Opinion
20 C 577
09-15-2020
STEVEN VANCE and TIM JANECYK, for themselves and others similarly situated, Plaintiffs, v. INTERNATIONAL BUSINESS MACHINES CORPORATION, a New York corporation, Defendant.
MEMORANDUM OPINION CHARLES P. KOCORAS, District Judge :
Before the Court is Defendant International Business Machines Corporation's ("IBM") motion to dismiss Plaintiffs Steven Vance ("Vance") and Tim Janecyk's ("Janecyk") (collectively, "Plaintiffs") Second Amended Class Action Complaint ("SAC") under Federal Rule of Civil Procedure 12(b)(6). For the following reasons, the Court will grant the motion in part.
BACKGROUND
For purposes of this motion, the Court accepts as true the following facts from the complaint. Alam v. Miller Brewing Co., 709 F.3d 662, 665-66 (7th Cir. 2013). All reasonable inferences are drawn in Plaintiffs' favor. League of Women Voters of Chicago v. City of Chicago, 757 F.3d 722, 724 (7th Cir. 2014).
Plaintiffs Vance and Janecyk are both Illinois residents. Defendant IBM is a multinational technology corporation organized under the laws of the State of New York with a corporate headquarters in Armonk, New York.
Vance has had an account with Flickr, a photo sharing service, since 2006. In 2008, Vance uploaded a photo of himself and two family members to Flickr from his computer in Illinois. Similarly, Janecyk has had a Flickr account since 2008 and uploaded a photo of himself to Flickr in 2011. Yahoo!, Flickr's parent company at the time, subsequently made Vance's photo available to IBM in 2014 when it released over 99 million photos in a single, downloadable dataset called YFCC100M ("Flickr Dataset").
Plaintiffs allege that IBM used the Flickr Dataset to create its own dataset (the "IBM Dataset"). The IBM Dataset was allegedly comprised of over one million front-facing images of human faces. In each image, IBM allegedly extracted 68 key-points and at least ten facial coding schemes, such as craniofacial distances, craniofacial areas, craniofacial ratios, facial symmetry, facial regions contrast, skin color, age prediction, gender prediction, subjective annotation, and pose and resolution.
Plaintiffs allege that IBM subsequently disseminated a dataset created from information extracted from the IBM Dataset. IBM called this dataset "Diversity in Faces" ("DIF Dataset"). Each image in the DIF Dataset could allegedly be traced back to the individual Flickr account to which it was originally uploaded.
Based on these facts, Plaintiffs filed the instant class action complaint on March 12, 2020. Plaintiffs allege that IBM did not establish a publicly available retention schedule and guidelines for destroying biometric information in violation of Section 15(a) of the Illinois Biometric Information Privacy Act, 740 ILCS § 14/1 et seq. ("BIPA") (Count One); IBM collected, captured, or otherwise obtained Plaintiffs' biometric information without written informed consent in violation of BIPA Section 15(b) (Count Two); IBM sold Plaintiffs' biometric information in violation of BIPA Section 15(c) (Count Three); IBM disclosed or otherwise disseminated Plaintiffs' biometric information without Plaintiffs' consent or required by law in violation of BIPA Section 15(d) (Count Four); IBM failed to use reasonable care to protect Plaintiffs' biometric information from disclosure and did not store Plaintiffs' biometric information in a matter the same as IBM would store other confidential information in violation of BIPA Section 15(e) (Count Five); a state law unjust enrichment claim (Count Six); and a state law injunctive relief claim (Count Seven).
Count Seven was improperly labeled as Count Six.
Plaintiffs seek statutory damages of $5,000 for each willful and reckless violation and $1,000 for each negligent violation of BIPA. IBM moved to dismiss the complaint under Rule 12(b)(6) on April 16, 2020.
LEGAL STANDARD
A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) "tests the sufficiency of the complaint, not the merits of the case." McReynolds v. Merrill Lynch & Co., 694 F.3d 873, 878 (7th Cir. 2012). The allegations in the complaint must set forth a "short and plain statement of the claim showing that the pleader is entitled to relief." Fed. R. Civ. P. 8(a)(2). A plaintiff need not provide detailed factual allegations, but it must provide enough factual support to raise its right to relief above a speculative level. Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007).
A claim must be facially plausible, meaning that the pleadings must "allow . . . the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). The claim must be described "in sufficient detail to give the defendant 'fair notice of what the . . . claim is and the grounds upon which it rests.'" E.E.O.C. v. Concentra Health Servs., Inc., 496 F.3d 773, 776 (7th Cir. 2007) (quoting Twombly, 550 U.S. at 555). "[T]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements," are insufficient to withstand a 12(b)(6) motion to dismiss. Iqbal, 556 U.S. at 678.
DISCUSSION
As a preliminary matter, we note that the Seventh Circuit's recent decision in Bryant v. Compass Group USA Inc., brings into question our subject-matter jurisdiction over Plaintiffs' claims under BIPA Section 15(a). 958 F.3d 617 (7th Cir. 2020). In Bryant, the Seventh Circuit resolved an important issue that has divided courts in our District for the past three years: what BIPA violations are sufficiently substantive to qualify as an injury for purposes of standing under Article III of the U.S. Constitution ("Article III").
Applying Justice Thomas's rubric from his concurrence in Spokeo Inc., v. Robbins, 136 S. Ct. 1540, 1551 (2016), the Bryant Court distinguished between the duty owed under BIPA Section 15(b)—requiring that private entities obtain informed consent to collect biometric information—and that owed under Section 15(a), requiring private entities to make publicly available a data retention schedule and guidelines for permanently destroying collected biometric identifiers and information. 958 F.3d at 624.
The Bryant Court found that the obligations under the former are owed to private individuals, and therefore, a violation of BIPA Section 15(b) invades a plaintiff's personal privacy right to consider the terms under which her biometric information is collected and used. Id. In contrast, the obligations under BIPA Section 15(a) are owed to the public generally. Id. at 626. Therefore, a violation of that Section does not invade a plaintiff's personal privacy rights in a concrete manner. Id. Accordingly, the Bryant Court held that a violation of Section BIPA Section 15(b) is a substantive violation that creates a concrete and particularized Article III injury, whereas a violation of BIPA Section 15(a) is procedural and does not create such an injury. Id.
Applying the Bryant Court's holding, we conclude that we lack subject-matter jurisdiction over Plaintiffs' Section 15(a) claims. In their complaint, Plaintiffs allege that IBM failed to maintain a publicly available retention and destruction schedule in violation of BIPA Section 15(a). But such a violation does not create a concrete injury as required under Article III. Therefore, we find that Plaintiffs lack standing to bring this claim in federal court. The Court accordingly dismisses the claims under Section 15(a) for lack of subject-matter jurisdiction. See Wernsing v. Thompson, 423 F.3d 732, 743 (7th Cir. 2005) ("[N]ot only may the federal courts police subject matter jurisdiction sua sponte, they must.") (internal citation omitted); Wingerter v. Chester Quarry Co., 185 F.3d 657, 660 (7th Cir. 1998) (holding that a court "has an obligation to examine its jurisdiction sua sponte, even if the parties fail to raise a jurisdictional issue.").
Turning to the merits of IBM's motion, IBM urges the Court to dismiss Plaintiffs' BIPA claims, unjust enrichment claim, and injunctive relief claim. We address each in turn.
I. BIPA
IBM urges the Court to dismiss Plaintiffs' BIPA claims for three reasons: (1) application of BIPA in this case would violate Illinois's extraterritoriality doctrine; (2) BIPA violates the U.S. Constitution's Dormant Commerce Clause; and (3) BIPA expressly exempts photographs. We address each argument in turn.
a. Illinois's Extraterritoriality Doctrine
IBM first argues that Illinois' extraterritoriality doctrine prohibits the litigation of Plaintiffs' claims because Plaintiffs do not allege that that the acts occurred primarily and substantially in Illinois. Plaintiffs argue that this is not an issue to be decided at the motion to dismiss stage. We agree with Plaintiffs.
The Illinois Supreme Court has held that "a statute is without extraterritorial effect unless a clear intent in this respect appears from the express provisions of the statute." Avery v. State Farm Mutual. Auto Ins. Co., 216 Ill. 2d 100, 184-85 (2005). However, an Illinois law can be applied if "the circumstances that relate to the disputed transaction occur[red] primarily and substantially in Illinois." Id. at 187. "[T]here is no single formula or bright-line test for determining whether a transaction occurs within [Illinois]" and "each case must be decided on its own facts." Id.
The parties agree that BIPA cannot be applied extraterritorially. Thus, the question is whether the events giving rise to this suit occurred primarily and substantially in Illinois. However, this is a highly fact-based analysis that is generally inappropriate for the motion to dismiss stage. Monroy v. Shutterfly, Inc., 2017 WL 4099846, *6 (N.D. Ill. 2017) (holding that the extraterritoriality doctrine is better addressed on a motion for summary judgment); Rivera v. Google, Inc., 238 F. Supp. 3d 1088, 1101-02 (N.D. Ill. 2017) (same).
While IBM is headquartered in New York, discovery is needed in order to determine to what extent IBM's alleged acts occurred in Illinois. For example, more facts will need to be known regarding where IBM performed the face scans and where the DIF Dataset was created. Without this information, the Court cannot determine whether BIPA is being applied extraterritorially under Avery.
b. Dormant Commerce Clause
IBM next argues that BIPA violates the Dormant Commerce Clause as applied in this case. Specifically, IBM argues that because New York, IBM's home state, has repeatedly failed to pass laws similar to BIPA, Illinois's BIPA "would displace the inconsistent policies of New York" and thus violate the Dormant Commerce Clause. Plaintiffs again argue that this is an issue more properly addressed on a motion for summary judgment. We agree with Plaintiffs.
The U.S. Constitution's Commerce Clause grants Congress the authority to "regulate Commerce . . . among the several States." U.S. Const. Art I, § 8, cl. 3. "Th[e] 'negative' aspect of the Commerce Clause is often referred to as the 'Dormant Commerce Clause' and is invoked to invalidate overreaching provisions of state regulation of commerce." Alliant Energy Corp. v. Bie, 330 F.3d 904, 911 (7th Cir.2003); see also Am. Trucking Assn's, Inc. v. Mich. Pub. Serv. Comm'n, 545 U.S. 429, 433 (2005). The Dormant Commerce Clause limits the permissible "extraterritorial effects of state economic regulation." Healy v. Beer Institute, 491 U.S. 324, 336 (1989). Additionally, the "Dormant Commerce Clause . . . precludes the application of a state statute to commerce that takes place wholly outside of the State's borders, whether or not the commerce has effects within the State." Id. at 336 (quoting Edgar v. MITE Corp., 457 U.S. 624, 642-43 (1982)).
Like the extraterritoriality doctrine, courts have repeatedly rejected the argument that the Dormant Commerce Clause prevents BIPA's application to out-of-state defendants at the motion to dismiss stage and held that the issue is more properly addressed on a motion for summary judgment. Rivera., 238 F. Supp. 3d at 1104; Monroy, 2017 WL 4099846, at **7-8; see In re Facebook Biometric Privacy Litig., 2018 WL 2197546, *4 (N.D. Cal. 2018). In Rivera, for example, the Court held, "this is not the stage at which to assess these arguments in detail. . . . Whether the Privacy Act is nevertheless being summoned here to control commercial conduct wholly outside Illinois is not possible to figure out without a better factual understanding of what is happening in the [Defendant's] face-scan process." Rivera at 1104.
We again believe that summary judgment is the more appropriate time to determine whether the Dormant Commerce Clause bars Plaintiffs' claims. We need more detailed facts regarding IBM's processes to know the extent to which IBM's actions occurred in Illinois and whether the Dormant Commerce Clause bars this suit.
c. BIPA's Exclusion of Photographs
IBM next argues that BIPA expressly excludes photographs and biometric information derived from photographs. Plaintiffs argue that courts have held that conduct similar to IBM's alleged conduct has been held to not be barred by BIPA's photograph exclusions. We agree with Plaintiffs.
BIPA defines a "biometric identifier" as "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry." 740 ILCS 14/10. BIPA's definition of a biometric identifier expressly excludes photographs. Id. "Biometric information" is "any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual." Id. However, courts have held that biometric data obtained from photographs is a "biometric identifier." See, e.g., Rivera, 238 F. Supp 3d at 1095; In re Facebook Biometric Privacy Litig., 185 F. Supp. 3d 1155, 1170-72 (N.D. Cal. 2016); Monroy, 2017 WL 4099846, at **3-5.
In Rivera, the court held that Google's "face templates" derived from photographs do not fall within BIPA's exclusion of photographs. 238 F. Supp 3d at 1095. The court said that each template involved "creating a set of biology-based measurements ('biometric') that is used to identify a person ('identifier')." Id. Moreover, "a face template is one of the specified biometric identifiers in the Privacy Act, namely, a 'scan of ... face geometry.'" Id. The court found that nothing in BIPA supported Google's argument that the face scan had to be done in person and not from a photograph because the statute does not specify how biometric information must be captured. Id. "The bottom line is that a 'biometric identifier' is not the underlying medium itself, or a way of taking measurements, but instead is a set of measurements of a specified physical component (eye, finger, voice, hand, face) used to identify a person." Id. at 1096.
Here, Plaintiffs allege that IBM extracted biometric information from photographs to create their DIF Dataset. The DIF Dataset includes biometric measurements that can be used to identify Plaintiffs. Thus, IBM's alleged actions implicate BIPA. While IBM argues that Rivera and other cases were wrongly decided, IBM has not offered any persuasive arguments to convince us. Indeed, as the Rivera court warned, "Who knows how iris scans, retina scans, fingerprints, voiceprints, and scans of faces and hands will be taken in the future? It is not the how that is important to the Privacy Act; what's important is the potential intrusion on privacy posed by the unrestricted gathering of biometric information." Id. Accordingly, IBM's motion to dismiss Plaintiffs' BIPA claims is denied.
II. Unjust Enrichment
IBM argues that Plaintiffs' unjust enrichment claims should be dismissed because Plaintiffs do not allege they suffered a corresponding "economic expense" or that they had a reasonable expectation of payment. In other words, IBM's first argument seems to be that Plaintiffs have not suffered damages. Plaintiffs argue that they are not required to allege that they suffered an "economic expense" under Illinois law or that they expected any payment. We agree with Plaintiffs.
IBM also argues that the unjust enrichment claims should be dismissed because they are based on the BIPA claims, and the underlying BIPA claims should be dismissed. As we are not dismissing the BIPA claims, we do not address this argument.
To plead a claim of unjust enrichment under Illinois law, "'a plaintiff must allege that the defendant has unjustly retained a benefit to the plaintiff's detriment, and that defendant's retention of the benefit violates the fundamental principles of justice, equity, and good conscience.'" Cleary v. Philip Morris Inc., 656 F.3d 511, 516 (7th Cir. 2011) (quoting HPI Health Care Servs., Inc. v. Mt. Vernon Hosp., Inc., 131 Ill.2d 145, 160 (1989)).
Plaintiffs have adequately plead an unjust enrichment claim. Plaintiffs allege that IBM unlawfully acquired their biometric information and profited from the dissemination of their biometric information. Plaintiffs allege that such alleged acts by IBM violated Illinois public policy as expressed in BIPA. Moreover, Plaintiffs allege that it would violate the principles of equity and good conscience to allow IBM to retain and continue to profit from their biometric information. Plaintiffs allege that they suffered damages because they are exposed to a heightened risk of privacy harm and because they have been deprived of their control over their biometric data.
The requirement that a plaintiff have a reasonable expectation of payment applies when an unjust enrichment claim is predicated on a third party receiving the benefit of a contract. Sunny Handicraft Ltd. v. Envision This!, LLC, 2015 WL 231108, *4 (N.D. Ill. 2015) (applying Illinois law). This is because Illinois law ordinarily prohibits third party quasi-contractual liability. Id.; see Goldstick v. ICM Realty, 788 F.2d 456, 468 (7th Cir. 1986) ("if you do work pursuant to a contract with X, you don't expect that Y, a nonparty, will pay you if X defaults, merely because Y was benefited by your work"). However, Plaintiffs claims are based on underlying statutory violations, not contract law. Accordingly, IBM's motion to dismiss Plaintiffs' unjust enrichment claim is denied.
III. Injunctive Relief
IBM argues that Plaintiffs' injunctive relief claim should be dismissed because injunctive relief is a remedy and not a cause of action. Plaintiffs did not respond to this argument, thus waiving any argument. United States v. Holm, 326 F.3d 872 (7th Cir. 2003) ("It is not the obligation of this court to research and construct the legal arguments open to parties," and "perfunctory and undeveloped arguments" are waived.) Nevertheless, the Court agrees that injunctive relief is not a cause of action. See, e.g., Noah v. Enesco Corp., 911 F. Supp. 305, 307 (N.D. Ill. 1995) ("An injunction is a remedy, not a cause of action"); Independents Gas & Service Stations Associations, Inc. v. City of Chicago, 112 F. Supp. 3d 749, 758 (N.D. Ill. 2015) (same); Missouri Pet Breeders Assoc. v. County of Cook, 106 F. Supp. 3d 908, 927 (N.D. Ill 2015) (same). Accordingly, Count Seven is dismissed.
CONCLUSION
For the reasons mentioned above, the Court grants IBM's motion to dismiss (Dkt. # 35) as to Count Seven. Additionally, the Court dismisses Count One for lack of subject matter jurisdiction. IBM's motion is denied as to the remaining counts. Status is set for 10/13/2020 at 10:40 a.m. It is so ordered. Dated: 09/15/2020
/s/_________
Charles P. Kocoras
United States District Judge