Norberg v. Shutterfly, Inc. et al

RESPONSE

N.D. Ill.August 28, 2015

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS BRIAN NORBERG, on behalf of himself and all others similarly situated, Plaintiff, v. SHUTTERFLY, INC.; and THISLIFE.COM, INC., Defendants. Civil Action No. 1:15-cv-05351 PLAINTIFF’S RESPONSE IN OPPOSITION TO DEFENDANTS’ MOTION TO DISMISS (D.E. 26) THE FIRST AMENDED CLASS ACTION COMPLAINT (D.E. 6) Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 1 of 26 PageID #:114 ii TABLE OF CONTENTS I. INTRODUCTION .................................................................................................................................. 1 II. THE MOTION TO DISMISS PURSUANT TO RULE 12(B)(6) OVERLOOKS THE PLAIN LANGUAGE OF THE BIPA AND READS INTO THE STATUTE EXCEPTIONS THAT THE LEGISLATURE DID NOT INTEND ........................................................................................................ 2 A. Applicable Legal Standards ................................................................................................................ 2 B. Argument .............................................................................................................................................. 3 1. Scans of Face Geometry Derived From Photographs Are Biometric Identifiers Under The Plain and Ordinary Meaning of the BIPA ................................................................................... 4 2. Statutory Construction and Legislative History Confirm BIPA’s Applicability to Scans of Face Geometry Obtained from Photographs .............................................................................. 5 III. DEFENDANTS ARE SUBJECT TO SPECIFIC PERSONAL JURISDICTION FOR THEIR INVASION OF ILLINOIS RESIDENTS’ BIOMETRIC PRIVACY IN VIOLATION OF THE BIPA ........................................................................................................................................................ 15 A. Applicable Legal Standard ................................................................................................................ 15 B. Argument ............................................................................................................................................ 16 IV. CONCLUSION ................................................................................................................................. 20 Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 2 of 26 PageID #:115 iii TABLE OF AUTHORITIES CASES Abrahamson v. Ill. Dep’t of Prof’l Regulation, 153 Ill. 2d 76 (1992) .......................................................................... 2 Brown v. Kirk, 64 Ill. 2d 144 (1976) ........................................................................................................................ 14 Bruso by Bruso v. Alexian Brothers Hospital, 178 Ill. 2d 445 (1997): ........................................................................ 6 Bunn-O-Matic Corp. v. Bunn Coffee Serv., Inc., 88 F. Supp. 2d 914 (C.D. Ill. 2000) ............................................ 18 Burger King Corp. v. Rudzewicz, 471 U.S. 462 (1985) ....................................................................................... 15, 16 Carlson v. CSX Transp., Inc., 758 F.3d 819 (7th Cir. 2014).................................................................................... 2 Hood v. Hartford Life & Accident Ins. Co., 567 F. Supp. 2d 1221 (E.D. Cal. 2008)........................................... 14 DeLuna v. Burciaga, 223 Ill. 2d 49 (2006) ................................................................................................................. 2 Felland v. Clifton, 682 F.3d 665 (7th Cir. 2012) ..................................................................................................... 16 Gridley v. Gridley, 399 Ill. 215 (1948) ........................................................................................................................ 7 Helicopteros Nacionales de Colombia, S.A. v. Hall, 466 U.S. 408 (1984) .......................................................... 15, 16 Illinois v. Hemi Group LLC, 622 F.3d 754 (7th Cir. 2010) ................................................................................... 17 Images of the World, Inc. v. Cont’l Am. Indus., Inc., 2005 WL 2171193 (N.D. Ill. Aug. 30, 2005) ............... 16, 17 Jogi v. Voges, 480 F.3d 822 (7th Cir. 2007) ............................................................................................................ 14 Jordan v. Dominick’s Finer Foods, 2015 WL 4498909 (N.D. Ill. July 23, 2015)... .............................. 3, 5, 7, 9, 12 Lebowitz v. City of New York, 2014 WL 772349 (S.D.N.Y. Feb. 25, 2014) ....................................................... 11 Lincoln Diagnostics, Inc. v. Panatrex, Inc., 2008 WL 2246960 (C.D. Ill. May 29, 2008) ...................................... 18 People v. Holm, 387 Ill. Dec. 616 (Ill. App. Ct. 2014) ............................................................................................. 3 People v. Lewis, 223 Ill. 2d 393 (2006) ....................................................................................................................... 2 Public Access Opinion No. 14-008, 2014 WL 4407615 (Ill. Att’y Gen. Aug. 19, 2014) ................................ 8 Purdue Research Found. v. Sanofi-Synthelabo, S.A., 338 F.3d 773 (7th Cir. 2003) ................................................. 15 Richter v. INSTAR Enterprises Int’l, Inc., 594 F. Supp. 2d 100 (N.D. Ill. 2009) ................................................ 19 S. Illinoisan v. Illinois Dep’t of Pub. Health, 218 Ill. 2d 390 (2006) .......................................................................... 5 Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 3 of 26 PageID #:116 iv Erie Railroad Co. v. Tompkins, 304 U.S. 64 (1938) .................................................................................................. 2 U.S. Fire Ins. Co. v. Barker Car Rental, 132 F.3d 1153 (7th Cir. 1997) ................................................................. 2 uBid, Inc. v. The GoDaddy Group, Inc., 623 F.3d 421 (7th Cir. 2010)............................................................. 17, 20 Valtech, LLC v. 18th Avenue Toys Ltd., 2015 WL 603854 (N.D. Ill. Feb. 12, 2015) .................................. 16, 17 Varitalk, LLC v. Lahoti, 2007 WL 1576127 (N.D. Ill. May 30, 2007) ............................................................. 18 VPS, LLC v. Shutterfly, Inc., 2004 WL 1557954 (N.D. Ill. July 8, 2004) .......................................................... 16 World-Wide Volkswagen Corp. v. Woodson, 444 U.S. 286 (1980) ........................................................................... 15 STATUTES Federal Rules of Evidence, Rule 702, Practice Comment (3d ed., Dec. 2014) .............................................. 11 735 Ill. Comp. Stat. 5/2-209 .................................................................................................................................. 15 740 ILCS 14/10 ................................................................................................................................................passim 740 ILCS 14/15. ..........................................................................................................................................3, 4, 9, 12 OTHER AUTHORITIES Elizabeth M. Walker, Biometric Boom: How the Private Sector Commodifies Human Characteristics, 25 Fordham Intell. Prop. Media & Ent. L.J. 831 (2015) ...................................................................................................... 10 Michael Cherry & Edward Imwinkelried, A Cautionary Note About Fingerprint Analysis and Reliance on Digital Technology, Champion, August 2006 .................................................................................................................. 11 Stephen Hoffman, Biometrics, Retinal Scanning, and the Right to Privacy in the 21st Century, Syracuse Sci. & Tech. L. Rep., Spring 2010 ................................................................................................................................ 11 Steven C. Bennett, Privacy Implications of Biometrics, Prac. Law., June 2007 ........................................................ 8 Sutherland, Statutes and Statutory Construction § 47.04 (5th ed. 1992, Norman Singer ed.) ..................... 14 Yana Welinder, A Face Tells More Than A Thousand Posts: Developing Face Recognition Privacy in Social Networks, 26 Harv. J.L. & Tech. 165 (2012) .................................................................................................... 10 Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 4 of 26 PageID #:117 1 Plaintiff submits this response in opposition to the Motion to Dismiss (D.E. 26 (the “Motion to Dismiss”)) the First Amended Class Action Complaint (D.E. 6 (the “Complaint”)) filed by Shutterfly, Inc. and ThisLife.com, Inc. (collectively, “Defendants”). I. INTRODUCTION The Motion to Dismiss is right about one thing. This is a simple case. In enacting the Biometric Information Privacy Act (the “BIPA”), Illinois banned unauthorized gathering of two distinct and separately defined things: (1) “biometric identifiers,” which are defined as retinal scans, iris scans, voiceprints, fingerprints, and scans of hand or face geometry; and (2) “biometric information,” i.e., any information that can be derived from biometric identifiers. Defendants gather biometric identifiers – specifically, scans of face geometry – without consent. Defendants therefore violate the statute. Simple as that. Defendants do not deny that they gather scans of face geometry without consent. Instead, they argue that scans of face geometry are not biometric identifiers if they are derived from photographs rather than in person, because the definition of biometric information excludes information derived from photographs. This argument fails for several reasons. First, the exception for derivatives pertains only to the definition of biometric information, not biometric identifiers. Scans of face geometry are biometric identifiers, not biometric information. Second, the statute says nothing about gathering biometric identifiers in person. Third, it would be senseless to permit scanning from photographs but not in person. All of the biometric identifiers are obtained from visual or audio media. If the intermediation of a photograph or audio recording excused all subsequent processing into a biometric identifier, Defendants’ interpretation of the exception would swallow the rule. Defendants are free to gather photographs, and to gather information from photographs, but they are not free to gather biometric identifiers from photographs. The Motion to Dismiss for failure to state a claim should be denied. Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 5 of 26 PageID #:118 2 The Motion to Dismiss for lack of personal jurisdiction should likewise be denied. The Complaint alleges that the Defendants’ facial recognition technology violated an Illinois statute and caused widespread harm directed to thousands of Illinois residents, easily satisfying the requirements of the state’s long-arm statute. II. THE MOTION TO DISMISS PURSUANT TO RULE 12(b)(6) OVERLOOKS THE PLAIN LANGUAGE OF THE BIPA AND READS INTO THE STATUTE EXCEPTIONS THAT THE LEGISLATURE DID NOT INTEND A. Applicable Legal Standards On a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6), a court “must construe [the complaint] in the light most favorable to plaintiff, accept well-pleaded facts as true, and draw all inferences in the plaintiff’s favor.” Carlson v. CSX Transp., Inc., 758 F.3d 819, 826 (7th Cir. 2014). When interpreting state law, a federal court applies the rules of statutory construction applicable under state law. See Erie Railroad Co. v. Tompkins, 304 U.S. 64 (1938); U.S. Fire Ins. Co. v. Barker Car Rental, 132 F.3d 1153, 1156 (7th Cir. 1997) (“[W]e must apply the same rules of statutory construction that the Supreme Court of Illinois would apply if it were faced with the same task.”). “In Illinois, the applicable principles of statutory construction are well established. The primary rule is that courts should ascertain and give effect to the intention of the legislature. To achieve that goal, we must regard the language of the statute as the best indication of legislative intent.” U.S. Fire Ins., 132 F.3d at 1156 (citing Abrahamson v. Ill. Dep’t of Prof’l Regulation, 153 Ill. 2d 76, 90 (1992)); see also DeLuna v. Burciaga, 223 Ill. 2d 49, 59 (2006) (“When the language of the statute is clear, it must be applied as written without resort to aids or tools of interpretation.”). Courts “will not depart from the plain statutory language by reading into the statute exceptions, limitations, or conditions that the legislature did not express.” People v. Lewis, 223 Ill. 2d 393, 402 (2006) (citation omitted). Where a statute requires interpretation and the exact legislative intent cannot be ascertained from the plain and ordinary meaning of its language alone, the court is guided by the canons of Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 6 of 26 PageID #:119 3 statutory construction and by legislative history, People v. Holm, 387 Ill. Dec. 616, 619 (Ill. App. Ct. 2014), and also by the practical consequences of the competing statutory interpretations, Jordan v. Dominick’s Finer Foods, No. 10 C 407, 2015 WL 4498909, at *2 (N.D. Ill. July 23, 2015). B. Argument Section 10 of the BIPA states: ‘Biometric identifier’ means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Biometric identifiers do not include writing samples, written signatures, photographs, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions such as height, weight, hair color, or eye color. . . . ‘Biometric information’ means any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual. Biometric information does not include information derived from items or procedures excluded under the definition of biometric identifiers. 740 ILCS 14/10 (emphasis added). The BIPA prohibits the collection, possession and/or disclosure, without the individual’s express written consent, of both biometric identifiers and biometric information. 740 ILCS 14/15(a)-(d).1 The plain language of the BIPA defines Defendants’ scans of face geometry to be biometric identifiers. The analysis should end there. See DeLuna, 223 Ill. 2d at 52. But even looking past the plain language of the statute, Defendants’ interpretation finds no purchase in the canons of statutory construction, the legislative history, or practical considerations. The Motion to Dismiss should be denied. 1 Each BIPA restriction (i.e., collection, possession and use) applies disjunctively to both biometric information and biometric identifiers. See 740 ILCS 14/15(a) (“A private entity in possession of biometric identifiers or biometric information must develop a written policy . . .); 740 ILCS 14/15(b) (“No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s biometric identifier or biometric information, unless it first . . .”). Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 7 of 26 PageID #:120 4 1. Scans of Face Geometry Derived From Photographs Are Biometric Identifiers Under The Plain and Ordinary Meaning of the BIPA Under the plain language of the BIPA, the definition of “biometric identifiers” includes “scans of . . . face geometry.” 740 ILCS 14/10. The definition does not contain any qualification relating to how the identifier was derived. Therefore, on its face, the statute encompasses biometric identifiers – i.e., scans of face geometry – derived from human faces depicted in photographs. The Complaint is entirely consistent with the clear and unambiguous statutory language. The Complaint alleges that Defendants’ sophisticated, patented facial recognition technology searches each and every user-uploaded photo for faces, and then scans those faces for geometric points and contours for purposes of creating and storing a digitized face template of each face. (Compl. ¶¶ 5, 12, 20, 22, 28, 30-33, 37.) The resulting face templates – not the innocuous photographs from which they were derived, but the resulting highly detailed digital maps of geometric points and measurements – are “scans of face geometry” and thus fall within the BIPA’s definition of “biometric identifiers.” (Id.)2 Defendants attempt to overcome the plain meaning of the statute in two ways. First, they point out that the definition of biometric identifiers excludes photographs, and then rely on and conflate this with the definition of “biometric information,” which excludes information derived from items (such as photographs) that are excluded from the definition of biometric identifiers. This misses the mark. Information derived from photographs is excluded from the definition of biometric information, not from the definition of biometric identifier. The Complaint alleges that Defendants gather biometric identifiers (scans of face geometry) from photographs. Defendants’ argument fails under the plain language of the statute. See DeLuna, 223 Ill. 2d at 52. 2 The Complaint also alleges that Defendants collect “biometric information” (pertaining to gender, race and age) that is derived from the resulting “scans of face geometry.” (Compl. ¶ 23.) Because such information is derived from “biometric identifiers” as opposed to the photographs themselves, Defendants’ unauthorized collection of this information also constitutes a violation of the BIPA. See 740 ILCS 14/10; 740 ILCS 14/15(a)-(d). Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 8 of 26 PageID #:121 5 Second, Defendants argue that the BIPA regulates only the “in-person” collection of biometric identifiers, not collection from photographs. The definition of biometric identifiers, however, contains no reference whatsoever to the source of the identifier. There is neither a requirement of in-person collection nor an exclusion of photographic collection. On its face, the statute regulates biometric identifiers, regardless of derivation. Defendants’ argument improperly “read[s] into the statute exceptions, limitations or conditions that the legislature did not express.” Lewis, 223 Ill. 2d at 402. Again, Defendants’ argument fails under the plain language of the statute. The Complaint states a claim, and the Motion to Dismiss should be denied. 2. Statutory Construction and Legislative History Confirm BIPA’s Applicability to Scans of Face Geometry Obtained from Photographs Proper statutory construction and the legislative history confirm that the BIPA prohibits unauthorized gathering of biometric identifiers from photographs or other media, no less than unauthorized gathering of identifiers in person. All biometric identifiers are subject to the statute, regardless of derivation. a. Statutory Construction Canons of statutory construction – including statutory language and structure, extrinsic meanings of relevant terms, and practical consequences – all confirm that the statute prohibits gathering scans of face geometry from photographs (or from any other source) without consent. i. Statutory Language and Structure “A fundamental principle of statutory construction is to view all provisions of a statutory enactment as a whole. Accordingly, words and phrases should not be construed in isolation, but must be interpreted in light of other relevant provisions of the statute.” S. Illinoisan v. Illinois Dep’t of Pub. Health, 218 Ill. 2d 390, 415 (2006); see also Jordan, 2015 WL 4498909, at *2 (“[T]he statutory ‘text’ must be placed within its ‘context’ to be properly understood.”). Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 9 of 26 PageID #:122 6 Accordingly, differences in statutory language must be given force and effect, especially in adjacent provisions where parallel terms would be expected if truly intended. Thus, the Illinois Supreme Court reasoned in Bruso by Bruso v. Alexian Brothers Hospital, 178 Ill. 2d 445 (1997): Subsection (c) is clearly intended to act as an exception to both subsections (a) and (b). If the legislature had intended legal disability to be an exception for adults only, the logical place for that exception would have been in, or immediately following, subsection (a). The legislature, however, chose to locate the tolling provision for legal disability in a separate subsection following subsections (a) and (b). 178 Ill. 2d at 453. Similarly, the Court reasoned in DeLuna: If the legislature had intended subsection (e) of section 13–214.3 to apply only to the statute of limitations contained in subsection (b), it could have placed that tolling provision ‘in, or immediately following,’ subsection (b). However, the legislature chose, instead, to locate the tolling provision for minors in a separate subsection following subsections (b) and (c). It is, therefore, reasonable to infer that it was meant to apply to both. 223 Ill. 2d at 63-64. The definitions of “biometric identifier” and “biometric information” differ at exactly the point where Defendants have placed all their chips. The definition of biometric identifiers contains a long list of items (such as photographs) that are excluded. 740 ILCS 14/10. None of the many exclusions, however, says anything about identifiers derived from those exclusions. The definition of “biometric information,” by contrast, contains just one simple exclusion: “information derived from items or procedures excluded under the definition of biometric identifiers.” Id. Thus, the statute explicitly excludes derivatives from the definition of biometric information, but not from the separate definition of biometric identifiers. Notably, the words “identifiers” and “information” are separately defined and consistently used in a manner that confirms the exclusion of derivatives pertains only to biometric information, not biometric identifiers. The statute provides: “Biometric information does not include information derived from items or procedures excluded under the definition of biometric identifiers.” Id. Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 10 of 26 PageID #:123 7 (emphasis added). The statute does not, however, exclude derivatives of biometric identifiers from the definition of biometric identifiers. The Court must give meaning to these significant differences in statutory language and structure. The legislature could easily have provided for derivatives to be excluded from the definition of biometric identifiers, just as they are from the definition of biometric information. A parallel exclusion could have simply read: “Biometric identifiers do not include identifiers derived from items or procedures excluded under this definition of biometric identifiers.” Or, as explained by Bruso and DeLuna, a single exclusion could have covered both definitions: “Biometric identifiers and biometric information do not include identifiers or information derived from items or procedures excluded under the definition of biometric identifiers.” But there is no such exclusion. The legislature’s decision to place an exclusion for derivatives solely in the definition of biometric information is clear evidence that the legislature intended for biometric identifiers to be regulated regardless of derivation. A scan of face geometry derived from a photograph therefore constitutes a biometric identifier no less than any other scan of face geometry. The Complaint states a claim, and the Motion to Dismiss should be denied. ii. Extrinsic Definitions Extrinsic definitions of statutory terms, especially technical terms, are properly considered in statutory construction. See Jordan, 2015 WL 4498909, at *2 (stating that when a term “is not defined by the statute itself” or “by any applicable case law interpreting the statute,” it is “appropriate to employ a dictionary to ascertain the meaning of an otherwise undefined word or phrase.”) (citing Landis v. Marc Realty, L.L.C., 235 Ill. 2d 1, 8 (2009)); Gridley v. Gridley, 399 Ill. 215, 223 (1948) (“Technical words, or words of known legal import, must have their legal effect[.] When unexplained and uncontrolled by the context they are to be interpreted according to their technical meaning.”). Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 11 of 26 PageID #:124 8 “Biometric identifier” is a term of art that would generally be understood to exclude ordinary photographs but include technologically-enhanced identifiers derived from photographs. The term “biometrics” is defined as “the measurement and analysis of unique physical or behavioral characteristics (as fingerprint or voice patterns) especially as a means of verifying personal identity.” Definition of BIOMETRICS, Merriam-Webster, www.merriam- webster.com/dictionary/biometrics (last visited Aug. 12, 2015). Biometrics are characterized by the use of enhanced tools of measurement and analysis made possible by modern computing technology. See generally Steven C. Bennett, Privacy Implications of Biometrics, Prac. Law., June 2007, at 13, 14-15 (“The rise of mechanical biometric technology, especially computers and computerized databases, and the consequent automation of the identification process have radically increased both the ability to identify individuals biometrically and the potential for abuse of biometrics.”); see also Public Access Opinion No. 14-008, 2014 WL 4407615, at *4 (Ill. Att’y Gen. Aug. 19, 2014) (stating, in context of Illinois FOIA statute, that “any clear photo of a person contains some biometric information,” but a photo does not qualify as a biometric identifier “in the technical or legal sense” unless there is an “intention to convert it to a template or match it against a face gallery” (emphasis added)). Here, Defendants convert photographs into digitized templates and match those templates against face galleries – the precise conduct the legislature intended to regulate. In keeping with this ordinary understanding, including the understanding of the Illinois Attorney General, the BIPA regulates the use of such technologically enhanced “measurement and analysis” to collect individuals’ unique identifying characteristics. Id. The BIPA regulates scans of the retina or iris, fingerprints, voiceprints, and scans of hand or face geometry, all of which employ technological measurement and analysis to ascertain identity. See 740 ILCS 14/10. Conversely, the BIPA explicitly does not regulate commonplace and readily observable items that do not employ technologically enhanced tools of measurement and analysis to ascertain identity – items such as Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 12 of 26 PageID #:125 9 signatures, photographs and physical descriptions such as height, weight, hair color and eye color, see id. Both the statute and the general definition of biometrics thus distinguish between technologically enhanced identifiers and commonplace items. The statute expresses the legislature’s judgment that technologically enhanced identifiers require regulation. This fully explains the legislature’s decision to regulate identifiers regardless of derivation. It is the use of enhanced “measurement and analysis” that necessitated legislative action. The enhanced measurement and analysis embodied in a biometric identifier (i.e., a scan of face geometry) derived from a photograph obtained second-hand is no different from the enhanced measurement and analysis embodied in a biometric identifier obtained in person. The statute therefore applies equally to both. In this case, the Complaint alleges that Defendants developed and implemented sophisticated technological tools of measurement and analysis to create millions of biometric identifiers – unique face prints – and then applied further tools of measurement and analysis to match those face prints against faces appearing in newly uploaded photographs. (Compl. ¶¶ 5, 12, 19, 20, 22, 30, 33, 37.) Defendants thus “collect, capture, purchase, receive through trade, or otherwise obtain,” 740 ILCS 14/15(b), as well as “possess[],” 740 ILCS 14/15(a), biometric identifiers without proper consent in violation of the BIPA. (Compl. ¶¶ 18, 24-25, 34-36.) The Complaint states a claim, and the Motion to Dismiss should be denied. iii. Practical Consequences The practical consequences of a statutory interpretation are a strong indication of whether it is correct. Jordan, 2015 WL 4498909, at *2. Here, Defendants’ argument that the statute does not apply to biometric identifiers derived from photographs, but only to scans of face geometry from in- person interaction, is belied by the practical consequences of such an interpretation. Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 13 of 26 PageID #:126 10 The statute defines biometric identifiers as including “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILCS 14/10. Every single one of those identifiers depends in the first instance on the capture of a photograph or, in the case of a voiceprint, an audio recording. Photographs are the raw material used by Defendants and others to create scans of face geometry in the use of facial recognition technology: Generally, the automatic face recognition process begins with an analysis of ‘training images’ of already known individuals and measurement of their facial features. These measurements – which make up the individuals’ unique biometric data – are compiled into a biometric database along with other known information about them. Face recognition technology is then applied to a new photo to find faces and identify them. If it detects any faces in that photo, it ‘normalizes’ them, which involves transforming their scale, position, and lighting, and sometimes converting them into gray scale images so that they can more easily be compared to faces photographed under different conditions. The technology then identifies and measures facial features in the normalized faces. The resulting measurements are compared to biometric data in the previously compiled database to identify the faces detected in the new photo. Yana Welinder, A Face Tells More Than A Thousand Posts: Developing Face Recognition Privacy in Social Networks, 26 Harv. J.L. & Tech. 165, 171 (2012) (emphasis added); see also, e.g., Elizabeth M. Walker, Biometric Boom: How the Private Sector Commodifies Human Characteristics, 25 Fordham Intell. Prop. Media & Ent. L.J. 831, 849-50 (2015) (“Many individuals . . . lack an understanding of how privacy and security are affected by technology. . . . [B]iometrics can be captured without an individual’s knowledge. A fingerprint can be lifted from another object, gait can be recorded from a distance, and face and voice samples are easily captured by cameras, phones, and other devices.”); Douglas A. Fretty, Face-Recognition Surveillance: A Moment of Truth for Fourth Amendment Rights in Public Places, 16 Va. J.L. & Tech. 430, 454 (2011) (“For FRT [face recognition technology] to function, the state needs pre- labeled photographs of its citizens, and the gathering of these photographs may implicate federal law as well as the Fourth Amendment. Governments already have proprietary control over four major Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 14 of 26 PageID #:127 11 sources of facial photos: arrestee mug shots, passport photos, driver's license photos, and border- entry photos of non-citizens. Agencies can be expected to exploit these resources to support FRT to the maximum extent allowed by law.” (emphasis added)). Retina and iris scans are likewise based in the first instance on photographs. See, e.g., Stephen Hoffman, Biometrics, Retinal Scanning, and the Right to Privacy in the 21st Century, Syracuse Sci. & Tech. L. Rep., Spring 2010, at 38 (explaining that in retinal scanning technology, “the camera photographs the vasculature structure of your eyes and runs it against a database”); Lebowitz v. City of New York, No. 12 CIV. 8982 JSR, 2014 WL 772349, at *2 (S.D.N.Y. Feb. 25, 2014), aff’d, 606 F. App’x 17 (2d Cir. 2015) (“Iris scans are high resolution photographs of the pigmented portion of the eye, and are more accurate than fingerprints in confirming identity.”). Fingerprint recognition systems, too, are based in the first instance on photographs. See, e.g., Michael Cherry & Edward Imwinkelried, A Cautionary Note About Fingerprint Analysis and Reliance on Digital Technology, Champion, August 2006, at 27, 28 (“If the police suspect that a criminal might have left a fingerprint impression on a particular surface, such as a glass tabletop, they can use techniques such as the application of special powders to visualize the image. When they find an image, they photograph it for comparison with the images in the library of fingerprint cards. . . . The law enforcement community is making extensive use of digitized technology in its fingerprint systems. In many cases, if the police succeed in visualizing a latent print at the crime scene, they use a digital camera to preserve the image.”). Voiceprints are not visual, but prove the point just the same. The first step in voiceprint analysis is obtaining a recording of the subject’s voice. See Paul F. Rothstein, Federal Rules of Evidence, Rule 702, Practice Comment (I)(F) (3d ed., Dec. 2014) (“Voiceprint evidence attempts to identify a voice connected with a crime, by a process of reducing a recording of it to an electronically produced pictorial display and comparing it with a similar pictorial display of a known voice or series of voices.”). Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 15 of 26 PageID #:128 12 Defendants’ interpretation of the BIPA as inapplicable to face scans of photographs is contrary to the very nature of biometric technology and thus would undermine the statute’s core purpose. A photograph of a face is exactly what is scanned to map out the unique geometric patterns that establish an individual’s identity. Taken to its logical conclusion, Defendants’ argument would exclude all the biometric identifiers from the definition of biometric identifiers, because they are all based on the initial capture of a photograph or recording. The legislature could not possibly have intended to expressly enumerate a series of “biometric identifiers,” only to effectively exclude them in the following sentence because they are each derived from a photograph or recording. See Jordan, 2015 WL 4498909, at *2 (“[T]he interpretation of a statute must be grounded on the nature and object of the statute, as well as the consequences which would result from construing it one way or another. Legislative intent may be ascertained from the reason and necessity for the act, the evils sought to be remedied, and the objects and purposes sought to be obtained.”) (citation omitted). In construing the BIPA to cover only in-person face scanning without any photographic involvement, Defendants are crediting the Illinois legislature with passing a fantastical statute that lacks any real world application – one that applies solely to face scanning technology not yet in existence, and exempts existing, abundant technology implicating precisely the harm the legislature intended to address. That cannot be the case. The “evil[] sought to be remedied,” Jordan, 2015 WL 4498909, at *2, is private industry’s presumptuous arrogation of the right to apply hi-tech tools of measurement and analysis to create identifiers of private individuals without authorization. That is exactly what happened to plaintiff Brian Norberg, and it makes no difference that his picture was obtained second- hand from a third party who took or uploaded the image on which Defendants based their illegal face scan. Indeed, Defendants’ interpretation would deny the BIPA’s promise of privacy precisely where it is needed most. The statute prohibits gathering biometric identifiers without consent. 740 ILCS Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 16 of 26 PageID #:129 13 14/15(b). If an individual subjected himself or herself to an in-person photography session with Defendants, who are in the business of biometric identification through face-matching and hold numerous patents related to that technology, it might be hard to deny that the individual had given consent.3 The greatest evil occurs when privacy-invading operators like Defendants obtain an individual’s picture and create a biometric identifier without his or her consent, as happened here. By Defendants’ logic, nothing would stop them from amassing a tremendous, Orwellian electronic database of face scans with no permission whatsoever so long as the data base were derived from photographs. And indeed, that appears to be exactly what they are doing. The Illinois legislature has it right. The practice is offensive to reasonable expectations of privacy.4 The statute should not be held inapplicable to the most compelling case for its application. The Complaint states a claim, and the Motion to Dismiss should be denied. b. Legislative History The legislative findings and legislative history only further demonstrate that the intent of the BIPA is to regulate all collection of biometric identifiers, regardless of derivation. Defendants cite the statute’s statement of purpose in an attempt to limit the statute to biometric identifiers obtained in the context of financial transactions and security screenings. This argument is without merit for two reasons. First, the statement of purpose is not so limited. It broadly states that “[t]he full ramifications of biometric technology are not fully known,” 740 ILCS 14/5(f), and that the statutory intent is to broadly protect the “public welfare, security, and safety” from 3 But even if consent were lacking from an in-person scan, Defendants would claim no harm because, after all, they only took a photograph. 4 Defendants’ biometrics database could ultimately be hacked or otherwise wind up in the hands of a nefarious actor who uses the data in a way that it was not intended. Defendants, unfortunately, cannot guarantee the security of that data any more than Target, Sony, or the Office of Personnel Management were able to ensure the security of their electronically-stored data. The BIPA was intended to prevent this risk of harm to innocent non-users by prohibiting companies from collecting and storing biometric data without consent. This is a laudable and legitimate legislative objective. Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 17 of 26 PageID #:130 14 “biometric identifiers and information” generally, 740 ILCS 14/5(g). The legislature thus intended for the statute to reach a broad range of technologies, even those that do not yet exist, through statutory language of general applicability. Financial transactions and security screenings are mentioned only as illustrations of the broader problem warranting regulation. Cf. Hood v. Hartford Life & Accident Ins. Co., 567 F. Supp. 2d 1221, 1228 (E.D. Cal. 2008) (rejecting argument based on statement of purposes where “[n]othing in the statement of purpose expressly limits” reach of statute). Second, the statement of purpose cannot override the plain language of the operative provisions of the statute. E.g., Thillens, Inc. v. Fryzel, 712 F. Supp. 1319, 1324 (N.D. Ill. 1989) (“For one thing, well settled Illinois law states [that] a declaration of policy, like a preamble, ‘is no part of the Act.’” (citation omitted); Brown v. Kirk, 64 Ill. 2d 144, 152 (1976) (“’The policy section like the preamble is available for the clarification of ambiguous provisions of the statute, but may not be used for the creation of ambiguity.’”) (citation omitted); Jogi v. Voges, 480 F.3d 822, 834 (7th Cir. 2007) (“It is a mistake to allow general language of a preamble to create an ambiguity in specific statutory or treaty text where none exists. Courts should look to materials like preambles and titles only if the text of the instrument is ambiguous.”); see generally 2A Sutherland, Statutes and Statutory Construction § 47.04, at 146 (5th ed. 1992, Norman Singer ed.) (“The preamble cannot control the enacting part of the statute in cases where the enacting part is expressed in clear, unambiguous terms.”). Because the legislature intended for the statute to apply broadly, to biometric technology in existence at the time of its passage and to future biometric technology as it arises, the legislative history confirms that the BIPA applies to the sophisticated, privacy-invading technologies that Defendants are using to amass a database of face maps for as many private citizens as possible without regard for individual consent. The Complaint states a claim, and the Motion to Dismiss should be denied. Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 18 of 26 PageID #:131 15 III. DEFENDANTS ARE SUBJECT TO SPECIFIC PERSONAL JURISDICTION FOR THEIR INVASION OF ILLINOIS RESIDENTS’ BIOMETRIC PRIVACY IN VIOLATION OF THE BIPA Defendants also argue, without offering a lick of evidence, that they are immune from personal jurisdiction in Illinois because they merely operated a website without any particular focus on doing business in the state. Their activities, however, went far beyond merely filling sales orders. Defendants collected photographs of Illinois residents and created biometric identifiers of Illinois residents, in massive numbers, without consent and in flagrant derogation of Illinois law. Nonetheless, if the Court has any reservations about the sufficiency of the jurisdictional allegations in the Complaint, the Plaintiff requests leave to amend his Complaint. A. Applicable Legal Standard “A complaint need not include facts alleging personal jurisdiction. However, once the defendant moves to dismiss the complaint under Federal Rule of Civil Procedure 12(b)(2) for lack of personal jurisdiction, the plaintiff bears the burden of demonstrating the existence of jurisdiction.” Purdue Research Found. v. Sanofi-Synthelabo, S.A., 338 F.3d 773, 782 (7th Cir. 2003) (citations and internal alterations omitted). The Illinois long-arm statute authorizes the exercise of personal jurisdiction to the fullest constitutional limit. See 735 Ill. Comp. Stat. 5/2-209(c). The test for personal jurisdiction is whether the defendant has sufficient “minimum contacts” with the forum state that it “‘should reasonably anticipate being haled into court’” there. Burger King Corp. v. Rudzewicz, 471 U.S. 462, 474 (1985) (quoting World-Wide Volkswagen Corp. v. Woodson, 444 U.S. 286, 297 (1980)). Jurisdiction cannot be avoided “merely because the defendant did not physically enter the forum State.” Id. at 476. The exercise of specific personal jurisdiction depends on “the relationship among the defendant, the forum, and the litigation.” Helicopteros Nacionales de Colombia, S.A. v. Hall, 466 U.S. 408, 414 (1984). Jurisdiction is established where (1) the defendant has purposefully directed its activities Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 19 of 26 PageID #:132 16 at the forum state, Burger King, 471 U.S. at 472, or purposefully availed itself of the privilege of conducting business there, id. at 475, and (2) the alleged injuries “‘arise out of or relate to’” the defendant’s forum related activities. Id. at 472 (quoting Helicopteros, 466 U.S. at 414). The Seventh Circuit has not yet decided whether the “arise out of or relate to” requirement requires a “but for” analysis, a proximate causation analysis, or something in between. See Felland v. Clifton, 682 F.3d 665, 676-77 (7th Cir. 2012). Whichever formulation is applied, Defendants are subject to specific personal jurisdiction in this case. B. Argument The Motion to Dismiss does not contend – nor could it contend in good faith – that Defendants have not “purposefully availed” themselves of the privilege of doing business in Illinois. Defendants solicit and enlist Illinois customers through an interactive website, sell storage upgrades to those customers, collect photographs from those customers and create biometric identifiers of Illinois residents (both customers and non-customers) that are such unique forms of identification that the Illinois legislature has acted to regulate Defendants’ business. Even ten years ago, 3.8% of Shutterfly’s annual revenue was generated from business that it conducted in the Northern District of Illinois. See VPS, LLC v. Shutterfly, Inc., No. 04 C 1709, 2004 WL 1557954, at *1 (N.D. Ill. July 8, 2004) (“Shutterfly has customers in a myriad of locations, including the Northern District of Illinois, and roughly 3.8% of its business is derived from this district.”). Defendants’ contacts with Illinois are clearly not fortuitous. See Valtech, LLC v. 18th Avenue Toys Ltd., No. 14 C 134, 2015 WL 603854, at *4 (N.D. Ill. Feb. 12, 2015) (holding online sales to Illinois customers were not fortuitous, and established purposeful availment); Images of the World, Inc. v. Cont’l Am. Indus., Inc., No. 04 C 7002, 2005 WL 2171193, at *4 (N.D. Ill. Aug. 30, 2005) (same). Defendants nonetheless argue that the subject matter of the complaint does not arise out of or relate to Defendants’ activities in Illinois. (See D.E. 26 at 12.) The argument is without merit. A Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 20 of 26 PageID #:133 17 long line of cases in this Circuit supports the exercise of personal jurisdiction where a defendant causes injuries in Illinois to an Illinois plaintiff as a result of activities – including Internet-based activities – directed at Illinois. For instance, the Seventh Circuit in uBid, Inc. v. The GoDaddy Group, Inc., 623 F.3d 421 (7th Cir. 2010), held GoDaddy subject to personal jurisdiction in Illinois, based on GoDaddy’s registration of allegedly infringing domain names for Illinois customers: The claim brought by uBID in Illinois arises directly out of GoDaddy’s registration of the infringing domain names bought by customers it has solicited in Illinois and many other states. The claim bears a sufficient relationship to GoDaddy’s business activities in Illinois to expect GoDaddy to defend itself in Illinois without violating the due process clause. Id. at 432. See also Illinois v. Hemi Group LLC, 622 F.3d 754 (7th Cir. 2010) (holding Internet-based cigarette seller subject to personal jurisdiction in Illinois for violation of state statute); Valtech, 2015 WL 603854, at *4 (exercising specific jurisdiction where tortious conduct caused injury to Illinois victim); Images of the World, 2005 WL 2171193, at *5. Likewise, the claims in this case arise out of Defendants’ business relationships with customers it solicited in Illinois, and the resultant injury in Illinois to the Illinois-resident Plaintiff. The claim for violation of the BIPA, which is unique to Illinois residents, arises out of Defendants’ gathering and storage of photographs from Illinois residents and technologically sophisticated processing of those photographs to derive and use biometric identifiers of Illinois residents, in massive numbers and without consent, in violation of Illinois law. Surely there would be no claim but for Defendants’ activities. Equally, Defendants’ activities are the proximate cause of Plaintiff’s injuries. It was reasonably foreseeable that gathering photographs en masse from a huge population of Illinois users of Shutterfly, and scanning the face geometry of all individuals in those photographs without regard for prior consent, would eventually result in a legal claim by Illinois non-users whose biometric identifiers have been appropriated without consent. Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 21 of 26 PageID #:134 18 Moreover, the exercise of personal jurisdiction over Defendants is perfectly consistent with notions of fair play and substantial justice. Defendants derive substantial revenue from their business activities in Illinois, and the statutory injury they caused was unique to Illinois residents. Indeed, it would be unfair and unjust to deny an Illinois forum to Plaintiff, who was injured as a direct result of Defendants’ purposeful business activities in Illinois. See, e.g., Lincoln Diagnostics, Inc. v. Panatrex, Inc., No. 07-CV-2077, 2008 WL 2246960, at *13 (C.D. Ill. May 29, 2008) (“Illinois has an interest in adjudicating this case because Plaintiff is an Illinois company and Defendant’s alleged tortious activity caused injury in Illinois.”); Varitalk, LLC v. Lahoti, No. 07 C 1771, 2007 WL 1576127, at *6 (N.D. Ill. May 30, 2007) (exercising jurisdiction where Internet activity with Illinois website users caused injury in Illinois to Illinois plaintiff); Bunn-O-Matic Corp. v. Bunn Coffee Serv., Inc., 88 F. Supp. 2d 914, 920 (C.D. Ill. 2000) (“A tortfeasor who commits a tort against an Illinois business so that the injury is felt in Illinois, submits himself to the jurisdiction of Illinois courts.”). Exercising jurisdiction in this case is especially important in view of the strong interest Illinois has in the enforcement of the BIPA, a state statute tailored to regulate precisely the conduct in which Defendants have engaged. The BIPA depends on the deputization of private attorneys general, like Plaintiff here, to carry out state regulatory policy. The present case thus resembles Hemi Group, where jurisdiction over an Internet-based cigarette seller was exercised in recognition of the state’s substantial interest in regulating tobacco sales. 622 F.3d at 759-60. In both cases, jurisdiction is warranted in view of the strong interest in having Illinois courts adjudicate cases involving Illinois regulatory policy. There is nothing unfair or unjust about exercising jurisdiction over Defendants who purposely did business in Illinois and purposely created unique identifiers for Illinois residents en masse and without consent, in flagrant disregard of Illinois statutory law. Defendants cite two decisions in which the facts were held insufficient to establish the purposeful intent toward the forum sufficient to exercise jurisdiction. Only one of the decisions, Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 22 of 26 PageID #:135 19 Richter v. INSTAR Enterprises Int’l, Inc., 594 F. Supp. 2d 100 (N.D. Ill. 2009), involved Internet activity, and it is neither binding nor likely even correct in view of the Seventh Circuit’s subsequent decision in uBid. Moreover, the present case is completely different. Defendants are not alleged to have merely operated a website available in all fifty states over the Internet. Rather, Defendants chose to do business in Illinois in a manner that violated an Illinois statute specifically regulating the very conduct in which Defendants engaged. Defendants’ flagrant violation of state law – collecting photographs of Illinois residents and creating biometric identifiers of those Illinois residents, all without consent – is a purposeful course of conduct directed at the state and its residents. Defendants’ activities have directly caused distinct injuries to Illinois residents’ statutory right of biometric privacy – injuries that plainly arise from Defendants’ statutory violations. Defendants remark that the Complaint insufficiently alleges the location of the user who uploaded Plaintiff’s photo. Plaintiff, however, is an Illinois resident who was injured in Illinois by Defendants’ conduct, which Illinois law specifically regulates. The BIPA is an Illinois statute, making suit here entirely foreseeable. Facts such as the location of the person who tagged the photograph, or the location of the computer server where biometric identifiers were stored, are of attenuated significance in this context. As the Seventh Circuit explained in uBid, where Chicago-based uBid sued out-of-state GoDaddy for injuries inflicted in Illinois: The relationship between GoDaddy’s Illinois contacts and uBID’s claims is close enough to make the relatedness quid pro quo balanced and reasonable. GoDaddy has reached hundreds of thousands of people in Illinois with its advertising, which we know because it has made hundreds of thousands of sales in Illinois. . . . The concept of a geographical nexus is harder to apply to cases like this one, where the alleged wrong can fairly be characterized as occurring anywhere the Internet is accessible. In other words, uBID has the same claim against GoDaddy whether the customer who registered or another similar domain name did so from Illinois, from Wyoming, or from China. One conclusion we might draw from this fact is that a physical geographical nexus is simply less important in cases where the alleged harm occurred Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 23 of 26 PageID #:136 20 over the Internet. Such a conclusion would not necessarily be inconsistent with due process. After all, the geographical relationship between claim and contacts is only one facet of the constitutional inquiry. . . . GoDaddy argues that the alleged injury to uBID was not complete until GoDaddy connected the newly registered domain name to the parked page service. . . . Due process does not require us to slice GoDaddy’s alleged wrongdoing so finely. . . . Where GoDaddy chooses to locate the servers that complete the task is irrelevant. uBid, 623 F.3d at 430-32. Even if Plaintiff’s claims somehow did not “arise out of” Defendants’ contacts with Illinois (which they plainly do), they certainly “relate to” Defendants’ contacts with Illinois. See Inamed Corp. v. Kuzmak, 249 F.3d 1356, 1362 (Fed. Cir. 2001) (“[T]he constitutional catch-phrase [arise out of or relate to] is disjunctive in nature, indicating an added flexibility and signaling a relaxation of the applicable standard from a pure ‘arise out of’ standard.”). Defendants’ commercialization of their facial recognition and tagging technology in Illinois has resulted in the violation of an Illinois statute and injuries to Illinois residents, including to Plaintiff Brian Norberg. Accordingly, the claims in this case obviously are “related to” Defendants’ contacts with Illinois. IV. CONCLUSION For the foregoing reasons, the Court should deny the Motion to Dismiss (D.E. 26) in its entirety. Dated: August 28, 2015 Respectfully submitted, By: /s/ Katrina Carroll_______ Katrina Carroll kcarroll@litedepalma.com Kyle A. Shamberg kshamberg@litedepalma.com Lite DePalma Greenberg, LLC Chicago Office 211 West Wacker Drive Suite 500 Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 24 of 26 PageID #:137 21 Chicago, IL 60606 Telephone: (312) 750-1265 CAREY RODRIGUEZ MILIAN GONYA, LLP David P. Milian (pro hac vice) dmilian@careyrodriguez.com Frank S. Hedin (pro hac vice) fhedin@careyrodriguez.com 1395 Brickell Avenue, Suite 700 Miami, FL 33131 Telephone: (305) 372-7474 Facsimile: (305) 372-7475 Counsel for Plaintiff and the Putative Class Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 25 of 26 PageID #:138 22 CERTIFICATE OF SERVICE The undersigned, an attorney, hereby certifies that on the 28th day of August, 2015, she caused a true and correct copy of the foregoing RESPONSE IN OPPOSITION TO THE MOTION TO DISMISS to be filed electronically with the Clerk of the Court to be filed and served on all parties via the Court’s CM/ECF system. By: /s/Katrina Carroll Katrina Carroll Case: 1:15-cv-05351 Document #: 29 Filed: 08/28/15 Page 26 of 26 PageID #:139