IN THE UNITED STATES DISTRICT COURT FOR THE SOUTHERN DISTRICT OF ILLINOIS
KAMIL KUKLINSKI, Individually, and on Behalf of All Others Similarly Situated,
Plaintiff,
v. Case No. 21-cv-001425-SPM
BINANCE CAPITAL MANAGEMENT CO., LTD , BAM TRADING SERVICES INC. d/b/a Binance.US, and JUMIO CORPORATION
Defendants.
MEMORANDUM AND ORDER
McGLYNN, District Judge: Plaintiff Kamil Kuklinski (“Kuklinski”) brings a proposed class action against defendants Binance Capital Management Co., Ltd. d/b/a Binance (“BCM”), BAM Trading Services, Inc. d/b/a Binance.US (“BAM”), and Jumio Corporation (“Jumio”) for alleged violations of the Illinois Biometric Privacy Act (“BIPA”), codified at 740 ILCS §14/1, et seq. All three defendants have filed separate motions to dismiss the complaint, which are currently pending before the Court. (Docs. 53-55). For the reasons set forth below, the Court grants the motion to dismiss filed by BCM and denies the motions filed by BAM and Jumio. The Illinois Biometric Information Privacy Act The Illinois General Assembly enacted the Illinois Biometric Information Page 1 of 29 Privacy Act (“BIPA”), in 2008 to protect a person’s privacy interests in his “biometric identifiers”, which includes fingerprints, retina and iris scans, hand scans and facial geometry. 740 ILCS 14/1, et seq. (2008); Fox v. Dakkota Intefrated Systems, LLC., 980
F.3d 1146 (2020). BIPA was created in response to the growing use of biometrics “in the business and security screening sectors”. 740 ILCS 14/5. In fact, the legislative findings refer to the immutability of biometric identifiers and the risk of identity theft, and state the following, “Biometrics are unlike other unique identifiers that are used to access finances or other sensitive information. For example, social security numbers, when compromised, can be changed. Biometrics, however, are biologically
unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric- facilitated transactions.” 740 ILCS 14/5(c). Because “the full ramifications of biometric technology are not fully known”, the General Assembly found that “the public welfare, security, and safety will be served by regulating the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” Id. §§14/5 (f)-(g).
Section 15 of the Act comprehensively regulates the collection, use, retention, disclosure and dissemination of biometric identifiers. 740 ILCS 14/15. Specifically, § 15(a) of BIPA states: “A private entity in possession of biometric identifiers or information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the Page 2 of 29 private entity, whichever comes first.” 740 ILCS 15/15(a).
Section 15(b) of the Act deals with informed consent and prohibits private entities from collecting, capturing, or otherwise obtaining a person’s biometric identifiers or information without the person’s informed written consent. Id. § 15(b). In other words, the collection of biometric identifiers or information is barred unless the collector first informs the person “in writing of the specific purpose and length of term for which the data is being collected, stored, and used” and “receives a written release” from the person or his legally authorized representative. Id. PROCEDURAL HISTORY
On October 5, 2021, Kuklinski filed a two-count class action Complaint against defendants herein in the Twentieth Judicial Circuit, St. Clair County, Illinois (Doc. 1-1). Count I asserted violations of the Illinois Biometric Information Privacy Act, while Count II asserted unjust enrichment (Id.). The action was brought pursuant to 735 ILCS §5/2-801 on behalf of Kuklinski and the following putative class: “All Illinois
Binance.US users and account holders whose facial and biometric data were collected prior to May 25, 2021” (Id.). On November 12, 2021, BAM timely removed Kuklinski’s action to this Court under 28 U.S.C. § 1332(d), diversity of citizenship, and 28 U.S.C. § 1453, CAFA (Doc. 1). On January 31, 2022, defendants filed their initial motions to dismiss; however, prior to ruling on the respective motions, Kuklinski obtained leave to amend the
complaint, and on February 22, 2022, the amended complaint was filed (Doc. 45).
Page 3 of 29 On March 15, 2022, all three motions to dismiss the first amended complaint were filed herein (Docs. 53-55). Jumio’s motion was brought pursuant to Rule 12(b)(6) of the Federal Rules of Civil Procedure and asserted five (5) grounds for dismissal
(Doc. 53). BCM filed its motion pursuant to Rule 12(b)(2) of the Federal Rules of Civil, arguing that plaintiff’s allegations are insufficient to show personal jurisdiction (Doc. 54). Alternatively, BCM claims plaintiff did not adequately plead a cause of action against it and seeks dismissal under Rule 12(b)(6) (Id.). Within its motion which was also brought pursuant to Rule 12(b)(6), BAM asserts four arguments for dismissal of the BIPA claims (Doc. 55).
FACTUAL BACKGROUND The facts alleged by Kuklinski are accepted as true for purposes of defendants’ motions1. FED. R. CIV. P. 10(c); Arnett v. Webster, 658 F.3d 742, 751-52 (7th Cir. 2011). This Court will summarize what it deems necessary to address this motion. Within the first amended complaint, plaintiff alleges an aider, abettor, and co- conspirator relationship amongst the three defendants (Doc. 45, ¶ 20). Plaintiff also
claims each defendant acted as the agent, employee, representative, partner, joint- venturer of the other defendants; however, these are legal conclusions to be determined by the Court (Id.). BCM is a digital asset marketplace or cryptocurrency exchange which allows account holders using the company platform to purchase over 500 types of cryptocurrency (Id., ¶ 1). BCM was founded in 2017 and is considered the world’s
1 The factual information was taken directly from the complaint (Doc.1) and will be cited accordingly. Page 4 of 29 largest cryptocurrency exchange by volume (Id.). Cryptocurrency is not legal tender in the United States and is not considered “money” or a “security” (Id., ¶ 2). BCM was founded in China, but later company headquarters were moved (Id., ¶ 17).
Although BCM claims to operate in a decentralized matter, BCM is a registered entity in the British Virgin Islands (Id.). In June of 2019, BCM began ending trade for U.S. customers, and in September 2019, partnered with BAM to launch trading services for users within the U.S. (Id., ¶¶ 3, 4). BAM is a digital asset marketplace or cryptocurrency exchange which allows Illinois account holders to purchase various cryptocurrencies when
using the company’s platform (Id., ¶ 5). Both BAM and BCM collect fees for the purchase and sale of cryptocurrency by its account holders (Id., ¶ 6). BAM is a foreign corporation headquartered in California and operating under the laws of Delaware (Id., ¶ 18). To begin trading on BAM, users can either download the application onto a mobile device or visit the BAM website to sign up for a desktop account (Id., ¶ 7). Once the application is downloaded or the website is visited, users must create an
account by inputting both personal and private information about their identity (Id., ¶ 8). BAM utilized Jumio’s software as part of its identity verification process, which required taking images of a user’s driver’s license or other photo identification, along with a “selfie” of the user to capture, analyze and compare biometric data of the user’s facial features (Id., ¶ 9). The identity verification process was used to avoid
Page 5 of 29 fraudulent activity and/or prohibit unauthorized users from accessing the BAM exchange (Id., ¶ 10). Jumio is a foreign corporation operating under the laws of Delaware and
headquartered in California (Id., ¶ 19). The capture process utilized by BAM was leased, owned, issued, created, or otherwise implemented by Jumio since at least 2018 (Id., ¶ 19). BAM’s website and application displayed “Powered by Jumio” during the identify verification process (Id., Id.). Facial features are personal biometric data, as the identifiers include a “scan … of face geometry” (Id., ¶¶ 12, 13). This identity verification process of obtaining
and collecting a user’s biometric data without proper notice and consent is unlawful pursuant to BIPA, 740 ILCS § 14/1 et seq. (Id., ¶ 11). BCM, BAM, and Jumio all obtained biometric identifiers and information from users of BAM, without first notifying them, without disclosing the length for collection, storage and use, and without obtaining proper written consent - all of which constituted violations of the law under BIPA (Id., ¶ 15). Kuklinski is a resident of Cook County, Illinois (Id., ¶ 16). On or about March
15, 2021, he downloaded the BAM application for his iPhone and created an account while he was on Cook County, Illinois (Id., ¶ 26). During the account creation process, Kuklinski entered his personal information, including his name, birthdate and home address (Id., ¶ 27). He was also prompted to review and accept a “Self-Directed Custodial Account Agreement” for an entity known as Prime Trust, LLC that had no reference to collection of any biometric data (Id., ¶ 28). Kuklinski was then prompted
Page 6 of 29 to take a photograph of his driver’s license or other state identification card2 (Id., ¶ 29). After submitting his driver’s license photo, Kuklinski was prompted to take a photograph of his face with the language popping up “Capture your Face” and “Center
your face in the frame and follow the on-screen instructions.” (Id., ¶ 30). When his face was close enough and positioned correctly within the provided oval, the screen flashed “Scanning completed.” (Id.). The next screen stated, “Analyzing biometric data,” “Uploading your documents”, and “This should only take a couple of seconds, depending on your network connectivity.” (Id., ¶ 31). While creating his account with BAM, Kuklinski was not given proper notice
that the uploaded images would capture and store his biometric data, including facial geometry, nor was he informed in writing that his biometric data was being collected, or the purpose and length of time of the collection, storage, and usage (Id., ¶¶ 32, 33). Kuklinski did not sign a written release under BIPA regarding the collection of his biometric data by BAM or Jumio (Id., ¶ 34). On or about May 25, 2021, which this Court is constrained to note was more than two (2) months after Kuklinski created his account, the BAM application was
updated to version 2.4.5, which included the following notification prior to activating the desktop or mobile camera application: By clicking “Continue” you consent to Jumio collecting and disclosing your biometric data pursuant to its Privacy Policy (Id., ¶ 35).
2 Once the camera was activated within the BAM application, the text read “Scan Document”, “Powered by Jumio”, “Scan identity Card Front”, and “Scan identity Card Back”. Page 7 of 29 Prior versions of the BAM software did not display the warning and/or notice; however, Jumio was mentioned during the downloading process with the phrase, “Powered by Jumio” (Id., ¶¶ 36, 37). Jumio’s website describes its biometric data
authentication process in a video on its website (Id., ¶ 38). Kuklinski was not advised as to how his biometric data was being collected and stored, nor was he advised that Jumio was collecting that data on behalf of BAM (Id., ¶ 39). BAM has a Terms of Use document on its website, but it does not mention the collection of biometric data by its application or website (Id., ¶ 40). Additionally, Kuklinski was not required to scroll through the Terms of Use, nor was assent
obtained that he had read the document much less even seen it (Id.). BAM maintains a Privacy Policy on its website, but it makes no mention of the collection of biometric data (Id., ¶ 43). Jumio also has a Privacy Policy on its website which references the collection of biometric data and states, “Jumio makes the Services available to third parties for integration into those third parties’ websites, applications, and online services” (Id., ¶ 41). Jumio’s policy further states, “to fully understand how your information will be
handled when you use the Services, you must review not just this Policy, but also the privacy policy of the third party with whom you are dealing directly (the “Customer Data Controller”).” (Id., ¶ 42).
Page 8 of 29 LEGAL STANDARDS
I. Rule 12(b)(2) of the Federal Rules of Civil Procedure A motion to dismiss under Rule 12(b)(2) challenges whether the Court has jurisdiction over a party. Fed.R.Civ.P. 12(b)(2). The party asserting jurisdiction has the burden of proof. Tamburo v. Dworkin, 601 F.3d 693 (7th Cir. 2010). The Court may consider affidavits and other competent evidence submitted by the parties. Purdue Research Found. v. Sanofi–Synthelabo, S.A., 338 F.3d 773 (7th Cir. 2003). If the Court rules on the motion without a hearing, the plaintiff need only establish a prima facie case of personal jurisdiction as the Court will “read the complaint liberally, in its entirety, and with every inference drawn in favor of the plaintiff.”
GCIU–Emp'r Ret. Fund v. Goldfarb Corp., 565 F.3d 1018 (7th Cir. 2009); Central States, Se. & Sw. Areas Pension Fund v. Phencorp Reinsurance Co., 440 F.3d 870 (7th Cir. 2006) (quoting Textor v. Bd. of Regents of N. Ill. Univ., 711 F.2d 1387 (7th Cir. 1983)). “[O]nce the defendant has submitted affidavits or other evidence in opposition to the exercise of jurisdiction,” however, “the plaintiff must go beyond the pleadings and submit affirmative evidence supporting the exercise of jurisdiction.” Purdue, 338
F.3d at 783. Any dispute concerning relevant facts is resolved in the plaintiff's favor. Id. at 782–83. II. Rule 12(b)(6) of the Federal Rules of Civil Procedure To survive a Rule 12(b)(6) motion to dismiss, a complaint must comply with Rule 8(a) by providing “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed.R.Civ.P. 8(a)(2). A motion to dismiss should be
Page 9 of 29 granted if the plaintiff fails to “state a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). The factual allegations in a complaint must
“raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555–56; see also Swanson v. Citibank, N.A., 614 F.3d 400, 404 (7th Cir.2010) (“[P]laintiff must give enough details about the subject-matter of the case to present a story that holds together.”). For purposes of a motion to dismiss, the court takes all facts alleged in the complaint as true and draws all reasonable inferences from those facts in the plaintiff's favor, although conclusory allegations that merely recite the elements of a
claim are not entitled to this presumption of truth. Virnich v. Vorwald, 664 F.3d 206, 212 (7th Cir.2011). ANALYSIS
Each defendant herein has filed its own Motion to Dismiss. The Court will address them individually. I. Binance Capital Management Co. Ltd. d/b/a Binance (“BCM”) BCM raises two main arguments in its motion to dismiss (Doc. 54). First, BCM argues that the amended complaint must be dismissed because the Court lacks personal jurisdiction (Id.). Second, and in the alternative, BCM contends that the amended complaint should be dismissed because Kuklinski does not adequately plead any claims against it (Id.). In response, Kuklinski raises the “alter ego” theory, arguing that because BAM is the alter ego of BCM, the Court may exercise jurisdiction (Doc. 63). Kuklinski
Page 10 of 29 further avers that he has stated a cause of action under BIPA and for unjust enrichment against BAM, and that said conduct is imputed to BCM (Id.). BCM filed a reply doubling down on the lack of personal jurisdiction over BCM
(Doc. 64). BCM also argued that neither a BIPA claim nor an unjust enrichment claim was adequately pled (Id.). A. Personal Jurisdiction Personal jurisdiction refers to a court's “power to bring a person into its adjudicative process.” N. Grain Mktg., LLC v. Greving, 743 F.3d 487, 491 (7th Cir.2014) (quoting Black' s Law Dictionary 930 (9th ed. 2009)). The scope of a federal
district court's personal jurisdiction over a defendant in a diversity case is, in the first instance, defined by the jurisdiction of courts of general jurisdiction in the state where the district court is located – Illinois, in this case. Fed. R.Civ.P. 4(k)(1)(A). Illinois permits its courts to exercise jurisdiction based on a variety of conditions not relevant here, but for purposes of this motion, it suffices to say that Illinois state courts may exercise jurisdiction “on any other basis now or hereafter permitted by the Illinois Constitution and the Constitution of the United States.” 735
Ill. Comp. Stat. § 5/2–209(c). Thus, the scope of this Court's personal jurisdiction over BCM is, ultimately, defined by the Due Process Clause. If an Illinois court may constitutionally exercise personal jurisdiction over a defendant, so may this Court. The plaintiff has the burden of establishing personal jurisdiction. N. Grain Mktg., 743 F.3d at 491–92. Courts recognize two types of personal jurisdiction – general and specific. Daimler AG v. Bauman, –– U.S. ––, 134 S.Ct. 746, 751 (2014).
Page 11 of 29 General jurisdiction is “all-purpose” while specific jurisdiction is case-specific. Id. (quoting Goodyear Dunlop Tires Operations, S.A. v. Brown, –– U.S. ––, 131 S.Ct. 2846, 2851 (2011)).
1. General Jurisdiction General, or “all-purpose,” jurisdiction exists “where a foreign corporation's continuous corporate operations within a state [are] so substantial and of such a nature as to justify suit against it on causes of action arising from dealings entirely distinct from those activities.” Daimler, 134 S.Ct. at 754 (quoting Int'l Shoe Co. v. Washington, 326 U.S. 310, 318 (1945)). In Goodyear, the Court elaborated on the
nature of the relationship required between a corporation and forum to establish general jurisdiction and held, “A court may assert general jurisdiction over foreign (sister-state or foreign-country) corporations to hear any and all claims against them when their affiliations with the state are so ‘continuous and systematic’ as to render them essentially at home in the forum State.” –– U.S. ––, 131 S.Ct. 2846, 2851 (2011) (quoting Int'l Shoe, 326 U.S. at 317). Consistent with its use of the phrase “at home”, the Goodyear Court noted that domicile is the touchstone of general
jurisdiction for both individuals and corporations, so a corporation's place of incorporation and principal place of business, which define its domicile, are the paradigmatic fora states in which a corporation should be deemed to be “at home.” 131 S.Ct. at 2853–54. In other words, Goodyear made clear that only a limited set of affiliations with a forum will automatically render a defendant amenable to all-purpose jurisdiction
Page 12 of 29 there. Daimler, 134 S.Ct. at 760. Although general jurisdiction is not limited to those states, it requires “an equivalent place.” Id. at 2853. That is to say, as the Court subsequently elaborated in Daimler, that general jurisdiction “requires affiliations so
continuous and systematic as to render [the foreign corporation] ... comparable to a domestic enterprise in [the forum] State.” 134 S.Ct. at 758 n. 11 (first alteration in original) (citation and internal quotation marks omitted). In support of its motion, BCM provided an Affidavit from Samantha Chan, Director of Compliance (Doc. 54-1). Within the Affidavit, Ms. Chan declares that BCM is organized under the laws of the British Virgin Islands. In other words, BCM is
neither registered in Illinois nor licensed to do business in Illinois. Ms. Chan further avers that BCM has no affiliation to Illinois, including but not limited to, office, agent, employee, bank account, real estate, subsidiary and/or records. She further states that BCM is neither the parent company of BAM nor is BAM a wholly or partially owned subsidiary of BCM (Id.). Instead, BCM and BAM are separate entities (Id.). The Affidavit is unrebutted. Kuklinski does not provide any evidence, contradictory or otherwise. As such, there is no general jurisdiction as BCM is not
“at home” in Illinois. 2. Specific Jurisdiction A court sitting in Illinois has specific personal jurisdiction over a nonresident defendant consistent with due process if two conditions are satisfied: the defendant must have (i) minimum contacts with the state such that (ii) exercising personal jurisdiction does not offend traditional notions of fair play and substantial
Page 13 of 29 justice. Asahi Metal Indus. Co. v. Superior Court of Cal., 480 U.S. 102, 109 (1987). To decide whether specific personal jurisdiction may be exercised, a court must engage in three distinct steps: (1) identify the contacts the defendant has with the forum; (2)
analyze whether these contacts meet constitutional minimums and whether exercising jurisdiction on the basis of these minimum contacts sufficiently comports with fairness and justice; (3) determine whether the sufficient minimum contacts, if any, arise out of or are related to the causes of action involved in the suit. Burger King Corporation v. Rudzewicz, 471 U.S. 462 (1985). The contacts must be established by the purposeful acts of the defendant, and
not the “unilateral activity of another party”. Helicopteros Nacionales de Colombia, S.A. v. Hall, 466 U.S. 408 (1984); Wilson v. Humphreys (Cayman) Ltd., 916 F.2d 1239 (7th Cir. 1990). Critical to the analysis is a showing that the defendant reasonably anticipated being haled into court in the forum state, and not as a result of random, fortuitous or attenuated contacts. World-Wide Volkswagon Corp. v. Woodson, 444 U.S. 286 (1980). As the Affiant declares, BCM has no contacts with Illinois, much less than the
minimum amount required to anticipate defending an Illinois cause of action (Doc. 54-1). Accordingly, there is no need to go past step one in determining whether the Court has specific jurisdiction over BCM.
Page 14 of 29 3. Alter Ego Because there is no personal jurisdiction – general or specific – over BCM, plaintiff next contends that jurisdiction is imputed via BAM (Doc. 63). Specifically,
plaintiff asserts that BAM is the “alter ego” of BCM (Id.). Generally, corporate ownership alone is not sufficient to convey personal jurisdiction and the jurisdictional contacts of a subsidiary corporation cannot be imputed to a parent. Central States, S.E. & S.W. Areas Pension Fund v. Reimer Express World Corp., 230 F.3d 934, 943–944 (7th Cir.2000). Notwithstanding the foregoing, there are circumstances under which jurisdictional contact can be carried
over – these are where there is evidence to justify piercing the corporate veil or when there is an agency relationship. A 12(b)(2) motion to dismiss for lack of personal jurisdiction, such as this one, requires the nonmovant to “go beyond the pleadings and submit affirmative evidence supporting the exercise of jurisdiction.” Purdue Research Found., 338 F.3d at 783. A plaintiff cannot merely rely on unsubstantiated allegations that BCM is an alter
ego of BAM. Taurus IP v. DaimlerChrysler Corp., 519 F.Supp.2d 905, 918 (W.D.Wis.2007). Rather, plaintiff must submit affirmative evidence demonstrating that: (1) BCM is BAM’s alter ego; and (2) BCM had minimum contacts with Illinois for this court to exercise personal jurisdiction. Plaintiff has not provided any evidence3 to support its contention. Kuklinski has not shown that BCM created BAM to manipulate its corporate structure to avoid
3 The October 29, 2020 Forbes article cited within the amended complaint contains theories and Page 15 of 29 U.S. law. Instead, plaintiff asserted bare allegations in an attempt to raise the alter ego theory to support jurisdiction. Plaintiff needed to go further and show that corporate formalities were not observed. While it may be true that they were not,
plaintiff offers no evidence. Even resolving all facts in favor of plaintiff, the record is insufficient to support a finding that BCM was BAM’s alter ego. Even assuming plaintiff had met his burden with respect to the alter ego theory, his argument still falls short since plaintiff also fails to offer any evidence that BCM has the necessary minimum contacts with Illinois. See Purdue Research Found., 338 F.3d at 782 (“[O]nce the defendant has submitted affidavits or other
evidence in opposition to the exercise of jurisdiction, the plaintiff must go beyond the pleadings and submit affirmative evidence supporting the exercise of jurisdiction.”). In light of the foregoing, this Court grants BCM’s Motion to Dismiss for lack of personal jurisdiction. Whether or not there is general jurisdiction over BAM does not confer general jurisdiction over BCM. Accordingly, the Court does not need to address the alternative argument that plaintiff failed to state causes of action under BIPA and for unjust enrichment. Furthermore, because the parties have engaged in jurisdictional discovery and seek to move forward on the other defendants, this dismissal is with prejudice.
II. BAM Trading Services, Inc. d/b/a Binance.US (“BAM”) In its motion, which was brought pursuant to Rule 12(b)(6), BAM argues that plaintiff failed to state any cause of action so the BIPA claims as well as the claims for unjust enrichment should be dismissed (Doc. 55). As for BIPA, BAM first claims
conjecture surrounding BCM and BAM; however, it is not evidence in support of any proposition. Page 16 of 29 to be a “financial institution” and BIPA does not apply to financial institutions. Second, BAM claims California law, not Illinois law applies. Third, BAM argues that BIPA does not apply extraterritorially. Finally, BAM claims that plaintiff did not
adequately allege that BAM violated BIPA. BAM also claims that the unjust enrichment claim is derivative of the BIPA action and that plaintiff did not adequately plead that BAM was unjustly enriched. A. BIPA 1. Financial Institution As set forth infra, BIPA is an Illinois law that regulates how private entities
may collect and handle individuals’ biometric data. Although BIPA generally imposes its regulations on any “private entity” that might collect or handle biometric data, section 25(c) contains an important limitation on BIPA's scope: “Nothing in this Act shall be deemed to apply in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm–Leach–Bliley Act of 1999 and the rules promulgated thereunder.” 740 ILCS § 14/25.
Title V of the Gramm-Leach-Bliley Act (“GLBA”), 15 U.S.C. §§ 6801 et seq., is a federal privacy law that regulates how “financial institutions” handle certain customer information. See 15 U.S.C. § 6801(a) (statement of policy); see also Am. Bar Ass'n v. FTC, 430 F.3d 457, 459 (D.C. Cir. 2005). The GLBA provides that “[i]t is the policy of the Congress that each financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers' nonpublic personal information.” 15 U.S.C. § 6801(a). Page 17 of 29 It is important to note that the BIPA exemption is not for all financial institutions. Stauffer v. Innovative Heights Fairview Heights, LLC, 480 F. Suppl. 888, 902 (S.D. Ill. 2020). Instead, the exemption is for those that are already covered by
another law, similar to BIPA, that requires financial institutions to explain their information-gathering practices and how they safeguard sensitive data to their customers. Id. The legislature enacted BIPA to “protect Illinois residents’ privacy interests in their biometric information.” 740 ILCS 14/1 et seq. Other than referencing the GLBA, BIPA does not define the term “financial-institution”. Furthermore, neither the
Illinois Supreme Court nor any Illinois appellate court has discussed the scope of the exemption. It seems doubtful that BAM would be designated as a “financial institution” and, therefore, exempt from BIPA. BIPA's financial institution exemption is explicit in that BIPA does not apply to financial institutions already subjected to GLBA. See 740 ILCS 14/25(c). The Federal Trade Commission describes the type of financial institutions that must comply with GLBA, which includes “all businesses,
regardless of size, that are ‘significantly engaged’ in providing financial products or services. This includes, for example, check-cashing businesses, payday lenders, mortgage brokers, nonbank lenders, personal property or real estate appraisers, professional tax preparers, and courier services.”4 Nowhere in the Complaint is BAM
4 See Federal Trade Commission, Gramm-Leach-Bliley Act, https://www.ftc.gov/tips-advice/business- center/guidance/financial-institutions-customer-information-complying. Page 18 of 29 described as a financial institution, that is engaged in any of the aforementioned activities that would subject it to GLBA. 2. California Law
BAM next argues that California law should be applied (Doc. 55). It is well settled that a federal court exercising diversity jurisdiction5 applies the choice-of- law rules of the state in which it sits—here, Illinois. See Heiman v. Bimbo Foods Bakeries Distrib. Co., 902 F.3d 715, 718 (7th Cir. 2018) (citing Klaxon Co. v. Stentor Elec. Mfg. Co., 313 U.S. 487, 496 (1941)). Under Illinois choice-of-law rules, this state's laws presumptively apply to a
dispute unless there is an actual conflict with another state's laws or the parties agree that forum-state law does not apply. See Sosa v. Onfido, Inc., 8 F.4th 631, 637 (7th Cir. 2021). Indeed, Illinois courts typically enforce a contractual choice-of-law provision unless (1) doing so would violate fundamental Illinois public policy, and (2) Illinois has a materially greater interest in the litigation than the other state. Smurfit Newsprint Corp. v. Se. Paper Mfg., 368 F.3d 944, 949 (7th Cir. 2004) (citing English Co. v. Nw. Envirocon, Inc., 663 N.E.2d 448, 452 (Ill. App. Ct 2. 1996)). A court may
also decline to enforce a contractual choice-of-law “if the contract's legality is fairly in doubt, for example, if the contract is unconscionable, or if there is some other issue as to the validity of the very formation of the contract.” Life Plans, Inc. v. Sec. Life of Denver Ins. Co., 800 F.3d 343, 357 (7th Cir. 2015). BAM contends that the parties
5 On November 12, 2021, BAM removed this case from Illinois state court pursuant to 28 U.S.C. § 1332(d) - diversity of citizenship, and 28 U.S.C. § 1453 – CAFA. Page 19 of 29 have entered into a contractual agreement and points to the choice-of-law provision contained in the Terms of Use, which states that California law applies to “contracts executed and to be wholly performed within such State”.
This Court rejects BAM’s argument. First, BIPA is an Illinois statute that was enacted to protect state residents’ right to privacy in and control over their biometric identifiers and information. 740 ILCS 14/1 et seq. To apply California law would likely foreclose every one of Kuklinski’s claims against BAM. Second, there is a question as to whether the entirety of the purported contract was performed wholly within California, since Kuklinski was in Illinois when he downloaded the BAM application.
3. Extraterritorial Application BAM argues that Kuklinski’s complaint is barred by the “extraterritorial doctrine” (Doc. 55). Under Illinois law, a “statute is without extraterritorial effect unless a clear intent in this respect appears from the express provisions of the statute.” Avery v. State Farm Mut. Auto. Ins. Co., 216 Ill. 2d 100, 184–85 (2005)). In the absence of such an intent, a plaintiff may only maintain a cause of action under an Illinois statute if “the circumstances that relate to the disputed
transaction occur[red] primarily and substantially in Illinois.” Id. at 187; see also Morrison v. YTB Int'l, Inc., 649 F.3d 533, 536 (7th Cir. 2011). As oft-cited, BIPA was enacted to “protect Illinois residents’ highly sensitive biometric information from unauthorized collection and disclosure”. See 740 ILCS 14/5(c). The statute itself is silent on the intent surrounding extraterritorial effect; therefore, the Court must determine whether the complained conduct “occurred
Page 20 of 29 primarily and substantially in Illinois.” Avery, 216 Ill.2d at 187. There is no bright line rule for determining where the conduct complained of “occurred primarily and substantially”; however, both our sister district to the north
as well as the Ninth Circuit have upheld cases involving Illinois residents having their biometric information collected in Illinois. See Rivera v. Google Inc., 238 F.Supp.3d 1088, 1101 (N.D. Ill. 2017) (Courts look to the residency of the plaintiff, the location of harm, communications between parties (where sent and where received), and where a company policy is carried out); see also Patel v. Facebook, Inc., 932 F.3d 1264, 1275-76 (9th Cir. 2019) (rejecting Facebook's argument that because
its servers are located outside Illinois, the necessary elements of a BIPA violation occurred extraterritorially, and reasoning that the Illinois legislature contemplated the statute's application to individuals who reside in Illinois and used Facebook in Illinois, even if some relevant activities occurred outside the state). In this case, Kuklinski is an Illinois resident, and as hereinbefore mentioned, BIPA was enacted to protect the rights of Illinois residents. Moreover, Kuklinski alleges that he downloaded the BAM application and created the BAM account while
he was in Illinois. Accordingly, this Court finds that the relevant events in this case occurred primarily and substantially in Illinois. 4. Fails to State a Claim In a last ditch effort to support dismissal, BAM argues that Kuklinski did not adequately allege a violation of BIPA in accordance with Rule 8 of the Federal Rules of Civil Procedure (Doc. 55). Specifically, BAM raises concerns that Kuklinski has
Page 21 of 29 lumped it together with BCM and Jumio and has not attributed the alleged violative conduct to any specific defendant (Id., p. 16). Unlike Rule 9(b), which requires claims of fraud and/or mistake be pled with
particularity, Rule 8(a) states as follows: “(a) Claim for Relief. A pleading that states a claim for relief must contain:
(1) a short and plain statement of the grounds for the court's jurisdiction, unless the court already has jurisdiction and the claim needs no new jurisdictional support;
(2) a short and plain statement of the claim showing that the pleader is entitled to relief; and
(3) a demand for the relief sought, which may include relief in the alternative or different types of relief.” Fed. R. Civ. P. 8(a).
Additionally, Rule 8(d)(1) specifies that a pleading must be simple, concise, and direct while Rule 8(d)(2) and 8(d)(3) allow for alternative statements of a claim as well as inconsistent claims. A complaint must “give the defendant fair notice of what the ... claim is and the grounds upon which it rests,” and its “[f]actual allegations must ... raise a right to relief above the speculative level.” Pisciotta v. Old Nat'l Bancorp, 499 F.3d 629, 633 (7th Cir. 2007). “There is no ‘group pleading’ doctrine per se that either permits or forbids allegations against defendants collectively.” Robles v. City of Chicago, 354 F. Supp. 3d 873, 875 (N.D. Ill. 2019). Notice is what counts. Id. Instead, the Complaint must include “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007); see Fed. R. Civ. P. 8(a)(2). Stated otherwise, a facially plausible complaint is one which permits “the court to draw the Page 22 of 29 reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Where the actions of “multiple defendants [are] so intertwined that no one from the outside could possibly separate the different
subsidiaries' alleged [mis]conduct,” a complaint can comply with Rule 8’s notice pleading requirement without detailing each defendant’s behavior. Acantha LLC v. Depuy Synthes Sales, Inc., 2016 WL 8201781 (E.D. Wis. July 28, 2016). BIPA does not require heightened pleading. In this case, BAM was placed on notice of the potential liability under BIPA. Accordingly, this Court finds that Kuklinski has adequately alleged a cause of action against BAM. Indeed, all a
plaintiff must do is allege that defendants collected, captured, purchased, received, or obtained their fingerprints without complying with BIPA’s requirements. See Roberson v. Maestro Consulting Services LLC, 507 F.Supp.3d 998, 1018 (S.D. Ill. 2020). Accordingly, for purposes of this 12(b)(6) motion, Kuklinski has pled sufficient facts to state a cause of action against BAM. B. Unjust Enrichment Next, BAM moves to dismiss Kuklinski’s unjust enrichment claim alleged in
the amended class action complaint (Doc. 55). In particular, BAM argues that the unjust enrichment claim is derivative of the BIPA claim (Id.). BAM further asserts that Kuklinski did not adequately plead his unjust enrichment claim (Id.). It is true that under Illinois law, unjust enrichment “is not a separate cause of action that, standing alone, would justify an action for recovery.” Toushin v. Ruggiero, 2021 WL 2718495 (Ill.App.Ct. 1st Dist. 2021) (quoting Mulligan v. QVC, Inc., 888
Page 23 of 29 N.E.2d 1190, 1200 (Ill.App.Ct. 1st Dist. 2008)). “[I]f an unjust enrichment claim rests on the same improper conduct alleged in another claim, then the unjust enrichment claim will be tied to this related claim—and, of course, unjust enrichment will stand
or fall with the related claim.” Cleary v. Philip Morris Inc., 656 F.3d 511, 517 (7th Cir. 2011). Because plaintiffs have sufficiently alleged their BIPA claims, the Court also denies BAM’s motion to dismiss the unjust enrichment claim that is secondary to the BIPA claims. III. Jumio Corporation (“Jumio”) Jumio offers software to businesses, including BAM, to help them verify the
identities of their customers. In its motion to dismiss, Jumio asserts the following five reasons for dismissal: (1) BIPA does not apply to this case because BAM is a financial institution subject to GLBA; (2) BIPA has no extraterritorial application; (3) Jumio has developed a publicly available retention policy; (4) Claims against Jumio before March 24, 2019 are preempted by settlement in Prelipceanu v. Jumio Corporation, 2018-CH-15883 (Cook County, IL July 21, 2020); and, (5) Application of BIPA against Jumio violates the First Amendment (Doc. 53).
On March 13, 2023, this Court granted Kuklinski’s Motion for Leave to File Supplemental Authority (Doc. 80), allowing submission of the recent decision from the Northern District of Illinois, to wit: Davis v. Jumio Corporation, 22-cv-00776 (N.D.Ill. February 14, 2023) (Doc. 83). While the Court has reviewed the Davis decision, it is important to note that Davis did not involve all of the parties in this case nor is it considered binding authority.
Page 24 of 29 1. Financial Institution Jumio first argues that Kuklinski’s claims against it should be dismissed because BIPA does not apply to financial institutions; in other words, because BIPA
cannot be applied against BAM, any application against Jumio would also be unlawful (Doc. 53). In response, Kuklinski counters that BAM is a cryptocurrency exchange and not a financial institution, that BIPA is applicable to BAM, and consequently applicable to Jumio (Doc. 62). This Court went thru the financial institution analysis infra (Section II, A, 1) and determined that BAM was NOT exempt under BIPA. Accordingly, this Court
extends that determination to Jumio’s motion and does not accept this argument. 2. No Extraterritorial Application Jumio next argues that BIPA does not apply extraterritorially (Doc. 53). Jumio further contends that Kuklinski did not sufficiently allege that the relevant conduct occurred primarily and substantially in Illinois (Id.). In response, Kuklinski outlined the paragraphs within the amended complaint where Jumio’s conduct was alleged in violation of BIPA, and also identified the specific paragraphs wherein Kuklinski, an
Illinois resident, downloaded the BAM application that contained the Jumio software and created his BAM account while in Illinois (Doc. 62). Kuklinski’s response also reiterated that he downloaded the BAM application while in Cook County, IL. It is true that BIPA does not apply extraterritorially; however, this Court has determined, albeit with respect to BAM (See II, A, 3, infra), that the relevant events in this case occurred primarily and substantially in Illinois by an Illinois resident.
Page 25 of 29 Accordingly, there are sufficient facts alleged to plausibly support Kuklinski’s claim that the conduct against Jumio also occurred in Illinois to deny dismissal and proceed to discovery.
3. Retention Policy Jumio’s third argument questions Kuklinski’s claims under BIPA §14/15(a) because Jumio claims to have complied with the required privacy and retention policy (Doc. 53). Section 15(a) of BIPA requires a private entity in possession of biometric data to develop, publicly disclose, and comply with a retention schedule and guidelines for destroying the data within specified time limits. 740 ILCS 14/15(a).
This case originated on October 4, 20216. Kuklinski downloaded the BAM application on March 15, 2021 (Doc. 45, ¶ 26). While Jumio attached its privacy policy to the motion to dismiss, it did not indicate when said policy went into effect (Doc. 53- 6). The mere fact that Jumio may or may not have complied with BIPA does not bely the fact that there may have been a violation of the Biometric Act. In fact, the Illinois Supreme Court has held the opposite. See Rosenbach v. Six Flags Entertainment Corporation, et al., 129 N.E.2d 1197 (Ill. 2019) (A person need not have sustained
actual damage beyond violation of his or her rights under [the Biometric Act] in order to bring an action under it; the violation, in itself, is sufficient to support the individual's or customer's statutory cause of action.). Furthermore, questions arise as to whether said policy even complies with BIPA.
6 The case was filed in the Circuit Court for the Twentieth Judicial Circuit, St. Clair County, Illinois, to wit: 21L962. Page 26 of 29 4. Cook County Settlement Jumio’s next argument is that any claims based on the period of time before June 23, 2019 are preempted by the class action settlement in Prelipceanu v. Jumio,
2018-CH-15883 (Cook County, IL, July 21, 2020). Specifically, the Prelipceanu settlement class was designated as follows: “All individuals in Illinois whose Biometrics or photos were collected, captured, purchased, received through trade, otherwise obtained or in the possession of Jumio and/or any of its parents, subsidiaries, or agents, or their technology, at any time between December 21, 2013 and December 23, 2019.” (Doc. 53-1).
Kuklinski does not address this argument, which can be deemed as acquiescence. See Alioto v. Town of Lisbon, 651 F.3d 715 (7th Cir. 2011) (a person waives an argument by failing to make it before the district court); Goodpaster v. City of Indianapolis, 736 F.3d 1060, 1075 (7th Cir. 2013) (claims waived where party asserting them did not provide the district court with any basis to decide them and did not respond to [the opposing party's] arguments”). Within the amended complaint, Kuklinski asserts the action is being brought
on his behalf and the following Illinois class, “All Illinois users and account holders whose facial and biometric data have been collected by the Binance.US applications, software and website.” (Doc. 45, ¶ 48). While Kuklinski did not expressly raise any dates or time parameters within the amended complaint, this Court will consider whether any potential recovery will be limited to claims arising after June 23, 2019 at a more appropriate time.
Page 27 of 29 5. First Amendment Jumio’s last argument is that interpreting BIPA 14/15(b) to apply to Jumio’s conduct would render BIPA unconstitutional (Doc. 53). Specifically, Jumio claims
that the First Amendment protects the right to make recordings and that BIPA interferes with this right; however, this argument is unpersuasive. Kuklinski counters and points to a recent decision from the Northern District wherein the Court went through an in depth analysis of the First Amendment as applied to BIPA § 14/15 (b) and found no restrictive speech, or if there was restrictive speech, it was a content-neutral restriction that satisfied the intermediate level of
scrutiny. Sosa v. Onfido, Inc., 600 F.Supp. 3d 859 (N.D. Ill. 2022). This Court concurs with the Sosa decision analysis and decision. Accordingly, Jumio’s motion fails. CONCLUSION In light of the forgoing, this Court does not have jurisdiction over BCM; however, Kuklinski has sufficiently pled causes of action against BAM and Jumio and
has plausibly alleged that he is entitled to relief. This is the pleading stage, not the proving stage. Because the purpose of a Rule 12(b)(6) motion to dismiss is to test the sufficiency of the complaint, not to resolve the case on the merits, any disputed issues may be better suited for disposition on a motion for summary judgment, after the case has been more fully developed through discovery. Accordingly, the motion to dismiss for lack of jurisdiction filed by Binance
Capital Management Co. is GRANTED with prejudice; however, the motions to Page 28 of 29 dismiss filed by defendants BAM Trading Services Inc. and Jumio Corporation are DENIED. BAM and Jumio shall answer the amended complaint within 14 days, or by April 19, 2023.
Finally, this Court lifts the stay that was entered on July 29, 2022. Additionally, because many of the deadlines set forth in the Scheduling Order were delayed by the stay, the presumptive trial is extended from February 2024 to November 2024. As such, the parties shall submit an Amended Joint Report of the Parties and Proposed Scheduling and Discovery Order within 21 days, or by April 26, 2023.
IT IS SO ORDERED.
DATED: April 4, 2023
/s/ Stephen P. McGlynn_ STEPHEN P. McGLYNN U.S. District Judge
Page 29 of 29