Mahmood v. Berbix Inc.

Opinion

UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION

SABA MAHMOOD, individually and on ) behalf of all similarly situated individuals, ) ) Case No. 22 C 2456 Plaintiff, ) ) Judge Sharon Johnson Coleman v. ) ) BERBIX, INC., a Delaware corporation, ) ) Defendant. )

MEMORANDUM OPINION AND ORDER On May 9, 2022, defendant Berbix, Inc. removed this lawsuit from the Circuit Court of Lake County, Illinois based on the Court’s jurisdiction under the Class Action Fairness Act, 28 U.S.C. § 1332(d) and the diversity jurisdiction statute, 28 U.S.C. § 1332(a)(1). Before the Court is Berbix’s motion to dismiss under Federal Rule of Civil Procedure 12(b)(6). For the following reasons, the Court denies Berbix’s motion. Background Plaintiff Saba Mahmood brings this lawsuit pursuant to the Illinois Biometric Information Act (“BIPA”), 740 ILCS 14/1, et seq. In her complaint, Mahmood alleges that Berbix is a developer of online identification verification services, which includes a biometric verification component. Berbix integrates its identity verification services with its clients’ websites to collect information, including biometric data, directly from its clients’ customers. In doing so, Berbix “uses facial recognition technology for verification and fraud detection purposes.” In August 2020, Mahmood registered with one of Berbix’s clients, SilverCar by Audi, a car rental company with significant operations in Illinois. After signing up with SilverCar, Mahmood was required to upload her Illinois Driver’s License and a separate “selfie” photograph to Berbix’s identity-verification platform. Using its proprietary facial recognition and technology, Berbix then collated, stored, and analyzed Mahmood’s facial geometry to compare her face with the photograph on her Illinois Driver’s License in order to verify her age and identity. Mahmood alleges that Berbix then disclosed or disseminated her biometric data to third parties for data storage and to facilitate future transactions, but failed to obtain Mahmood’s consent to do so. She also alleges Berbix unlawfully profited from her facial biometrics.

Legal Standard A motion to dismiss pursuant to Rule 12(b)(6) for failure to state a claim tests the sufficiency of the complaint, not its merits. Skinner v. Switzer, 562 U.S. 521, 529, 131 S.Ct. 1289, 179 L.Ed.2d 233 (2011). When considering dismissal of a complaint, the Court accepts all well-pleaded factual allegations as true and draws all reasonable inferences in favor of the plaintiff. Erickson v. Pardus, 551 U.S. 89, 94, 127 S.Ct. 2197, 167 L.Ed.2d 1081 (2007) (per curiam). To survive a motion to dismiss, plaintiff must “state a claim for relief that is plausible on its face.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). When ruling on a motion to dismiss, courts “may consider documents attached to the pleadings so long as the documents are referred to in the complaint and central to the plaintiff’s claims.” Doe v. Columbia Coll. Chicago, 933 F.3d 849, 854 (7th Cir. 2019). Discussion Extraterritorially

Berbix first argues BIPA does not apply extraterritorially. Indeed, because BIPA does not expressly intend to operate extraterritorially, the alleged BIPA violations must have taken place in Illinois. See Avery v. State Farm Mut. Auto. Ins. Co., 216 Ill.2d 100, 296 Ill.Dec. 448, 835 N.E.2d 801, 852 (Ill. 2005). In Avery, the Illinois Supreme Court concluded “there is no single formula or bright- line test for determining whether a transaction occurs within this state.” Id. at 187. The critical question is whether the circumstances relating to the violations occurred “primarily” and “substantially” in Illinois. Id. In making this inquiry, courts look to “the residency of the plaintiff, the location of harm, communications between parties (where sent and where received), and where a company policy is carried out.” Rivera v. Google Inc., 238 F.Supp.3d 1088, 1101 (N.D. Ill. 2017) (Chang, J.). Berbix asserts Mahmood failed to allege her transaction with SilverCar occurred in Illinois. Viewing the allegations and all reasonable inferences in her favor, Mahmood has plausibly alleged

her transaction with SilverCar took place primarily and substantially in Illinois. She specifically alleges she is an Illinois resident and SilverCar has significant operations in Illinois, leading to the reasonable inference that she uploaded her Illinois Driver’s License on Berbix’s platform while she was in Illinois. Furthermore, the Court recognizes applying the extraterritoriality doctrine is a fact intensive inquiry best left for summary judgment. See Rivera, 238 F.Supp.3d at 1102. As such, the Court denies Berbix’s motion to dismiss based on the extraterritoriality doctrine. Dormant Commerce Clause Next, Berbix argues BIPA, as sought to be applied here, violates the Dormant Commerce Clause of the United States Constitution. “While the Commerce Clause, U.S. CONST. art. I § 8, cl. 3, explicitly grants Congress the authority to regulate commerce among the States, it has long been understood that it also directly limits the power of the States to discriminate against or burden interstate commerce.” Alliant Energy Corp. v. Bie, 330 F.3d 904, 911 (7th Cir. 2003). The restraint on

the power of states to regulate commerce is called the Dormant Commerce Clause. Regan v. City of Hammond, Ind., 934 F.3d 700, 702 (7th Cir. 2019). The Dormant Commerce Clause prohibits “the application of a state statute to commerce that takes places wholly outside of the State’s borders, whether or not the commerce has effects within the State.” Healy v. Beer Inst., Inc., 491 U.S. 324, 336, 109 S.Ct. 2491, 105 L.Ed.2d 275 (1989). As discussed, Mahmood has plausibly alleged Berbix’s BIPA violations occurred primarily and substantially in Illinois, therefore, the violations did not take place “wholly outside” of Illinois. In addition, whether BIPA as applied controls “commercial conduct wholly outside Illinois is not possible to figure out without a better factual understanding” of Berbix’s identity-verification platform, and thus this issue is best addressed at summary judgment. Rivera, 238 F. Supp.3d at 1104. The Court denies this aspect of Berbix’s motion to dismiss.

Speculative and Conclusory Allegations Further, Berbix argues Mahmood’s claims under BIPA §§15(c) and 15(d) fail for the additional reason that they are speculative and conclusory. Berbix first takes issue with Mahmood’s allegations that are based on “information and belief.” “Where pleadings concern matters peculiarly within the knowledge of the defendants, conclusory pleading on ‘information and belief’ should be liberally viewed.” Brown v. Budz, 398 F.3d 904, 914 (7th Cir. 2005) (citation omitted); see also 5 Wright & Miller, Federal Practice & Procedure § 1224, at 300 & n.7 (3d ed. 2004) (“Pleading on information and belief is a desirable and essential expedient when matters that are necessary to complete the statement of a claim are not within the knowledge of the plaintiff.”). Berbix’s argument suggesting otherwise is misplaced. Turning to Mahmood’s allegations, § 15(c) provides: “No private entity in possession of a biometric identifier or biometric information may sell, lease, trade, or otherwise profit from a

person’s or a customer’s biometric identifier or biometric information.” Viewing her well-pleaded allegations and all reasonable inferences in her favor, Mahmood has plausibly alleged Berbix violated § 15(c) because SilverCar paid for access to Berbix’s facial recognition platform to verify Mahmood’s age and identity before she rented a car. In short, Berbix’s collection and use of biometrics is a necessary component to its business model. See In re Clearview AI, Inc., Consumer Privacy Litig., ___ F.Supp.3d ___, 2022 WL 444135, at *8 (N.D. Ill. Feb. 14, 2022) (“At its core, plaintiffs’ claim concerns the sale of biometric data because the Clearview defendants’ business model is premised on collecting and capturing biometric data and then profiting from that data when customers pay to search the Clearview database.”). Next, “[s]ection 15(d) requires entities to obtain a person’s consent when disclosing or disseminating an individual’s biometric data.” Cothron v. White Castle System, Inc., 467 F.Supp.3d 604, 613 (N.D. Ill. 2020) (Tharp, J.). Here, Mahmood alleges Berbix disclosed or disseminated her

biometric data to third parties for data storage and to facilitate future transactions, but failed to obtain her consent to do so. Moreover, Berbix’s privacy policy, which Mahmood referenced in her complaint and attached to her response brief, states Berbix may share personal and identity information and data with third parties. As such, Mahmood has plausibly alleged her § 15(d) claim. See Iqbal, 556 U.S. at 679 (“Determining whether a complaint states a plausible claim for relief” is “a context-specific task that requires the reviewing court to draw on its judicial experience and common sense”). Nevertheless, Berbix maintains BIPA’s financial transaction exception bars Mahmood’s § 15(d) claim. In particular, § 15(d)(2) reads: No private entity in possession of a biometric identifier or biometric information may disclose, redisclose, or otherwise disseminate a person’s or a customer’s biometric identifier or biometric information unless … the disclosure or redisclosure completes a financial transaction requested or authorized by the subject of the biometric identifier or the biometric information or the subject’s legally authorized representative.

Id. (emphasis added).

The plain reading of the “financial transaction” exception defeats Berbix’s argument because the disclosure of the biometric information must be requested or authorized by the subject of the biometric information, namely, Mahmood, who unequivocally alleges she did not provide her consent. Moreover, Berbix’s reading of the “financial transaction” exception contradicts BIPA’s legislative history where the Illinois General Assembly was concerned with the non-consensual use of biometric information in business transactions. See Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1149-50 (7th Cir. 2020); Marsh v. CSL Plasma Inc., 503 F.Supp.3d 677, 681 (N.D. IIL. 2020) (Chang, J.). Therefore, the Court denies Berbix’s motion to dismiss Mahmood’s § 15(d) claim. Damages Last, Mahmood seeks not only statutory damages of $1,000 per violation, but in the alternative, seeks enhanced actual or liquidated damages of $5,000 per violation because the alleged BIPA violations were intentional or reckless. See 740 ILCS 14/20(2). A request for enhanced damages is a demand for relief, not part of a BIPA claim, therefore, Mahmood need not allege facts to show she is entitled to this enhanced relief. Sosa v. Onjido, Inc., ____ F.Supp. 3d ____, 2022 WL 1211506, at *10 (N.D. Il Apr. 25, 2022) (Aspen, J.); see also Figueroa v. Kronos Inc, 454 F.Supp.3d 772, 786 (N.D. IIL 2020) (“BIPA provides that recklessness offers a basis for greater liquidated damages, not for a separate claim.”’) (Feinerman, J.). Put differently, Mahmood need not allege a specific level of culpability to plausibly state her BIPA claims because the Act imposes liability regardless of a defendant’s state of mind. Swider v. Heartland Beef, Inc, 479 F.Supp.3d 762, 772 (C.D. Ill. 2020) (“BIPA imposes liability regardless of whether damage can be shown and regardless of the violator’s state of mind.”). The Court denies this aspect of Berbix’s motion to dismiss. Conclusion For these reasons, the Court denies defendant’s motion to dismiss [20]. The Court also denies defendant’s request for oral argument. IT IS SO ORDERED. Date: 8/25/2022 Entered: AOE __ HARON JOHNSON COLEMAN United States District Judge