McGoveran v. Amazon Web Services, Inc.

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF DELAWARE

CHRISTINE MCGOVERAN, et al., indi- vidually and on behalf of all others simi- larly situated, known and unknown,

Plaintiffs,

No. 1:20-cv-01399-SB v.

AMAZON WEB SERVICES, INC.

Defendant.

Alexander L. Braitberg, Andrew D. Schlichter, Joel Rohlf, Nathan D. Stump, Peter Cosgrove, SCHLICHTER BOGARD LLP, St. Louis, Missouri; David T. Crumplar, JACOBS & CRUMPLAR, P.A., Wilmington, Delaware

Counsel for Plaintiffs.

Jody C. Barillare, MORGAN LEWIS & BOCKIUS LLP, Wilmington, Delaware; Ari M. Selman, MORGAN LEWIS & BOCKIUS LLP, New York, New York; Elizabeth Herring- ton, MORGAN LEWIS & BOCKIUS LLP, Chicago, Illinois; Jordan McCrary, MORGAN LEWIS & BOCKIUS LLP, Los Angeles, California; Raechel K. Kummer, MORGAN LEWIS & BOCKIUS LLP, Washington, DC

Counsel for Defendant.

MEMORANDUM OPINION October 30, 2024

BIBAS, Circuit Judge, sitting by designation. I grant Amazon summary judgment on plaintiffs’ surviving claim. Plaintiffs sued Amazon Web Services, alleging that it violated Illinois’ Biometric Information Pri- vacy Act. D.I. 1, 47. They brought four counts, but I dismissed three of them without

prejudice. D.I. 74, 75. Plaintiffs amended their complaint, realleging all four claims. D.I. 175. Three of these claims require no new analysis. Counts I and III charged Amazon with violating Sections 15(a) and (c) of the Act. Id. at 37, 39–40. I had dismissed those claims for lack of standing, and plaintiffs have neither challenged that ruling nor shown new evidence of standing. D.I. 74 at 17–20; D.I. 250 at 6. Because the Court does not have jurisdiction over these claims, I dismiss them. In re Diet Drugs, 582

F.3d 524, 553 (3d Cir. 2009). Count IV alleged that Amazon violated Section 15(d) of the Act. D.I. 175 at 40–41. I had dismissed that claim for failure to state a claim. D.I. 74 at 22. Plaintiffs repleaded that claim without adding any of the allegations that I told them were necessary. Id. at 22–24; D.I. 175 at 40–41. So I granted Amazon judg- ment on the pleadings on Count IV. D.I. 269, 270. That leaves only Count II, in which plaintiffs alleged that Amazon violated Section

15(b) of the Act by collecting biometric data without getting informed, written con- sent. D.I. 74 at 22; D.I. 175 at 38–39. The thrust of the claim is that Illinois citizens called the financial company John Hancock; their calls were routed through Amazon Connect; and Amazon Connect used technology from a third company, Pindrop, to voiceprint the callers. This claim survived Amazon’s motion to dismiss. D.I. 74 at 22. But it does not survive summary judgment. I. I DENY PLAINTIFFS’ MOTION TO STRIKE AMAZON’S DECLARATIONS Amazon’s bid for summary judgment relies on three declarations that plaintiffs ask me to strike. D.I. 252, D.I. 234 (Sullivan declaration), D.I. 235 (Srirama declara-

tion), D.I. 236 (Stick declaration). So I must address that motion first. Plaintiffs argue that Amazon failed to disclose enough about the subject matter that each witness knew about. D.I. 253 at 2. Not so. A. The initial disclosure sufficed When a party will use information “to support its claims or defenses,” Rule 26 requires it to disclose to the other side “the name … of each individual likely to have discoverable information” and “the subjects of that information.” Fed. R. Civ. P.

26(a)(1)(A)(i). Amazon adequately disclosed the individuals and the subjects they knew about. In its initial disclosure in July 2023, Amazon listed the three relevant employees: Joseph Sullivan, Ramprasad Srirama, and Scott Stick. D.I. 253-1 at 2–3. It said each had “knowledge regarding the Amazon Connect services at issue in this case.” Id. Amazon also disclosed that Stick had information “regarding AWS’s relationship with John Hancock.” Id. at 3. Plus, Amazon listed these three witnesses at the very top of

its witness list. Id. at 2–3. And it included each of their job titles, showing that they were engineers or executives. Id. So plaintiffs had good reason to know about these witnesses and what information they had. Branch v. Temple Univ., No. 21-3099, 2023 WL 3993016, at *5 (3d Cir. June 14, 2023). Then, Amazon disclosed even more information during discovery. A few months after the initial disclosure, Amazon emailed plaintiffs’ lawyers a list of custodians. That list included the three witnesses and described their job responsibilities, titles, and their chain of command. D.I. 260-1 at 2. This disclosure said that: (1) Sullivan was the “head engineer for the Amazon Connect service,” (2) Srirama “advised

Pindrop regarding making its product available to Amazon Connect customers,” and (3) Stick was “the account representative for John Hancock.” Id. A few months after that, Amazon filed a declaration by Srirama, stating: “I am knowledgeable of the technical aspects of how Pindrop … makes its technology available to Amazon Con- nect customers.” D.I. 137-3 at 2. Plaintiffs object that the witnesses relied on business records in their declarations to supplement their personal knowledge. D.I. 253 at 4; see D.I. 234 at 1, D.I. 235 at 1,

D.I. 236 at 1. Yet, as they acknowledge, witnesses may supplement personal knowledge with business records. D.I. 278 at 2; see also Heyman v. Citimortgage, Inc., No. 14-1680-KM-MAH, 2019 WL 2642655, at *17 (D.N.J. June 27, 2019) (noting that many district courts admit testimony refreshed by business records under Fed. R. Civ. P. 56(c)(4)). Earlier, they said that Amazon did not produce the records the witnesses relied

on. D.I. 253 at 2. But Amazon has shown that it produced all these documents. D.I. 277 at 2; D.I. 277-1 at 2–3. Now they claim that Amazon should have produced even more documents because the witnesses must have relied on them to deliver technical testimony. D.I. 278 at 2–3. Not so. Amazon noted where the declarations were sup- plemented by business records. Sullivan relied on them only sparingly, often as mere examples. D.I. 234 at 10, 13, 15. Srirama relied on them a bit more. D.I. 235 at 7–8. And Stick did not rely on any business records. D.I. 236. There is no reason to pre- sume that Sullivan or Srirama needed business records to talk about technical de- tails: they both hold senior engineering roles that would expose them to the technical

features of Amazon Connect during their day-to-day work. D.I. 234 at 1; D.I. 235 at 1. Even if Amazon’s disclosures were inadequate, I would still admit the declara- tions. Plaintiffs’ objections come far too late, and the declarations do not sufficiently prejudice them. First, the initial disclosures came in July 2023, more than a year ago. D.I. 253-1. Plaintiffs should have objected then. Waiting more than a year is an unreasonable

delay that makes this motion untimely. Bush v. Dep’t of Hum. Servs., 714 F. App’x 180, 183 (3d Cir. 2017). Second, precluding evidence is “an extreme sanction, not normally to be imposed absent a showing of willful deception or flagrant disregard of a court order by the proponent of the evidence.” In re Paoli R.R. Yard PCB Litig., 35 F.3d 717, 791–92 (3d Cir. 1994) (internal quotation marks omitted). Courts in this circuit consider five fac-

tors when deciding whether to exclude evidence as a discovery sanction. LabMD Inc. v. Boback, 47 F.4th 164, 189 (3d Cir. 2022). On balance, those factors weigh against excluding the declarations. Three favor Amazon. Plaintiffs were not prejudiced because Amazon disclosed the identities of its witnesses and the subjects of which they had knowledge; Amazon has not acted in bad faith or willfully failed to comply with my orders; and the evidence composes the bulk of Amazon’s support for summary judgment, making it important. Even if Am- azon’s disclosures were inadequate, only two factors would tip in plaintiffs’ favor: they cannot cure any hypothetical prejudice from lack of disclosure now and the case could

go to trial. So three factors weigh against plaintiffs, and one of the two tips in their favor only because they waited too long to object. I will not strike the testimony. B. Neither Srirama nor Sullivan is an expert witness Plaintiffs also fault Amazon for supposedly smuggling expert opinions into the declarations. D.I. 253 at 3. They claim that Srirama and Sullivan opine on technical matters, making them expert witnesses under Rule 702. Id. And even if Srirama and Sullivan are not fully experts, they claim the witnesses are still hybrid experts. Id.

Rule 26 requires a party to “disclose to the other parties the identity of any witness it may use at trial to present” expert testimony. Fed. R. Civ. P. 26(a)(2)(A). And Rule 702 defines expert testimony as testimony “in the form of an opinion” made by some- one who “qualifie[s] as an expert by knowledge, skill, experience, training, or educa- tion.” Fed. R. Evid. 702. Neither Srirama nor Sullivan offers expert testimony; both are lay witnesses.

True, both testify in part about technical topics, like how Amazon Connect works. But testimony is not expert testimony just because it covers specialized or technical top- ics. United States v. Fulton, 837 F.3d 281, 301 (3d Cir. 2016). Rather, it must offer an expert opinion. But both witnesses stuck to the facts. Plaintiffs do not offer any spe- cific examples of either witness offering an opinion. D.I. 253. Their own briefing belies their argument that Srirama and Sullivan offered opinions. D.I. 253 at 3 (characterizing Srirama’s testimony as “how” certain technical features work, show- ing that it is fact, not expert testimony.). Even if they offered opinions, the declarations would still be admissible under Fed.

R. Evid. 701. Both stuck to testimony that “ha[s] a reasonable basis grounded either in experience or specialized knowledge.” United States v. Savage, 970 F.3d 217, 286 (3d Cir. 2020) (emphases in original). Both witnesses were allowed to give opinions about Amazon Connect “because the testimony is based upon [their] personal knowledge rather than on specialized knowledge within the scope of Rule 702.” Id. Both declared under oath that the facts in their declarations “are based on … personal knowledge.” D.I. 234 at 1; D.I. 235 at 1. Both are senior engineers at Amazon, so it

makes sense that they would have personal knowledge of the technical topics they testified about. Id. (both). So neither testimony needs to satisfy Rule 702. For all these reasons, I deny plaintiffs’ motion to strike. D.I. 252. II. I GRANT SUMMARY JUDGMENT FOR AMAZON I now turn to the summary-judgment motion. I must grant summary judgment if there is “no genuine dispute as to any material fact.” Fed. R. Civ. P. 56(a). I view facts

in the light most favorable to plaintiffs, the nonmovants. Knopick v. Connelly, 639 F.3d 600, 606 (3d Cir. 2011). I must enter summary judgment “against a party who fails to make a showing sufficient to establish the existence of an element essential to that party’s case.” Celotex Corp. v. Catrett, 477 U.S. 317, 322 (1986). A. The Act does not apply to Amazon’s extraterritorial activities Illinois laws do not apply to events outside Illinois unless “the express provisions of the statute” say so. Avery v. State Farm Mut. Auto. Ins. Co., 835 N.E.2d 801, 852 (Ill. 2005). The Act does not expressly say that it applies outside Illinois. See Vance v. Google LLC, No. 20-CV-04696-BLF, 2024 WL 1141007, at *3 (N.D. Cal. Mar. 15, 2024). This means that Plaintiffs have a claim only if the alleged violations occurred

“primarily and substantially” in Illinois. Avery, 835 N.E.2d at 854. The Court dismissed plaintiffs’ original complaint because they failed to “allege conduct that occurred primarily and substantially in Illinois.” D.I. 34 at 7. Though plaintiffs alleged that Amazon intercepted biometric information from Illinois callers, “[t]he location of the caller does not, however, say anything about the location where the rest of the conduct occurred.” D.I. 34 at 7. The Court then let plaintiffs amend the complaint. Even though Amazon gave “reason to be skeptical of Plaintiffs’ allega-

tions,” they could amend because they made “new allegations raising at least a plau- sible inference that the alleged misconduct occurred principally and substantially in Illinois.” D.I. 46. Specifically, they alleged that Amazon “interacted directly with Plaintiffs in Illinois.” D.I. 46. Discovery clarified that this is not true. Even though the callers are Illinois resi- dents, “[t]he overwhelming majority of circumstances relating to the disputed trans-

actions in this case … occurred outside of Illinois.” Avery, 835 N.E.2d at 854. To ex- plain why, I must first discuss how Amazon Connect works. 1. How Amazon Connect works. Amazon is a Delaware corporation, headquartered in Washington state. D.I. 234 at 1. One of its many business lines is Amazon Connect, cloud software that helps companies run their call centers. Id. Amazon Connect is “an open platform.” D.I. 235 at 1. This means that when a company buys Amazon Connect services, the company can integrate other software—both its own and third parties’— into it. Id. It is like leasing an apartment. Amazon is the landlord, letting a company use the apartment for a fee. D.I. 234 at 2–3; D.I. 235 at 5. The company can customize

the apartment, choosing its own features (like whether to have a home gym or kids’ playroom). Id. (both sources). Amazon has some rules about what the company can do. But it will not barge in unannounced; it gives customers freedom to keep their data private and customize the software as they would like. D.I. 234 at 2–3, 12–17; D.I. 235 at 5. One major selling point is that “only AWS customers can access their data.” D.I. 234 at 4. Companies use Amazon Connect because it replaces physical call centers. Amazon

Connect uses an automated voice-response system that processes what human callers say and connects them to the right service representative. D.I. 234 at 4. Most people have probably experienced a service like this when calling a big company. You speak or type commands, listen to the robot’s response, and eventually (if you are lucky) get connected with a human. Amazon Connect can recognize words but not particular voices. D.I. 234 at 4.

Thousands of companies around the world use Amazon Connect. Id. at 2. John Hancock is one of them. Id. It is a financial firm based in Massachusetts. D.I. 233-1 at 43 (tr. 166:13–25). It uses Amazon Connect to route customers’ calls to agents who can answer their questions. Id. at 5–6 (tr. 16:20–17:12). John Hancock set up steps for the call service to follow when customers call. D.I. 234 at 5. Like the tenant choosing to use the spare den for a kids’ playroom, John Hancock got to choose those steps. D.I. 234 at 8–10; D.I. 235 at 2. One step it chose is “authentication”—making sure the callers are who they say

they are. D.I. 234 at 5. For example, the robot might ask you for your name and birth- day, or the last four digits of your social security number. Amazon Connect does not have a default authentication process. D.I. 235 at 2. The customer can pick one. And John Hancock chose to use Pindrop’s authentication technology. Id. Pindrop is a Delaware corporation headquartered in Georgia that makes software to identify callers and prevent fraud. D.I. 175 ¶¶ 21, 67–69; D.I. 235 at 2; D.I. 233-3 at 10 (tr. 33:7–10). John Hancock customized its Amazon Connect to use Pindrop’s

technology to authenticate some calls. D.I. 235 at 3; D.I. 176-1 at 3. Amazon had no role in that choice; it does not even write the software that makes Pindrop compatible with Amazon Connect. D.I. 235 at 2. If John Hancock’s system triggers the Pindrop process, Pindrop itself authenticates the caller, not Amazon. D.I. 235 at 4. 2. How Amazon Connect worked here. Plaintiffs have shown that three of the named plaintiffs (Richard Dresser, Robert Ritter, and Traci Thompson) are Illinois

residents who were in the state when they called John Hancock. D.I. 190-5 at 2; D.I. 190-7 at 2; D.I. 190-6 at 2; D.I. 190-9 at 5; D.I. 190-10. When those plaintiffs called, John Hancock’s phone carrier (AT&T) routed their calls to Amazon Connect’s servers in Northern Virginia. D.I. 234 at 6; D.I. 236 at 2. Amazon Connect does not operate on any servers in Illinois. D.I. 234 at 17, 19. When Amazon Connect received the call, the steps John Hancock chose kicked in. Sometimes, a step would prompt Pindrop to “listen in on this conversation.” D.I. 233- 1 at 74 (tr. 290:9–13). If so, Pindrop’s voice authentication would start up. For a time,

Pindrop was using “voice extraction features” on Illinois callers, meaning it used the callers’ voice audio as part of the authentication process. D.I. 233-3 at 11 (tr. 37:9– 18). After Pindrop authenticated the call, it created a “risk score.” D.I. 233-1 at 58 (tr. 226:20–25, 227:1–25). John Hancock created a step for Amazon Connect to route the risk score to John Hancock representatives, so that they would be tipped off to poten- tial fraud. Id. But the risk score was just a number between 1 and 100; it did not

contain any of the underlying data that Pindrop used to make the score nor did it include any voiceprint or even voice audio. Id. (tr. 227:11–25). Eventually, the call would get connected to a John Hancock representative or it would end. 3. Not primarily and substantially in Illinois. After sifting through all the evidence produced in discovery, “there is no indication … that [Amazon] did anything in Illi- nois.” D.I. 34 at 8. Plaintiffs alleged that Amazon routed calls through and stored

voiceprints on servers based in Illinois, thus “reach[ing] into Illinois to capture … the Illinois citizen’s vocal and other inputs.” D.I. 175 ¶ ¶ 139–141, 149. But that is not true. All it did was receive calls (routed from AT&T) on its servers in Northern Virginia. D.I. 234 at 6; D.I. 236 at 2. From there, it sometimes asked Pindrop, a company in Georgia, to listen in. D.I. 233-1 at 74 (tr. 290:9–13). It also sent reports and connected calls to John Hancock, a Massachusetts company. D.I. 233-1 at 58 (tr. 226:20–227:25). No Amazon employee in Illinois had access to any biometric data. D.I. 176-1 ¶ 6; D.I. 234 at ¶ ¶ 34–36; D.I. 235 at ¶ 30. Amazon never stored any biometric identifiers, and

it could not do so in Illinois because the servers it used for Amazon Connect were in Virginia. D.I. 234 at 11–17. So Amazon Connect had nothing to do with Illinois. That leaves plaintiffs with the same evidence they had at the beginning of this case when the Court dismissed their claims. D.I. 34 at 8–9. Three named plaintiffs are Illinois citizens who called John Hancock while in that state. Id. But being from Illinois and placing a call from there is not enough “to establish that the alleged con- duct occurred ‘primarily and substantially’ in Illinois.” D.I. 34 at 9; see also Vance v.

Microsoft Corp., No. C20-1082JLR, 2022 WL 9983979, at *7 (W.D. Wash. Oct. 17, 2022) (Illinois residency is not enough to trigger the Act). For this reason, I grant Amazon summary judgment on plaintiffs’ Section 15(b) claim. Plaintiffs resist that conclusion, but none of their arguments sway me. First, as plaintiffs mention, Amazon conceded that it has some Illinois activities. D.I. 250 at 21. But those activities are not related to “the disputed transactions in this case,”

which “occurred outside of Illinois.” Avery, 835 N.E.2d at 854; D.I. 232 at 21; D.I. 236 at 2. So those contacts with Illinois are irrelevant. Second, plaintiffs misleadingly cite cases ruling on claims at different stages of litigation. For one, they cite many cases letting claims under the Act proceed past the motion to dismiss because the complaint alleged enough connection to Illinois. D.I. 250 at 20; see, e.g., Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1091, 1102 (N.D. Ill. 2017) (noting allegations that Google automatically uploaded photos taken in Illinois to its cloud service on an Illinois IP address); Hernandez v. Omnitracs, LLC, No. 1:22- CV-00109, 2024 WL 1376352, at *6 (N.D. Ill. Mar. 31, 2024) (noting that the allegedly

illegal scan occurred in Illinois). For another, they cite a case ruling on class certifi- cation. D.I. 250 at 20. But there, the defendant had “not tendered any evidence to indicate that the … challenged conduct did not occur” in Illinois. In re Facebook Bio- metric Info. Priv. Litig., 326 F.R.D. 535, 547 (N.D. Cal. 2018); see also Patel v. Face- book, Inc., 932 F.3d 1264, 1275–76 (9th Cir. 2019) (ruling on class certification). At summary judgment, plaintiffs need more. Third, plaintiffs imply that the Court’s prior ruling on the motion to dismiss

means that extraterritoriality cannot now defeat their claims. D.I. 250 at 19–20. At that stage, plaintiffs’ claim survived because they alleged a host of other connections to Illinois. Now, after discovery, I see that those connections do not exist. Finally, plaintiffs state that because they called from Illinois, their injury must have occurred there too. D.I. 250 at 18–19; Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 624 (7th Cir. 2020). But this is just another flavor of their argument that

the named plaintiffs are Illinois residents. True, the callers themselves are tied to Illinois. But that alone is not enough to trigger the Act because the other relevant conduct—including all of Amazon’s activities—occurred outside of Illinois. Plus, this point assumes that Amazon really injured the plaintiffs by collecting their voiceprints in Illinois. But for the reasons listed in the next section, it did not. B. Amazon never collected plaintiffs’ biometric identifiers Section 15(b) says no “private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person’s” biometric identifier or information,

unless they receive written consent to do so. 740 Ill. Comp. Stat. § 15(b). The Illinois Supreme Court has defined “collect” and “capture” but not the other terms. Cothron v. White Castle Sys., Inc., 216 N.E.3d 918, 924 (Ill. 2023). All the verbs in the statute require the private entity to have gotten a biometric identifier or information. But Amazon never got any biometric identifier or information. So it has not violated Sec- tion 15(b). Amazon never made any voiceprints. It neither authenticates voices, nor processes

voiceprints or any voice data. Compare D.I. 175 ¶¶ 78 & 105 (alleging that Amazon does voice authentication), with D.I. 234 at 7–8 (explaining that Amazon does not even try to authenticate callers); D.I. 235 at 4 (explaining that Pindrop performs voice-based authentication). It also never stored any voiceprints on its servers. D.I. 176-1 ¶¶ 6, 9; D.I. 233-3 at 15–16 (tr. 56:20–57:5), 32 (tr. 122:5–23), 37 (tr. 141:2– 142:1). At most, the evidence merely suggests that Pindrop voiceprinted callers. D.I.

233-1 at 58 (tr. 227:11–25). (I need not reach the question of whether Pindrop voice- printed any callers because there is no evidence that Amazon did.) True, Amazon helped customers link Pindrop to Amazon Connect and presumably could have banned third-parties from it. See, e.g., D.I. 250-6, 250-8, 250-12. But that is not enough to show that Amazon got any biometric identifiers or information. Amazon never collected, captured, purchased, received through trade, or otherwise obtained any voiceprints or other biometric identifiers or information. So I grant summary judgment to Amazon for this reason too. III. I DENY THE RULE 56(D) REQUEST

Plaintiffs make one last effort to avoid judgment against them: moving under Rule 56(d) to get more discovery. D.I. 250-1. I have already rejected plaintiffs’ bid to reopen discovery many times. See D.I. 275–76. To get more discovery now, they would need to show “what particular information is sought; how, if uncovered, it would preclude summary judgment; and why it has not previously been obtained.” Dowling v. City of Philadelphia, 855 F.2d 136, 140 (3d Cir. 1988). Plaintiffs have not shown that any information would preclude summary judgment, and they have only themselves to

blame for failing to conduct discovery diligently. See D.I. 275. So I deny this last at- tempt to get more discovery. * * * * * Plaintiffs’ evidence does not match their allegations. No reasonable jury could find Amazon violated Section 15(b) of the Act. So I grant summary judgment to Amazon.