`
`UNITED STATES DISTRICT COURT
`NORTHERN DISTRICT OF ILLINOIS
`EASTERN DIVISION
`
`
`
`
`
`
`
`
`
`
`
`20 C 577
`
`
`
` )
`
`
`)
`)
`)
`)
`)
`)
`)
`)
`)
`)
`)
`
`MEMORANDUM OPINION
`
`
`STEVEN VANCE and TIM JANECYK, for
`themselves and others similarly situated,
`
`
`
`
`
`
`
`
`
`Plaintiffs,
`
`
`
`
`
`INTERNATIONAL BUSINESS
`MACHINES CORPORATION, a New York
`corporation,
`
`
`
`
`
`v.
`
`
`
`
`
`
`
`
`Defendant.
`
`
`
`CHARLES P. KOCORAS, District Judge:
`
`Before the Court is Defendant International Business Machines Corporation’s
`
`(“IBM”) motion to dismiss Plaintiffs Steven Vance (“Vance”) and Tim Janecyk’s
`
`(“Janecyk”) (collectively, “Plaintiffs”) Second Amended Class Action Complaint
`
`(“SAC”) under Federal Rule of Civil Procedure 12(b)(6). For the following reasons,
`
`the Court will grant the motion in part.
`
`BACKGROUND
`
`For purposes of this motion, the Court accepts as true the following facts from
`
`the complaint. Alam v. Miller Brewing Co., 709 F.3d 662, 665–66 (7th Cir. 2013). All
`
`reasonable inferences are drawn in Plaintiffs’ favor. League of Women Voters of
`
`Chicago v. City of Chicago, 757 F.3d 722, 724 (7th Cir. 2014).
`
`
`
`Case: 1:20-cv-00577 Document #: 48 Filed: 09/15/20 Page 2 of 13 PageID #:381
`
`Plaintiffs Vance and Janecyk are both Illinois residents. Defendant IBM is a
`
`multinational technology corporation organized under the laws of the State of New
`
`York with a corporate headquarters in Armonk, New York.
`
`Vance has had an account with Flickr, a photo sharing service, since 2006. In
`
`2008, Vance uploaded a photo of himself and two family members to Flickr from his
`
`computer in Illinois. Similarly, Janecyk has had a Flickr account since 2008 and
`
`uploaded a photo of himself to Flickr in 2011. Yahoo!, Flickr’s parent company at the
`
`time, subsequently made Vance’s photo available to IBM in 2014 when it released over
`
`99 million photos in a single, downloadable dataset called YFCC100M (“Flickr
`
`Dataset”).
`
`Plaintiffs allege that IBM used the Flickr Dataset to create its own dataset (the
`
`“IBM Dataset”). The IBM Dataset was allegedly comprised of over one million front-
`
`facing images of human faces. In each image, IBM allegedly extracted 68 key-points
`
`and at least ten facial coding schemes, such as craniofacial distances, craniofacial areas,
`
`craniofacial ratios, facial symmetry, facial regions contrast, skin color, age prediction,
`
`gender prediction, subjective annotation, and pose and resolution.
`
`Plaintiffs allege that IBM subsequently disseminated a dataset created from
`
`information extracted from the IBM Dataset. IBM called this dataset “Diversity in
`
`Faces” (“DIF Dataset”). Each image in the DIF Dataset could allegedly be traced back
`
`to the individual Flickr account to which it was originally uploaded.
`
`2
`
`
`
`Case: 1:20-cv-00577 Document #: 48 Filed: 09/15/20 Page 3 of 13 PageID #:382
`
`Based on these facts, Plaintiffs filed the instant class action complaint on March
`
`12, 2020. Plaintiffs allege that IBM did not establish a publicly available retention
`
`schedule and guidelines for destroying biometric information in violation of Section
`
`15(a) of the Illinois Biometric Information Privacy Act, 740 ILCS § 14/1 et seq.
`
`(“BIPA”) (Count One); IBM collected, captured, or otherwise obtained Plaintiffs’
`
`biometric information without written informed consent in violation of BIPA Section
`
`15(b) (Count Two); IBM sold Plaintiffs’ biometric information in violation of BIPA
`
`Section 15(c) (Count Three); IBM disclosed or otherwise disseminated Plaintiffs’
`
`biometric information without Plaintiffs’ consent or required by law in violation of
`
`BIPA Section 15(d) (Count Four); IBM failed to use reasonable care to protect
`
`Plaintiffs’ biometric information from disclosure and did not store Plaintiffs’ biometric
`
`information in a matter the same as IBM would store other confidential information in
`
`violation of BIPA Section 15(e) (Count Five); a state law unjust enrichment claim
`
`(Count Six); and a state law injunctive relief claim (Count Seven).1
`
`Plaintiffs seek statutory damages of $5,000 for each willful and reckless violation
`
`and $1,000 for each negligent violation of BIPA. IBM moved to dismiss the complaint
`
`under Rule 12(b)(6) on April 16, 2020.
`
`
`1 Count Seven was improperly labeled as Count Six.
`
`3
`
`
`
`Case: 1:20-cv-00577 Document #: 48 Filed: 09/15/20 Page 4 of 13 PageID #:383
`
`LEGAL STANDARD
`
`
`
`A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) “tests the
`
`sufficiency of the complaint, not the merits of the case.” McReynolds v. Merrill Lynch
`
`& Co., 694 F.3d 873, 878 (7th Cir. 2012). The allegations in the complaint must set
`
`forth a “short and plain statement of the claim showing that the pleader is entitled to
`
`relief.” Fed. R. Civ. P. 8(a)(2). A plaintiff need not provide detailed factual allegations,
`
`but it must provide enough factual support to raise its right to relief above a speculative
`
`level. Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007).
`
`
`
`A claim must be facially plausible, meaning that the pleadings must “allow . . .
`
`the court to draw the reasonable inference that the defendant is liable for the misconduct
`
`alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). The claim must be described
`
`“in sufficient detail to give the defendant ‘fair notice of what the . . . claim is and the
`
`grounds upon which it rests.’” E.E.O.C. v. Concentra Health Servs., Inc., 496 F.3d 773,
`
`776 (7th Cir. 2007) (quoting Twombly, 550 U.S. at 555). “[T]hreadbare recitals of the
`
`elements of a cause of action, supported by mere conclusory statements,” are
`
`insufficient to withstand a 12(b)(6) motion to dismiss. Iqbal, 556 U.S. at 678.
`
`DISCUSSION
`
`As a preliminary matter, we note that the Seventh Circuit’s recent decision in
`
`Bryant v. Compass Group USA Inc., brings into question our subject-matter jurisdiction
`
`over Plaintiffs’ claims under BIPA Section 15(a). 958 F.3d 617 (7th Cir. 2020). In
`
`Bryant, the Seventh Circuit resolved an important issue that has divided courts in our
`
`4
`
`
`
`Case: 1:20-cv-00577 Document #: 48 Filed: 09/15/20 Page 5 of 13 PageID #:384
`
`District for the past three years: what BIPA violations are sufficiently substantive to
`
`qualify as an injury for purposes of standing under Article III of the U.S. Constitution
`
`(“Article III”).
`
`Applying Justice Thomas’s rubric from his concurrence in Spokeo Inc., v.
`
`Robbins, 136 S. Ct. 1540, 1551 (2016), the Bryant Court distinguished between the duty
`
`owed under BIPA Section 15(b)—requiring that private entities obtain informed
`
`consent to collect biometric information—and that owed under Section 15(a), requiring
`
`private entities to make publicly available a data retention schedule and guidelines for
`
`permanently destroying collected biometric identifiers and information. 958 F.3d at
`
`624.
`
`The Bryant Court found that the obligations under the former are owed to private
`
`individuals, and therefore, a violation of BIPA Section 15(b) invades a plaintiff’s
`
`personal privacy right to consider the terms under which her biometric information is
`
`collected and used. Id. In contrast, the obligations under BIPA Section 15(a) are owed
`
`to the public generally. Id. at 626. Therefore, a violation of that Section does not invade
`
`a plaintiff’s personal privacy rights in a concrete manner. Id. Accordingly, the Bryant
`
`Court held that a violation of Section BIPA Section 15(b) is a substantive violation that
`
`creates a concrete and particularized Article III injury, whereas a violation of BIPA
`
`Section 15(a) is procedural and does not create such an injury. Id.
`
`Applying the Bryant Court’s holding, we conclude that we lack subject-matter
`
`jurisdiction over Plaintiffs’ Section 15(a) claims. In their complaint, Plaintiffs allege
`
`5
`
`
`
`Case: 1:20-cv-00577 Document #: 48 Filed: 09/15/20 Page 6 of 13 PageID #:385
`
`that IBM failed to maintain a publicly available retention and destruction schedule in
`
`violation of BIPA Section 15(a). But such a violation does not create a concrete injury
`
`as required under Article III. Therefore, we find that Plaintiffs lack standing to bring
`
`this claim in federal court. The Court accordingly dismisses the claims under Section
`
`15(a) for lack of subject-matter jurisdiction. See Wernsing v. Thompson, 423 F.3d 732,
`
`743 (7th Cir. 2005) (“[N]ot only may the federal courts police subject matter
`
`jurisdiction sua sponte, they must.”) (internal citation omitted); Wingerter v. Chester
`
`Quarry Co., 185 F.3d 657, 660 (7th Cir. 1998) (holding that a court “has an obligation
`
`to examine its jurisdiction sua sponte, even if the parties fail to raise a jurisdictional
`
`issue.”).
`
`
`
`Turning to the merits of IBM’s motion, IBM urges the Court to dismiss
`
`Plaintiffs’ BIPA claims, unjust enrichment claim, and injunctive relief claim. We
`
`address each in turn.
`
`I.
`
`
`
`BIPA
`
`IBM urges the Court to dismiss Plaintiffs’ BIPA claims for three reasons: (1)
`
`application of BIPA in this case would violate Illinois’s extraterritoriality doctrine; (2)
`
`BIPA violates the U.S. Constitution’s Dormant Commerce Clause; and (3) BIPA
`
`expressly exempts photographs. We address each argument in turn.
`
`
`
`
`
`a.
`
`Illinois’s Extraterritoriality Doctrine
`
`IBM first argues that Illinois’ extraterritoriality doctrine prohibits the litigation
`
`of Plaintiffs’ claims because Plaintiffs do not allege that that the acts occurred primarily
`
`6
`
`
`
`Case: 1:20-cv-00577 Document #: 48 Filed: 09/15/20 Page 7 of 13 PageID #:386
`
`and substantially in Illinois. Plaintiffs argue that this is not an issue to be decided at the
`
`motion to dismiss stage. We agree with Plaintiffs.
`
`
`
`The Illinois Supreme Court has held that “a statute is without extraterritorial
`
`effect unless a clear intent in this respect appears from the express provisions of the
`
`statute.” Avery v. State Farm Mutual. Auto Ins. Co., 216 Ill. 2d 100, 184–85 (2005).
`
`However, an Illinois law can be applied if “the circumstances that relate to the disputed
`
`transaction occur[red] primarily and substantially in Illinois.” Id. at 187. “[T]here is
`
`no single formula or bright-line test for determining whether a transaction occurs within
`
`[Illinois]” and “each case must be decided on its own facts.” Id.
`
`
`
`The parties agree that BIPA cannot be applied extraterritorially. Thus, the
`
`question is whether the events giving rise to this suit occurred primarily and
`
`substantially in Illinois. However, this is a highly fact-based analysis that is generally
`
`inappropriate for the motion to dismiss stage. Monroy v. Shutterfly, Inc., 2017 WL
`
`4099846, *6 (N.D. Ill. 2017) (holding that the extraterritoriality doctrine is better
`
`addressed on a motion for summary judgment); Rivera v. Google, Inc., 238 F. Supp. 3d
`
`1088, 1101–02 (N.D. Ill. 2017) (same).
`
`
`
`While IBM is headquartered in New York, discovery is needed in order to
`
`determine to what extent IBM’s alleged acts occurred in Illinois. For example, more
`
`facts will need to be known regarding where IBM performed the face scans and where
`
`the DIF Dataset was created. Without this information, the Court cannot determine
`
`whether BIPA is being applied extraterritorially under Avery.
`
`7
`
`
`
`Case: 1:20-cv-00577 Document #: 48 Filed: 09/15/20 Page 8 of 13 PageID #:387
`
`
`
`
`
`b.
`
`Dormant Commerce Clause
`
`IBM next argues that BIPA violates the Dormant Commerce Clause as applied
`
`in this case. Specifically, IBM argues that because New York, IBM’s home state, has
`
`repeatedly failed to pass laws similar to BIPA, Illinois’s BIPA “would displace the
`
`inconsistent policies of New York” and thus violate the Dormant Commerce Clause.
`
`Plaintiffs again argue that this is an issue more properly addressed on a motion for
`
`summary judgment. We agree with Plaintiffs.
`
`
`
`The U.S. Constitution's Commerce Clause grants Congress the authority to
`
`“regulate Commerce . . . among the several States.” U.S. Const. Art I, § 8, cl. 3. “Th[e]
`
`‘negative’ aspect of the Commerce Clause is often referred to as the ‘Dormant
`
`Commerce Clause’ and is invoked to invalidate overreaching provisions of state
`
`regulation of commerce.” Alliant Energy Corp. v. Bie, 330 F.3d 904, 911 (7th
`
`Cir.2003); see also Am. Trucking Assn's, Inc. v. Mich. Pub. Serv. Comm'n, 545 U.S.
`
`429, 433 (2005).
`
` The Dormant Commerce Clause
`
`limits
`
`the permissible
`
`“extraterritorial effects of state economic regulation.” Healy v. Beer Institute, 491 U.S.
`
`324, 336 (1989). Additionally, the “Dormant Commerce Clause . . . precludes the
`
`application of a state statute to commerce that takes place wholly outside of the State's
`
`borders, whether or not the commerce has effects within the State.” Id. at 336 (quoting
`
`Edgar v. MITE Corp., 457 U.S. 624, 642–43 (1982)).
`
`
`
`Like the extraterritoriality doctrine, courts have repeatedly rejected the argument
`
`that the Dormant Commerce Clause prevents BIPA’s application to out-of-state
`
`8
`
`
`
`Case: 1:20-cv-00577 Document #: 48 Filed: 09/15/20 Page 9 of 13 PageID #:388
`
`defendants at the motion to dismiss stage and held that the issue is more properly
`
`addressed on a motion for summary judgment. Rivera., 238 F. Supp. 3d at 1104;
`
`Monroy, 2017 WL 4099846, at **7–8; see In re Facebook Biometric Privacy Litig.,
`
`2018 WL 2197546, *4 (N.D. Cal. 2018). In Rivera, for example, the Court held, “this
`
`is not the stage at which to assess these arguments in detail. . . . Whether the Privacy
`
`Act is nevertheless being summoned here to control commercial conduct wholly outside
`
`Illinois is not possible to figure out without a better factual understanding of what is
`
`happening in the [Defendant’s] face-scan process.” Rivera at 1104.
`
`
`
`We again believe that summary judgment is the more appropriate time to
`
`determine whether the Dormant Commerce Clause bars Plaintiffs’ claims. We need
`
`more detailed facts regarding IBM’s processes to know the extent to which IBM’s
`
`actions occurred in Illinois and whether the Dormant Commerce Clause bars this suit.
`
`
`
`
`
`c.
`
`BIPA’s Exclusion of Photographs
`
`IBM next argues that BIPA expressly excludes photographs and biometric
`
`information derived from photographs. Plaintiffs argue that courts have held that
`
`conduct similar to IBM’s alleged conduct has been held to not be barred by BIPA’s
`
`photograph exclusions. We agree with Plaintiffs.
`
`
`
`BIPA defines a “biometric identifier” as “a retina or iris scan, fingerprint,
`
`voiceprint, or scan of hand or face geometry.” 740 ILCS 14/10. BIPA’s definition of
`
`a biometric identifier expressly excludes photographs. Id. “Biometric information” is
`
`“any information, regardless of how it is captured, converted, stored, or shared, based
`
`9
`
`
`
`Case: 1:20-cv-00577 Document #: 48 Filed: 09/15/20 Page 10 of 13 PageID #:389
`
`on an individual's biometric identifier used to identify an individual.” Id. However,
`
`courts have held that biometric data obtained from photographs is a “biometric
`
`identifier.” See, e.g., Rivera, 238 F. Supp 3d at 1095; In re Facebook Biometric Privacy
`
`Litig., 185 F. Supp. 3d 1155, 1170–72 (N.D. Cal. 2016); Monroy, 2017 WL 4099846,
`
`at **3-5.
`
`
`
`In Rivera, the court held that Google’s “face templates” derived from
`
`photographs do not fall within BIPA’s exclusion of photographs. 238 F. Supp 3d at
`
`1095. The court said that each template involved “creating a set of biology-based
`
`measurements (‘biometric’) that is used to identify a person (‘identifier’).” Id.
`
`Moreover, “a face template is one of the specified biometric identifiers in the Privacy
`
`Act, namely, a ‘scan of ... face geometry.’” Id. The court found that nothing in BIPA
`
`supported Google’s argument that the face scan had to be done in person and not from
`
`a photograph because the statute does not specify how biometric information must be
`
`captured. Id. “The bottom line is that a ‘biometric identifier’ is not the underlying
`
`medium itself, or a way of taking measurements, but instead is a set of measurements
`
`of a specified physical component (eye, finger, voice, hand, face) used to identify a
`
`person.” Id. at 1096.
`
`
`
`Here, Plaintiffs allege that IBM extracted biometric information from
`
`photographs to create their DIF Dataset. The DIF Dataset includes biometric
`
`measurements that can be used to identify Plaintiffs. Thus, IBM’s alleged actions
`
`implicate BIPA. While IBM argues that Rivera and other cases were wrongly decided,
`
`10
`
`
`
`Case: 1:20-cv-00577 Document #: 48 Filed: 09/15/20 Page 11 of 13 PageID #:390
`
`IBM has not offered any persuasive arguments to convince us. Indeed, as the Rivera
`
`court warned, “Who knows how iris scans, retina scans, fingerprints, voiceprints, and
`
`scans of faces and hands will be taken in the future? It is not the how that is important
`
`to the Privacy Act; what's important is the potential intrusion on privacy posed by the
`
`unrestricted gathering of biometric information.” Id. Accordingly, IBM’s motion to
`
`dismiss Plaintiffs’ BIPA claims is denied.
`
`II. Unjust Enrichment
`
`
`
`IBM argues that Plaintiffs’ unjust enrichment claims should be dismissed
`
`because Plaintiffs do not allege they suffered a corresponding “economic expense” or
`
`that they had a reasonable expectation of payment.2 In other words, IBM’s first
`
`argument seems to be that Plaintiffs have not suffered damages. Plaintiffs argue that
`
`they are not required to allege that they suffered an “economic expense” under Illinois
`
`law or that they expected any payment. We agree with Plaintiffs.
`
`
`
`To plead a claim of unjust enrichment under Illinois law, “‘a plaintiff must allege
`
`that the defendant has unjustly retained a benefit to the plaintiff's detriment, and that
`
`defendant's retention of the benefit violates the fundamental principles of justice,
`
`equity, and good conscience.’” Cleary v. Philip Morris Inc., 656 F.3d 511, 516 (7th
`
`Cir. 2011) (quoting HPI Health Care Servs., Inc. v. Mt. Vernon Hosp., Inc., 131 Ill.2d
`
`145, 160 (1989)).
`
`
`2 IBM also argues that the unjust enrichment claims should be dismissed because they are based on the
`BIPA claims, and the underlying BIPA claims should be dismissed. As we are not dismissing the BIPA
`claims, we do not address this argument.
`
`11
`
`
`
`Case: 1:20-cv-00577 Document #: 48 Filed: 09/15/20 Page 12 of 13 PageID #:391
`
`
`
`Plaintiffs have adequately plead an unjust enrichment claim. Plaintiffs allege
`
`that IBM unlawfully acquired their biometric information and profited from the
`
`dissemination of their biometric information. Plaintiffs allege that such alleged acts by
`
`IBM violated Illinois public policy as expressed in BIPA. Moreover, Plaintiffs allege
`
`that it would violate the principles of equity and good conscience to allow IBM to retain
`
`and continue to profit from their biometric information. Plaintiffs allege that they
`
`suffered damages because they are exposed to a heightened risk of privacy harm and
`
`because they have been deprived of their control over their biometric data.
`
`
`
`The requirement that a plaintiff have a reasonable expectation of payment applies
`
`when an unjust enrichment claim is predicated on a third party receiving the benefit of
`
`a contract. Sunny Handicraft Ltd. v. Envision This!, LLC, 2015 WL 231108, *4 (N.D.
`
`Ill. 2015) (applying Illinois law). This is because Illinois law ordinarily prohibits third
`
`party quasi-contractual liability. Id.; see Goldstick v. ICM Realty, 788 F.2d 456, 468
`
`(7th Cir. 1986) (“if you do work pursuant to a contract with X, you don't expect that Y,
`
`a nonparty, will pay you if X defaults, merely because Y was benefited by your work”).
`
`However, Plaintiffs claims are based on underlying statutory violations, not contract
`
`law. Accordingly, IBM’s motion to dismiss Plaintiffs’ unjust enrichment claim is
`
`denied.
`
`III.
`
`Injunctive Relief
`
`
`
`IBM argues that Plaintiffs’ injunctive relief claim should be dismissed because
`
`injunctive relief is a remedy and not a cause of action. Plaintiffs did not respond to this
`
`12
`
`
`
`Case: 1:20-cv-00577 Document #: 48 Filed: 09/15/20 Page 13 of 13 PageID #:392
`
`argument, thus waiving any argument. United States v. Holm, 326 F.3d 872 (7th Cir.
`
`2003) (“It is not the obligation of this court to research and construct the legal arguments
`
`open to parties,” and “perfunctory and undeveloped arguments” are waived.)
`
`Nevertheless, the Court agrees that injunctive relief is not a cause of action. See, e.g.,
`
`Noah v. Enesco Corp., 911 F. Supp. 305, 307 (N.D. Ill. 1995) (“An injunction is a
`
`remedy, not a cause of action”); Independents Gas & Service Stations Associations, Inc.
`
`v. City of Chicago, 112 F. Supp. 3d 749, 758 (N.D. Ill. 2015) (same); Missouri Pet
`
`Breeders Assoc. v. County of Cook, 106 F. Supp. 3d 908, 927 (N.D. Ill 2015) (same).
`
`Accordingly, Count Seven is dismissed.
`
`CONCLUSION
`
`
`
`For the reasons mentioned above, the Court grants IBM’s motion to dismiss (Dkt.
`
`# 35) as to Count Seven. Additionally, the Court dismisses Count One for lack of
`
`subject matter jurisdiction. IBM’s motion is denied as to the remaining counts. Status
`
`is set for 10/13/2020 at 10:40 a.m. It is so ordered.
`
`
`
`
`Dated: 09/15/2020
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`________________________________
`Charles P. Kocoras
`United States District Judge
`
`13
`
`