Zellmer v. Facebook, Inc.

Opinion

CLAYTON P. ZELLMER, on behalf of Case No. 3:18-cv-01880-JD himself and all others similarly situated, Plaintiff, ORDER RE SUMMARY JUDGMENT v. Re: Dkt. No. 67 FACEBOOK, INC., Defendant.

Plaintiff Clayton Zellmer sued defendant Facebook, Inc. (Facebook) on one claim under the Illinois Biometrics Information Privacy Act (BIPA). Dkt. No. 1. To a substantial degree, this case overlaps with the facts and law of In re Facebook Biometric Information Privacy Litigation, No. 15-cv-3747-JD (In re Facebook), which this Court presided over for several years, and which concluded in a $650 million settlement in favor of Illinois Facebook users. The main difference is that Zellmer “does not have, and has never had, a Facebook account,” and “has never used Facebook’s services,” and sued on behalf of a putative class of Illinois non-users. Dkt. No. 1 ¶¶ 28, 42. In effect, Zellmer filed a BIPA claim on behalf of just about everyone in Illinois not covered by the settlement with users in In re Facebook. Facebook asks for summary judgment on the BIPA claim. Dkt. No. 66-4.1 The parties’ familiarity with the record is assumed, and summary judgment is granted and denied in part. The Court has substantial familiarity with Facebook, its face recognition technology, and BIPA, from In re Facebook, and filed several detailed decisions that inform the discussion here. See In re Facebook Biometric Info. Privacy Litig., 185 F. Supp. 3d 1155 (N.D. Cal. 2016) (motions to dismiss and for summary judgment); In re Facebook Biometric Info. Privacy Litig., 1 Facebook filed a motion to seal, Dkt. No. 66, with its motion for summary judgment, Dkt. No. 67. The Court refers to Dkt. No. 66-4, the unredacted motion for summary judgment, and to 326 F.R.D. 353 (N.D. Cal. 2018) aff’d sub nom, Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019) (class certification); Patel v. Facebook Inc., 290 F. Supp. 3d 948 (N.D. Cal. 2018) (motion to dismiss); In re Facebook Biometric Info. Privacy Litig., No. 15-cv-3747-JD, 2018 WL 2197546 (N.D. Cal. May 14, 2018) (summary judgment); In re Facebook Biometric Inf. Privacy Litig., 522 F. Supp. 3d 617 (N.D. Cal. 2020) (final settlement approval and attorney’s fees award), aff’d, No. 21-15553, 2022 WL 822923 (9th Cir. 2022) (unpublished) (attorney’s fees). Zellmer challenges the same “tagging” functionality that was in issue in In re Facebook. See Dkt. No. 1 ¶ 6. This functionality entailed the scanning of faces in photographs uploaded on Facebook for association with other scanned faces to automatically tag users, their friends, and other recognized individuals. See Patel, 290 F. Supp. 3d at 951; In re Facebook, 185 F. Supp. 3d at 1158-59. Zellmer’s case also shares similarities to Gullen v. Facebook, Inc., No. 16-cv-937-JD, which involved Facebook’s face recognition technology as applied to certain non-users of the platform. Zellmer appears to have had some involvement in Gullen, albeit not as a named party. See Gullen ECF counsel list. Gullen was dismissed with prejudice for reasons not germane here. Gullen v. Facebook, Inc., No. 16-cv-937-JD, 2018 WL 1609337 (N.D. Cal. Apr. 3, 2018) aff’d, 772 F. App’x 481 (9th Cir. 2019) (unpublished). Zellmer focuses on the same written consent and posted policy provisions of BIPA that were at issue in In re Facebook. The Court discussed these and other provisions of BIPA in detail in In re Facebook, and will not repeat all of that here. In pertinent summary, Illinois enacted BIPA in 2008 on the basis of a legislative finding, among others, that “[a]n overwhelming majority of members of the public are weary of the use of biometrics when such information is tied to finances and other personal information.” 740 Ill. Comp. Stat. 14/5; see also Patel, 290 F. Supp. 3d at 953-54 (analyzing BIPA); In re Facebook, 185 F. Supp. 3d at 1169 (same). The statute sought to remedy this through greater regulation of the collection, use, safeguarding, retention, and destruction of biometrics. As BIPA requires: (a) A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever occurs first. Absent a valid warrant or subpoena issued by a court of competent jurisdiction, a private entity in possession of biometric identifiers or biometric information must comply with its established retention schedule and destruction guidelines. (b) No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s biometric identifier or biometric information, unless it first: (1) Informs the subject or the subject’s legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored; (2) Informs the subject or the subject’s legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and (3) Receives a written release executed by the subject of the biometric identifier or biometric information or the subject’s legally authorized representative. 740 Ill. Comp. Stat. 14/15. BIPA authorizes claims for damages or injunctive relief. 740 Ill. Comp. Stat. 14/20. Zellmer alleges violations of Section 15(a) and Section 15(b) of BIPA. Dkt. No. 1 at ¶¶ 47-55. Since Zellmer filed the complaint in this case, Facebook has abandoned the tagging functionality pursuant to the settlement agreement in In re Facebook and other related reasons. See In re Facebook, 522 F. Supp. 3d at 617; Torsten Kracht, Lisa Sotto, & Bennett Sooy, Facebook Pivots from Facial Recognition System Following Biometric Privacy Suit, REUTERS (Jan. 26, 2022), https://www.reuters.com/legal/legalindustry/facebook-pivots-facial-recognition- system-following-biometric-privacy-suit-2022-01-26. DISCUSSION I. LEGAL STANDARDS A party “may move for summary judgment, identifying each claim or defense -- or the part of each claim or defense -- on which summary judgment is sought. The court shall grant summary judgment if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). “The Court may dispose of less than the entire case and even just portions of a claim or defense.” CZ Servs., Inc. v. Express Scripts Holding Co., No. 3:18-CV-04217-JD, 2020 WL 4368212, at *2 (N.D. Cal. July 30, 2020) (citing Smith v. Cal. Dep’t of Highway Patrol, 75 F. Supp. 3d 1173, 1179 (N.D. Cal. 2014)). A dispute is genuine “if the evidence is such that a reasonable jury could return a verdict for the nonmoving party.” Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986). A fact is material if it could affect the outcome of the suit under the governing law. Id. To determine whether a genuine dispute as to any material fact exists, the Court views the evidence in the light most favorable to the nonmoving party, and “all justifiable inferences are to be drawn” in that party’s favor. Id. at 255. The moving party may initially establish the absence of a genuine issue of material fact by “pointing out to the district court that there is an absence of evidence to support the nonmoving party’s case.” Celotex Corp. v. Catrett, 477 U.S. 317, 325 (1986). It is then the nonmoving party’s burden to go beyond the pleadings and identify specific facts that show a genuine issue for trial. Id. at 323-24. “A scintilla of evidence or evidence that is merely colorable or not significantly probative does not present a genuine issue of material fact.” Addisu v. Fred Meyer, Inc., 198 F.3d 1130, 1134 (9th Cir. 2000). In resolving a summary judgment motion, it is not the Court’s task “to scour the record in search of a genuine issue of triable fact.” Keenan v. Allan, 91 F.3d 1275, 1279 (9th Cir. 1996) (quotations omitted). Rather, it is entitled to rely on the nonmoving party to “identify with reasonable particularity the evidence that precludes summary judgment.” Id.; see also Fed. R. Civ. P. 56(c)(3) (“The court need consider only the cited materials, but it may consider other materials in the record.”). II. THE SECTION 15(B) CLAIM Summary judgment is granted in Facebook’s favor on the portion of Zellmer’s BIPA claim relating to notice and consent under Section 15(b). The reason is straightforward: it would be patently unreasonable to construe BIPA to mean that Facebook was required to provide notice to, and obtain consent from, non-users who were for all practical purposes total strangers to Facebook, and with whom Facebook had no relationship whatsoever. Facebook and Zellmer devoted substantial effort to debating technical questions of whether Facebook’s face scans are “biometric identifiers” or “biometric information” within the meaning of BIPA, and whether 10-17. But even assuming for present purposes that Zellmer has the better argument on these disputes, which is by no means clear in the record, his claim is premised on an untenable construction of Section 15(b). In interpreting a statute, Illinois follows the well-established “cardinal rule” that courts must “ascertain and give effect to the intent of the legislature.” In re Hernandez, 161 N.E.3d 135, 140 (Ill. 2020).2 “The best indicator of that intent is the language used in the statute itself,” and that “language must be given its plain and ordinary meaning.” Id. (citing Bayer v. Panduit Corp., 63 N.E.3d 890, 895 (Ill. 2016)). “In construing a statute, a court must not focus exclusively on a single sentence or phrase but must view the statute as a whole, construing words and phrases in light of other relevant statutory provisions and not in isolation.” Sigcho-Lopez v. Illinois State Bd. of Elections. --- N.E.3d ---, 2022 WL 869783 at *5 (Ill. 2022) (citation omitted). A court may also “consider the reason for the law, the problems sought to be remedied, the purposes to be achieved, and the consequences of construing the statute one way or another.” Id. (citation omitted). Illinois also follows the construction principle that “a court presumes that the legislature did not intend absurd, inconvenient, or unjust results.” Id.; see also Solon v. Midwest Medical Records Ass’n, Inc., 925 N.E. 2d 1113, 1118 (Ill. 2010) (same). A court should “avoid an interpretation producing an absurd or unreasonable result.” Sablik v. County of DeKalb, 163 N.E.3d 181, 187 (Ill. Ct. App. 2019). The Illinois Supreme Court has specifically stated with respect to BIPA that “[c]ompliance should not be difficult” and any expense a business might incur to comply should be minimal. Rosenbach v. Six Flags Ent’t Corp., 129 N.E.3d 1197, 1207 (Ill. 2019). These standards make fairly short work of Zellmer’s Section 15(b) claim. To start, the Illinois legislature clearly contemplated that BIPA would apply in situations where a business had at least some measure of knowing contact with and awareness of the people subject to biometric data collection. The legislative findings emphasize that BIPA is intended to apply to interactions

2 Facebook used Illinois law for its statutory construction arguments, Dkt. No. 66-4 at 18, and between businesses and their customers, such as “at grocery stores, gas stations, and school cafeterias.” 740 Ill. Comp. Stat. 14/1(b). These examples, along with references to “financial transactions” and other business practices, 740 Ill. Comp. Stat. 14/1(d), convey the legislature’s intent that BIPA applies where there is at least a minimum level of known contact between a person and an entity that might be collecting biometric information. It also bears mention that the Illinois legislature did not intend to ban the use of biometrics altogether, but to regulate it. 740 Ill. Comp. Stat. 14/1(g). In light of these and other provisions in BIPA, the Court had no trouble concluding in In re Facebook that Facebook should have complied with the notice and consent requirements of Section 15(b) for its known users. See, e.g., In re Facebook, 326 F.R.D. at 545. The settlement in that case achieved a vastly higher claims rate than is typical in consumer cases precisely because of Facebook’s relationship with its users. See In re Facebook, 522 F. Supp. 3d at 622 (outreach to class members was maximized by “Facebook’s direct access to users”). The situation here could not be more different. Zellmer and the putative class are by definition entirely unknown to Facebook. Zellmer made no meaningful effort to explain how or why BIPA might reasonably be interpreted to apply in this circumstance. This omission was all the more glaring because Facebook highlighted portions of hearings in similar cases where the Court expressed substantial doubt that the Illinois legislature had contemplated such a counterintuitive result. See Dkt. No. 67-7 at 10:6-11:20; Dkt. No. 67-8 at 31:21-34:15. To construe BIPA as Zellmer urges would lead to obvious and insoluble problems. Under Zellmer’s interpretation of Section 15(b), Facebook in effect would need to identify every non- user in Illinois on a regular basis, and figure out a way to communicate with them to provide notice and obtain consent. Given the readily apparent impossibility of carrying such a burden, the Court expressly asked Zellmer’s counsel for guidance on what, if anything, Facebook could reasonably and realistically do vis-a-vis non-users who are unknown to it. See, e.g., Dkt. No. 84 at 5:5-17; Dkt. No. 67-7 at 9:8-18; Dkt. No. 67-8 at 31:21-34:14. The proposals offered in response were highly problematic. Counsel suggested that Facebook might “deputize” its users in Illinois facial scanning program when photos are uploaded. Dkt. No. 70-19 at 18-19. How this might work as a practical matter is entirely unclear, as are the contours of the agency relationship required for “legally authorized representatives” under BIPA. Zellmer also suggested that Facebook could have revised its terms of service to apply facial scanning only when users had written permission from every person in a photo. Id. at 19-20. This too is not consonant with the plain language of BIPA, and immediately raises an insurmountable practical problem for the myriad of photos taken in restaurants, vacation destinations, school graduations, and countless other settings where unknown people will appear in a picture. There is no realistic way for the person posting the photo to obtain consent from every stranger whose face happened to be caught on camera. It may be, as Zellmer suggests, that Amazon and Shutterfly have such policies, but that does not mean those policies satisfy BIPA, or are otherwise legally sound. Simply pointing to other policies also does not provide an answer to the problems the Court has identified. Overall, Zellmer’s notice and consent claim entails an unreasonable reading of Section 15(b) that would put Facebook in an impossible position. It is not consonant with the Illinois legislature’s intent or the Illinois Supreme Court’s determination that BIPA should not impose extraordinary burdens on businesses. Summary judgment on the Section 15(b) portion of Zellmer’s BIPA claim is granted in favor of Facebook. The Court emphasizes that this conclusion is made on the basis of the specific record before it, and may not apply in other circumstances. III. THE SECTION 15(A) CLAIM The Section 15(a) claim goes to whether Facebook had a “written policy, made available to the public” that established data retention policies and related practices for biometric identifiers or information. 740 Ill. Comp. Stat. 14/15(a). Facebook did not state that it had such a policy. Instead, it requested summary judgment on the basis of a number of highly factual arguments about whether it possessed such identifiers or information at all. See Dkt. No. 66-4 at 11-18. Zellmer contests Facebook’s evidence, and much of the parties’ arguments are volleys and returns about the record. For example, Facebook says that it deleted face signatures if it determined that there was no match to an existing face templates. See Dkt. No. 66-12 at ¶ 16. 1 for later use. See Dkt. No. 70-19 at 5-6. Zellmer says that all of the steps of Facebook’s facial 2 recognition technology and the resulting data constituted scans of face geometry. Dkt. No. 70-19 3 at 2; Dkt. No. 70-8 at 44-45. Facebook says that is not true. Dkt. No. 66-4 at 5; Dkt. No. 66-12 4 at J] 2-7. The parties dispute whether face signatures could identify non-users. A Facebook 5 engineer states that face signatures were useless for identifying unknown faces because they can 6 only be used with Facebook’s existing face templates. Dkt. No. 66-12 at ¥ 12. Zellmer says the 7 evidence demonstrates otherwise. See Dkt. No. 70-14. 8 These are quintessential disputes of material facts that will require a trial to resolve. See 9 Facebook, 2018 WL 2197546, at *2-*3. Consequently, summary judgment is denied on the 10 Section 15(a) portion of Zellmer’s BIPA claim. 12 The Court previously stayed and administratively closed the case pending further order. 13 The case will be re-opened and a status conference is set for May 26, 2022, at 10:00 a.m. in 14 Courtroom 11, San Francisco. The parties are directed to file a joint case management statement 3 15 by May 19, 2022. At the conference, the parties should be prepared to discuss whether the lack of 16 a public policy as contemplated by Section 15(a) is a single violation that warrants a single 3 17 liquidated damages or actual damages award, or some other remedy. IT IS SO ORDERED. 19 Dated: March 31, 2022 20 21 7 JAMES PONATO United pftates District Judge 23 24 25 26 27 28