Zellmer v. Facebook, Inc.

Opinion

1 UNITED STATES DISTRICT COURT 2 NORTHERN DISTRICT OF CALIFORNIA 3 4 CLAYTON P. ZELLMER, on behalf of Case No. 3:18-cv-01880-JD himself and all others similarly situated, 5 Plaintiff, ORDER RE SUMMARY JUDGMENT 6 AND STATUS CONFERENCE v. 7 Re: Dkt. No. 67 FACEBOOK, INC., 8 Defendant.

9 10 Plaintiff Clayton Zellmer sued defendant Facebook, Inc. (Facebook) on one claim under 11 the Illinois Biometrics Information Privacy Act (BIPA). Dkt. No. 1. To a substantial degree, this 12 case overlaps with the facts and law of In re Facebook Biometric Information Privacy Litigation, 13 No. 15-cv-3747-JD (In re Facebook), which this Court presided over for several years, and which 14 concluded in a $650 million settlement in favor of Illinois Facebook users. The main difference is 15 that Zellmer “does not have, and has never had, a Facebook account,” and “has never used 16 Facebook’s services,” and sued on behalf of a putative class of Illinois non-users. Dkt. No. 1 ¶¶ 17 28, 42. In effect, Zellmer filed a BIPA claim on behalf of just about everyone in Illinois not 18 covered by the settlement with users in In re Facebook. 19 Facebook asks for summary judgment on the BIPA claim. Dkt. No. 66-4.1 The parties’ 20 familiarity with the record is assumed, and summary judgment is granted and denied in part. 21 BACKGROUND 22 The Court has substantial familiarity with Facebook, its face recognition technology, and 23 BIPA, from In re Facebook, and filed several detailed decisions that inform the discussion here. 24 See In re Facebook Biometric Info. Privacy Litig., 185 F. Supp. 3d 1155 (N.D. Cal. 2016) 25 (motions to dismiss and for summary judgment); In re Facebook Biometric Info. Privacy Litig., 26 1 Facebook filed a motion to seal, Dkt. No. 66, with its motion for summary judgment, Dkt. No. 27 67. The Court refers to Dkt. No. 66-4, the unredacted motion for summary judgment, and to 1 326 F.R.D. 353 (N.D. Cal. 2018) aff’d sub nom, Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2 2019) (class certification); Patel v. Facebook Inc., 290 F. Supp. 3d 948 (N.D. Cal. 2018) (motion 3 to dismiss); In re Facebook Biometric Info. Privacy Litig., No. 15-cv-3747-JD, 2018 WL 2197546 4 (N.D. Cal. May 14, 2018) (summary judgment); In re Facebook Biometric Inf. Privacy Litig., 522 5 F. Supp. 3d 617 (N.D. Cal. 2020) (final settlement approval and attorney’s fees award), aff’d, No. 6 21-15553, 2022 WL 822923 (9th Cir. 2022) (unpublished) (attorney’s fees). 7 Zellmer challenges the same “tagging” functionality that was in issue in In re Facebook. 8 See Dkt. No. 1 ¶ 6. This functionality entailed the scanning of faces in photographs uploaded on 9 Facebook for association with other scanned faces to automatically tag users, their friends, and 10 other recognized individuals. See Patel, 290 F. Supp. 3d at 951; In re Facebook, 185 F. Supp. 3d 11 at 1158-59. Zellmer’s case also shares similarities to Gullen v. Facebook, Inc., No. 16-cv-937-JD, 12 which involved Facebook’s face recognition technology as applied to certain non-users of the 13 platform. Zellmer appears to have had some involvement in Gullen, albeit not as a named party. 14 See Gullen ECF counsel list. Gullen was dismissed with prejudice for reasons not germane here. 15 Gullen v. Facebook, Inc., No. 16-cv-937-JD, 2018 WL 1609337 (N.D. Cal. Apr. 3, 2018) aff’d, 16 772 F. App’x 481 (9th Cir. 2019) (unpublished). 17 Zellmer focuses on the same written consent and posted policy provisions of BIPA that 18 were at issue in In re Facebook. The Court discussed these and other provisions of BIPA in detail 19 in In re Facebook, and will not repeat all of that here. In pertinent summary, Illinois enacted 20 BIPA in 2008 on the basis of a legislative finding, among others, that “[a]n overwhelming 21 majority of members of the public are weary of the use of biometrics when such information is 22 tied to finances and other personal information.” 740 Ill. Comp. Stat. 14/5; see also Patel, 290 F. 23 Supp. 3d at 953-54 (analyzing BIPA); In re Facebook, 185 F. Supp. 3d at 1169 (same). The 24 statute sought to remedy this through greater regulation of the collection, use, safeguarding, 25 retention, and destruction of biometrics. As BIPA requires: 26 (a) A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the 27 public, establishing a retention schedule and guidelines for identifiers or information has been satisfied or within 3 years of the 1 individual’s last interaction with the private entity, whichever occurs first. Absent a valid warrant or subpoena issued by a court of 2 competent jurisdiction, a private entity in possession of biometric identifiers or biometric information must comply with its established 3 retention schedule and destruction guidelines. 4 (b) No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s biometric 5 identifier or biometric information, unless it first: (1) Informs the subject or the subject’s legally authorized 6 representative in writing that a biometric identifier or biometric information is being collected or stored; 7 (2) Informs the subject or the subject’s legally authorized representative in writing of the specific purpose and length of term 8 for which a biometric identifier or biometric information is being collected, stored, and used; and 9 (3) Receives a written release executed by the subject of the biometric identifier or biometric information or the subject’s legally 10 authorized representative. 11 740 Ill. Comp. Stat. 14/15. BIPA authorizes claims for damages or injunctive relief. 740 12 Ill. Comp. Stat. 14/20. Zellmer alleges violations of Section 15(a) and Section 15(b) of BIPA. 13 Dkt. No. 1 at ¶¶ 47-55. 14 Since Zellmer filed the complaint in this case, Facebook has abandoned the tagging 15 functionality pursuant to the settlement agreement in In re Facebook and other related reasons. 16 See In re Facebook, 522 F. Supp. 3d at 617; Torsten Kracht, Lisa Sotto, & Bennett Sooy, 17 Facebook Pivots from Facial Recognition System Following Biometric Privacy Suit, REUTERS 18 (Jan. 26, 2022), https://www.reuters.com/legal/legalindustry/facebook-pivots-facial-recognition- 19 system-following-biometric-privacy-suit-2022-01-26. 20 DISCUSSION 21 I. LEGAL STANDARDS 22 A party “may move for summary judgment, identifying each claim or defense -- or the part 23 of each claim or defense -- on which summary judgment is sought. The court shall grant summary 24 judgment if the movant shows that there is no genuine dispute as to any material fact and the 25 movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). “The Court may dispose 26 of less than the entire case and even just portions of a claim or defense.” CZ Servs., Inc. v. 27 Express Scripts Holding Co., No. 3:18-CV-04217-JD, 2020 WL 4368212, at *2 (N.D. Cal. July 1 30, 2020) (citing Smith v. Cal. Dep’t of Highway Patrol, 75 F. Supp. 3d 1173, 1179 (N.D. Cal. 2 2014)). A dispute is genuine “if the evidence is such that a reasonable jury could return a verdict 3 for the nonmoving party.” Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986). 4 A fact is material if it could affect the outcome of the suit under the governing law. Id. To 5 determine whether a genuine dispute as to any material fact exists, the Court views the evidence in 6 the light most favorable to the nonmoving party, and “all justifiable inferences are to be drawn” in 7 that party’s favor. Id. at 255. The moving party may initially establish the absence of a genuine 8 issue of material fact by “pointing out to the district court that there is an absence of evidence to 9 support the nonmoving party’s case.” Celotex Corp. v. Catrett, 477 U.S. 317, 325 (1986). It is 10 then the nonmoving party’s burden to go beyond the pleadings and identify specific facts that 11 show a genuine issue for trial. Id. at 323-24. “A scintilla of evidence or evidence that is merely 12 colorable or not significantly probative does not present a genuine issue of material fact.” Addisu 13 v. Fred Meyer, Inc., 198 F.3d 1130, 1134 (9th Cir. 2000). 14 In resolving a summary judgment motion, it is not the Court’s task “to scour the record in 15 search of a genuine issue of triable fact.” Keenan v. Allan, 91 F.3d 1275, 1279 (9th Cir. 1996) 16 (quotations omitted). Rather, it is entitled to rely on the nonmoving party to “identify with 17 reasonable particularity the evidence that precludes summary judgment.” Id.; see also Fed. R. 18 Civ. P. 56(c)(3) (“The court need consider only the cited materials, but it may consider other 19 materials in the record.”). 20 II. THE SECTION 15(B) CLAIM 21 Summary judgment is granted in Facebook’s favor on the portion of Zellmer’s BIPA claim 22 relating to notice and consent under Section 15(b). The reason is straightforward: it would be 23 patently unreasonable to construe BIPA to mean that Facebook was required to provide notice to, 24 and obtain consent from, non-users who were for all practical purposes total strangers to 25 Facebook, and with whom Facebook had no relationship whatsoever. Facebook and Zellmer 26 devoted substantial effort to debating technical questions of whether Facebook’s face scans are 27 “biometric identifiers” or “biometric information” within the meaning of BIPA, and whether 1 10-17. But even assuming for present purposes that Zellmer has the better argument on these 2 disputes, which is by no means clear in the record, his claim is premised on an untenable 3 construction of Section 15(b). 4 In interpreting a statute, Illinois follows the well-established “cardinal rule” that courts 5 must “ascertain and give effect to the intent of the legislature.” In re Hernandez, 161 N.E.3d 135, 6 140 (Ill. 2020).2 “The best indicator of that intent is the language used in the statute itself,” and 7 that “language must be given its plain and ordinary meaning.” Id. (citing Bayer v. Panduit Corp., 8 63 N.E.3d 890, 895 (Ill. 2016)). “In construing a statute, a court must not focus exclusively on a 9 single sentence or phrase but must view the statute as a whole, construing words and phrases in 10 light of other relevant statutory provisions and not in isolation.” Sigcho-Lopez v. Illinois State Bd. 11 of Elections. --- N.E.3d ---, 2022 WL 869783 at *5 (Ill. 2022) (citation omitted). A court may also 12 “consider the reason for the law, the problems sought to be remedied, the purposes to be achieved, 13 and the consequences of construing the statute one way or another.” Id. (citation omitted). 14 Illinois also follows the construction principle that “a court presumes that the legislature 15 did not intend absurd, inconvenient, or unjust results.” Id.; see also Solon v. Midwest Medical 16 Records Ass’n, Inc., 925 N.E. 2d 1113, 1118 (Ill. 2010) (same). A court should “avoid an 17 interpretation producing an absurd or unreasonable result.” Sablik v. County of DeKalb, 163 18 N.E.3d 181, 187 (Ill. Ct. App. 2019). The Illinois Supreme Court has specifically stated with 19 respect to BIPA that “[c]ompliance should not be difficult” and any expense a business might 20 incur to comply should be minimal. Rosenbach v. Six Flags Ent’t Corp., 129 N.E.3d 1197, 1207 21 (Ill. 2019). 22 These standards make fairly short work of Zellmer’s Section 15(b) claim. To start, the 23 Illinois legislature clearly contemplated that BIPA would apply in situations where a business had 24 at least some measure of knowing contact with and awareness of the people subject to biometric 25 data collection. The legislative findings emphasize that BIPA is intended to apply to interactions 26

27 2 Facebook used Illinois law for its statutory construction arguments, Dkt. No. 66-4 at 18, and 1 between businesses and their customers, such as “at grocery stores, gas stations, and school 2 cafeterias.” 740 Ill. Comp. Stat. 14/1(b). These examples, along with references to “financial 3 transactions” and other business practices, 740 Ill. Comp. Stat. 14/1(d), convey the legislature’s 4 intent that BIPA applies where there is at least a minimum level of known contact between a 5 person and an entity that might be collecting biometric information. It also bears mention that the 6 Illinois legislature did not intend to ban the use of biometrics altogether, but to regulate it. 740 Ill. 7 Comp. Stat. 14/1(g). 8 In light of these and other provisions in BIPA, the Court had no trouble concluding in In re 9 Facebook that Facebook should have complied with the notice and consent requirements of 10 Section 15(b) for its known users. See, e.g., In re Facebook, 326 F.R.D. at 545. The settlement in 11 that case achieved a vastly higher claims rate than is typical in consumer cases precisely because 12 of Facebook’s relationship with its users. See In re Facebook, 522 F. Supp. 3d at 622 (outreach to 13 class members was maximized by “Facebook’s direct access to users”). 14 The situation here could not be more different. Zellmer and the putative class are by 15 definition entirely unknown to Facebook. Zellmer made no meaningful effort to explain how or 16 why BIPA might reasonably be interpreted to apply in this circumstance. This omission was all 17 the more glaring because Facebook highlighted portions of hearings in similar cases where the 18 Court expressed substantial doubt that the Illinois legislature had contemplated such a 19 counterintuitive result. See Dkt. No. 67-7 at 10:6-11:20; Dkt. No. 67-8 at 31:21-34:15. 20 To construe BIPA as Zellmer urges would lead to obvious and insoluble problems. Under 21 Zellmer’s interpretation of Section 15(b), Facebook in effect would need to identify every non- 22 user in Illinois on a regular basis, and figure out a way to communicate with them to provide 23 notice and obtain consent. Given the readily apparent impossibility of carrying such a burden, the 24 Court expressly asked Zellmer’s counsel for guidance on what, if anything, Facebook could 25 reasonably and realistically do vis-a-vis non-users who are unknown to it. See, e.g., Dkt. No. 84 at 26 5:5-17; Dkt. No. 67-7 at 9:8-18; Dkt. No. 67-8 at 31:21-34:14. The proposals offered in response 27 were highly problematic. Counsel suggested that Facebook might “deputize” its users in Illinois 1 facial scanning program when photos are uploaded. Dkt. No. 70-19 at 18-19. How this might 2 work as a practical matter is entirely unclear, as are the contours of the agency relationship 3 required for “legally authorized representatives” under BIPA. Zellmer also suggested that 4 Facebook could have revised its terms of service to apply facial scanning only when users had 5 written permission from every person in a photo. Id. at 19-20. This too is not consonant with the 6 plain language of BIPA, and immediately raises an insurmountable practical problem for the 7 myriad of photos taken in restaurants, vacation destinations, school graduations, and countless 8 other settings where unknown people will appear in a picture. There is no realistic way for the 9 person posting the photo to obtain consent from every stranger whose face happened to be caught 10 on camera. It may be, as Zellmer suggests, that Amazon and Shutterfly have such policies, but 11 that does not mean those policies satisfy BIPA, or are otherwise legally sound. Simply pointing to 12 other policies also does not provide an answer to the problems the Court has identified. 13 Overall, Zellmer’s notice and consent claim entails an unreasonable reading of Section 14 15(b) that would put Facebook in an impossible position. It is not consonant with the Illinois 15 legislature’s intent or the Illinois Supreme Court’s determination that BIPA should not impose 16 extraordinary burdens on businesses. Summary judgment on the Section 15(b) portion of 17 Zellmer’s BIPA claim is granted in favor of Facebook. The Court emphasizes that this conclusion 18 is made on the basis of the specific record before it, and may not apply in other circumstances. 19 III. THE SECTION 15(A) CLAIM 20 The Section 15(a) claim goes to whether Facebook had a “written policy, made available to 21 the public” that established data retention policies and related practices for biometric identifiers or 22 information. 740 Ill. Comp. Stat. 14/15(a). Facebook did not state that it had such a policy. 23 Instead, it requested summary judgment on the basis of a number of highly factual arguments 24 about whether it possessed such identifiers or information at all. See Dkt. No. 66-4 at 11-18. 25 Zellmer contests Facebook’s evidence, and much of the parties’ arguments are volleys and 26 returns about the record. For example, Facebook says that it deleted face signatures if it 27 determined that there was no match to an existing face templates. See Dkt. No. 66-12 at ¶ 16. 1 for later use. See Dkt. No. 70-19 at 5-6. Zellmer says that all of the steps of Facebook’s facial 2 || recognition technology and the resulting data constituted scans of face geometry. Dkt. No. 70-19 3 at 2; Dkt. No. 70-8 at 44-45. Facebook says that is not true. Dkt. No. 66-4 at 5; Dkt. No. 66-12 4 at J] 2-7. The parties dispute whether face signatures could identify non-users. A Facebook 5 engineer states that face signatures were useless for identifying unknown faces because they can 6 || only be used with Facebook’s existing face templates. Dkt. No. 66-12 at ¥ 12. Zellmer says the 7 evidence demonstrates otherwise. See Dkt. No. 70-14. 8 These are quintessential disputes of material facts that will require a trial to resolve. See 9 || Facebook, 2018 WL 2197546, at *2-*3. Consequently, summary judgment is denied on the 10 Section 15(a) portion of Zellmer’s BIPA claim. 11 CONCLUSION 12 The Court previously stayed and administratively closed the case pending further order. 5 13 The case will be re-opened and a status conference is set for May 26, 2022, at 10:00 a.m. in 14 || Courtroom 11, San Francisco. The parties are directed to file a joint case management statement 3 15 by May 19, 2022. At the conference, the parties should be prepared to discuss whether the lack of 16 a public policy as contemplated by Section 15(a) is a single violation that warrants a single 3 17 liquidated damages or actual damages award, or some other remedy. IT IS SO ORDERED. 19 Dated: March 31, 2022 20 21 7 JAMES PONATO United pftates District Judge 23 24 25 26 27 28