28 U.S.C. § 1447(c); Bergquist v. Mann Bracken, LLP, 592 F.3d 816, 819 (7th Cir. 2010); Colon, 2021 WL 492870 at *1 (severing Section 15(a) claim, remanding it to state court, and retaining jurisdiction over the plaintiff's remaining BIPA claims). Accordingly, the Section 15(c) claims are severed from the rest of the suit and remanded to state court. See Kashkeesh, 2022 WL 2340876 at *4.

Dated: June 23, 2023 John J. Tharp, Jr. United States District Judge