1 2 3
4 5 6 7 UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON 8 AT SEATTLE
9 10 STEVEN VANCE, et al., CASE NO. C20-1084JLR 11 Plaintiffs, ORDER GRANTING IN PART v. AND DENYING IN PART 12 AMAZON’S MOTION TO DISMISS AMAZON.COM INC, 13 Defendant. 14
15 I. INTRODUCTION 16 Before the court is Defendant Amazon.com, Inc.’s (“Amazon”) motion to dismiss 17 Plaintiffs Steven Vance and Tim Janecyk’s (collectively, “Plaintiffs”) complaint. (MTD 18 (Dkt. # 18); Reply (Dkt. # 25).) Plaintiffs oppose the motion. (Resp. (Dkt. # 24).) 19 Having considered the motion, the parties’ submissions regarding the motion, the 20 //
21 //
22 // 1 relevant portions of the record, and the applicable law,1 the court GRANTS in part and 2 DENIES in part the motion to dismiss. 3 II. BACKGROUND
4 Facial recognition technology uses computer artificial intelligence and machine 5 learning algorithms to “detect, recognize, verify and understand characteristics of humans 6 faces.”2 (Compl. (Dkt. # 1) ¶ 23 (quoting Michele Merler, et al., Diversity in Faces, IBM 7 Research AI at 1 (Apr. 10, 2019)) (“Diversity in Faces”).) However, “significant 8 technical hurdles” hinder the technology’s accuracy, and improving that accuracy relies
9 upon “the use of data-driven deep learning to train increasingly accurate models by using 10 growing amounts of data.” (Diversity in Faces at 1.) In other words, practice makes 11 perfect: for artificial intelligence to more accurately recognize different faces, “vast 12 quantities of images of a diverse array of faces” must be fed to the underlying 13 machine-learning algorithms. (Compl. ¶ 24.)
14 Amazon is one of many companies that have developed and produced facial 15 recognition products. (Id. ¶¶ 3, 54-56.) Amazon’s product, Amazon Rekognition, allows 16 users to “match new images of faces with existing, known facial images ‘based on their 17 visual geometry.’” (Id. ¶ 55.) Amazon Rekognition is a “fundamental cornerstone” of 18 other Amazon products, including Amazon Photos, Amazon’s smart home systems and
20 1 Both parties request oral argument (MTD at 1; Resp. at 1), but the court finds oral argument unnecessary to its disposition of the motion, see Local Rules W.D. Wash. LCR 7(b)(4).
21 2 For the purposes of a motion to dismiss, the court accepts all well-pleaded allegations in Plaintiffs’ complaint as true and draws all reasonable inferences in favor of Plaintiffs. See Wyler 22 Summit P’ship v. Turner Broad. Sys., Inc., 135 F.3d 658, 661 (9th Cir. 1998). 1 cameras, and Amazon’s virtual assistant technology Alexa. (Id. ¶ 56.) Moreover, 2 Amazon is “the largest provider of facial recognition technology to law enforcement 3 agencies,” including Immigration Customs Enforcement (“ICE”), the Federal Bureau of
4 Investigations (“FBI”), and more than 1,300 other law enforcement agencies. (Id. ¶ 57.) 5 Plaintiffs are Illinois residents who, starting in 2008, uploaded photos of 6 themselves to the photo-sharing website Flickr. (Id. ¶¶ 6-7, 28, 66-67, 75.) Both were in 7 Illinois when uploading the photos. (Id. ¶¶ 66, 75.) Unbeknownst to Plaintiffs, Flickr, 8 through its parent company Yahoo!, compiled hundreds of millions of photographs
9 posted on its platform, including those of Plaintiffs and other Illinois residents, into a 10 dataset (“Flickr dataset”) that it then made publicly available to “help improve the 11 accuracy and reliability of facial recognition technology.” (Id. ¶¶ 29-32.) 12 Utilizing the Flickr dataset, International Business Machines Corporation (“IBM”) 13 selected one million images to create a new dataset called Diversity in Faces in an effort
14 to reduce bias in facial recognition. (Id. ¶ 42.) IBM scanned the “facial geometry” of the 15 images and created a “comprehensive set of annotations of intrinsic facial features,” 16 including craniofacial distances, areas and ratios, facial symmetry and contrast, skin 17 color, age and gender predictions, subjective annotations, and pose and resolution. (Id. 18 ¶ 43 (citing Diversity in Faces at 2).) Ultimately, IBM utilized “19 facial landmark
19 points” to determine “68 key points for each face” and to extract “craniofacial features” 20 for each image in the dataset. (Id. ¶¶ 44-45 (citing Diversity in Faces at 9).) Again, the 21 Diversity in Faces dataset included the facial scans of Plaintiffs and other Illinois 22 // 1 residents, but like Flickr and Yahoo!, IBM did not seek or receive permission from 2 individuals whose faces were analyzed. (Id. ¶¶ 46-47.) 3 IBM made the Diversity in Faces dataset available to other companies seeking to
4 improve their facial recognition technology. (Id. ¶ 49.) To obtain the dataset, companies 5 applied for permission via an online questionnaire, and if IBM granted access, IBM 6 would send a link for companies to download the dataset. (Id. ¶ 50.) Those with the 7 dataset, and the corresponding information, could “identify the Flickr user who uploaded 8 the photograph,” “view the Flickr user’s homepage,” and “view each photograph’s
9 metadata, including any available [information] relating to where the photograph was 10 taken or uploaded.” (Id. ¶ 53.) Amazon applied for and downloaded the dataset from 11 IBM. (Id. ¶ 61.) Amazon used the dataset to improve “the fairness and accuracy of its 12 facial recognition products,” which “improve[d] the effectiveness” of those products and 13 made them “more valuable in the commercial marketplace.” (Id. ¶¶ 64-65.) Once again,
14 the dataset downloaded by Amazon contained Plaintiffs’ information, but Amazon did 15 not inform or obtain permission from Plaintiffs. (Id. ¶¶ 63, 71-72, 79-80.) 16 Plaintiffs bring a class action suit against Amazon for violating Illinois’s 17 Biometric Information Privacy Act, 740 ILCS 14/1, et seq. (“BIPA”), which regulates the 18 collection, storage and use of biometric identifiers and biometric information
19 (collectively, “biometric data”). (Id. ¶¶ 4, 17.) Specifically, they allege violations of two 20 BIPA provisions: (1) Amazon violated § 15(b) by collecting and obtaining biometric 21 data without providing the requisite information or obtaining written releases; and (2) 22 Amazon violated § 15(c) by unlawfully profiting from individuals’ biometric data. (Id. 1 ¶¶ 99-112.) Plaintiffs additionally bring an unjust enrichment claim (id. ¶¶ 113-22) and a 2 separate count for injunctive relief (id. ¶¶ 123-28). 3 III. ANALYSIS
4 When considering a motion to dismiss under Rule 12(b)(6), the court construes the 5 complaint in the light most favorable to the nonmoving party. Livid Holdings Ltd. v. 6 Salomon Smith Barney, Inc., 416 F.3d 940, 946 (9th Cir. 2005). The court must accept 7 all well-pleaded facts as true and draw all reasonable inferences in favor of the plaintiff. 8 Wyler Summit P’ship, 135 F.3d at 661. The court, however, is not required “to accept as
9 true allegations that are merely conclusory, unwarranted deductions of fact, or 10 unreasonable inferences.” Sprewell v. Golden State Warriors, 266 F.3d 979, 988 (9th 11 Cir. 2001). “To survive a motion to dismiss, a complaint must contain sufficient factual 12 matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft 13 v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544,
14 570 (2007)); see also Telesaurus VPC, LLC v. Power, 623 F.3d 998, 1003 (9th Cir. 15 2010). “A claim has facial plausibility when the plaintiff pleads factual content that 16 allows the court to draw the reasonable inference that the defendant is liable for the 17 misconduct alleged.” Iqbal, 556 U.S. at 677-78. Dismissal under Rule 12(b)(6) can be 18 based on the lack of a cognizable legal theory or the absence of sufficient facts alleged
19 under a cognizable legal theory. Balistreri v. Pacifica Police Dep’t, 901 F.2d 696, 699 20 (9th Cir. 1990). 21 Amazon moves to dismiss all of Plaintiffs’ claims in its instant motion. (See 22 MTD.) The court addresses the arguments pertaining to each claim in turn. 1 A. BIPA Claims 2 In urging the court to dismiss Plaintiffs’ two BIPA claims, Amazon first 3 challenges the applicability of BIPA. (MTD at 7-16.) It argues that BIPA does not have
4 extraterritorial effect here and that if it did, BIPA would violate the Dormant Commerce 5 Clause. (Id.) Even if BIPA applies, Amazon contends that Plaintiffs fail to state a claim. 6 (Id. at 16-21.) The court addresses each argument in turn. 7 1. Illinois Extraterritorial Doctrine 8 Amazon first argues that BIPA was not intended to have exterritorial effect and
9 thus could not apply here because Plaintiffs have not established that the claim occurred 10 in Illinois. (Id. at 7-9.) The court, like many others that have considered this argument, 11 determines that at this early stage, it cannot dismiss the BIPA claims on this basis. 12 The parties agree that an Illinois statute does not have an “extraterritorial effect 13 unless a clear intent in this respect appears from the express provisions of the statute.”
14 Avery v. State Farm Mutual Auto. Ins. Co., 835 N.E.2d 801, 852 (Ill. 2005); (MTD at 6; 15 see Resp. at 4-5.) They further agree that BIPA does not have such an express provision 16 and thus is not authorized to have extraterritorial effect. (MTD at 7; see Resp. at 4-5); 17 see Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1100 (N.D. Ill. 2017). Nonetheless, 18 Plaintiffs may assert BIPA claims if they sufficiently allege that Amazon’s purported
19 violations “occur[red] primarily and substantially in Illinois.” See Avery, 835 N.E.2d at 20 853. The parties disagree on whether Plaintiffs have done so. 21 There is “no single formula or bright-line test for determining whether a 22 transaction occurs within [Illinois].” Id. at 854. Instead, “each case must be decided on 1 its own facts.” Id. Courts consider a myriad of factors, including the plaintiff’s 2 residency, the location of harm, where communications between parties occurred, and 3 where a company is carrying out the aggrieved policy. Id. For transactions occurring on
4 the Internet, courts may need to consider Internet-specific factors, such as where the site 5 or information was accessed, or where the corporation operates the online practice. See 6 Rivera, 238 F. Supp. 3d at 1101. As illustrated by these factors, whether events occurred 7 primarily and substantially in Illinois is a “highly fact-based analysis that is generally 8 inappropriate for the motion to dismiss stage.” Vance v. IBM Corp., No. 20 C 577, 2020
9 WL 5530134, at *3 (N.D. Ill. Sept. 15, 2020) (“IBM”). 10 Accordingly, the majority of courts in BIPA cases to consider the issue at this 11 stage have denied the motion to dismiss, opting instead to allow discovery for more 12 information regarding the extent to which the alleged misconduct occurred in Illinois. 13 See, e.g., Monroy v. Shutterfly, Inc., No. 16 C 10984, 2017 WL 4099846, at *6 (N.D. Ill.
14 Sept. 15, 2017); cf. In re Facebook Biometric Info. Privacy Litig., 326 F.R.D. 535, 15 547-48 (N.D. Cal. 2018) (analyzing issue in class certification context). In Rivera, the 16 plaintiffs alleged that they were Illinois residents; that their photographs were taken and 17 uploaded in Illinois; and that the defendant failed to provide the required disclosures in 18 Illinois, but they did not allege where the defendant accessed their photographs or facial
19 scans. 238 F. Supp. 3d at 1101-02. Nonetheless, the court concluded that the allegations 20 “tip[ped] toward a holding that the alleged violations primarily happened in Illinois.” Id. 21 However, the court recognized the need for discovery, highlighting the need for more 22 information regarding where the injury and the lack of consent took place. Id. at 1102. 1 The court holds the same based on Plaintiffs’ allegations. Plaintiffs, and all 2 purported class members, are Illinois residents who, while in Illinois, uploaded photos 3 that were taken in Illinois. (Compl. ¶¶ 6-7, 66-67, 75.) The required disclosures or
4 permissions would have been obtained from Illinois, and so any communication would 5 have necessarily involved Illinois. (See id. ¶¶ 71-72, 79-80.) The alleged harm to 6 privacy interests is ongoing for Illinois residents. (Id. ¶¶ 73, 81, 83.) Moreover, 7 Plaintiffs allege that Amazon sells various facial recognition products nationwide (id. 8 ¶ 55-56), that these products are used by consumers and law enforcement agencies with
9 national reach (id. ¶ 55-57), and that the Diversity in Faces dataset “improve[d] its facial 10 recognition products” (id. ¶ 65), thereby allowing the reasonable inference that Amazon 11 utilized the dataset in Illinois during its business dealings. 12 While Amazon is correct that Plaintiffs do not allege where Amazon obtained the 13 dataset (see MTD at 8), that fact alone may not be dispositive. See Rivera, 238 F. Supp.
14 3d at 1102 (citing Avery, 835 N.E.2d at 853). It is certainly possible that with more 15 factual refinement around this complex issue, the circumstances around Amazon’s 16 attainment, possession and use of the Diversity in Faces dataset will reveal that the 17 alleged violations did not occur primarily in Illinois. See IBM, 2020 WL 5530134, at *3. 18 But more information is needed to reach any determination, and so, the court agrees with
19 Rivera that “[f]or now, it is enough to say that the allegations survive the accusation that 20 the law is being applied outside of Illinois.” See 238 F. Supp. 3d at 1102. 21 Amazon attempts to distinguish those previous cases by arguing that they involve 22 plaintiffs who “uploaded a photo directly to the defendant’s systems,” whereas Plaintiffs 1 did not upload anything directly to Amazon’s systems. (MTD at 8 (bolding and italics 2 removed).) This argument is unavailing for two reasons. First, Amazon’s distinction 3 does not hold true for all cases. In IBM—a suit brought by Plaintiffs against IBM for its
4 part in this chain—the court found dismissal premature even though Plaintiffs did not 5 upload anything directly to IBM’s systems. See 2020 WL 5530134, at *3; see also 6 Monroy, 2017 WL 4099846, at *1-2, 6 (identifying plaintiff as non-Illinois resident who 7 “does not use Shutterfly”). The fact that Plaintiffs did not access any IBM products had 8 no impact on how “discovery is needed in order to determine to what extent IBM’s
9 alleged acts occurred in Illinois.” IBM, 2020 WL 5530134, at *3. Second, direct upload 10 is not the only way to establish that an alleged violation occurred in Illinois, and Amazon 11 points to no authority saying so. (See MTD.) Thus, while Amazon is correct that 12 Plaintiffs’ connection with Amazon—and in turn, the connection between the alleged 13 misconduct and Illinois—is not through direct use of its products, that does not defeat the
14 need for more information that may bear on this fact-laden analysis. 15 The authority Amazon relies upon are easily distinguishable. In Neals v. PAR 16 Tech. Corp., 419 F. Supp. 3d 1088 (N.D. Ill. 2019), the plaintiff did not allege that her 17 biometric information was collected in Illinois, and thus, the court could not reasonably 18 infer any connection with Illinois.3 Id. at 1091. Plaintiffs here have explicitly pleaded
19 // 20 3 Like Amazon, the defendant in Neals was a non-resident corporation with no allegations that it had property or stored data in Illinois. 419 F. Supp. 3d at 1091. The court made clear that 21 the defendant’s “physical location and property holdings, the location of its servers, and the identity of its customers [who used its technology to collect biometric information] are not 22 determinative of [BIPA’s] application.” Id. 1 their connection with Illinois. (Compl. ¶¶ 6-7, 66-67, 75.) Similarly, in Tarzian v. Kraft 2 Heinz Foods Co., No. 18 C 7148, 2019 WL 5064732 (N.D. Ill. Oct. 9, 2019), the court 3 dismissed consumer fraud claims brought by non-resident plaintiffs when the only
4 connection to Illinois was that the deception scheme allegedly originated there. Id. at *3. 5 Notably, the same claims brought by resident plaintiffs survived. See id. Plaintiffs here 6 have pleaded many more allegations than the non-residents in Tarzian, including their 7 own residency and Illinois as the place of harm. (Compl. ¶¶ 66-68, 74-76, 83.) 8 In sum, more discovery is needed to explore whether and to what extent Amazon’s
9 alleged acts involving the Diversity in Faces dataset occurred in Illinois. For now, 10 Plaintiffs’ allegations are sufficient to withstand dismissal. 11 2. Dormant Commerce Clause 12 Building on its extraterritoriality argument, Amazon next argues that applying 13 BIPA as Plaintiffs allege here would violate the Dormant Commerce Clause. (MTD at
14 9-16.) Specifically, because Amazon maintains that it has not “engaged in any relevant 15 conduct in Illinois,” it contends that Plaintiffs’ BIPA claims would allow Illinois law to 16 control transactions outside its boundaries. (Id. at 10 (bolding and italics removed).) 17 The Commerce Clause has “long been understood to have a ‘negative’ aspect that 18 denies the States the power unjustifiably to discriminate against or burden the interstate
19 flow of articles of commerce,” known as the Dormant Commerce Clause. Or. Waste 20 Sys., Inc. v. Dep’t of Env’t Quality of State of Or., 511 U.S. 93, 98 (1994); Daniels 21 Sharpsmart, Inc. v. Smith, 889 F.3d 608, 614 (9th Cir. 2018). A state statute runs afoul of 22 the Dormant Commerce Clause if it “directly regulate[s] . . . interstate commerce” by 1 “affect[ing] transactions that take place across state lines or entirely outside the state’s 2 borders.” Daniels Sharpsmart, 889 F.3d at 614. Thus, the Dormant Commerce Clause 3 prohibits “the application of a state statute to commerce that takes place wholly outside of
4 the State’s borders, whether or not the commerce has effects within the State.” Healy v. 5 Beer Inst., 491 U.S. 324, 336 (1989). 6 As many courts have observed, the Dormant Commerce Clause argument is 7 directly related to the extraterritoriality effect argument, as both hinge on where the 8 alleged misconduct takes place. See In re Facebook, 2018 WL 2197546, at *4. Thus,
9 unsurprisingly, most courts in this context have found that the Dormant Commerce 10 Clause argument is “more properly addressed on a motion for summary judgment.” See, 11 e.g., IBM, 2020 WL 5530134, at *4. In IBM, the court concluded that it “need[s] more 12 detailed facts regarding IBM’s processes to know the extent to which IBM’s actions 13 occurred in Illinois and whether the Dormant Commerce Clause bars this suit.” Id.; see
14 also Rivera, 238 F. Supp. 3d at 1104 (“Whether the [BIPA] is nevertheless being 15 summoned here to control commercial conduct wholly outside Illinois is not possible to 16 figure out without a better factual understanding of what is happening in the Google 17 Photos face-scan process.”); Monroy, 2017 WL 4099846, at *8 (stating that “important 18 information is lacking regarding how Shutterfly’s technology works”).
19 Again, the court agrees with those that have previously considered the issue. At 20 this point, the court needs more information about the technology behind how Amazon 21 obtained, stores, or uses the Diversity in Faces dataset to conclude that applying BIPA 22 would run afoul of the Dormant Commerce Clause. Nor does the court have an adequate 1 basis for determining whether applying BIPA here would, as Amazon argues, displace 2 the policies of other states. (See MTD at 12-16.) As discussed above, the fact that 3 Plaintiffs did not directly interact with Amazon’s systems does not affect the need for
4 more detailed facts about Amazon’s processes. See IBM, 2020 WL 5530134 at *3-4. 5 Accordingly, the court denies Amazon’s motion to dismiss on applicability grounds. 6 3. Failure to State a Claim 7 Finally, Amazon contends that Plaintiffs fail to state a claim for three reasons. 8 (MTD at 16-21.) Amazon first maintains that BIPA does not apply to photographs, and
9 thus, Plaintiffs cannot bring a claim under either §§ 15(b) or 15(c) for facial scans derived 10 from their photographs. (Id. at 16-19.) Alternatively, Amazon argues that § 15(b) only 11 applies to “entities who actively ‘collect’” biometric data and that § 15(c) only applies to 12 “the direct provision of biometric data in exchange for money”—neither of which are 13 alleged here. (Id. at 18-21.) The court disagrees and reviews each contention in turn.
14 a. BIPA’s Applicability to Photographs 15 BIPA prohibits private entities from gathering or using “biometric identifier[s]” or 16 “biometric information” without notice and consent. 740 ILCS 14/15. A “[b]iometric 17 identifier” is “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face 18 geometry.” 740 ILCS 14/10. Biometric identifiers “do not include writing samples,
19 written signatures, photographs, human biological samples used for valid scientific 20 testing or screening, demographic data, tattoo descriptions, or physical descriptions such 21 as height, weight, hair color, or eye color.” Id. “Biometric information” means “any 22 information . . . based on an individual’s biometric identifier used to identify an 1 individual” but “does not include information derived from items . . . excluded under the 2 definition of biometric identifiers.” Id. Amazon reasons that because photographs are 3 not “biometric identifiers,” and “biometric information” does not include information
4 derived from photographs, Plaintiffs’ facial scans created from their photographs do not 5 qualify as either biometric identifiers or biometric information. (MTD at 16.) The court 6 disagrees and holds that the facial scans are “biometric identifiers” under BIPA. 7 This is not the first—or second, or third, or even fourth—time that defendants 8 have challenged BIPA’s applicability to facial scans derived from photographs. Every
9 court to consider this issue has rejected Amazon’s argument.4 See, e.g., Monroy, 2017 10 WL 4099846, at *3 (calling defendant’s reading “sensible enough at first blush” but 11 concluding “it begins to unravel under scrutiny”). The reason lies in the statute’s plain 12 language, where the statutory interpretation analysis must begin. See Lacey v. Village of 13 Palatine, 904 N.E.2d 18, 25 (Ill. 2009). The court must give the language its plain and
14 ordinary meaning. Hadley v. Ill. Dep’t of Corrections, 864 N.E.2d 162, 165 (Ill. 2007). 15 When the language is clear, it will be given effect without resort to other aids of 16 construction. Id. The court may not “under the guise of construction, supply omissions, 17 remedy defects, annex new provisions, substitute different provisions, and exceptions, 18 limitations or conditions, or otherwise change law so as to depart from the language
20 4 Recognizing the weight of authority against it, Amazon maintains that all those cases were wrongly decided. (MTD at 17-18.) For instance, Amazon states that Rivera did not “properly account for BIPA Section 5,” which lists only in-person transactions as examples that 21 are regulated. (Id. at 18.) Not so. See Rivera, 238 F.3d at 1098 (analyzing Section 5 and its list of example transactions). Amazon has not offered persuasive arguments that Rivera and other 22 cases were wrongly decided. 1 employed in the statute.” DeWig v. Landshire, Inc., 666 N.E.2d 1204, 1207 (Ill. App. Ct. 2 1996). 3 Here, the “comprehensive set of annotations of intrinsic facial features” (Compl.
4 ¶ 43) is one of the biometric identifiers listed in BIPA’s plain text: a “scan of . . . face 5 geometry,” 740 ILCS 14/10; see, e.g., Rivera, 238 F. Supp. 3d at 1095 (“[E]ach face 6 template . . . [features] a set of biology-based measurements (‘biometric’) that is used to 7 identify a person (‘identifier’).”). Plaintiffs “do not claim that simply possessing a 8 photograph of a face violates BIPA,” and thus the exclusion of photographs as biometric
9 identifiers has little bearing. (See Resp. at 15 n.3.) And while these facial scans may not 10 qualify as biometric information—because they are “derived from items . . . excluded 11 under the definition of biometric identifiers,” namely, photographs—there is no textual 12 support for the contention that these scans could not be biometric identifiers themselves. 13 See 740 ILCS 14/10; In re Facebook, 185 F. Supp. 3d at 1171 (finding “digital
14 representation of the face . . . based on geometric relationship of their facial features” to 15 be a “scan of face geometry”). 16 At base, Amazon takes issue with how these scans are captured. It argues that 17 only scans taken in-person, not from photographs, are biometric identifiers. (See MTD at 18 18.) Put another way, Amazon wishes to apply the same limitation that is placed on
19 biometric information to biometric identifiers. See 740 ILCS 14/10. But the Illinois 20 legislature chose not to use terms such as “derived from” when defining biometric 21 identifier. See Rivera, 238 F. Supp. 3d at 1097 (“It would have been simple enough for 22 the Illinois legislature to include similar ‘based on’ or ‘derived from’ language in the 1 definition of ‘biometric identifier’ but it did not.”); see also Dana Tank Container, Inc. v. 2 Hum. Rts. Comm’n, 687 N.E.2d 102, 104 (Ill. App. Ct. 1997) (“Where the legislature 3 uses certain words in one instance and different words in another, it intended different
4 results.”). “The bottom line is that a ‘biometric identifier’ is not the underlying medium 5 itself, or a way of taking measurements, but instead is a set of measurements of a 6 specified physical component . . . used to identify a person.” Rivera, 238 F. Supp. 3d at 7 1097. The facial scans here fall squarely within that definition.5 Accordingly, the court 8 denies Amazon’s motion to dismiss the BIPA claims on this ground.
9 b. Obtaining Biometric Data Under § 15(b) 10 Amazon argues next that § 15(b) of BIPA is only triggered by those who “actively 11 ‘collect’” biometric data, whereas it “merely ‘possess[es]’” the data. (MTD at 18-20 12 (emphasis removed).) Plaintiffs respond that the complaint contains sufficient allegations 13 that establish how Amazon obtained and used their biometric data, contending that
14 Amazon “could not have used the [data] unless it first collected or obtained it.” (Resp. at 15 17.) The court agrees with Plaintiffs. 16 Again, the analysis begins, and ends, with BIPA’s plain language. The protections 17 under § 15(b) are triggered whenever a private entity “collect[s], capture[s], purchase[s], 18 receive[s] through trade, or otherwise obtain[s]” biometric data. 740 ILCS 14/15(b). The
19 catch-all phrase “otherwise obtain” is not defined by BIPA. See 740 ILCS 14/10. Where 20
5 Because the text is “plain and unambiguous,” the court need not consider Amazon’s 21 legislative history arguments. See Ultsch v. Ill. Mun. Ret. Fund, 874 N.E.2d 1, 10 (Ill. 2007). Even if the court considered them, it finds persuasive the Rivera court’s analysis and ultimate 22 rejection of similar arguments. See 238 F. Supp. 3d at 1098-100. 1 a term is undefined, “[i]t is entirely appropriate to employ the dictionary as a resource to 2 ascertain [its] meaning.” Lacey, 904 N.E.2d at 26. “Obtain” is defined as “[t]o come into 3 the possession of,” or “to get, acquire, or secure.” Obtain, Oxford English Dictionary,
4 https://www.oed.com/view/Entry/130002 (last visited Mar. 9, 2021). “Otherwise” means 5 “[i]n a different manner; in another way, or in other ways.” Black’s Law Dictionary 6 1101 (6th ed. 1990); see also Otherwise, Oxford English Dictionary, 7 https://www.oed.com/view/Entry/133247 (last visited Mar. 9, 2021). Accordingly, in 8 context, § 15(b) is triggered whenever a private entity acquires biometric data in the
9 enumerated ways—collecting, capturing, purchasing, receiving through trade—or gets 10 the biometric data in some other way. 11 Plaintiffs have sufficiently alleged that Amazon got its biometric data in some 12 other way—namely by applying for and downloading the data set from IBM. (See 13 Compl. ¶¶ 61-63.) Moreover, Plaintiffs allege that Amazon used the biometric data to
14 “improve its facial recognition products and technologies.” (Id. ¶¶ 64-65.) Contrary to 15 Amazon’s contentions, these allegations establish more than “passive ‘possession.’” (See 16 MTD at 2.) Indeed, Amazon does not explain how it could have come into possession of 17 or used Plaintiffs’ facial scans without having first obtained it. See Figueroa v. Kronos 18 Inc., 454 F. Supp. 3d 772, 784 (N.D. Ill. 2020) (“[T]o have [stored or used] the data, [the
19 defendant] necessarily first had to ‘obtain’ the data.”). Thus, it makes no difference that 20 § 15(b) does not contain the word “possession” whereas the other provisions do, because 21 //
22 // 1 even accepting Amazon’s argument that “only actions trigger [§] 15(b),” Plaintiffs have 2 sufficiently alleged such actions.6 (See MTD at 20 (bolding and italics removed).) 3 Nor will the court adopt Amazon’s proposal that § 15(b) only applies when an
4 entity acquires biometric data “directly from any individual.” (See MTD at 19.) Nothing 5 in the statute’s language supports such a narrow application. For instance, the word 6 “collect” carries no inherent limitation on who or where the information is collected 7 from. See Collect, Oxford English Dictionary, https://www.oed.com/view/Entry/36263 8 (last visited Mar. 9, 2021) (defining “collect” simply as “to gather”). Section 15(b) does
9 not add any limitation either, stating only that the protections are triggered when an entity 10 collects biometric data, regardless of how that collection occurs. See 740 ILCS § 15(b). 11 The same is true of the other methods of attainment in the provision. In essence, Amazon 12 wishes the court to read the limitation “directly from the person” into § 15(b) where none 13 exists. The court cannot do so. See DeWig, 666 N.E.2d at 1207.
14 This straightforward reading of the text does not, as Amazon fears, produce an 15 absurd result. (See MTD at 20.) BIPA obligates any private entity that obtains a person’s 16 biometric identifier to comply with certain requirements to protect that person’s privacy 17 interests. See 740 ILCS 14/5 (recognizing public’s wariness of use of biometrics and 18 need for regulation for public welfare, security and safety). Whether that biometric
19 // 20 6 Obtaining biometric data via a download could also qualify as “collecting” that data. See Collect, Oxford English Dictionary, https://www.oed.com/view/Entry/36263 (last visited 21 Mar. 9, 2021) (defining “collect” as “to gather together”). Because the court finds that Amazon’s actions qualify under “otherwise obtain,” it need not determine whether these actions 22 could also fall with the meaning of the enumerated terms. 1 information comes from an individual or is part of a large dataset, there is nothing absurd 2 about requiring any entity that obtains such information to comply with the safeguards 3 that the Illinois legislature deemed necessary.7 See Neals, 419 F. Supp. 3d at 1092; 740
4 ILCS 14/5(g). Although complying with BIPA requires entities like Amazon to take 5 additional steps before acquiring biometric data, the court does not believe that “under 6 Plaintiffs’ reading of the statute, no entity could safely download any large [biometric] 7 dataset.” (See MTD at 20 (bolding and italics removed).) 8 Amazon relies solely on cases in the employment context (see id. at 20), and the
9 court acknowledges that there is a “split on . . . whether BIPA governs outside vendors” 10 who provide biometric timekeeping or operating systems to employers, see Figueroa, 11 454 F. Supp. 3d at 783-84. Analogizing itself to these third-party vendors, Amazon 12 argues that it also has no relationship with those whose facial scans are in the dataset. 13 The court is unpersuaded. As a preliminary matter, the court observes that most of these
14 cases focus on, as expected, circumstances specific to employment and do not purport to 15 extend beyond that context.8 See Cameron v. Polar Tech. Indus., Inc. & ADP, LLC, No. 16 2019-CH-000013 (Ill. Cir. Ct. Aug. 23, 2019) at 33:22-34:3.9 But more importantly, 17 //
18 7 Indeed, it stands to reason that if the Illinois legislature were concerned about individual collection of biometric data that could compromise identity—which Amazon seems to have no 19 qualms with (see MTD at 19)—the legislature would be equally, if not more concerned about that data being shared in large swaths accessible through download. 20 8 BIPA may very well treat the use of biometric data in employment differently, as the statute defines “written release” differently in the employment context. See 740 ILCS 14/10. 21
9 Amazon attaches the transcript of the Cameron court’s oral ruling as an exhibit to its 22 motion to dismiss. (See MTD, Ex. E.) 1 these cases concern complaints that do not sufficiently plead the role of the third-party, 2 thus warranting dismissal. In Namuwonge v. Kronos, Inc., the plaintiff alleged that only 3 the employer, not the third-party vendor, obtained her fingerprints. 418 F. Supp. 3d 279,
4 286 (N.D. Ill. 2019); see also Heard v. Becton, Dickinson & Co., 440 F. Supp. 3d 960, 5 966-67 (N.D. Ill. 2020) (dismissing complaint alleging collection with no further facts). 6 Similarly, in Bernal v. ADP, LLC, No. 2017-CH-12364 (Ill. Cir. Ct. Aug. 23, 2019), the 7 decision “ultimately turn[ed] on the insufficiency of [the] [p]laintiff’s complaint” because 8 he alleged only that the third-party vendor supplied the biometric technology. Id. at 3.
9 The same is not true here. To the extent that dicta in these cases require some 10 relationship to exist, the court declines to adopt that interpretation, as that requirement 11 does not appear in the statutory language, and persuasive authority exists to the contrary. 12 See, e.g., Flores v. Motorola Solutions, Inc., No. 1:20-cv-01128, 2021 WL 232627, at *3 13 (N.D. Ill. Jan. 8, 2021); Monroy, 2017 WL 4099846, at *1.
14 In sum, § 15(b) applies when a private entity collects, captures, purchases, trades 15 for, or gets biometric data in some other way. Plaintiffs allege that Amazon got the 16 biometric data in some other way by applying for and downloading it from IBM and then 17 used that data to improve its own products. (Compl. ¶¶ 48-49, 55-58.) Such allegations 18 suffice to trigger § 15(b).
19 c. Profit Under § 15(c) 20 Lastly, Amazon contends that § 15(c) of BIPA does not apply because Plaintiffs 21 have not alleged that it has exchanged biometric data for a pecuniary benefit. (MTD at 22 21.) Section 15(c) states that no private entity may “sell, lease, trade, or otherwise profit 1 from” biometric data in its possession. 740 ILCS 14/15(c). Amazon argues that sell, 2 lease, trade, and profit “all contemplate the direct provision of biometric data in exchange 3 for money,” which doesn’t reach the “indirect ‘profit’” of improving its facial recognition
4 products. (MTD at 21.) The court determines that supplemental briefing is needed and 5 thus defers ruling on the issue. 6 The question of what “otherwise profit from” means in § 15(c) is a novel issue. 7 However, neither party spends more than a page briefing the issue, nor do they offer any 8 authority analyzing this provision.10 (See MTD at 21-22; Resp. at 22-23; Reply at
9 10-11.) The parties focus instead on the doctrine of ejusdem generis and whether it 10 applies to verbs. (See MTD at 22; Resp. at 22; Reply at 11.) The court additionally 11 recognizes that the parties’ briefing was completed in the fall of 2020, and there is the 12 possibility that more recent case law has analyzed this issue since that time. Thus, the 13 court finds additional briefing would be beneficial and defers ruling on this issue. The
14 court directs the parties to file responses to this order addressing the definition of 15 “otherwise profit from” in the context of § 15(c), including an analysis of any recent case 16 law that bears on the issue. The parties’ responses for this issue and the choice-of-law 17 issue, see infra § III.B, shall total no more than 15 pages and be filed by Friday, March 18 26, 2021, at 5:00 p.m. There shall be no replies unless otherwise ordered by the court.
19 // 20
10 The court acknowledges that Plaintiffs filed a Notice of Supplemental Authority 21 identifying a recent case that may bear on this analysis. (See Not. of Supp. Authority (Dkt. # 26).) However, neither party has had a chance to meaningfully apply the identified case to the 22 allegations here. 1 B. Unjust Enrichment Claim 2 Amazon next challenges Plaintiffs’ unjust enrichment claim as insufficiently 3 pleaded under Washington law. (MTD at 21-23.) Plaintiffs respond that the claim is
4 sufficiently pleaded under Illinois law. (Resp. at 22-24.) Thus, the court must resolve a 5 choice-of-law question before determining whether the unjust enrichment claim survives. 6 A federal court sitting in diversity applies the choice-of-law rules of its forum 7 state. Kohlrautz v. Oilmen Participation Corp., 441 F.3d 827, 833 (9th Cir. 2006). 8 Washington employs a two-step approach. Kelley v. Microsoft Corp., 251 F.R.D. 544,
9 550 (W.D. Wash. 2008). First, the court must determine whether “an actual conflict 10 between Washington and the other applicable state law exists.” Id. (citing Burnside v. 11 Simpson Paper Co., 864 P.2d 937, 942 (1994)). If there is an actual conflict, then the 12 court must determine which state has the “most significant relationship” to the action. Id. 13 (citing Johnson v. Spider Staging Corp., 555 P.2d 997, 1000 (Wash. 1976)).
14 An actual conflict between Washington and Illinois law exists over whether 15 Plaintiffs must plead that they suffered an economic expense distinct from a privacy 16 harm. An actual conflict exists when the two laws “could produce different outcomes on 17 the same legal issue.” Id. at 550. In Washington, alleging a non-economic loss, such as a 18 loss of privacy, is insufficient because “Washington courts have not applied the doctrine
19 of unjust enrichment outside the context of an ‘expense’ stemming from some tangible 20 economic loss to a plaintiff.” Cousineau v. Microsoft Corp., 992 F. Supp. 2d 1116, 1130 21 (W.D. Wash. 2012). Plaintiffs make no argument why Cousineau is not controlling law 22 in Washington. (See Resp. at 22-24.) In Illinois, however, the assertion that plaintiffs are 1 “exposed to a heightened risk of privacy harm” and “have been deprived of their control 2 over their biometric data” sufficiently states an unjust enrichment claim. Vance, 2020 3 WL 5530134, at *5. Amazon does not argue otherwise. (See MTD at 21-23; Reply at
4 11-12.) Because the two laws would produce different outcomes on this legal issue, the 5 court determines that there is an actual conflict between Washington and Illinois law. 6 Because there is an actual conflict, the court must apply Washington’s “most 7 significant relationship” test to determine which law governs. Coe v. Philips Oral 8 Healthcare Inc., No. C13-0518MJP, 2014 WL 5162912, at *3 (W.D. Wash. Oct. 14,
9 2014). First, the court considers the states’ relevant contacts to the cause of action, and if 10 those contacts are balanced, the court must then consider “the interests and public 11 policies of [the two] states and . . . the manner and extent of such policies as they relate to 12 the transaction in issue.” Johnson, 555 P.2d at 1001. This analysis can be complex, 13 involving an identification of the relevant contacts, assigning significance to those
14 contacts, and weighing those contacts. See Kelley, 251 F.R.D. at 551-53; Coe, 2014 WL 15 5162912, at *3-4; Restatement (Second) of Law on Conflict of Laws §§ 145-55. 16 Moreover, some of the traditionally relevant contacts, such as where the injury and 17 misconduct occurred, may concern facts that the court currently lacks. See supra 18 § III.A.1-2. Despite the intricacies of this analysis, neither party meaningfully discusses
19 the issue, nor do they offer analogous case law. (See MTD; Resp; Reply.) 20 The court concludes that further briefing from the parties on this issue would be 21 beneficial. Accordingly, the court defers ruling on Amazon’s motion to dismiss 22 Plaintiffs’ unjust enrichment claim. The court further directs the parties to file responses 1 to this order on the question of which state law should govern under Washington’s “most 2 significant relationship” test. In particular, the parties should touch on how the contacts 3 analysis differs, if at all, for an unjust enrichment claim in a privacy suit and address
4 whether further factual development is needed to analyze the states’ relevant contacts. 5 The parties’ responses addressing the choice-of-law issue and the aforementioned § 15(c) 6 issue, see supra § III.A.3.c, shall total no more than 15 pages and be filed by Friday, 7 March 26, 2021, at 5:00 p.m. There shall be no replies unless otherwise ordered. 8 C. Injunctive Relief
9 Lastly, Amazon asserts that Plaintiffs’ separate count for injunctive relief must be 10 dismissed. (MTD at 24.) The court agrees with Amazon that “[i]njunctive relief is a 11 remedy, not a cause of action.” Edifecs Inc. v. TIBCO Software Inc., No. C10-0330RSM, 12 2011 WL 1045645, at *3 (W.D. Wash. 2011) (citing Black’s Law Dictionary 201 13 (1979)). Plaintiffs do not argue otherwise. (See Resp.) Accordingly, the court dismisses
14 Plaintiffs’ standalone injunctive relief claim, but Plaintiffs may pursue injunctive relief in 15 connection with its other claims. 16 IV. CONCLUSION 17 For the foregoing reasons, the court GRANTS in part and DENIES in part 18 Amazon’s motion to dismiss (Dkt. # 18). Specifically, the court GRANTS the motion to
19 dismiss Plaintiffs’ injunctive relief claim but DENIES the motion as it applies to 20 Plaintiffs’ BIPA § 15(b) claim. The court DEFERS ruling on Plaintiffs’ § 15(c) and 21 unjust enrichment claims and further DIRECTS the parties to file responses on those two 22 // 1 issues as identified above. These responses shall not exceed 15 pages and must be filed 2 by Friday, March 26, 2021, at 5:00 p.m. 3 Dated this 15th day of March, 2021.
4 A 5 6 JAMES L. ROBART United States District Judge 7 8 9 10 11 12 13 14 15 16 17 18
19 20 21 22