IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION
) NICHOLAS MARQUEZ, individually ) and on behalf of all others similarly ) situated, ) No. 20 C 4454 ) Plaintiff, ) Judge Virginia M. Kendall ) v. )
) GOOGLE LLC, ) Defendant. )
MEMORANDUM OPINION AND ORDER Before the Court is Plaintiff’s motion to sever and remand his claim under § 15(a) of the Illinois Biometric Information Privacy Act to the Circuit Court of Will County for lack of Article III standing. Plaintiff’s motion to sever and remand is granted. BACKGROUND In May 2015, according to Plaintiff Nicholas Marquez, Defendant Google LLC (“Google”) released Google Photos, a photo sharing and storage service. (Dkt. 1-1 ¶¶ 8, 20). Marquez alleges that the Google Photos app is pre-installed on Google Android devices and set by default to automatically upload all photos taken on such devices to the cloud-based Google Photos service. (Dkt. 1-1 at 22). Marquez contends that every photo uploaded to Google Photo is scanned by “FaceNet” (Google’s proprietary facial recognition technology) to extract biometric data and create highly detailed and sophisticated “face models” of those depicted in the photos. (Dkt. 1-1 ¶¶ 20–27). According to Marquez, Google collects, stores, and uses this biometric data without providing notice, obtaining written consent, or publishing data retention policies. (Dkt. 1-1 ¶¶ 4, 16). Marquez contends he purchased a Google Android, took
photos of himself with the device, and that these photos were automatically uploaded to Google Photos. (Dkt. 1-1 ¶¶ 32–33). Marquez claims Google used its FaceNet technology to extract his biometric data from these photos. (Dkt. 1-1 at 34–37). Marquez alleges that Google never disclosed it would extract his biometric data, never obtained his written consent to do so, and never afforded him the opportunity to prohibit or prevent such extraction. (Dkt. 1-1 at 38–40).
Marquez filed this putative class action in the Circuit Court of Will County, Illinois, against Google alleging violations of the Illinois Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/1 et seq on March 23, 2020. (Dkt. 1-1). Specifically, Marquez alleges Google violated both BIPA § 15(a) and BIPA § 15(b). (Dkt. 1-1 ¶¶ 46–55). Google timely removed the suit under 28 U.S.C. § 1453(b) on July 29, 2020, premising jurisdiction on the Class Action Fairness Act, 28 U.S.C. § 1332(d). (Dkt. 1). Marquez moves to sever and remand his claim under BIPA § 15(a) to state
court for lack of Article III standing. (Dkt. 11). Marquez’s motion to sever and remand is granted. LEGAL STANDARD As the party invoking federal jurisdiction, Google bears the burden of establishing Marquez’s Article III standing. See Tri-State Water Treatment, Inc. v. Bauer, 845 F.3d 350, 352–53 (7th Cir. 2017) (explaining that “the party seeking removal . . . bears the burden of establishing federal jurisdiction”); Collier v. SP Plus Corp., 889 F.3d 894, 896 (7th Cir. 2018) (“As the party invoking federal jurisdiction, [Defendant] had to establish that all elements of jurisdiction—including Article III
standing—existed at the time of removal.”). To establish that Marquez has Article III standing, Google must demonstrate that Marquez alleges an injury-in-fact that was caused by Google and that is redressable by this Court. See Groshek v. Time Warner Cable, Inc., 865 F.3d 884, 886 (7th Cir. 2017) (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992) (“The ‘irreducible constitutional minimum of standing consists of three elements: injury-in-fact, causation, and redressability.”).
An injury-in-fact is an injury that is “concrete and particularized” and “actual and imminent, not conjectural or hypothetical.” Spokeo, Inc. v. Robbins, 136 S. Ct. 1540, 1548 (2016). To be concrete, an injury “must be ‘de facto’; that is, it must actually exist.” Id. (quoting Black’s Law Dictionary 479 (9th ed. 2009). Although both “tangible” and “intangible” injuries, even those that are “difficult to prove or measure,” can be concrete, “a bare procedural violation, divorced from any concrete harm,” does not “satisfy the injury-in-fact requirement of Article III.” Id. at 1548–49.
A statutory violation must present an “‘appreciable risk of harm to the underlying interest [the legislature] sought to protect by enacting the statute’” to cause a concrete injury for Article III standing. Groshek, 865 F.3d at 887 (quoting Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 727 (7th Cir. 2016). DISCUSSION BIPA “regulat[es] the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” 740 ILCS
14/5(g). “Biometric identifier” is defined to include a “scan of . . . face geometry.” 740 ILCS 14/10. A biometric identifier is particularly sensitive because, unlike other unique identifiers such as a social security number, it cannot be “changed,” which means that “once [it is] compromised, the individual has no recourse [and] is at heightened risk for identity theft.” 740 ILCS 14/5(c). Recognizing this concern, Illinois adopted BIPA to protect the privacy of biometric data. See Rosenbach v. Six
Flags Entm’t Corp., 129 N.E.3d 1197, 1206–07 (Ill. 2019). BIPA allows a private right of action by “[a]ny person aggrieved by a violation.” 740 ILCS 14/20. At issue here is Marquez’s standing to bring his claim under BIPA § 15(a), which requires private entities that possess biometric data to develop, publish, and comply with a written policy that includes a retention schedule and destruction guidelines. 740 ILCS 14/15(a). In Bryant v. Compass Group USA, Inc., the Seventh Circuit held that “the duty to disclose under section 15(a) is owed to the public
generally, not to particular persons whose biometric information the entity collects.” 958 F.3d 617, 626 (7th Cir. 2020). Because the plaintiff’s claim in Bryan—that the defendant failed to establish a written retention schedule and destruction guidelines—did not include “alleg[ations of] particularized harm that resulted from [Defendant’s] violation of section 15(a),” it amounted to an alleged procedural violation insufficient to establish Article III standing. Id. Significantly, the Seventh Circuit’s holding did not extend to “the provision [of BIPA § 15(a)] requiring compliance with the established retention schedule and destruction guidelines.” Id. (emphasis added). Google argues that remand of Marquez’s BIPA § 15(a) claim is
inappropriate because Marquez alleges that Google failed to comply with BIPA § 15(a)’s deletion requirements and thereby pleads a violation of individual privacy rights sufficient for Article III standing. (Dkt. 15 at 1). Marquez does not allege that Google failed to comply with BIPA § 15(a)’s deletion requirements.
Free access — add to your briefcase to read the full text and ask questions with AI
IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION
) NICHOLAS MARQUEZ, individually ) and on behalf of all others similarly ) situated, ) No. 20 C 4454 ) Plaintiff, ) Judge Virginia M. Kendall ) v. )
) GOOGLE LLC, ) Defendant. )
MEMORANDUM OPINION AND ORDER Before the Court is Plaintiff’s motion to sever and remand his claim under § 15(a) of the Illinois Biometric Information Privacy Act to the Circuit Court of Will County for lack of Article III standing. Plaintiff’s motion to sever and remand is granted. BACKGROUND In May 2015, according to Plaintiff Nicholas Marquez, Defendant Google LLC (“Google”) released Google Photos, a photo sharing and storage service. (Dkt. 1-1 ¶¶ 8, 20). Marquez alleges that the Google Photos app is pre-installed on Google Android devices and set by default to automatically upload all photos taken on such devices to the cloud-based Google Photos service. (Dkt. 1-1 at 22). Marquez contends that every photo uploaded to Google Photo is scanned by “FaceNet” (Google’s proprietary facial recognition technology) to extract biometric data and create highly detailed and sophisticated “face models” of those depicted in the photos. (Dkt. 1-1 ¶¶ 20–27). According to Marquez, Google collects, stores, and uses this biometric data without providing notice, obtaining written consent, or publishing data retention policies. (Dkt. 1-1 ¶¶ 4, 16). Marquez contends he purchased a Google Android, took
photos of himself with the device, and that these photos were automatically uploaded to Google Photos. (Dkt. 1-1 ¶¶ 32–33). Marquez claims Google used its FaceNet technology to extract his biometric data from these photos. (Dkt. 1-1 at 34–37). Marquez alleges that Google never disclosed it would extract his biometric data, never obtained his written consent to do so, and never afforded him the opportunity to prohibit or prevent such extraction. (Dkt. 1-1 at 38–40).
Marquez filed this putative class action in the Circuit Court of Will County, Illinois, against Google alleging violations of the Illinois Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/1 et seq on March 23, 2020. (Dkt. 1-1). Specifically, Marquez alleges Google violated both BIPA § 15(a) and BIPA § 15(b). (Dkt. 1-1 ¶¶ 46–55). Google timely removed the suit under 28 U.S.C. § 1453(b) on July 29, 2020, premising jurisdiction on the Class Action Fairness Act, 28 U.S.C. § 1332(d). (Dkt. 1). Marquez moves to sever and remand his claim under BIPA § 15(a) to state
court for lack of Article III standing. (Dkt. 11). Marquez’s motion to sever and remand is granted. LEGAL STANDARD As the party invoking federal jurisdiction, Google bears the burden of establishing Marquez’s Article III standing. See Tri-State Water Treatment, Inc. v. Bauer, 845 F.3d 350, 352–53 (7th Cir. 2017) (explaining that “the party seeking removal . . . bears the burden of establishing federal jurisdiction”); Collier v. SP Plus Corp., 889 F.3d 894, 896 (7th Cir. 2018) (“As the party invoking federal jurisdiction, [Defendant] had to establish that all elements of jurisdiction—including Article III
standing—existed at the time of removal.”). To establish that Marquez has Article III standing, Google must demonstrate that Marquez alleges an injury-in-fact that was caused by Google and that is redressable by this Court. See Groshek v. Time Warner Cable, Inc., 865 F.3d 884, 886 (7th Cir. 2017) (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992) (“The ‘irreducible constitutional minimum of standing consists of three elements: injury-in-fact, causation, and redressability.”).
An injury-in-fact is an injury that is “concrete and particularized” and “actual and imminent, not conjectural or hypothetical.” Spokeo, Inc. v. Robbins, 136 S. Ct. 1540, 1548 (2016). To be concrete, an injury “must be ‘de facto’; that is, it must actually exist.” Id. (quoting Black’s Law Dictionary 479 (9th ed. 2009). Although both “tangible” and “intangible” injuries, even those that are “difficult to prove or measure,” can be concrete, “a bare procedural violation, divorced from any concrete harm,” does not “satisfy the injury-in-fact requirement of Article III.” Id. at 1548–49.
A statutory violation must present an “‘appreciable risk of harm to the underlying interest [the legislature] sought to protect by enacting the statute’” to cause a concrete injury for Article III standing. Groshek, 865 F.3d at 887 (quoting Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 727 (7th Cir. 2016). DISCUSSION BIPA “regulat[es] the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” 740 ILCS
14/5(g). “Biometric identifier” is defined to include a “scan of . . . face geometry.” 740 ILCS 14/10. A biometric identifier is particularly sensitive because, unlike other unique identifiers such as a social security number, it cannot be “changed,” which means that “once [it is] compromised, the individual has no recourse [and] is at heightened risk for identity theft.” 740 ILCS 14/5(c). Recognizing this concern, Illinois adopted BIPA to protect the privacy of biometric data. See Rosenbach v. Six
Flags Entm’t Corp., 129 N.E.3d 1197, 1206–07 (Ill. 2019). BIPA allows a private right of action by “[a]ny person aggrieved by a violation.” 740 ILCS 14/20. At issue here is Marquez’s standing to bring his claim under BIPA § 15(a), which requires private entities that possess biometric data to develop, publish, and comply with a written policy that includes a retention schedule and destruction guidelines. 740 ILCS 14/15(a). In Bryant v. Compass Group USA, Inc., the Seventh Circuit held that “the duty to disclose under section 15(a) is owed to the public
generally, not to particular persons whose biometric information the entity collects.” 958 F.3d 617, 626 (7th Cir. 2020). Because the plaintiff’s claim in Bryan—that the defendant failed to establish a written retention schedule and destruction guidelines—did not include “alleg[ations of] particularized harm that resulted from [Defendant’s] violation of section 15(a),” it amounted to an alleged procedural violation insufficient to establish Article III standing. Id. Significantly, the Seventh Circuit’s holding did not extend to “the provision [of BIPA § 15(a)] requiring compliance with the established retention schedule and destruction guidelines.” Id. (emphasis added). Google argues that remand of Marquez’s BIPA § 15(a) claim is
inappropriate because Marquez alleges that Google failed to comply with BIPA § 15(a)’s deletion requirements and thereby pleads a violation of individual privacy rights sufficient for Article III standing. (Dkt. 15 at 1). Marquez does not allege that Google failed to comply with BIPA § 15(a)’s deletion requirements. First, when quoting the statutory text, the Complaint omits the portion of BIPA § 15(a) addressing compliance. Compare 740 ILCS § 15(a) with
(Dkt. 1-1 ¶ 15 omitting “[A] private entity in possession of biometric identifiers or biometric information must comply with its established retention schedule and destruction guidelines.”) (emphasis added). Second, the Complaint consistently characterizes Google’s alleged BIPA § 15(a) violation as a failure to “provide a publicly available written policy regarding its schedule and guidance for the retention and permanent destruction of individuals’ biometrics.” (Dkt. 1-1 ¶ 16); see also (Dkt. 1-1 ¶ 26 “In direct violation of § 15(a) of the BIPA, Google does not have written,
publicly available policies identifying their retention schedules, or guidelines for permanently destroying biometric identifiers or information.”); (Dkt. 1-1 ¶ 53 “Google does not publicly provide a retention schedule or guidelines for permanently destroying the ‘biometric identifiers’ and ‘biometric information’ of Plaintiff or Class members.”). Nowhere does the Complaint address compliance with mandated BIPA § 15(a) policies or deletion requirements. Google’s argument that “stor[ed]” really means “failed to delete” in the context of the Complaint’s BIPA § 15(a) pleading is unconvincing. Storage is not synonymous with a failure to delete, particularly given the Complaint’s silence as to when Google collected Marquez’s biometric data, how
long Google retained Marquez’s biometric data, and the date of Marquez’s last interaction with Google. See (Dkt. 1-1). Moreover, the complaint at issue in Bryant alleged the defendant stored plaintiff’s biometric data and the Seventh Circuit nonetheless held the plaintiff lacked Article III standing to pursue the BIPA § 15(a) claim. See Bryant, 958 F.3d at 619–20. Third, on reply Marquez affirms that his “Section 15(a) claim arises only from allegations that Google failed to publish the
requisite policies—not from any allegations that Google additionally failed to comply with Section 15(a)’s mandated deletion or retention schedules.” (Dkt. 16 at 2). Instead, this Complaint is like that at issue in Bryant. Marquez alleges Google violated BIPA § 15(a) by failing to publish data retention policies. (Dkt. 1-1 ¶¶ 16, 26, 53). See also Bryant,958 F.3d at 619–20, 626. Like the plaintiff in Bryant, Marquez does not plead any particularized harm which arose out of Google’s alleged violation of BIPA § 15(a). See Bryant, F.3d at 626. Marquez lacks standing under
Article III to pursue his BIPA § 15(a) claim in federal court. See id. When a case is filed in state court and removed to federal court, and when the federal court finds it lacks subject matter jurisdiction, the appropriate disposition is a remand to state court under 28 U.S.C. § 1447(c). See Collier v. SP Plus Corp., 889 F.3d 894, 897 (7th Cir. 2018). Where, as here, the court lacks jurisdiction only over a portion of a suit, it should remand only that portion. See Bergquist v. Mann Bracken, LLP, 592 F.3d 816, 819 (7th Cir. 2010) (“If some portions of a single suit are within federal jurisdiction, while others are not, the federal court must resolve the elements within federal jurisdiction and remand the rest.”). Marquez’s BIPA § 15(a) claim is severed under Federal Rule of Civil Procedure 21 and remanded to the Circuit Court of Will County. See Fed. R. Civ. P. 21 (“The court may... sever any claim against a party.”); see also, e.g., Figueroa v. Kronos, Inc., No. 19 C 1306, 2020 WL 4273995, at *5 (N.D. Ill. Jul. 24, 2020) (severing plaintiffs’ BIPA § 15(a) claim from their BIPA § 15(b) claim and remanding to state court for lack of subject matter jurisdiction). CONCLUSION For the foregoing reasons, Marquez’s motion to sever and remand his claim under BIPA § 15(a) is granted. The Clerk of Court is directed to remand case to the Circuit Court of Will County, Illinois, forthwith.
x oO A paunial |: HKenstot Aaah f MME ginia M. Kendall United States District Judge Date: October 27, 2020
Page 7 of 7