Santana et al v. Take-Two Interactive Software, Inc.

RESPONSE in Opposition to Motion re: 48 MOTION to Dismiss of Take-Two interactive Software, Inc. to Dismiss the Second Amended Complaint or, in the alternative, to strike the class allegations. . Document

S.D.N.Y.August 19, 2016

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK VANESSA VIGIL and RICARDO VIGIL, on behalf of themselves and all others similarly situated, Plaintiffs, v. TAKE-TWO INTERACTIVE SOFTWARE, INC., Defendant. Civil Action No. 15-cv-08211-JGK PLAINTIFFS’ RESPONSE IN OPPOSITION TO DEFENDANT’S MOTION TO DISMISS THE SECOND AMENDED CLASS ACTION COMPLAINT i TABLE OF CONTENTS INTRODUCTION ........................................................................................................................................... 1 ARGUMENT .................................................................................................................................................... 2 I. PLAINTIFFS HAVE ARTICLE III STANDING. ......................................................................... 2 A. The Violations of BIPA Alleged In the Complaint, Without Any Additional __.Allegations of Harm, Confer Article III Standing on Plaintiffs .............................................. 3 1. Take-Two, By Virtue of Its BIPA Violations, Invaded Plaintiffs’ Property …Interests in Their Face Scans, Causing Them Tangible Injury. .................................. 3 2. Take-Two Failed to Provide Plaintiffs the Written Disclosures Required By …BIPA and Failed to Obtain Plaintiffs’ Express Written Consent As Required …by BIPA, Causing Them Intangible Injury. ................................................................... 6 i. Spokeo confirmed that legislatures can identify intangible concrete harms redressable in federal court. ..................................................................... 6 ii. Plaintiffs’ informational injury is sufficient to confer standing. .................... 8 iii. The common law and the legislature’s judgment confirm that both Take-Two’s failure to make the required disclosures and its failure to obtain consent before collecting biometric data are concrete injuries....... 10 a. BIPA bears a close relationship to well-established, traditional .actions involving the right of publicity and right to privacy. ........... 11 b. The Illinois Legislature exercised its judgment to protect an …individual’s interest in the privacy of their biometric data. .............. 12 B. Even if Take-Two’s BIPA Violations Are Insufficient by Themselves to Confer Article III Standing, Plaintiff Ricardo Vigil Suffered Monetary Harm Stemming from Take-Two’s BIPA Violations and Thus Still Has Article III Standing. ................................ 15 II. PLAINTIFFS HAVE STATUTORY STANDING. .................................................................... 16 III. THE MOTION TO STRIKE IS BOTH PREMATURE AND WITHOUT MERIT. ........ 23 CONCLUSION .............................................................................................................................................. 25 ii TABLE OF AUTHORITIES CASES Abdul-Jabbar v. Gen. Motors Corp, 85 F.3d 407 (9th Cir. 1996) .................................................................... 11 American Surety Co. v. Jones, 384 Ill. 222 (1943) ............................................................................................. 19 Blessing v. Sirius XM Radio, Inc., 756 F. Supp. 2d 445 (S.D.N.Y. 2010) ..................................................... 24 Boelter v. Hearst Commc’ns, Inc., --- F. Supp. 3d, 2016 WL 3369541 (S.D.N.Y. June 17, 2016) .......... 5, 16 Bohannon v. Facebook, Inc., No. 12-CV-01894-BLF, 2014 WL 5598222 (N.D. Cal. Nov. 3, 2014) ...................................................................................................................................................... 3 Bona Fide Conglomerate, Inc. v. SourceAmerica, No. 14 Civ. 00751(GPC)(DHB), 2016 WL 3543699 (S.D. Cal. June 29, 2016) ................................................................................................... 14 Canessa v. J.I. Kislak, Inc., 235 A.2d 62 (N.J. Super. Ct. Law Div. 1967) ..................................................... 4 Cantrell v. City of Long Beach, 241 F.3d 674 (9th Cir. 2001) ........................................................................... 8 Chenensky v. N.Y. Life Ins. Co., No. 07 Civ. 11504, 2011 WL 1795305 (S.D.N.Y. Apr. 27, 2011) .................................................................................................................................................... 23 Church v. Accretive Health, Inc., No. 15-15708, 2016 WL 3611543 (11th Cir. July 6, 2016) ....................... 7 Facebook, Inc. v. ConnectU, Inc., No. C 07-01389 JW, 2008 WL 8820476 (N.D. Cal. June 25, 2008) ...................................................................................................................................................... 3 Federal Election Commission v. Akins, 524 U.S. 11 (1998) ................................................................................ 8 Friends of Animals v. Jewell, — F.3d —, No. 15-5223, 2016 WL 3854010 (D.C. Cir. July 15, 2016) ................................................................................................................................................ 8, 10 Glos v. People, 259 Ill. 332 (1913) .................................................................................................................... 19 Greeling v. Abendroth, 351 Ill. App. 3d 658 (4th Dist. 2004) ........................................................................ 19 Guzman v. Bridgepoint Educ., Inc., No. 11-CV-69-WQH (WVG), 2013 WL 593431 (S.D. Cal. Feb. 13, 2013) ..................................................................................................................................... 24 Hardin v. Jordan, 140 U.S. 371 (1891) ............................................................................................................. 12 Havens Realty Corporation v. Coleman, 455 U.S. 363 (1982) ............................................................................. 9 In re Estate of Harmston, 10 Ill. App. 3d 882 (3rd Dist. 1973) ..................................................................... 19 In re Facebook Biometric Info. Privacy Litig., No. 15-CV-03747-JD, 2016 WL 2593853 (N.D. Cal. May 5, 2016) .................................................................................................................................... 4, 13 iii In re Nickelodeon Consumer Privacy Litig., — F.3d —, No. 15-1441, 2016 WL 3513782 (3d Cir. June 27, 2016) ................................................................................................................................. 7, 14 In re Tronox Sec. Litig., No. 09 Civ. 6220, 2010 WL 2835545 (S.D.N.Y. June 28, 2010) ........................ 23 Kyllo v. United States, 533 U.S. 27 (2001) ........................................................................................................ 11 Lane v. Bayview Loan Servicing, LLC, No. 15 C 10446, 2016 WL 3671467 (N.D. Ill. July 11, 2016) .................................................................................................................................................... 10 Lawrence v. Texas, 539 U.S. 558 (2003)............................................................................................................. 4 Leopold v. Levin, 259 N.E.2d 250 (Ill. 1970) .................................................................................................. 11 Lujan, 504 U.S. at 580.................................................................................................................................. 8, 12 Mandziara v. Canulli, 299 Ill. App. 3d 593 (1998) ......................................................................................... 18 McCollough v. Smarte Carte, Inc., No. 16 C 03777, 2016 WL 4077108 (N.D. Ill. Aug. 1, 2016) .............. 14 Mey v. Got Warranty, Inc., No. 5:15-CV-101, 2016 WL 3645195 (N.D.W. Va. June 30, 2016) ............. 14 Myers v. MedQuist, Inc., No. 05–4608, 2006 WL 3751210 (D.N.J. 2006) .................................................. 24 Ortiz v. Fibreboard Corp., 527 U.S. 815 (1999) ............................................................................................... 24 Padilla v. Dish Network L.L.C., No. 12-cv-7350, 2013 WL 3791140 (N.D. Ill. July 19, 2013) .............. 20 People ex rel. Ferrill v. Graydon, 164 N.E. 832 (Ill. 1928) ............................................................................... 12 Planned Parenthood of Se. Pa. v. Casey, 505 U.S. 833 (1992) ............................................................................. 4 Public Citizen v. Dep’t of Justice, 491 U.S. 440 (1989) ....................................................................................... 8 Robidoux v. Celani, 987 F.2d 931 (2d Cir. 1993) ............................................................................................ 24 Rosenbach v. Six Flags Entertainment Corporation et al., 16 CH 13 (Cir Court, Lake County, IL, June 17, 2016 ...................................................................................................................................... 19 Schlesinger v. Reservists Comm. to Stop the War, 418 U.S. 208 (1974) ............................................................. 13 Spokeo Inc. v. Robins, 136 S. Ct. 1540 (2016) .......................................................................................... passim Steel Co. v. Citizens for a Better Env’t, 523 U.S. 83 (1998) .............................................................................. 11 Thomas v. FTS USA, LLC, No. 3:13-CV-825, 2016 WL 3653878 (E.D. Va. June 30, 2016) ........... 9, 12 Thompson v. N. Am. Stainless, 562 U.S. 170 (2011) ................................................................................. 16, 22 United States Dept. of Justice v. Reporters Comm. for Freedom of Press, 489 U.S. 749 (1989) ........................... 12 iv United States v. Kriesel, 720 F.3d 1137 (9th Cir. 2013) .................................................................................... 4 United States v. Novak, 443 F.3d 150 (2d Cir. 2006) ..................................................................................... 15 Wilderness Soc’y, Inc. v. Rey, 622 F.3d 1251 (9th Cir. 2010) .......................................................................... 10 Winfield v. Citibank, N.A., 842 F. Supp. 2d 560 (S.D.N.Y. 2012) (Koeltl, J.) .................................... 23, 24 STATUTES 220 Ill. Comp. Stat. 5....................................................................................................................................... 26 740 Ill. Comp. Stat. 110 .................................................................................................................................. 21 740 Ill. Comp. Stat. 14 ............................................................................................................................ passim 765 Ill. Comp. Stat. 1075 .................................................................................................................................. 4 OTHER AUTHORITIES 7A Charles Alan Wright, Arthur R. Miller & Mary K. Kane, Federal Practice and Procedure Civil § 1785.3 (3d ed. 2005) .............................................................................................................. 27 Michael Corkery, The New York Times (June 21, 2016) .......................................................................... 20 The Right of Privacy, 4 Harv. L.R. 193 (1890) ............................................................................................ 13 RULES Fed. R. Crim. P. 41(a)(2)(A) ............................................................................................................................. 4 1 Plaintiffs Vanessa Vigil and Ricardo Vigil, individually and on behalf of all others similarly situated, submit this response in opposition to the motion to dismiss (the “Motion”) the second amended complaint (the “Complaint”) filed by Take-Two Interactive Software, Inc. (“Take-Two”). INTRODUCTION Plaintiffs seek redress for Take-Two’s unlawful collection and retention of their biometric data in violation of the Biometric Information Privacy Act (“BIPA”), 740 Ill. Comp. Stat. 14/1 to 14/99. Take-Two argues, based on a misreading of the Supreme Court’s recent opinion in Spokeo Inc. v. Robins, 136 S. Ct. 1540 (2016), that Plaintiffs have failed to allege they suffered a concrete harm sufficient to demonstrate an injury in fact as required by Article III of the United States Constitution. Take-Two further argues that Plaintiffs lack statutory standing on the ground that they are not “persons aggrieved” within the meaning of BIPA. The arguments are without merit. Take-Two’s Motion completely overlooks the injuries that give rise to Plaintiffs’ standing in this case. Plaintiffs possess Article III standing for two independent reasons, neither of which is even addressed by the Motion. First, the invasion of Plaintiffs’ property right in the information that makes up their own faces, in violation of BIPA, is a tangible injury that confers standing. Second, the informational injury Plaintiffs suffered when Take-Two failed to make certain crucial written disclosures, in violation of BIPA, is grounded in Plaintiffs’ rights to privacy and to control the use of their own likenesses, and is therefore also a concrete, if intangible, injury. Additionally, Plaintiff Ricardo Vigil suffered monetary damages, another tangible harm, stemming from Take-Two’s violations of BIPA. Having had their unique biological identifiers and biometric information collected and stored by Take-Two without authorization or disclosure, Plaintiffs fall well within the zone of interests the Illinois Legislature sought to protect when it enacted the statute. Plaintiffs therefore have statutory standing for the same reasons they have Article III standing. Finally, Take-Two requests, in the alternative, that the Court strike the Complaint’s class 2 allegations, contending that the standing of the putative class members requires individualized inquiries and thus predominates over issues common to the putative class. Take-Two’s request is premature and its argument is wholly without merit. Motions to strike class allegations are improper where, as here, discovery has not even commenced and the pleadings have not yet closed. In any event, the class allegations themselves demonstrate that the standing of the putative class members can be resolved in one stroke, because each class member, by definition, suffered the very same tangible and intangible injuries that Plaintiffs suffered, which are sufficient for Article III purposes. Plaintiffs and the putative class members have standing, and the Motion should be denied. ARGUMENT Plaintiffs allege tangible and intangible injuries that confer constitutional standing under Article III and statutory standing under BIPA, both as to themselves individually and as to all putative class members in a uniform manner. The Motion should be denied. I. PLAINTIFFS HAVE ARTICLE III STANDING To establish Article III standing, a plaintiff must show (1) that he has “suffered an injury in fact,” (2) that the injury is “fairly traceable to the challenged conduct of the defendant,” and (3) that the injury “is likely to be redressed by a favorable judicial decision.” Spokeo, 136 S. Ct. at 1547. The first requirement, injury in fact, has two components: the injury must be both (1) particularized and (2) concrete. Take-Two does not contest that Plaintiffs satisfied the second and third requirements for standing. As to the first requirement, injury in fact, Take-Two does not contest that the injuries suffered by Plaintiffs are sufficiently “particularized.” Take-Two argues only that Plaintiffs have failed to allege they suffered “concrete” injury resulting from Take-Two’s statutory violations, and focuses this analysis entirely on whether Plaintiffs suffered monetary harm or a “risk of real harm.” This misses the mark. By virtue of Take-Two’s violations of BIPA, Plaintiffs suffered the misappropriation of their 3 personal property and the deprivation of information to which they were entitled -- tangible and intangible harms that are each sufficiently concrete to confer Article III standing. Plaintiff Ricardo Vigil also suffered monetary harm stemming from Take-Two’s violations of BIPA, which is yet another alternative basis for his Article III standing. A. The Violations of BIPA Alleged In the Complaint Confer Article III Standing on Plaintiffs By virtue of Take-Two’s BIPA violations themselves, Plaintiffs and the putative class members suffered both tangible injury, based on the misappropriation of their personal property, and intangible injury, based on the deprivation of written disclosures to which they were entitled. 1. Take-Two, By Virtue of Its BIPA Violations, Invaded Plaintiffs’ Property Interests in Their Face Scans, Causing Them Tangible Injury It is not disputed that tangible injuries, such as the loss of money or property, are concrete for the purposes of Article III. Spokeo, 136 S. Ct. at 1549. Information is frequently considered proprietary in nature. See Carpenter v. United States, 484 U.S. 19, 26 (1987) (“Confidential business information has long been recognized as property.”); see also Facebook, Inc. v. ConnectU, Inc., No. C 07-01389 JW, 2008 WL 8820476, at *1 (N.D. Cal. June 25, 2008) (“In essence, Facebook alleges that ConnectU gained unauthorized access to Facebook’s servers and website and took information for its own unlawful use.”); Bohannon v. Facebook, Inc., No. 12-CV-01894-BLF, 2014 WL 5598222, at *4 (N.D. Cal. Nov. 3, 2014) (granting Facebook’s motion to seal on grounds that “information in these documents, if disclosed, could both provide Facebook’s competitors with valuable proprietary information and prevent Facebook from effectively enforcing its policies”). In the same vein, the Illinois legislature has already recognized that an individual has a property interest in his or her identity. The Illinois Right of Publicity Act (“IRPA”) recognizes that Illinois citizens have a “right to control and to choose whether and how to use an individual's identity for 4 commercial purposes,” and confirms that this right is a “property right[].” 765 Ill. Comp. Stat. 1075/10, 15. Having such information taken without permission is an Article III injury in fact. In BIPA, the Illinois Legislature has recognized that biometric data is different from other identifiers in that it is “biologically unique to the individual” and cannot be changed. 740 Ill. Comp. Stat. 14/5(c). Just as trade secrets or lists of gamers can be proprietary to a company like Take-Two, unique and unchangeable biometric identifiers are proprietary to individuals like Plaintiffs. Indeed, it is difficult to imagine something that an individual has greater interest in than her own body and the unique biometric data it contains. See United States v. Kriesel, 720 F.3d 1137, 1144–45 (9th Cir. 2013) (“The Rule’s definition of property includes ‘documents, books, papers, any other tangible objects, and information.’ Fed. R. Crim. P. 41(a)(2)(A). The district court also properly concluded that . . . the genetic code contained within the blood sample is information.”); cf. Lawrence v. Texas, 539 U.S. 558, 574 (2003); Planned Parenthood of Se. Pa. v. Casey, 505 U.S. 833, 851 (1992). In passing BIPA, the Illinois legislature set out the “fundamental policy of the state of Illinois” that citizens have a right to control how their own biometric identifiers are collected, stored, and used. In re Facebook Biometric Info. Privacy Litig., No. 15-CV-03747-JD, 2016 WL 2593853, at *10 (N.D. Cal. May 5, 2016). Take-Two invaded this right by collecting Plaintiffs’ biometric identifiers and information without their consent, and without providing disclosures required by the statute. And because biometric identifiers are property, Take-Two’s statutory violations are an invasion of Plaintiffs’ property rights. See, e.g., Canessa v. J.I. Kislak, Inc., 235 A.2d 62, 76 (N.J. Super. Ct. Law Div. 1967) (holding that individuals’ likenesses “belong to them[;] [a]s such they are property,” and that plaintiffs’ claim for misappropriation of likeness was therefore “an action for invasion of their ‘property’ rights”).1 1 Although Take-Two claims that its technology only “creates a non-identifying, cartoon-like avatar of an NBA player” (Mot. at 2), the Complaint specifically alleges that Take-Two collects, stores and disseminates scans of face geometry (“biometric identifiers”) and personally identifying facial 5 Indeed, because Take-Two benefits in a tangible way from the face scans it collects in violation of BIPA, as alleged in the Complaint, it necessarily follows that the individuals to whom those face scans belong suffered a tangible harm when Take-Two collected them without authorization. The Complaint alleges that “[t]he unique personally-identifying facial renditions (i.e., biometric information) and face templates (i.e., biometric identifiers) that Take-Two collects from gamers, and then disseminates in conjunction with multiplayer game play, are valuable assets to Take-Two because they enhance the realism of Take-Two’s multiplayer game play for the NBA 2K15 and NBA2K16 video games.” (Complaint ¶ 56.) The Complaint alleges that “[t]he realism of the multiplayer game play mode for the NBA 2k15 and NBA2k16 video games is a material factor motivating a significant numbers of individuals’ decisions to purchase the NBA 2k15 and NBA 2k16 video games.” (Id. ¶ 57.) The Complaint alleges that, “[b]y collecting Plaintiffs’ biometric identifiers and biometric information without informing Plaintiffs and without obtaining Plaintiffs’ express consent, in violation of BIPA, Take-Two misappropriated Plaintiffs’ valuable personal property” (id. 58), for its own profit (id. ¶ 59). These allegations confirm that Plaintiffs suffered a tangible harm to their personal property sufficient to confer Article III standing. See, e.g., Boelter v. Hearst Commc’ns, Inc., --- F. Supp. 3d ---, 2016 WL 3369541, at *3 (S.D.N.Y. June 17, 2016) (concluding that Article III standing existed based on allegations “that Defendant disclosed protected information about Plaintiffs … by selling it to third parties, and by providing it to ‘data mining’ companies who then supplemented it with additional data to enhance the value of the information for Defendant,” because such allegations suggest that the defendant “unjustly retained the economic benefit the value of that information conferred”). renditions derived from those scans of face geometry (“biometric information”). Take-Two’s attempt to disprove those allegations is not susceptible of resolution on a motion to dismiss. 6 Having alleged a tangible, concrete harm resulting from Take-Two’s misappropriation of their face scans in violation of BIPA, Plaintiffs have alleged an injury in fact sufficient to confer Article III standing. The Motion should be denied. 2. Take-Two Failed to Provide Plaintiffs the Written Disclosures Required By BIPA and Failed to Obtain Plaintiffs’ Express Written Consent As Required by BIPA, Causing Them Intangible Injury Independent of the tangible injury to their property rights, Plaintiffs have also suffered intangible injury: the informational injury caused by Take-Two’s failure to make the disclosures required by 740 Ill. Comp. Stat. 14/15(a), (b)(1), and (b)(2), and the related invasion of their privacy rights caused by Take-Two’s collection of their biometric identifiers without obtaining the consent required by 740 Ill. Comp. Stat. 14/15(b)(3). Like the tangible injury suffered by Plaintiffs, this form of intangible injury also provides the basis for an Article III injury in fact. When a statute requires disclosure of certain information, and a defendant who is required to provide that information fails to do so, the person who was supposed to receive the information has suffered an injury in fact. Here, Take-Two violated BIPA’s disclosure mandate, because Plaintiffs did not receive the information to which they were entitled. Further, both the common law and the reasoned judgment of the Illinois legislature confirm the concrete nature of consumers’ interest in controlling who is allowed to collect and store that sensitive and unique data, and in their knowledge of how that data is used. i. Spokeo confirmed that legislatures can identify intangible concrete harms redressable in federal court In the context of an injury sufficient to confer Article III standing, “[c]oncrete’ is not . . . necessarily synonymous with ‘tangible.’ Although tangible injuries are perhaps easier to recognize, we have confirmed in many of our previous cases that intangible injuries can nevertheless be concrete.” Spokeo, 136 S. Ct. at 1549. Thus, multiple appellate courts since Spokeo have noted that failure to receive statutorily required disclosures is an injury -- though intangible -- sufficient to support Article III 7 standing. Church v. Accretive Health, Inc., No. 15-15708, 2016 WL 3611543, at *3 (11th Cir. July 6, 2016) (“[Plaintiff] has sufficiently alleged that she has sustained a concrete—i.e. ‘real’—injury because she did not receive the allegedly required disclosures…. While this injury may not have resulted in tangible economic or physical harm that courts often expect, the Supreme Court has made clear an injury need not be tangible to be concrete.”); In re Nickelodeon Consumer Privacy Litig., — F.3d —, No. 15-1441, 2016 WL 3513782, at *7 (3d Cir. June 27, 2016) (“Intangible harms that may give rise to standing also include harms that ‘may be difficult to prove or measure,’ such as unlawful denial of access to information subject to disclosure.”) (quoting Spokeo).2 To be sure, a plaintiff does not “automatically satisfy the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” Spokeo, 136 S. Ct. at 1549. But Take-Two’s proposed test for Article III standing in the context of a statutory violation completely ignores the legislature’s “instructive and important” judgment and its “role in identifying and elevating intangible harms[.]” Spokeo, 136 S. Ct. at 1549. According to Take- Two, “Plaintiffs[’] allegations fail to establish any concrete injuries beyond the alleged statutory violation itself, which . . . is insufficient as a matter of law.” (Mot. at 7 (citing Spokeo).) Nothing could be further from the truth. Adopting Justice Kennedy’s test from Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992), the Supreme Court in Spokeo held that legislatures have “the power to define injuries and articulate chains of 2 Hancock v. Urban Outfitters, Inc., — F.3d —, No. 14-7047, 2016 WL 3996710 (D.C. Cir. July 26, 2016), which held that a statutory prohibition on requesting zip code information was a “bare procedural violation,” is not to the contrary. The plaintiffs in that case, unlike Plaintiffs here, did not allege “any invasion of privacy” or other intangible injury, and they did not demonstrate that the D.C. City Council passed the statute at issue to remedy the kind of harm they suffered. See id. at *3. 8 causation that will give rise to a case or controversy where none existed before,” even where those injuries are intangible. Spokeo, 136 S. Ct. at 1549 (quoting Lujan, 504 U.S. at 580 (Kennedy, J., concurring in part and concurring in the judgment)). In other words, a legislature “can create new private rights and authorize private plaintiffs to sue based simply on the violation of those private rights.” See id. at 1553 (Thomas, J., concurring); see also Cantrell v. City of Long Beach, 241 F.3d 674, 684 (9th Cir. 2001) (“[S]tate law can create interests that support standing in federal courts. . . . State statutes constitute state law that can create such interests.”). Thus, “the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact. . . . [A] plaintiff in such a case need not allege any additional harm beyond the one Congress has identified.” Spokeo, 136 S. Ct. at 1549. Take-Two’s sweeping statement to the contrary -- that statutory violations are incapable of establishing concrete injury -- is incorrect as a matter of law and, as discussed below, cannot be squared with Supreme Court jurisprudence on informational injury. ii. Plaintiffs’ informational injury is sufficient to confer standing Spokeo confirms that “the existence and scope of an injury for informational standing purposes is defined by Congress” (or, as here, the Illinois Legislature), and that “a plaintiff seeking to demonstrate that it has informational standing generally ‘need not allege any additional harm’” to have Article III standing. Friends of Animals v. Jewell, — F.3d —, No. 15-5223, 2016 WL 3854010, at *2 (D.C. Cir. July 15, 2016) (quoting Spokeo, 136 S. Ct. at 1549). To that end, the Spokeo majority cited both Federal Election Commission v. Akins, 524 U.S. 11 (1998), for the proposition that “inability to obtain information that Congress had decided to make public is a sufficient injury in fact to satisfy Article III,” and Public Citizen v. Dep’t of Justice, 491 U.S. 440 (1989), for its “holding that two advocacy organizations’ failure to obtain information subject to disclosure under the Federal Advisory Committee Act ‘constitutes a sufficiently distinct injury to provide standing to sue.’” 136 S. Ct. at 1549-50. Although Akins and Public Citizen relate to information from government sources, legislatures 9 can also require private entities to disclose information. For example, in another informational injury case, Havens Realty Corporation v. Coleman, 455 U.S. 363, 373 (1982), the Supreme Court considered the portion of the Fair Housing Act that guarantees “a legal right to truthful information about available housing.” The Court confirmed that a black “tester”—that is a person who inquired about the availability of real estate “without any intention of buying or renting a home”—had standing to sue an entity that gave her false information about the availability of housing because of her race. Id. at 374. The “real” and “actual” injury in Havens was the denial of information to which the plaintiff was entitled, not the underlying racial discrimination that caused her not to get that information. The Court made that much clear by its treatment of the claims of another plaintiff, a white man who had not received any false information about the availability of housing. The white plaintiff lacked standing because he “alleged no injury to his statutory right to accurate information concerning the availability of housing.” Havens, 455 U.S. at 375. The fact that he did not “allege that he was a victim of a discriminatory misrepresentation” was relevant only in that it showed that he had “not pleaded a cause of action” under the statute. Id. (emphasis added). In other words, if he had been given false information for reasons other than his race, then he would have had standing, but he still would have lost on the merits. Thus, for Article III purposes, the “invasion” of a “statutorily created private right” to information is a sufficient injury to allow a plaintiff to sue in federal court. See Spokeo, 136 S. Ct. at 1553 (Thomas, J., concurring). Since Spokeo, courts have consistently found that plaintiffs have standing to sue defendants who deprive them “of a fully appreciable disclosure to which he or she is entitled under” a statute. See Thomas v. FTS USA, LLC, No. 3:13-CV-825, 2016 WL 3653878, at *9 (E.D. Va. June 30, 2016) (holding that it is “clear” that the plaintiff alleged a concrete injury under the Fair Credit Reporting Act because he “alleged that he was deprived of a clear disclosure stating that Defendants sought to procure a consumer report before the report was obtained” without any additional or 10 resulting harm); see also Lane v. Bayview Loan Servicing, LLC, No. 15 C 10446, 2016 WL 3671467, at *4 (N.D. Ill. July 11, 2016) (concluding that the plaintiff had “alleged a sufficiently concrete injury because he alleges that [the debt collector defendant] denied him the right to information due to him under” a statute). The BIPA violations that Plaintiffs allege here are exactly the type of informational injury that courts have deemed sufficient for Article III standing purposes. Specifically, Plaintiffs pleaded that Take-Two collected their biometric identifiers and biometric information but failed to disclose its “written . . . policy establishing a retention schedule and guidelines for permanently destroying . . . biometric identifiers and biometric information,” Complaint ¶ 49; 740 Ill. Comp. Stat. 14/15(a), did not tell Plaintiffs that a biometric identifier or biometric information was being collected or stored, Complaint ¶ 46; 740 Ill. Comp. Stat. 14/15(b)(1), and failed to inform them “of the specific purpose and length of term for which a biometric identifier or biometric information was being collected, stored, and used,” Complaint ¶ 47; 740 Ill. Comp. Stat. 14/15(b)(2). Having been deprived of that information, access to which is guaranteed by statute, Plaintiffs suffered an injury in fact. Because Plaintiffs were entitled to information about Take-Two’s collection, retention, and use of their biometric identifiers and biometric information and did not receive it, they have suffered a legally cognizable injury of the type routinely remedied in federal court and sufficient to confer Article III standing. iii. The common law and the legislature’s judgment confirm that both Take- Two’s failure to make the required disclosures and its failure to obtain consent before collecting biometric data are concrete injuries. In the informational injury context, some cases suggest that the information must bear a relationship to a separate concrete interest before its nondisclosure will itself be a concrete injury. See, e.g., Friends of Animals, 2016 WL 3854010 at *3; Wilderness Soc’y, Inc. v. Rey, 622 F.3d 1251, 1258-59 (9th Cir. 2010). Here, the disclosures Take-Two was required (but failed) to make to Plaintiffs were directly 11 related to their interest in controlling how their personal biometric data is collected, stored, and used. In addition to the informational injury, Take-Two substantively invaded that same interest when it collected Plaintiffs’ biometric data without their informed consent, in violation of 740 Ill. Comp. Stat. 14/15(b)(3). This privacy interest -- recognized as fundamental Illinois policy -- is certainly concrete when examined through the lens of the two “important” and “instructive” sources identified by Spokeo: the legislature’s judgment and the common law. See Spokeo, 136 S. Ct. at 1549. a. BIPA bears a close relationship to well-established, traditional actions involving the right of publicity and right to privacy Under Spokeo, “it is instructive to consider whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” Id. This is because federal judicial power under Article III applies to “cases and controversies of the sort traditionally amenable to, and resolved by, the judicial process.” Steel Co. v. Citizens for a Better Env’t, 523 U.S. 83, 102 (1998). Thus, as part of the Article III inquiry, courts are to consider whether a case is the type of case that could be brought under common law. See id. American courts have long recognized that allegations of invasions of privacy are a type of case that they have jurisdiction to hear. The common law right to privacy is uniquely American, originating with “Samuel Warren and Louis D. Brandeis, whose famous article The Right of Privacy, 4 Harv. L.R. 193 (1890) first used the phrase ‘right of privacy.’” Eick v. Perk Dog Food Co., 106 N.E.2d 742, 743 (Ill. App. Ct. 1952). By the early 1950s, “the right [had been] recognized by the great preponderance of authority throughout the country.” Id. (collecting cases); see also Abdul-Jabbar v. Gen. Motors Corp, 85 F.3d 407, 414 (9th Cir. 1996) (recognizing California’s “common law cause of action for appropriation of name or likeness”); Kyllo v. United States, 533 U.S. 27, 33-34 (2001) (holding that the expectation of privacy guaranteed by the Fourth Amendment can extend to a non-physical intrusion). Illinois, specifically, has recognized the harm associated with invasions of privacy for many years. See Leopold v. Levin, 259 N.E.2d 250, 253-54 (Ill. 1970) (citing Eick, 106 N.E.3d). Even after the decision in Spokeo 12 was handed down, courts have continued to reiterate that “[t]he common law has long recognized a right to personal privacy, and ‘both the common law and the literal understandings of privacy encompass the individual’s control of information concerning his or her person.’” Thomas, 2016 WL 3653878, at *10 (quoting United States Dept. of Justice v. Reporters Comm. for Freedom of Press, 489 U.S. 749, 763 (1989) (emphasis added)). The protections afforded by BIPA are simply an extension of these traditionally recognized common law and constitutional principles, applied by the Illinois legislature to a new form of technology. The Illinois legislature granted its citizens the means to enforce a right to privacy with respect to biometric identifiers and biometric information and to prohibit companies from collecting and using that data without consent. Take-Two invaded that right when it took Plaintiffs’ biometric data without their consent and without telling them what it planned to do with the data. Plaintiffs have standing to seek redress. b. The Illinois Legislature exercised its judgment to protect an individual’s interest in the privacy of their biometric data Even if BIPA did not follow from the common law, which it does, the statute still creates a valid legal right concerning a concrete harm. The power of the legislature is not limited by strict adherence to the common law, and a legislative body can create “new rights of action that do not have clear analogs in our common law tradition.” Lujan, 504 U.S. at 580 (Kennedy, J., concurring in part and concurring in the judgment). Indeed, even the common law itself is only in force in Illinois by an act of the Legislature, Hardin v. Jordan, 140 U.S. 371, 387 (1891), and the Legislature “has the full power to repeal or modify the common law as thus declared, except as restrained by constitutional limitation,” People ex rel. Ferrill v. Graydon, 164 N.E. 832, 835 (Ill. 1928). To create a new cause of action, the legislature must “identify the injury it seeks to vindicate and relate the injury to the class of persons entitled to bring suit.” Lujan, 504 U.S. at 580 (Kennedy, J., concurring in part and concurring in the judgment). The Illinois Legislature did just that here. 13 BIPA was sparked by an incident in which a company had collected a consumers’ biometric data, and, when the company went into bankruptcy, it became clear that consumers were unaware of exactly who had collected their data and what they were allowed to do with it. To solve this problem, the Legislature required entities collecting biometric identifiers to get consent first, and to tell consumers exactly what they planned to do with the identifiers and how long they planned to keep it. As the district court in In re Facebook Biometric Info. Privacy Litigation recognized: The [Illinois] legislature expressly found that: (1) “Biometrics are unlike other unique identifiers...[and] are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions” ([740 Ill. Comp. Stat.] at 14/5(c)); (2) “[t]he full ramifications of biometric technology are not fully known” (id. at 14/5(f)); and (3) “[t]he public welfare, security and safety will be served by regulating the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information” (id. at 14/5(g)). In connection with these findings, the Illinois legislature implemented a series of safeguards intended to protect the privacy of personal biometric data. In re Facebook Biometric Info. Privacy Litig., 2016 WL 2593853, at *10. In short, in the judgment of the Illinois legislature, consumers who unwittingly gave away their unique biometric data without their consent and without the opportunity to consider these important disclosures have been injured and are entitled to relief. That said, the principle that a legislative body can define new legal rights, the invasion of which is an injury sufficient to support Article III standing, is limited in order to “keep[] courts out of political disputes by denying private litigants the right to test the abstract legality of government action.” Spokeo, 136 S. Ct. at 1552 (Thomas, J., concurring) (citing Schlesinger v. Reservists Comm. to Stop the War, 418 U.S. 208, 222 (1974)). Congress or the Illinois legislature could not, for example, pass a law requiring an “executive agency to ‘follow the law’” and expect that obligation to be privately enforceable without some showing of harm beyond the violation of the statute itself. Id. But that is not what the Illinois Legislature did. It created a right that protects the privacy of consumers’ unique and unchangeable 14 biometric data. “A plaintiff seeking to vindicate a statutorily created private right need not allege actual harm beyond the invasion of that private right.” Id. at 1553. Although the plaintiff in a recent BIPA case, McCollough v. Smarte Carte, Inc., No. 16 C 03777, 2016 WL 4077108, (N.D. Ill. Aug. 1, 2016), was unable to present the court with a cogent explanation of why she had suffered a concrete injury, see Plaintiff’s Response to Defendant’s 12(b)(1) and 12(b)(6) Motion to Dismiss, id. Dkt. 26 (June 27, 2016), Plaintiffs here do not have that problem. They have explained that they alleged an invasion of the private right defined by the Illinois Legislature in BIPA, both by Take-Two’s failure to make the required disclosures and its collection of their biometric data without consent, and they have therefore suffered an injury sufficient to allow them to pursue their claims in federal court. Cf. In re Nickelodeon Consumer Privacy Litig., 2016 WL 3513782, at *7 (“Congress has long provided plaintiffs with the right to seek redress for unauthorized disclosures of information that, in Congress’s judgment, ought to remain private.”); Bona Fide Conglomerate, Inc. v. SourceAmerica, No. 14 Civ. 00751(GPC)(DHB), 2016 WL 3543699, at *8 (S.D. Cal. June 29, 2016) (holding, after discussion of Article III standing in light of Spokeo, that plaintiff “alleged a concrete and particularized injury—violation of its privacy rights—that is actual and imminent”); Mey v. Got Warranty, Inc., No. 5:15-CV-101, 2016 WL 3645195, at *3-5 (N.D.W. Va. June 30, 2016) (holding that “a plaintiff asserting a TCPA claim has Article III standing” because the TCPA provides redress for an invasion of privacy, which is “a harm recognized as redressable through a common law tort claim” and which was “clearly identified” by Congress as a ”legally cognizable harm” when it enacted the TCPA). Further, unlike the plaintiff in McCollough -- who did not identify the concrete informational or other injury she suffered -- Plaintiffs here detailed the specific ways that they suffered both tangible harm, because Take-Two invaded their property interest in their face scans, and intangible harm, because Take-Two failed to give them information that they were entitled to by law and invaded their privacy. Because the district court in McCollough arrived at its decision without the benefit of that explanation -- and because the case was 15 wrongly decided as a result -- it should not guide this Court’s reasoning. Article III poses no bar to the Court’s jurisdiction over this case. Plaintiffs have Article III standing, and the Motion should be denied. B. Even if Take-Two’s BIPA Violations Are Insufficient by Themselves to Confer Article III Standing, Plaintiff Ricardo Vigil Suffered Monetary Harm Stemming from Take- Two’s BIPA Violations and Thus Still Has Article III Standing Even if the informational and property-based harms resulting from Take-Two’s BIPA violations are somehow insufficient to confer Article III standing, Plaintiff Ricardo Vigil also has Article III standing based on the monetary harm he suffered. Plaintiff Ricardo Vigil alleges that, had he known Take-Two would violate his statutorily protected rights to biometric privacy and information through his use of the NBA2k15 video game, he would not have purchased the NBA2k15 video game, for any price. (Complaint ¶¶ 54-55.) Plaintiff Ricardo Vigil further alleges that, upon learning of Take-Two’s unauthorized and undisclosed collection, storage and dissemination of his biometrics in violation of BIPA, he was unable to return the NBA2k15 video game for a monetary refund. (Id. ¶ 55.) Having reasonably relied on the belief that Take-Two would refrain from violating his legally protected rights when he purchased the video game, to his detriment, Plaintiff Ricardo Vigil suffered concrete monetary harm that permits him to pursue his claim for statutory damages in federal court. Contrary to Take-Two’s assertion that these allegations “do[] not constitute ‘concrete injury’ unless BIPA compliance was part of [Plaintiff Ricardo Vigil’s] contracted-for bargain with Take-Two” (Mot. at 8), it is well established that compliance with the law and respect for the legal rights of the other party are obligations implicit in every contractual bargain. See, e.g., United States v. Novak, 443 F.3d 150, 159 (2d Cir. 2006) (noting that “the defendants’ compliance with the law in carrying out their contractual obligations was a fundamental part of the bargain between the parties”). Plaintiff Ricardo Vigil’s allegations are analogous to the plaintiff’s allegations in Boelter v. Hearst 16 Commc’ns, Inc., another post-Spokeo putative class action alleging violation of a state consumer protection law providing for statutory damages. There, Judge Torres of this District concluded that Article III standing existed based on the plaintiff’s allegation that she would not have paid as much for her subscription to Country Living magazine had she known that the defendant would disclose her subscriber information to third parties in violation of Michigan’s Video Rental Privacy Act (“VRPA”). See Boelter, 2016 WL 3369541, at *3 (“[H]ad Plaintiffs known that Defendant would disclose their information, they ‘would not have been willing to pay as much, if at all, for [their magazine] subscriptions.’ As alleged, Plaintiffs suffered a particularized, concrete injury-in-fact—the violation of their rights under the VRPA, along with economic harm—that was caused by Defendant and that can be remedied by court action. At this stage, the pleadings are sufficient to establish Plaintiffs' standing to sue.”). The Court should reach the same conclusion here. Even if the alleged violations of Plaintiffs’ rights under BIPA are somehow insufficient by themselves to confer Article III standing, the resulting monetary damages suffered by Plaintiff Ricardo Vigil, i.e., the purchase price of the NBA2k15 video game, constitutes tangible economic harm that is sufficiently concrete for Article III purposes. II. PLAINTIFFS HAVE STATUTORY STANDING Take-Two’s alternative argument – that Plaintiffs and the putative class members are not “persons aggrieved” within the meaning of BIPA and thus lack statutory standing – is also incorrect. “Person aggrieved” is a term of common usage that refers to a person who falls within the “zone of interests” sought to be protected by the statute claimed to have been violated. See, e.g., Thompson v. N. Am. Stainless, 562 U.S. 170, 178 (2011). In Thompson, the Supreme Court held that the term “aggrieved,” when used in a statute, enables suit “by any plaintiff with an interest ‘arguably [sought] to be protected by the statute,’ while excluding plaintiffs who might technically be injured in an Article III sense but whose interests are unrelated to the statutory prohibitions.” Id. (citation omitted). 17 Here, Take-Two invaded Plaintiffs’ property interests in their face scans, and further violated their statutorily protected rights to keep these immutable biological identifiers private absent informed written consent, and to be provided the requisite written disclosures and statutorily compliant data retention and destruction policies. There can be no legitimate dispute that these injuries are of precisely the sort that the Illinois legislature sought to protect against in enacting BIPA. Take-Two nevertheless argues that “the types of harms that plaintiffs allege in the SAC are not the types of harms BIPA was designed to address.” (Mot. at 15.) According to Take-Two, the statute was enacted only to regulate “the use of biometrics in connection with ‘financial transactions and security screenings.’” (Mot. at 15 (quoting 740 Ill. Comp. Stat. 14/5(a)-(b)). This is a remarkably sloppy misreading of the statute. Financial transactions and security screenings are merely settings in which compromised biometrics might be misused. It would make no sense to safeguard biometrics only in those settings. Stolen identification – whether a social security number or a scan of face geometry – is a security threat no matter how, when, or where it was stolen.3 Take-Two might as well argue that the theft of a wallet matters only if it occurs at a cash register, or that the theft of social security numbers 3 Indeed, as reported by the New York Times on June 21, 2016, “[s]ome of the nation’s largest banks, acknowledging that traditional passwords are either too cumbersome or no longer secure, are increasingly using fingerprints, facial scans and other types of biometrics to safeguard accounts.” Michael Corkery, The New York Times (June 21, 2016) (available at “http://www.nytimes.com/2016/06/22/business/dealbook/goodbye-password-banks-opt-to-scan- fingers-and-faces-instead.html?_r=0) (emphasis added). A breach of Take-Two’s massive database of scans of face geometry could thus have devastating consequences, financial and otherwise, for the putative class members. Although a bank account number or a password is subject to change, an individual’s facial geometry is not. 18 matters only if it occurs in the context of a banking transaction. The argument is nonsense. The statute evinces no such crippling restriction on the regulatory scheme. Rather, the statute sensibly expresses a general, unrestricted intent to regulate “the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information,” 740 Ill. Comp. Stat. 14/5(g), to prevent all of the evils that may result from a breach of personal-identification security. Having alleged claims that place them well within BIPA’s “zone of interests,” Plaintiffs are clearly “persons aggrieved” within the meaning of the statute. Moreover, the meaning of “person aggrieved” under Illinois law was discussed in Mandziara v. Canulli, 299 Ill. App. 3d 593 (1998), and the result demonstrates that Take-Two’s argument is incorrect. In Mandziara, the plaintiff brought an action against the defendant, her former husband, for subpoenaing her mental health records without a court order in violation of the Illinois Mental Health and Developmental Disabilities Confidentiality Act (“MHA”), 740 Ill. Comp. Stat. 110/1-17. The MHA provides, in pertinent part, that “[n]o party . . . nor his or her attorney, shall serve a subpoena seeking to obtain access to records or communications under this Act unless the subpoena is accompanied by a written order issued by a judge, authorizing the disclosure of the records or the issuance of the subpoena.” 740 Ill. Comp. Stat. 110/10(d). The MHA further provides that “[a]ny person aggrieved by a violation of this Act may sue for damages, an injunction, or other appropriate relief.” 740 Ill. Comp. Stat. 110/15. In rejecting the defendant’s argument that the plaintiff failed to state a claim because the defendant “did not look at [plaintiff’s] records,” Mandziara, 299 Ill. App. 3d at 599, and thus did not actually harm the plaintiff, the court explained: “The General Assembly has made a strong statement about the importance of keeping mental health records confidential. If we were to hold Canulli did not violate the Act merely because he did not look at Mandziara’s records, we would be rewriting the statute, effectively eroding unmistakable legislative intent under the weight of judicial fiat,” id. Accordingly, the Court concluded that the plaintiff was a “person aggrieved” under FHA by virtue of 19 the defendant’s violation of the disclosure restrictions of 740 Ill. Comp. Stat. 110/10(d). See id. at 600 (explaining that “a person aggrieved by a violation of the Act” is entitled to “a remedy of damages against persons who violate the act,” without regard for the “nature and extent of those damages”). In this case, the phrase “person aggrieved,” as it appears in BIPA, has the same meaning. Plaintiffs are “persons aggrieved” under BIPA, and thus have statutory standing, based upon Take- Two’s violations of the specific statutory requirements of BIPA. As in Mandziari, the “nature and extent of [Plaintiffs’] damages” are of no consequence, especially since BIPA specifically provides for statutory damages for each such violation. See id.; see also Glos v. People, 259 Ill. 332, 340 (1913) (“A person is prejudiced or aggrieved, in the legal sense, when a legal right is invaded by the act complained of . . . . ‘Aggrieved’ means having a substantial grievance; a denial of some personal or property right.”); American Surety Co. v. Jones, 384 Ill. 222, 229-30 (1943) (same); In re Estate of Harmston, 10 Ill. App. 3d 882, 885 (3rd Dist. 1973) (“‘Aggrieved’ means having a substantial grievance; a denial of some personal or property right.”); Greeling v. Abendroth, 351 Ill. App. 3d 658, 662 (4th Dist. 2004) (stating that “the plaintiff must be ‘aggrieved,’ that is, the plaintiff must ‘suffer[] from an infringement or denial of legal rights’”). Indeed, the meaning of the term “person aggrieved” under BIPA was recently considered by the court in Rosenbach v. Six Flags Entertainment Corporation, 16 CH 13 (Cir. Ct., Lake County, Ill., June 17, 2016), another putative class action.4 In rejecting the defendant’s argument that the plaintiff was not a 4 A copy of the defendant’s motion to dismiss filed in Sex Flags is attached hereto as Exhibit “A”, and a copy of the court’s decision in Six Flags is attached hereto as Exhibit “B”. A copy of the transcript of oral argument held in Six Flags on the defendant’s motion to dismiss is attached hereto as Exhibit “C.” 20 “person aggrieved” under BIPA by virtue of defendant’s unauthorized and undisclosed collection of his biometrics in violation of the statute, the court explained: THE COURT: And I look at the statute, and it says ‘collection.’ I have to give meaning to every word of the statute and then interpret the thing as a whole. And to accept your interpretation of the statute ignores the intent that the legislature put in Section 5. MS. BERNARD: Your Honor, I understand your position, and that's plaintiff’s position, but you have to also give meaning to the term ‘aggrieved.’ And if the data is never retained, if there is no information that can be breached, and you know it’s collected, but we don’t have it anymore, how is a plaintiff then, how is a plaintiff aggrieved? THE COURT:· By giving ‘aggrieved’ its common meaning, which is set forth in the 10th edition of Black's Law Dictionary, which not only says ‘aggrieved,’ but says ‘aggrieved person.’ It defines ‘aggrieved person.’ And I pulled that out because I actually have the 6th edition of Black’s. And it says what you quoted as saying in your brief, but there is a 10th edition. And the 10th edition: ‘Aggrieved. Of a person or entity having legal rights that are adversely affected; having ·been harmed by an infringement of legal rights.’ Doesn't talk about any kind of damages. … A common meaning of ‘aggrieved’ means somebody who had some right violated. It doesn’t define ‘aggrieved’ with respect to damages. (Ex. C at 19:4-20:2, 21:1-3 (emphasis added).) This court should reach the same conclusion. Plaintiffs are “persons aggrieved” within the meaning of BIPA because Take-Two violated their legally protected rights provided by BIPA. Take-Two contends that the district court’s decision in Padilla v. Dish Network L.L.C., No. 12- cv-7350, 2013 WL 3791140 (N.D. Ill. July 19, 2013), which held a plaintiff was not a “person aggrieved” within the meaning of the federal Satellite Home Viewer Extension and Reauthorization Act (“SHVERA”), demonstrates that Plaintiffs are not “persons aggrieved” under BIPA in this case. First, Mandziari belies that assertion. Second, Padilla is inapposite; because SHVERA is a federal statute, its provisions are not interpreted pursuant to Illinois’s rules of statutory construction. Third, the exact same argument regarding Padilla was also raised by the defendant in Six Flags (compare Mot. at 13-14 with Ex. B at 10-11), and it was flatly rejected by the court. At oral argument, the court stated the following 21 in response to the defendant’s argument that, pursuant to Padilla, a person whose biometrics are collected without consent or receipt of the requisite disclosures is not “aggrieved” within the meaning of BIPA: THE COURT: Then what’s the purpose of the statute? Why even put this language in there then [regarding the required consent and disclosures]? MS. BERNARD: Well, because if there is a breach or there is a misuse, then the plaintiff can sue under any of the provisions of the statute for violations. And that’s what the statutory scheme contemplates. THE COURT: But it doesn’t say that. It says a ‘violation of this Act.’ And this Act requires certain disclosures -- you’re reading things into Section 20 that aren’t there. (Ex. C at 13:19-14:4.) According to Take-Two, until its tremendous, Orwellian face scan database is actually compromised, it may continue violating the statute with impunity, because no one has been “aggrieved” by its violations. The argument is nonsense, not only for the reasons stated above, but because it flies directly in the face of the legislative purpose underlying the statute. As the court in Six Flags explained: THE COURT: So under your scenario, as long as [Six Flags] continues to violate the statute and there is no breach of the privacy or the confidentiality of the information, they can do it continuously. There is no remedy for anybody. MS. BERNARD: Respectfully, your Honor, we don't think we have breached the statute, but -- THE COURT: No, no, answer my question. That is the result of how you read that statute. Great America can ignore the statute as long as they take whatever steps they need to take to protect the integrity of that information and it doesn’t get distributed or disclosed to anybody else. MS. BERNARD: Actually, your Honor, yes -- THE COURT: Okay. MS. BERNARD: -- because there is no harm. There is no aggrieved party. And that’s exactly what the Sterk court held and what Judge Dow held in the Padilla case, that just because the statute provides X, if a 22 violation of X does not cause any harm, then how is someone an aggrieved party? THE COURT: Okay. Rectify that with Section 5(g), which is the intent of the legislation, which is set forth here. It says: ‘The public welfare, security, and safety will be served by regulating the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.’ Specifically, it deals with the collection. So under your analysis of this statute, the legislative intent is ignored because they can collect and ignore this statute, as long as they protect the integrity of the information. (Ex. C at 15:22-17:5.) Take-Two’s argument that Plaintiffs are not “persons aggrieved” is thus contrary to BIPA’s plain language and purpose.5 Finally, even if Plaintiffs were somehow not “aggrieved” by virtue of the statutory violations themselves, it is beyond dispute that Plaintiff Ricardo Vigil was “aggrieved” in an amount equal to the 5 Take-Two also contends that the absence of the term “person aggrieved” in the Illinois Cable and Video Customer Protection Law (“CVCPL”), 220 Ill. Comp. Stat. 5/22-501, means that actual injury is required under any other statute, such as BIPA, in which the term “person aggrieved” appears. First, Mandziara and Six Flags belie that assertion. Second, the CVCPL does not conflict with BIPA; the two statutes simply address different concerns and accordingly provide different grounds for standing. A plaintiff under the CVCPL must be a customer of the defendant cable or video provider, but otherwise need not be within the “zone of interests” contemplated by a “person aggrieved” standard, see Thompson, 562 U.S. at 178. A plaintiff under BIPA, by contrast, plainly need not be a customer of the defendant, yet must be within the zone of interests contemplated by a “person aggrieved” standard. Thus, Plaintiffs would have standing under BIPA to sue not only Take-Two but also a secondary trafficker that bought face scans from Take-Two and sold them to identity theft criminals – even though Plaintiffs were not “customers” of the secondary trafficker. The CVCPL poses no obstacle to Plaintiffs’ standing under BIPA. 23 cost of the video game he purchased. See Ex. C at 24:23-25:4 (court in Six Flags stating that the plaintiffs “are an aggrieved party whether you look at it as a violation of a right, even though they can’t put a monetary number on what that violation is, or you look at what the cost of the pass was. I would not have paid that had I known everything that’s supposed to have been disclosed to me.”). Plaintiffs have statutory standing, and the Motion should be denied. III. THE MOTION TO STRIKE IS BOTH PREMATURE AND WITHOUT SUBSTANTIVE MERIT Take-Two requests, in the alternative, that the Court strike the class allegations because the Complaint “bases plaintiffs’ standing on highly individualized harms,” and, as such, “the class will include persons who . . . lack standing.” (Mot. at 18). The argument is both premature and substantively baseless. “Motions to strike are generally disfavored, and should be granted only when there is a strong reason for doing so.” Winfield v. Citibank, N.A., 842 F. Supp. 2d 560, 573 (S.D.N.Y. 2012) (Koeltl, J.) (quoting In re Tronox Sec. Litig., No. 09 Civ. 6220, 2010 WL 2835545, at *4 (S.D.N.Y. June 28, 2010)). “Moreover, a motion to strike class allegations . . . is even more disfavored because it requires a reviewing court to preemptively terminate the class aspects of . . . litigation, solely on the basis of what is alleged in the complaint, and before plaintiffs are permitted to complete the discovery to which they would otherwise be entitled on questions relevant to class certification.” Id. (quoting Chenensky v. N.Y. Life Ins. Co., No. 07 Civ. 11504, 2011 WL 1795305, at *1 (S.D.N.Y. Apr. 27, 2011)); see also 7A Charles Alan Wright, Arthur R. Miller & Mary K. Kane, Federal Practice and Procedure Civil § 1785.3 (3d ed. 2005) (stating that the practice employed in the overwhelming majority of class actions is to resolve class certification only after an appropriate period of discovery)). In this case, Take-Two’s motion to strike the class allegations on Article III standing grounds is premature for several reasons. First, in the class action context, “courts are reluctant to determine disputed or substantial questions of law on a motion to strike.” Guzman v. Bridgepoint Educ., Inc., No. 11- 24 CV-69-WQH (WVG), 2013 WL 593431, at *4 (S.D. Cal. Feb. 13, 2013). Second, no discovery has been taken (class discovery or otherwise), the pleadings remain open, and Plaintiffs have not yet moved for class certification. See, e.g., Winfield, 842 F. Supp. 2d at 573-74 (“[T]he defendant’s motion to strike plaintiff Shen’s class allegations is premature and should await a decision on class certification where the Court will have the benefit of a full factual record[.]”); Myers v. MedQuist, Inc., No. 05–4608, 2006 WL 3751210, *4 (D.N.J. 2006) (declining to strike class allegations because discovery had not yet commenced and observing that most courts deny such motions if brought prior to discovery). Furthermore, as this Court has held, where a motion to strike class allegations is premised on concerns regarding Article III standing, like the motion to strike filed by Take-Two here, “[i]t is appropriate to defer standing objections until after class certification where certification issues are ‘logically antecedent’ to Article III concerns.” Winfield, 842 F. Supp. 2d at 574 (quoting Ortiz v. Fibreboard Corp., 527 U.S. 815, 831 (1999)). “[C]lass certification is ‘logically antecedent,’ where its outcome will affect the Article III standing determination, and the weight of authority holds that in general class certification should come first.” Id. (quoting Blessing v. Sirius XM Radio, Inc., 756 F. Supp. 2d 445, 451 (S.D.N.Y. 2010). In this case, class certification is “logically antecedent” to the Article III standing of the individual class members because the outcome of class certification will determine who the individual class members are. The proposed class definition is just that -- a proposal -- and is subject to change prior to or at class certification, as necessary after the completion of discovery. See Robidoux v. Celani, 987 F.2d 931, 937 (2d Cir. 1993) (holding that “a court is not bound by the class definition proposed in the complaint”). Because the putative class as defined in the Complaint may differ from the class that is ultimately certified, the Article III standing of the class members cannot be determined until after a decision on class certification. Accordingly, the motion to strike should be denied as premature on this basis as well. See, e.g., Winfield, 842 F. Supp. 2d at 574 (denying motion to strike class allegations where 25 “each of the named plaintiffs has standing,” explaining that “it is appropriate to decide class certification before resolving the defendant’s Article III standing challenge”). Moreover, even if the Court considers Take-Two’s motion to strike at this stage, it also fails on the merits. Just as Article III poses no bar to the Court’s jurisdiction over the claims asserted by Plaintiffs’ individually, Article III is no obstacle for the putative class members. The same tangible injury suffered by Plaintiffs was suffered uniformly by the putative class, because each putative class member, by definition, had his or her face scan misappropriated by Take-Two. Likewise, the same intangible injury suffered by Plaintiffs was suffered uniformly by the putative class, because each putative class member, by definition, was deprived of the written disclosures required by BIPA. Because all putative class members have standing, Take-Two’s motion to strike the class allegations fails as a matter of law and should be denied. Finally, even in the unlikely event the Court determines that the informational and property- based injuries suffered by Plaintiffs are insufficient to confer Article III standing, and that as a result only Plaintiff Ricardo Vigil has Article III standing, the Court should still decline to strike the class allegations at this stage of the proceedings. In those circumstances, Plaintiff Ricardo Vigil should be afforded an opportunity to amend the proposed class definition and corresponding class allegations -- as he has reserved his right to do (Complaint ¶ 66) -- to encompass all similarly situated individuals who purchased the NBA2k15 video game, who had their biometrics collected and stored by Take-Two in violation of BIPA, and who would not have paid as much for the NBA2k15 video game (or purchased it all) had he or she known that Take-Two would collect his or her biometrics in violation of BIPA during the course of game play. CONCLUSION For the foregoing reasons, the Motion should be denied. 26 Dated: August 19, 2016 Respectfully submitted, By: /s/ Frank S. Hedin_______ CAREY RODRIGUEZ MILIAN GONYA, LLP John C. Carey (NY Bar No. JC-4639) jcarey@careyrodriguez.com David P. Milian dmilian@careyrodriguez.com Frank S. Hedin fhedin@careyrodriguez.com Ernesto M. Rubi* erubi@careyrodriguez.com 1395 Brickell Avenue, Suite 700 Miami, Florida 33131 Telephone: (305) 372-7474 Facsimile: (305) 372-7475 *Pro Hac Vice Application Forthcoming Counsel for Plaintiffs and the Putative Class 27 CERTIFICATE OF SERVICE I hereby certify that on August 19, 2016, I electronically filed the foregoing document with the Clerk of Court using CM/ECF. I also certify that the foregoing document is being served this day on all counsel of record via transmission of Notices of Electronic Filing generated by CM/ECF. /s/ Frank S. Hedin