IN THE UNITED STATES DISTRICT COURT FOR THE SOUTHERN DISTRICT OF ILLINOIS
ROSLYN HAZLITT, JANE DOE, by and through Next Friend JOHN DOE, RICHARD ROBINSON, and YOLANDA BROWN, on behalf of themselves and all other similarly situated,
Plaintiffs,
v. Case No. 3:20-CV-421-NJR
APPLE INC.,
Defendant.
MEMORANDUM AND ORDER
ROSENSTENGEL, Chief Judge: On March 2, 2020, Plaintiffs Roslyn Hazlitt, Jane Doe, a minor, by and through Next Friend John Doe, Richard Robinson, and Yolanda Brown (“Plaintiffs”) filed a putative Class Action Complaint against Defendant Apple Inc. (“Apple”) in the Circuit Court for the Twentieth Judicial Circuit in St. Clair County, Illinois. (Doc. 1-1). Plaintiffs allege Apple violated sections 14/15(a)-(c) of Illinois’s Biometric Information Privacy Act (BIPA), 740 ILL. COMP. STAT. § 14/1 et seq., by collecting, possessing, and profiting from Plaintiffs’ facial geometries through the use of its Photos app. (Id. at ¶¶ 1, 3). Apple subsequently removed the action to this Court under the Class Action Fairness Act of 2005 and filed a motion to dismiss for lack of standing and for failure to state a claim. (Docs. 1, 19). The Court initially granted the motion to dismiss in part for lack of Article III standing and remanded two of Plaintiffs’ three claims to the Twentieth Judicial Circuit, St. Clair County, Illinois. (Doc. 26). Apple then filed a motion for reconsideration (Doc. 29),1 while contemporaneously filing a petition for leave to appeal
the remand of Plaintiffs’ BIPA Section 15(c) claim directly with the Seventh Circuit Court of Appeals. The Seventh Circuit subsequently vacated the Court’s remand order and instructed the undersigned to reconsider Plaintiffs’ claims in light of Fox v. Dakkota Integrated Systems, LLC, 980 F.3d 1146 (7th Cir. 2020), and Thornley v. Clearview AI, Inc., 984 F.3d 1241 (7th Cir. 2021). See Apple Inc. v. Hazlitt, No. 20-8033 (7th Cir.). Having done so, the Court finds that Plaintiffs have Article III standing to bring
their claims in Counts I and II under BIPA sections 15(a) and 15(b).2 Furthermore, those claims survive Apple’s motion to dismiss for failure to state a claim. Plaintiffs do not have Article III standing to bring their claim in Count III under BIPA section 15(c), however, so that claim will be remanded to state court. BACKGROUND
A. The Illinois Biometric Information Privacy Act In 2008, Illinois passed BIPA due to concerns with emerging technology and the increasing collection and use of biometrics in the business and security screening sectors. The Illinois legislature recognized that unlike other personal identifiers, like social security numbers, biometrics are biologically unique to each individual and cannot be
altered or changed once compromised. If this data is compromised, due to the sensitive
1 In light of the current procedural posture of the case, the motion for reconsideration (Doc. 29) is denied as moot. 2 As requested by the parties in their briefing, where appropriate, the Court incorporates its prior analysis and conclusions from its now-vacated order of November 12, 2020. (Doc. 26). That analysis pertains to Plaintiffs’ claims in Count I related to BIPA section 15(b). nature of biometrics, an individual is at heightened risk for identity theft and lacks recourse. See 740 ILL. COMP. STAT. §§ 14/5(a)-(c). The Illinois legislature observed an
overwhelming majority of the public is wary of the use of biometrics when such information is tied to finances and other personal information. While the full ramifications of biometric technology are unknown, BIPA is intended to serve public welfare, security, and safety by regulating the “collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” See 740 ILL. COMP. STAT. §§ 14/5(d)-(g).
BIPA regulates private entities or “any individual, partnership, corporation, limited liability company, association, or other group, however organized.” See 740 ILL. COMP. STAT. §§ 14/10-20. BIPA requires all private entities in possession of biometric identifiers or biometric information to “develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying
biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the private entity.” 740 ILL. COMP. STAT. § 14/15(a). Further, private entities are prohibited from collecting, capturing, purchasing, or receiving through trade, or otherwise obtaining a person’s biometric identifier or
biometric information unless it informs the subject in writing with the specific purpose and length of time disclosed, and receives a written release, i.e., informed written consent. 740 ILL. COMP. STAT. §§ 14/10, 15(b). Moreover, BIPA prohibits private entities from selling, leasing, trading, or otherwise profiting from a person’s or customer’s biometric identifier or information in their possession. 740 ILL. COMP. STAT. § 14/15(b). BIPA’s definition of “biometric identifier” includes “a retina or iris scan,
fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILL. COMP. STAT. § 14/10. BIPA excludes writing samples, written signatures, photographs, human biological samples for valid scientific testing or medical uses, demographic data, tattoo descriptions, and physical descriptions from the definition for “biometric identifier.” Id. The Act defines “biometric information” as “any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used
to identify an individual.” Id. BIPA further narrows the definition by not including “information derived from items or procedures excluded under the definition of biometric identifiers.” Id. The Illinois legislature devised BIPA to protect consumers against the threat of irreparable privacy violations, identity theft, and economic injuries stemming from the
use of biometric identifiers and biometric information by private entities. Notably, as a matter of state law, BIPA creates a private right of action for “[a]ny person aggrieved by a violation” of the outlined provisions. 740 ILL. COMP. STAT. § 14/20. B. Plaintiffs’ Complaint Facial recognition or “faceprinting” uses biological characteristics to verify an
individual’s identity by extracting an individual’s face geometry data in order to confirm a subsequent match of the individual’s face. (Id. at ¶ 44). Geometric attributes of faces include distance between the eyes, width of the nose, and other features. (Id. at ¶ 75). Face geometry is a physiological characteristic and qualifies as a “biometric identifier” under BIPA. (Id. at ¶ 26). Plaintiffs allege Apple’s Photos app employs a proprietary software and facial
recognition technology to scan individual face geometries from a user’s photographs creating a unique “faceprint” for every person detected. (Id. at ¶¶ 2, 27, 67, 77). Apple’s devices use facial recognition technology to add frequently detected faces to the user’s “People” album within the Photos app. (Id. at ¶ 67). Further, Apple pre-installs the Photos app on all devices including phones, tablets, and computers, and the app cannot be removed or modified. (Id. at ¶¶ 2, 64). This feature of the Photos app allegedly enables
users to “recognize the people, scenes, and objects in [photographs]” and easily sort or find images of their “favorite subjects—the people in [their lives].” (Id. at ¶¶ 80, 81, 83). Plaintiffs also allege that the Photos app applies an algorithm to specifically identify the Apple device user, which creates biometric information as defined by BIPA. (Id. at ¶ 101). Moreover, device users can “tag” and input names for each of the faces
detected in the People album. (Id. at ¶¶ 146, 147). Apple does not store or transfer all user biometric identifiers or biometric information on its servers, but rather, as Plaintiffs allege, on each Apple device locally in a facial recognition database in the solid-state memory on the device. (Id. at ¶¶ 71, 105, 179). Plaintiffs allege this conduct presents an imminent threat of serious harm to
Plaintiffs and the proposed class, as Apple does not delete the biometric data it collects on the devices, even discarded Apple devices. (Id. at ¶ 130). Moreover, Plaintiffs cannot prevent their devices from collecting their unique and sensitive biometric data (Id. at ¶ 132). And because this information is stored on individual devices, Plaintiffs and the class members face the imminent threat of disclosure of their biometric data as the result of a data breach on any Apple device on which their biometric data is stored. (Id. at ¶ 133).
Each named Plaintiff is a resident of Illinois. (Id. at ¶¶ 10-13). According to the Complaint, each named Plaintiff has used an Apple device to take or store photographs of themselves or others using the Photos app. (Id. at ¶¶ 2, 143). Furthermore, each named Plaintiff had their facial geometry scanned from the photographs and their biometric data collected, stored, and used by Apple. (Id. at ¶ 14). Apple is a California corporation conducting business throughout Illinois. (Id. at ¶ 15).
Plaintiffs assert three counts of BIPA violations, 740 ILL. COMP. STAT. §§ 14/15(a)- (c). In Count I, Plaintiffs claim Apple violated BIPA section 14/15(b) by collecting Plaintiffs’ and Class Members’ biometric identifiers and biometric information, including scans of facial geometry and related biometric information, without first notifying Plaintiffs in writing and obtaining informed consent. (Id. at ¶¶ 162-164). In Count II,
Plaintiffs assert Apple violated BIPA section 14/15(a) by possessing biometric identifiers and biometric information without creating and following a written, publicly available policy with retention schedules and destruction guidelines. (Id. at ¶ 171). In Count III, Plaintiffs allege Apple violated BIPA section 14/15(c) by profiting from biometric identifiers and biometric information it possessed, through marketing and selling its
devices based upon claims of photograph sorting technology. (Id. at ¶¶ 179-181). Plaintiffs seek to represent a class consisting of all Illinois citizens whose faces appeared in one or more photos taken or stored on their own, or someone else’s, Apple device using the Photos app from March 4, 2015, until present. (Id. at ¶ 153). On behalf of themselves and the putative class, Plaintiffs seek actual damages, statutory damages of $5,000 for each intentional and reckless violation of BIPA pursuant to 740 ILL. COMP. STAT.
§ 14/20(2), statutory damages of $1,000 for each negligent violation of BIPA pursuant to 740 ILL. COMP. STAT. § 14/20(1), an order enjoining Apple from further violating BIPA, attorneys’ fees and costs, and pre- and post-judgment interest. (Id. at ¶ 42). DISCUSSION I. Article III Standing Jurisdiction must be established as a threshold matter, due to the nature and limits
of federal judicial power. Steel Co. v. Citizens for a Better Environment, 532 U.S. 83, 94-95, 118 S.Ct. 1003, 140 L.Ed.2d 210 (1998). Without Article III standing, federal courts have no authority to resolve a case for want of subject matter jurisdiction. MAO-MSO Recovery II, LLC v. State Farm Mut. Auto. Ins. Co., 935 F.3d 573, 581 (7th Cir. 2019); see also Spokeo, Inc. v. Robins, 136 S.Ct. 1540, 1547, 194 L.Ed.2d 635 (2016). Article III standing requires:
(1) plaintiffs to suffer an actual or imminent, concrete and particularized injury-in-fact; (2) a causal connection between the injury and the conduct complained of; and (3) a likelihood that the injury can be redressed by a favorable decision. Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 620-21 (7th Cir. 2020) (citing Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-61, 112 S.Ct. 2130, 119 L.Ed.2d 352 (1992)).
Bare procedural violations separated from any concrete harm do not satisfy the injury-in-fact requirement. Spokeo, 136 S.Ct. at 1549 (2016). The violation of a procedural right, conferred by a statute, may sufficiently constitute an injury-in-fact. Id. A statutory violation, however, must present “an ‘appreciable risk of harm’ to the underlying concrete interest [the legislature] sought to protect by enacting the statute.” Bryant, 958 F.3d at 621 (quoting Groshek v. Time Warner Cable, Inc., 865 F.3d 884, 887 (7th Cir. 2017)).
Typically the plaintiff bears the burden of demonstrating that the district court has subject-matter jurisdiction over a case and that it falls within “the Judicial Power” conferred in Article III. Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1244 (7th Cir. 2021). “But more generally, the party that wants the federal forum is the one that has the burden of establishing the court’s authority to hear the case.” Id. In this case, that means Apple has the burden of establishing that Plaintiffs have standing.
A. Count I – BIPA Section 15(b) As agreed by the parties, the Court adopts and incorporates its prior analysis and conclusion regarding Plaintiffs’ standing to bring their section 15(b) claim, as discussed in the Court’s order of November 12, 2020. (Doc. 26). B. Count II – BIPA Section 15(a)
BIPA section 15(a) requires private entities that possess biometric information to develop, publicly disclose, and comply with a data retention schedule, including providing for the permanent destruction of biometric information after its initial purpose is satisfied, but in no event later than three years from the person’s last interaction with the entity. 740 ILL. COMP. STAT. § 14/15(a).
In its previous order, the Court found that, under Bryant v. Compass Group USA, Inc., Apple’s alleged failure to publicize a retention and destruction policy in violation of BIPA section 15(a) constitutes a public harm, not a harm particular to Plaintiffs. See Bryant, 958 F.3d at 626. Because this public harm is not the type of concrete, particularized injury necessary to satisfy Article III’s requirements, the Court found that Plaintiffs lack standing to bring their section 15(a) claim in federal court.
After the Court entered its order, the Seventh Circuit Court of Appeals clarified in Fox v. Dakkota Integrated Systems that its decision in Bryant was limited to allegations involving a violation of the public disclosure duty in section 15(a). Fox, 980 F.3d at 1154. But where a plaintiff alleges the defendant has violated “the full panoply of its section 15(a) duties—the duties to develop, publicly disclose, and comply with data retention and destruction policies—resulting in the wrongful retention of her biometric data,” the
plaintiff has sufficiently pleaded an injury in fact for purposes of Article III. Id. at 1149, 1154-55. This is because the “unlawful retention of biometric data inflicts a privacy injury in the same sense that an unlawful collection does.” Id. at 1154. Here, Plaintiffs allege Apple “violated BIPA section 15(a) by possessing Plaintiffs’ and Class members’ biometric identifiers and biometric information, including scans of
face geometry and related biometric information, without creating and following a written policy . . . establishing and following a retention schedule and destruction guidelines for Defendant’s possession of biometric identifiers and information.” (Doc. 1- 1 at ¶ 171) (emphasis added). Under Fox, the allegation that Apple has failed to follow a policy for retaining and
destroying Plaintiffs’ biometric identifiers and information is enough to establish Article III standing for Plaintiffs’ section 15(a) claim. See id. at 1154-55; see also Neals v. ParTech, Inc., No. 19-CV-05660, 2021 WL 463100, at *5 (N.D. Ill. Feb. 9, 2021) (plaintiffs’ allegation that defendant continued to collect and retain biometrics, while failing to adhere to a retention schedule and to delete biometric information, satisfied the injury in fact requirement of standing); Wilcosky v. Amazon.com, Inc., No. 19-CV-05061, 2021 WL 410705,
at *6 (N.D. Ill. Feb. 5, 2021) (“Plaintiffs alleged that Amazon unlawfully retained all of their biometric data in violation of Section 15(a), which is sufficiently particularized to satisfy Article III.”); Marsh v. CSL Plasma Inc., No. 19 C 6700, 2020 WL 7027720, at *4 (N.D. Ill. Nov. 30, 2020) (an alleged violation of the Act’s requirement that a collector of biometric information develop a retention policy satisfies the injury in fact needed for Article III standing).
Plaintiffs agree that Fox recognizes section 15(a) creates a legally protected interest in individuals’ biometric data not being retained after the time allowed by the statute. They point out, however, that in Fox the plaintiff alleged her “former” employer, Dakkota Integrated Systems, wrongfully retained her biometric data after her employment ended. That is, once the plaintiff’s employment ended, the retention of her handprint in
conjunction with Dakkota’s biometric timekeeping system was a sufficient privacy violation to constitute a particularized injury under Article III. Here, however, Plaintiffs have not alleged that they have ceased using Apple Devices. Therefore, Plaintiffs argue, they are more akin to a Dakkota employee who continues to use a biometric timekeeping system, and nothing in Fox suggests that such individuals would have standing to assert
a claim under section 15(a). The Court is somewhat perplexed by this argument, as it seems to suggest that Plaintiffs are conceding they could not succeed on the merits of their section 15(a) claim under Illinois law. Plaintiffs admit they are still interacting with Apple, and they further allege that the collection of biometric identifiers is automatic and occurs whenever a new photograph is stored on an Apple Device. (Doc. 1-1 at ¶ 85). Thus, the initial purpose for
the collection of biometric information would appear to continue each time a photo is taken. If the initial purpose for possessing the biometric information has not been satisfied, and Plaintiffs have not discontinued their interaction with the company, it seems as though Apple would have no active, current duty under section 15(a) to comply with a data retention schedule that provides for the permanent destruction of biometric information.
Nevertheless, the Court disagrees that Plaintiffs’ continued interaction with Apple deprives them of Article III standing. Plaintiffs allege that the durability of solid-state memory in Apple Devices creates a nearly permanent risk of a data breach of biometric identifiers and information, as the memory can last well past the natural life of the device user and, perhaps, in perpetuity. (Id. at ¶ 136). Plaintiffs also claim the biometric data may
even persist on discarded Apple Devices, creating the risk of illicit harvesting of the data far into the future. (Id. at ¶ 138). The Court finds that this alleged unlawful retention of Plaintiffs’ biometric information, potentially indefinitely, constitutes a privacy injury such that Plaintiffs have Article III standing to bring their BIPA section 15(a) claims.3
3 If this were not enough, Apple also points to discovery responses that demonstrate each Plaintiff stopped using at least one Apple Device during the relevant time period. (Doc. 56-1). Thus, if standing turns on whether Plaintiffs ceased using a “Device,” as opposed to interacting with Apple as a private entity, these discovery responses establish standing for Plaintiffs’ section 15(a) claims. The Court can consider this new evidence, even though it is outside the pleadings, because it is relevant to the Court’s subject matter jurisdiction. See Bazile v. Fin. Sys. of Green Bay, Inc., 983 F.3d 274, 279 (7th Cir. 2020) (noting that where a party makes a factual attack on the existence of jurisdictional facts underlying the allegations, “the court may consider and weigh evidence outside the pleadings to determine whether it has power to adjudicate the action”). C. Count III – BIPA Section 15(c) Section 15(c) of BIPA prohibits entities in possession of a person’s or customer’s biometric identifiers or information from selling, leasing, trading, or otherwise profiting
from that data. 740 ILL. COMP. STAT. § 14/15(c). In this case, Plaintiffs allege Apple violated section 15(c) by marketing and selling its devices based upon claims that its facial recognition technology could sort photographs, thus profiting from a person’s or customer’s biometric data (Doc. 1-1 at ¶ 181). Yet, because Plaintiffs do not allege Apple sold or otherwise profited from their individual biometric data, the Court, in its earlier
order, found that Plaintiffs failed to allege any particularized or concrete injury. After the Court entered its order, the Seventh Circuit Court of Appeals issued its decision in Thornley v. Clearview AI, Inc. In that case, the plaintiffs filed a complaint in state court on behalf of themselves and as representatives of the following class: All current Illinois citizens whose biometric identifiers or biometric information were [sic], without their knowledge, included in the Clearview AI Database at any time from January 1, 2016 to January 17, 2020 (the “Class Period”) and who suffered no injury from Defendant’s violation of Section 15(c) of BIPA other than statutory aggrievement . . . .
Thornley, 984 F.3d at 1246. The complaint further stated that none of the named plaintiffs, and no class member, “suffered any injury as a result of the violations of Section 15(c) of BIPA other than the statutory aggrievement alleged in Paragraph 38.” Id. Clearview removed the case to federal court, but the district court remanded it, holding that the complaint “raised questions only about a general regulatory rule found in BIPA: no one may profit in the specified ways from another person’s biometric identifiers or information.” Id. Clearview appealed, asserting the Seventh Circuit should equate a person’s potential injury from the sale of his or her data with the injury from retention of that data
as in Fox, or the injury that occurs when a company fails to obtain written consent to collect the data, as recognized in Bryant. Id. at 1247. The Seventh Circuit agreed that a different complaint might present those circumstances, but the plaintiffs at hand took care in their allegations to assert only “a general, regulatory violation, not something that is particularized to them and concrete.” Id. at 1247-48. Because the plaintiffs were careful to allege only bare procedural violations rather than concrete and particularized harm to
them individually, they were entitled to keep their claims in state court. Id. at 1248. The Seventh Circuit noted that section 15(c) “addresses only the regulated entity—the collector or holder of the biometric data—and flatly prohibits for-profit transactions.” Id. at 1247. Indeed, the Court found section 15(c) to be “the same kind of general regulation as the duty to create and publish a retention and destruction schedule found in section
15(a), at least when the plaintiff asserts no particularized injury resulting from the commercial transaction.” Id. (citing Bryant, 958 F.3d at 626). Here, Apple asserts Plaintiffs have alleged concrete and particularized harm because the Complaint states that Apple “profit[ed] from Plaintiffs’ and Class members’ biometric identifiers and biometric information, including scans of facial geometry and
related biometric information . . . .”; “Plaintiffs incurred injuries that were caused by Defendant’s conduct”; and “Through its actions, Defendant exposed Plaintiffs and the Class to imminent threats of serious harm.” (Doc. 1-1 at ¶¶ 181, 184). According to Apple’s reading of the Complaint, Plaintiffs also allege that any “profit” received from the sale of devices into Illinois with “the face recognition ‘feature’” was not “lawful” because the devices “automatically collect biometric information without consent in
violation of BIPA.” (Doc. 1-1 at ¶¶ 43, 103, 117). The Court does not read the Complaint so broadly. Plaintiffs allege Apple profits from Plaintiffs’ biometric data because it uses the facial recognition capabilities of its Photos App to market and sell its devices and software. (Id. at ¶ 3). They further allege Apple developed the facial recognition feature of the Photos App to “competitively position its devices and software in the marketplace, compete with other software
applications, and thereby profit.” (Id. at ¶ 43). Additionally, Apple uses the facial recognition feature “to advertise its operating systems and Apple Devices to potential users.” (Id. at ¶ 115). Plaintiffs also claim Apple developed the facial recognition feature “for its Photos App to compete with similar features being offered on other devices, giving Defendant a competitive edge that allowed Defendant to profit from the sale of
Apple Devices.” (Id. at ¶ 117). Plaintiffs note that BIPA section 15(c) prohibits Apple from profiting from their biometric information and that Apple did, in fact, profit from the sale of its Apple Devices as a result of its facial recognition feature. (Id. at ¶¶ 119, 127). Based on these allegations, the Court previously found that Plaintiffs did not allege Apple sold or otherwise profited from their individual biometric data. The Court stands
by that analysis. Plaintiffs do not allege the type of particularized harm envisioned by the Thornley court, or any particularized harm for that matter. Instead, they allege that Apple used its facial recognition technology to sell more devices, advertise its software, and to give Apple an edge over competitors—all in an effort to profit from the sale of its Devices. And while the plaintiffs in Thornley expressly stated that they suffered no injury other than statutory aggrievement, the Court of Appeals did not find express disavowal of
individual harm to be a requirement. Because Plaintiffs have alleged nothing more than a regulatory violation, the Court again finds that Plaintiffs lack Article III standing.4 Apple has not met its burden of demonstrating Plaintiffs have standing to bring their section 15(c) claim in federal court. Accordingly, the Court lacks subject matter jurisdiction over the claim, and it must be remanded to state court. While Apple urges the Court to instead dismiss the claim for the reasons set forth in its motion to dismiss,
the adequacy of Plaintiffs’ substantive allegations is a matter for the Illinois state court to address. See Thornley, 984 F.3d at 1249. II. Failure to State a Claim The purpose of a motion to dismiss for failure to state a claim under Rule 12(b)(6) is to evaluate the adequacy of a complaint, not to determine the merits of the case or
whether a plaintiff will ultimately prevail. Gibson v. City of Chicago, 910 F.2d 1510, 1520 (7th Cir. 1990). To survive a Rule 12(b)(6) motion, a plaintiff only needs to allege enough facts to state a claim for relief that is plausible on its face. Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007). A plaintiff need not plead detailed factual allegations, but must provide “more than labels and conclusions, and a formulaic recitation of the elements.”
Id. In deciding a motion to dismiss under Rule 12(b)(6), the Court accepts as true all well- pleaded facts in the complaint and draws all reasonable inferences in the plaintiff’s favor.
4 Having found the case must be remanded, the Court need not address Plaintiffs’ argument that Defendants are judicially estopped from arguing Plaintiffs do have standing after previously arguing they do not have standing. Burke v. 401 N. Wabash Venture, LLC, 714 F.3d 501, 504 (7th Cir. 2013). Taken together, the factual allegations contained within a complaint must “raise a right to relief above the
speculative level, on the assumption that all the allegations in the complaint are true (even if doubtful in fact).” Twombly, 550 U.S. at 555 (internal citations omitted). A. Count I – BIPA Section 15(b) As agreed by the parties, the Court adopts and incorporates its prior analysis and conclusion that Plaintiffs have stated a plausible cause of action to survive Apple’s 12(b)(6) motion to dismiss on their section 15(b) claim. (Doc. 26)
B. Count II – BIPA Section 15(a) BIPA section 15(a) only applies to private entities “in possession” of biometric identifiers or biometric information. 740 ILL. COMP. STAT. § 14/15(a). Apple argues Plaintiffs have made only a conclusory allegation that Apple “possessed” such biometric identifiers or information, without pleading any facts to support their claims. Instead, the
Complaint is rife with allegations that the facial recognition technology runs on the users’ devices and that the biometric data remains in the solid-state memory on the Apple Device, which is owned and controlled by the user. Apple asserts Plaintiffs have the choice to erase any or all data stored on their devices, only the plaintiffs know the identities of anyone in their photos, and there is no suggestion in the Complaint that
Apple reserves the right to access a user’s photos after selling the device. Apple also disputes Plaintiffs’ theory that Apple is vicariously liable for the actions of the Photos app, as Apple’s “software agent.” In sum, Apple contends Plaintiffs have failed to sufficiently allege that it “possesses” Plaintiffs’ biometric identifiers or information. In response, Plaintiffs argue that Apple is reading into BIPA a “storage” requirement that plainly does not exist. Because BIPA merely requires that an entity
“possess” biometric data to be liable, not that the entity “store” data on its own servers, Apple’s argument that it is exempt from BIPA because its biometric data is located in databases on user devices that Apple alone controls is meritless. Plaintiffs also point out that the language of the statute itself differentiates between possession and storage. See 740 ILCS 14/15(e)(1) (requiring entities “in possession of” biometric data to “store, transmit, and protect [the data] from disclosure”). Thus, any interpretation of the statute
that equates possession with “storage” would render these provisions superfluous, which violates the basic rules of statutory construction. BIPA does not define “possession,” so the Court turns to its “popularly understood meaning” or its “settled legal meaning if one exists.” See 740 ILCS 14/10; Heard v. Becton, Dickinson & Co., 440 F. Supp. 3d 960, 968 (N.D. Ill. 2020) (citing Rosenbach
v. Six Flags Entm’t Corp., 129 N.E.3d 1197, 1205 (Ill. 2019). “The Illinois Supreme Court has held that ‘possession, as ordinarily understood, occurs when a person has or takes control of the subject property or holds the property at his or her disposal.’” Id. (quoting People v. Ward, 830 N.E.2d 556, 560 (Ill. 2005)). The ordinary definition of possession does not require exclusive control, “and nothing in BIPA indicates that the ordinary definition of
possession does not apply.” Id. Here, Plaintiffs allege Apple “possesses” their biometric data because it has complete and exclusive control over the data on Apple Devices, including what biometric identifiers are collected, what biometric data is saved, whether biometric identifiers are used to identify users (creating biometric information), and how long biometric data is stored. (Doc. 1-1 at ¶ 105). Plaintiffs also claim Apple uses its software to create, gather, and harvest faceprints, which Apple stores in facial recognition databases that Apple
provided users no knowledge of or control over, and that Apple alone could access the biometric data or disable its collection. (Id. at ¶¶ 32, 65-104). Users also cannot disable the collection of biometric data, cannot limit what information is collected or from whom information is collected, cannot remove the People folder, and cannot delete the database of facial recognition information that Apple creates or any information in that database.
(Id. at ¶ 110). Finally, Apple only allows users to use Apple Devices on the condition that it collects biometric data. (Id. at ¶ 112). As it did in its previous, vacated order—taking all allegations as true and making all inferences in favor of Plaintiffs—the Court finds Plaintiffs have adequately alleged that Apple possessed their biometric data such that BIPA section 15(a) applies to it.
Accordingly, the Court will not dismiss Count II at this stage of the proceedings. III. Intentional or Reckless Violations of BIPA As agreed by the parties, the Court adopts and incorporates its prior denial of Apple’s request to strike Plaintiffs’ prayer for enhanced statutory damages, as set forth in the Court’s order of November 12, 2020. (Doc. 26). CONCLUSION The Motion to Dismiss (Doc. 19) filed by Defendant Apple Inc. is GRANTED in part and DENIED in part. Plaintiffs’ claim in Count II under BIPA section 15(c) is REMANDED to the Twentieth Judicial Circuit, St. Clair County, Illinois, for lack of subject matter jurisdiction. Defendant Apple Inc.’s motion to dismiss for lack of Article III standing and for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6) as to Counts I and I] is DENIED. IT IS SO ORDERED. DATED: June 14, 2021 neff NANCY J. ROSENSTENGEL Chief U.S. District Judge
Page 19 of 19