Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 1 of 24
`
`UNITED STATES DISTRICT COURT
`WESTERN DISTRICT OF WASHINGTON
`AT SEATTLE
`
`
`STEVEN VANCE, et al.,
`
`CASE NO. C20-1082JLR
`
`
`
`Plaintiffs,
`
`v.
`
`
`
`MICROSOFT CORPORATION,
`
`
`
`Defendant.
`
`ORDER GRANTING IN PART
`AND DENYING IN PART
`MICROSOFT’S MOTION TO
`DISMISS
`
`I.
`
`INTRODUCTION
`
`Before the court is Defendant Microsoft Corporation’s (“Microsoft”) motion to
`
`
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`dismiss Plaintiffs Steven Vance and Tim Janecyk’s (collectively, “Plaintiffs”) complaint.
`
`18
`
`(MTD (Dkt. # 25); Reply (Dkt. # 34).) Plaintiffs oppose the motion. (Resp. (Dkt. # 37).)
`
`19
`
`Having considered the motion, the parties’ submissions regarding the motion, the
`
`20
`
`21
`
`22
`
`
`
`//
`
`//
`
`//
`
`ORDER - 1
`
`

`

`Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 2 of 24
`
`
`
`1
`
`relevant portions of the record, and the applicable law, 1 the court GRANTS in part and
`
`2
`
`DENIES in part the motion to dismiss.
`
`3
`
`4
`
`II.
`
`BACKGROUND
`
`Facial recognition technology uses computer artificial intelligence and machine
`
`5
`
`learning algorithms to “detect, recognize, verify and understand characteristics of humans
`
`6
`
`faces.”2 (Compl. (Dkt. # 1) ¶ 23 (quoting Michele Merler, et al., Diversity in Faces, IBM
`
`7
`
`Research AI at 1 (Apr. 10, 2019)) (“Diversity in Faces”).) However, “significant
`
`8
`
`technical hurdles” hinder the technology’s accuracy, and improving that accuracy relies
`
`9
`
`upon “the use of data-driven deep learning to train increasingly accurate models by using
`
`10
`
`growing amounts of data.” (Diversity in Faces at 1.) In other words, practice makes
`
`11
`
`perfect: for artificial intelligence to more accurately recognize different faces, “vast
`
`12
`
`quantities of images of a diverse array of faces” must be fed to the underlying
`
`13
`
`machine-learning algorithms. (Compl. ¶ 24.)
`
`14
`
`Microsoft is one of many companies that have developed and produced facial
`
`15
`
`recognition products. (Id. ¶¶ 3, 52-53.) Among these products are its Cognitive Services
`
`16
`
`Face Application Program Interface and its Face Artificial Intelligence service that allow
`
`17
`
`customers to embed facial recognition technology into their applications. (Id. ¶ 53.)
`
`18
`
`Microsoft conducts “extensive business within Illinois” related to facial recognition,
`
`19
`
`20
`
`21
`
`22
`
`
`
`
`1 Both parties request oral argument (MTD at 1; Resp. at 1), but the court finds oral
`argument unnecessary to its disposition of the motion, see Local Rules W.D. Wash. LCR 7(b)(4).
`
`2 For the purposes of a motion to dismiss, the court accepts all well-pleaded allegations in
`Plaintiffs’ complaint as true and draws all reasonable inferences in favor of Plaintiffs. See Wyler
`Summit P’ship v. Turner Broad. Sys., Inc., 135 F.3d 658, 661 (9th Cir. 1998).
`
`ORDER - 2
`
`

`

`Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 3 of 24
`
`
`
`1
`
`including selling its facial recognition products through an Illinois -based vendor; working
`
`2
`
`with an Illinois-based business to build new applications for facial recognition
`
`3
`
`technology; and working with Illinois entities to build a “digital transformation institute”
`
`4
`
`that accelerates the use of artificial intelligence throughout society. (Id. ¶ 59.)
`
`5
`
`Plaintiffs are Illinois residents who, starting in 2008, uploaded photos of
`
`6
`
`themselves to the photo-sharing website Flickr. (Id. ¶¶ 6-7, 28, 60-61, 69.) Both were in
`
`7
`
`Illinois when uploading the photos. (Id. ¶¶ 60, 69.) Unbeknownst to Plaintiffs, Flickr,
`
`8
`
`through its parent company Yahoo!, compiled hundreds of millions of photographs
`
`9
`
`posted on its platform, including those of Plaintiffs and other Illinois residents, into a
`
`10
`
`dataset (“Flickr dataset”) that it then made publicly available to “help improve the
`
`11
`
`accuracy and reliability of facial recognition technology.” (Id. ¶¶ 29-32.)
`
`12
`
`Utilizing the Flickr dataset, International Business Machines Corporation (“IBM”)
`
`13
`
`selected one million images to create a new dataset called Diversity in Faces in an effort
`
`14
`
`to reduce bias in facial recognition. (Id. ¶ 40.) IBM scanned the “facial geometry” of the
`
`15
`
`images and created a “comprehensive set of annotations of intrinsic facial features ,”
`
`16
`
`including craniofacial distances, areas and ratios, facial symmetry and contrast, skin
`
`17
`
`color, age and gender predictions, subjective annotations, and pose and resolution. ( Id.
`
`18
`
`¶ 41 (citing Diversity in Faces at 2).) Ultimately, IBM utilized “19 facial landmark
`
`19
`
`points” to determine “68 key points for each face” and to extract “craniofacial features”
`
`20
`
`for each image in the dataset. (Id. ¶¶ 42-43 (citing Diversity in Faces at 9).) Again, the
`
`21
`
`Diversity in Faces dataset included the facial scans of Plaintiffs and other Illinois
`
`22
`
`//
`
`
`
`ORDER - 3
`
`

`

`Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 4 of 24
`
`
`
`1
`
`residents, but like Flickr and Yahoo!, IBM did not seek or receive per mission from
`
`2
`
`individuals whose faces were analyzed. (Id. ¶¶ 44-45.)
`
`3
`
`IBM made the Diversity in Faces dataset available to other companies seeking to
`
`4
`
`improve their facial recognition technology. (Id. ¶ 47.) To obtain the dataset, companies
`
`5
`
`applied for permission via an online questionnaire, and if IBM granted access, IBM
`
`6
`
`would send a link for companies to download the dataset . (Id. ¶ 48.) Those with the
`
`7
`
`dataset, and the corresponding information, could “identify the Flickr user who uploaded
`
`8
`
`the photograph,” “view the Flickr user’s homepage,” and “view each photograph’s
`
`9
`
`metadata, including any available [information] relating to where the photograph was
`
`10
`
`taken or uploaded.” (Id. ¶ 51.) Microsoft applied for and downloaded the dataset from
`
`11
`
`IBM. (Id. ¶ 55.) Microsoft used the dataset to improve “the fairness and accuracy of its
`
`12
`
`facial recognition products,” which “improve[d] the effectiveness” of those products and
`
`13
`
`made them “more valuable in the commercial marketplace.” (Id. ¶¶ 57-58.) Once again,
`
`14
`
`the dataset downloaded by Microsoft contained Plaintiffs ’ information, but Microsoft did
`
`15
`
`not inform or obtain permission from Plaintiffs. (Id. ¶¶ 56, 65-66, 73-74.)
`
`16
`
`Plaintiffs bring a class action suit against Microsoft for violating Illinois’s
`
`17
`
`Biometric Information Privacy Act, 740 ILCS 14/1, et seq. (“BIPA”), which regulates the
`
`18
`
`collection, storage and use of biometric identifiers and biometric information
`
`19
`
`(collectively, “biometric data”). (Id. ¶¶ 4, 17.) Specifically, they allege violations of two
`
`20
`
`BIPA provisions: (1) Microsoft violated § 15(b) by collecting and obtaining biometric
`
`21
`
`data without providing the requisite information or obtaining written releases; and (2)
`
`22
`
`Microsoft violated § 15(c) by unlawfully profiting from individuals’ biometric data. (Id.
`
`
`
`ORDER - 4
`
`

`

`Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 5 of 24
`
`
`
`1
`
`¶¶ 93-106.) Plaintiffs additionally bring an unjust enrichment claim ( id. ¶¶ 107-16) and a
`
`2
`
`separate count for injunctive relief (id. ¶¶ 117-22).
`
`3
`
`4
`
`III. ANALYSIS
`
`When considering a motion to dismiss under Rule 12(b)(6), the court construes the
`
`5
`
`complaint in the light most favorable to the nonmoving party. Livid Holdings Ltd. v.
`
`6
`
`Salomon Smith Barney, Inc., 416 F.3d 940, 946 (9th Cir. 2005). The court must accept
`
`7
`
`all well-pleaded facts as true and draw all reasonable inferences in favor of the plaintiff.
`
`8
`
`Wyler Summit P’ship, 135 F.3d at 661. The court, however, is not required “to accept as
`
`9
`
`true allegations that are merely conclusory, unwarranted deductions of fact, or
`
`10
`
`unreasonable inferences.” Sprewell v. Golden State Warriors, 266 F.3d 979, 988 (9th
`
`11
`
`Cir. 2001). “To survive a motion to dismiss, a complaint must contain sufficient factual
`
`12
`
`matter, accepted as true, to ‘state a claim to relief that is plausible on i ts face.’” Ashcroft
`
`13
`
`v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544,
`
`14
`
`570 (2007)); see also Telesaurus VPC, LLC v. Power, 623 F.3d 998, 1003 (9th Cir.
`
`15
`
`2010). “A claim has facial plausibility when the plaintiff pleads f actual content that
`
`16
`
`allows the court to draw the reasonable inference that the defendant is liable for the
`
`17
`
`misconduct alleged.” Iqbal, 556 U.S. at 677-78. Dismissal under Rule 12(b)(6) can be
`
`18
`
`based on the lack of a cognizable legal theory or the absence of sufficient facts alleged
`
`19
`
`under a cognizable legal theory. Balistreri v. Pacifica Police Dep’t, 901 F.2d 696, 699
`
`20
`
`(9th Cir. 1990).
`
`21
`
`Microsoft moves to dismiss all of Plaintiffs’ claims in its instant motion. (See
`
`22
`
`MTD.) The court addresses the arguments pertaining to each claim in turn.
`
`
`
`ORDER - 5
`
`

`

`Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 6 of 24
`
`
`
`1
`
`A.
`
`BIPA Claims
`
`2
`
`In urging the court to dismiss Plaintiffs’ two BIPA claims, Microsoft first
`
`3
`
`challenges the applicability of BIPA. (MTD at 6-15.) It argues that BIPA does not have
`
`4
`
`extraterritorial effect here and that if it did, BIPA would violate the Dormant Commerce
`
`5
`
`Clause. (Id.) Even if BIPA applies, Microsoft contends that Plaintiffs fail to state a
`
`6
`
`claim. (Id. at 16-22.) The court addresses each argument in turn.
`
`7
`
`8
`
`1.
`
`Illinois Extraterritorial Doctrine
`
`Microsoft first argues that BIPA was not intended to have exterritorial effect and
`
`9
`
`thus could not apply here because Plaintiffs have not established that the claim occurred
`
`10
`
`in Illinois. (Id. at 6-9.) The court, like many others that have considered this argument,
`
`11
`
`determines that at this early stage, it cannot dismiss the BIPA claims on this basis.
`
`12
`
`The parties agree that an Illinois statute does not have an “extraterritorial effect
`
`13
`
`unless a clear intent in this respect appears from the express provisions of the statute.”
`
`14
`
`Avery v. State Farm Mutual Auto. Ins. Co., 835 N.E.2d 801, 852 (Ill. 2005); (MTD at 6;
`
`15
`
`see Resp. at 4-5.) They further agree that BIPA does not have such an express provision
`
`16
`
`and thus is not authorized to have extraterritorial effect. (MTD at 6; see Resp. at 4-5);
`
`17
`
`see Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1100 (N.D. Ill. 2017). Noneth eless,
`
`18
`
`Plaintiffs may assert BIPA claims if they sufficiently allege that Microsoft’s purported
`
`19
`
`violations “occur[red] primarily and substantially in Illinois.” See Avery, 835 N.E.2d at
`
`20
`
`853. The parties disagree on whether Plaintiffs have done so.
`
`21
`
`There is “no single formula or bright-line test for determining whether a
`
`22
`
`transaction occurs within [Illinois].” Id. at 854. Instead, “each case must be decided on
`
`
`
`ORDER - 6
`
`

`

`Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 7 of 24
`
`
`
`1
`
`its own facts.” Id. Courts consider a myriad of factors, including the plaintiff’s
`
`2
`
`residency, the location of harm, where communications between parties occurred, and
`
`3
`
`where a company is carrying out the aggrieved policy. Id. For transactions occurring on
`
`4
`
`the Internet, courts may need to consider Internet-specific factors, such as where the site
`
`5
`
`or information was accessed, or where the corporation operates the online practice. See
`
`6
`
`Rivera, 238 F. Supp. 3d at 1101. As illustrated by these factors, whether events occurred
`
`7
`
`primarily and substantially in Illinois is a “highly fact -based analysis that is generally
`
`8
`
`inappropriate for the motion to dismiss stage.” Vance v. IBM Corp., No. 20 C 577, 2020
`
`9
`
`WL 5530134, at *3 (N.D. Ill. Sept. 15, 2020) (“IBM”).
`
`10
`
`Accordingly, the majority of courts in BIPA cases to consider the issue at this
`
`11
`
`stage have denied the motion to dismiss, opting instead to allow discovery for more
`
`12
`
`information regarding the extent to which the alleged misconduct occurred in Illinois.
`
`13
`
`See, e.g., Monroy v. Shutterfly, Inc., No. 16 C 10984, 2017 WL 4099846, at *6 (N.D. Ill.
`
`14
`
`Sept. 15, 2017); cf. In re Facebook Biometric Info. Privacy Litig., 326 F.R.D. 535,
`
`15
`
`547-48 (N.D. Cal. 2018) (analyzing issue in class certification context). In Rivera, the
`
`16
`
`plaintiffs alleged that they were Illinois resid ents; that their photographs were taken and
`
`17
`
`uploaded in Illinois; and that the defendant failed to provide the required disclosures in
`
`18
`
`Illinois, but they did not allege where the defendant accessed their photographs or facial
`
`19
`
`scans. 238 F. Supp. 3d at 1101-02. Nonetheless, the court concluded that the allegations
`
`20
`
`“tip[ped] toward a holding that the alleged violations primarily happened in Illinois.” Id.
`
`21
`
`However, the court recognized the need for discovery, highlighting the need for more
`
`22
`
`information regarding where the injury and the lack of consent took place. Id. at 1102.
`
`
`
`ORDER - 7
`
`

`

`Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 8 of 24
`
`
`
`1
`
`The court holds the same based on Plaintiffs’ allegations. Plaintiffs, and all
`
`2
`
`purported class members, are Illinois residents who, while in Illinois, uploaded photos
`
`3
`
`that were taken in Illinois. (Compl. ¶¶ 6-7, 60-61, 69.) The required disclosures or
`
`4
`
`permissions would have been obtained from Illinois, and so any communication would
`
`5
`
`have necessarily involved Illinois. (See id. ¶¶ 65-66, 73-74.) The alleged harm to
`
`6
`
`privacy interests is ongoing for Illinois residents. (Id. ¶¶ 67, 75, 77.) Moreover,
`
`7
`
`Plaintiffs allege that Microsoft conducts “extensive business” in Illinois involving their
`
`8
`
`facial recognition products (id. ¶ 59), and that the Diversity in Faces dataset “improve [d]
`
`9
`
`its facial recognition products” (id. ¶ 58), thereby allowing the reasonable inference that
`
`10
`
`Microsoft utilized the dataset in Illinois during its business dealings.
`
`11
`
`While Microsoft is correct that Plaintiffs do not allege where Microsoft obtained
`
`12
`
`the dataset (see MTD at 7), that fact alone may not be dispositive. See Rivera, 238 F.
`
`13
`
`Supp. 3d at 1102 (citing Avery, 835 N.E.2d at 853). It is certainly possible that with more
`
`14
`
`factual refinement around this complex issue, the circumstances around Microsoft’s
`
`15
`
`attainment, possession and use of the Diversity in Faces dataset will reveal that the
`
`16
`
`alleged violations did not occur primarily in Illinois. See IBM, 2020 WL 5530134, at *3.
`
`17
`
`But more information is needed to reach any determination, and so, the court agrees with
`
`18
`
`Rivera that “[f]or now, it is enough to say that the allegations survive the accusation that
`
`19
`
`the law is being applied outside of Illinois.” See 238 F. Supp. 3d at 1102.
`
`20
`
`Microsoft attempts to distinguish those previous cases by arguing that they involve
`
`21
`
`plaintiffs who “uploaded a photo directly to the defendant’s systems ,” whereas Plaintiffs
`
`22
`
`did not upload anything directly to Microsoft’s systems. (MTD at 8 (bolding and italics
`
`
`
`ORDER - 8
`
`

`

`Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 9 of 24
`
`
`
`1
`
`removed).) This argument is unavailing for two reasons. First, Microsoft’s distinction
`
`2
`
`does not hold true for all cases. In IBM—a suit brought by Plaintiffs against IBM for its
`
`3
`
`part in this chain—the court found dismissal premature even though Plaintiffs did not
`
`4
`
`upload anything directly to IBM’s systems. See 2020 WL 5530134, at *3; see also
`
`5
`
`Monroy, 2017 WL 4099846, at *1-2, 6 (identifying plaintiff as non-Illinois resident who
`
`6
`
`“does not use Shutterfly”). The fact that Plaintiffs did not access any IBM products had
`
`7
`
`no impact on how “discovery is needed in order to determine to what extent IBM’s
`
`8
`
`alleged acts occurred in Illinois.” IBM, 2020 WL 5530134, at *3. Second, direct upload
`
`9
`
`is not the only way to establish that an alleged violation occurred in Illinois, and
`
`10
`
`Microsoft points to no authority saying so. (See MTD.) Thus, while Microsoft is correct
`
`11
`
`that Plaintiffs’ connection with Microsoft—and in turn, the connection between the
`
`12
`
`alleged misconduct and Illinois—is not through direct use of its products, that does not
`
`13
`
`defeat the need for more information that may bear on this fact -laden analysis.
`
`14
`
`The authority Microsoft relies upon are easily distinguishable. In Neals v. PAR
`
`15
`
`Tech. Corp., 419 F. Supp. 3d 1088 (N.D. Ill. 2019), the plaintiff did not allege that her
`
`16
`
`biometric information was collected in Illinois, and thus, the court could not reason ably
`
`17
`
`infer any connection with Illinois.3 Id. at 1091. Plaintiffs here have explicitly pleaded
`
`18
`
`their connection with Illinois. (Compl. ¶¶ 6-7, 60-61, 69.) Similarly, in Tarzian v. Kraft
`
`19
`
`//
`
`20
`
`21
`
`22
`
`
`
`
`3 Like Microsoft, the defendant in Neals was a non-resident corporation with no
`allegations that it had property or stored data in Illinois. 419 F. Supp. 3d at 1091. The court
`made clear that the defendant’s “physical location and property holdings, the location of its
`servers, and the identity of its customers [who used its technology to collect biometric
`information] are not determinative of [BIPA’s] application.” Id.
`
`ORDER - 9
`
`

`

`Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 10 of 24
`
`
`
`1
`
`Heinz Foods Co., No. 18 C 7148, 2019 WL 5064732 (N.D. Ill. Oct. 9, 2019), the court
`
`2
`
`dismissed consumer fraud claims brought by non -resident plaintiffs when the only
`
`3
`
`connection to Illinois was that the deception scheme allegedly originated there. Id. at *3.
`
`4
`
`Notably, the same claims brought by resident plaintiffs sur vived. See id. Plaintiffs here
`
`5
`
`have pleaded many more allegations than the non-residents in Tarzian, including their
`
`6
`
`own residency and Illinois as the place of harm. (Compl. ¶¶ 60-62, 68-70, 77.)
`
`7
`
`In sum, more discovery is needed to explore whether and t o what extent
`
`8
`
`Microsoft’s alleged acts involving the Diversity in Faces dataset occurred in Illinois. For
`
`9
`
`now, Plaintiffs’ allegations are sufficient to withstand dismissal.
`
`10
`
`11
`
`2. Dormant Commerce Clause
`
`Building on its extraterritoriality argument, Microsoft next argues that applying
`
`12
`
`BIPA as Plaintiffs allege here would violate the Dormant Commerce Clause. (MTD at
`
`13
`
`9-15.) Specifically, because Microsoft maintains that it has not “engaged in any relevant
`
`14
`
`conduct in Illinois,” it contends that Plaintiffs’ BIPA claims would allow Illinois law to
`
`15
`
`control transactions outside its boundaries. (Id. at 10 (bolding and italics removed).)
`
`16
`
`The Commerce Clause has “long been understood to have a ‘negative’ aspect that
`
`17
`
`denies the States the power unjustifiably to discriminate against or burden the interstate
`
`18
`
`flow of articles of commerce,” known as the Dormant Commerce Clause. Or. Waste
`
`19
`
`Sys., Inc. v. Dep’t of Env’t Quality of State of Or., 511 U.S. 93, 98 (1994); Daniels
`
`20
`
`Sharpsmart, Inc. v. Smith, 889 F.3d 608, 614 (9th Cir. 2018). A state statute runs afoul of
`
`21
`
`the Dormant Commerce Clause if it “directly regulate[s]” interstate commerce by
`
`22
`
`“affect[ing] transactions that take place across state lines or entirel y outside the state’s
`
`
`
`ORDER - 10
`
`

`

`Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 11 of 24
`
`
`
`1
`
`borders.” Daniels Sharpsmart, 889 F.3d at 614. Thus, the Dormant Commerce Clause
`
`2
`
`prohibits “the application of a state statute to commerce that takes place wholly outside of
`
`3
`
`the State’s borders, whether or not the commerce has effects within the State.” Healy v.
`
`4
`
`Beer Inst., 491 U.S. 324, 336 (1989).
`
`5
`
`As many courts have observed, the Dormant Commerce Clause argument is
`
`6
`
`directly related to the extraterritoriality effect argument, as both hinge on where the
`
`7
`
`alleged misconduct takes place. See In re Facebook, 2018 WL 2197546, at *4. Thus,
`
`8
`
`unsurprisingly, most courts in this context have found that the Dormant Commerce
`
`9
`
`Clause argument is “more properly addressed on a motion for summary judgment.” See,
`
`10
`
`e.g., IBM, 2020 WL 5530134, at *4. In IBM, the court concluded that it “need[s] more
`
`11
`
`detailed facts regarding IBM’s processes to know the extent to which IBM’s actions
`
`12
`
`occurred in Illinois and whether the Dormant Commerce Clause bars this suit.” Id.; see
`
`13
`
`also Rivera, 238 F. Supp. 3d at 1104 (“Whether the [BIPA] is nevertheless being
`
`14
`
`summoned here to control commercial conduct wholly outside Illinois is not possible to
`
`15
`
`figure out without a better factual understanding of what is happening in the Google
`
`16
`
`Photos face-scan process.”); Monroy, 2017 WL 4099846, at *8 (stating that “important
`
`17
`
`information is lacking regarding how Shutterfly’s technology works”).
`
`18
`
`Again, the court agrees with those that have previously considered the issue . At
`
`19
`
`this point, the court needs more information about the technology behind how Microsoft
`
`20
`
`obtained, stores, or uses the Diversity in Faces dataset to conclude that applying BIPA
`
`21
`
`would run afoul of the Dormant Commerce Clause. Nor does the court have an adequate
`
`22
`
`basis for determining whether applying BIPA here would, as Microsoft argues, displ ace
`
`
`
`ORDER - 11
`
`

`

`Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 12 of 24
`
`
`
`1
`
`the policies of other states. (See MTD at 12-15.) As discussed above, the fact that
`
`2
`
`Plaintiffs did not directly interact with Microsoft’s systems does not affect the need for
`
`3
`
`more detailed facts about Microsoft’s processes. See IBM, 2020 WL 5530134 at *3-4.
`
`4
`
`Accordingly, the court denies Microsoft’s motion to dismiss on applicability grounds.
`
`5
`
`6
`
`3. Failure to State a Claim
`
`Finally, Microsoft contends that Plaintiffs fail to state a claim for three reasons.
`
`7
`
`(MTD at 16-22.) Microsoft first maintains that BIPA does not apply to photographs, and
`
`8
`
`thus, Plaintiffs cannot bring a claim under either §§ 15(b) or 15(c) for facial scans derived
`
`9
`
`from their photographs. (Id. at 16-19.) Alternatively, Microsoft argues that § 15(b) only
`
`10
`
`applies to “entities who actively ‘collect’” biometric data and that § 15(c) only applies to
`
`11
`
`“the direct provision of biometric data in exchange for money” —neither of which are
`
`12
`
`alleged here. (Id. at 19-22.) The court disagrees and reviews each contention in turn.
`
`13
`
`a.
`
`BIPA’s Applicability to Photographs
`
`14
`
`
`
`BIPA prohibits private entities from gathering or using “biometric identifier[s]” or
`
`15
`
`“biometric information” without notice and consent. 740 ILCS 14/15. A “[b]iometric
`
`16
`
`identifier” is “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face
`
`17
`
`geometry.” 740 ILCS 14/10. Biometric identifiers “do not include writing samples,
`
`18
`
`written signatures, photographs, human biological samples used for valid scientific
`
`19
`
`testing or screening, demographic data, tattoo descriptions, or physical descriptions such
`
`20
`
`as height, weight, hair color, or eye color.” Id. “Biometric information” means “any
`
`21
`
`information . . . based on an individual’s biometric identifier used to identify an
`
`22
`
`individual” but “does not include information derived from items . . . excluded under the
`
`
`
`ORDER - 12
`
`

`

`Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 13 of 24
`
`
`
`1
`
`definition of biometric identifiers.” Id. Microsoft reasons that because photographs are
`
`2
`
`not “biometric identifiers,” and “biometric information” does not include information
`
`3
`
`derived from photographs, Plaintiffs’ facial scans created from their photographs do not
`
`4
`
`qualify as either biometric identifiers or biometric information. (MTD at 16.) The court
`
`5
`
`disagrees and holds that the facial scans are “biometric identifiers” under BIPA.
`
`6
`
`
`
`This is not the first—or second, or third, or even fourth—time that defendants
`
`7
`
`have challenged BIPA’s applicability to facial scans derived from photographs. Every
`
`8
`
`court has rejected Microsoft’s argument.4 See, e.g., Monroy, 2017 WL 4099846, at *3
`
`9
`
`(calling defendant’s reading “sensible enough at first blush ” but concluding “it begins to
`
`10
`
`unravel under scrutiny”). The reason lies in the statute’s plain language, where the
`
`11
`
`statutory interpretation analysis must begin. See Lacey v. Village of Palatine, 904 N.E.2d
`
`12
`
`18, 25 (Ill. 2009). The court gives the language its plain and ordinary meaning. Hadley
`
`13
`
`v. Ill. Dep’t of Corrections, 864 N.E.2d 162, 165 (Ill. 2007). When the language is clear,
`
`14
`
`it will be given effect without resort to other aids of construction. Id. The court may not
`
`15
`
`“under the guise of construction, supply omissions, remedy defects, annex new
`
`16
`
`provisions, substitute different provisions, and exceptions, limitations or conditions, or
`
`17
`
`otherwise change law so as to depart from the language employed in the statute.” DeWig
`
`18
`
`v. Landshire, Inc., 666 N.E.2d 1204, 1207 (Ill. App. Ct. 1996).
`
`19
`
`20
`
`21
`
`22
`
`
`
`
`4 Recognizing the weight of authority against it, Microsoft maintains that all those cases
`were wrongly decided. (MTD at 17-18.) For instance, Microsoft states that Rivera did not
`“properly account for BIPA Section 5,” which lists only in-person transactions as examples that
`are regulated. (Id. at 18.) Not so. See Rivera, 238 F.3d at 1098 (analyzing Section 5 and its list
`of example transactions). Microsoft has not offered persuasive arguments that Rivera and other
`cases were wrongly decided.
`
`ORDER - 13
`
`

`

`Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 14 of 24
`
`
`
`
`
`1
`
`Here, the “comprehensive set of annotations of intrinsic facial features” (Compl.
`
`2
`
`¶ 41) is one of the biometric identifiers listed in BIPA’s plain text: a “scan of . . . face
`
`3
`
`geometry,” 740 ILCS 14/10; see, e.g., Rivera, 238 F. Supp. 3d at 1095 (“[E]ach face
`
`4
`
`template . . . [features] a set of biology-based measurements (‘biometric’) that is used to
`
`5
`
`identify a person (‘identifier’).”). Plaintiffs “do not claim that simply possessing a
`
`6
`
`photograph of a face violates BIPA,” and thus the exclusion of photographs as biometric
`
`7
`
`identifiers has little bearing. (See Resp. at 15 n.4.) And while these facial scans may not
`
`8
`
`qualify as biometric information—because they are “derived from items . . . excluded
`
`9
`
`under the definition of biometric identifiers,” namely, photographs—there is no textual
`
`10
`
`support for the contention that these scans could not be biometric identifiers themselves.
`
`11
`
`See 740 ILCS 14/10; In re Facebook, 185 F. Supp. 3d at 1171 (finding “digital
`
`12
`
`representation of the face . . . based on geometric relationship of their facial features” to
`
`13
`
`be a “scan of face geometry”).
`
`14
`
`
`
`At base, Microsoft takes issue with how these scans are captured. It argues that
`
`15
`
`only scans taken in-person, not from photographs, are biometric identifiers. (See MTD at
`
`16
`
`18.) Put another way, Microsoft wishes to apply the same limitation that is placed on
`
`17
`
`biometric information to biometric identifiers. See 740 ILCS 14/10. But the Illinois
`
`18
`
`legislature chose not to use terms such as “derived from” when defining biometric
`
`19
`
`identifier. See Rivera, 238 F. Supp. 3d at 1097 (“It would have been simple enough for
`
`20
`
`the Illinois legislature to include similar ‘based on’ or ‘derived from’ language in the
`
`21
`
`definition of ‘biometric identifier’ but it did not.” ); see also Dana Tank Container, Inc. v.
`
`22
`
`Hum. Rts. Comm’n, 687 N.E.2d 102, 104 (Ill. App. Ct. 1997) (“Where the legislature
`
`
`
`ORDER - 14
`
`

`

`Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 15 of 24
`
`
`
`1
`
`uses certain words in one instance and different words in another, it intended different
`
`2
`
`results.”). “The bottom line is that a ‘biometric identifier’ is not the underlying medium
`
`3
`
`itself, or a way of taking measurements, but instead is a set of measurement s of a
`
`4
`
`specified physical component . . . used to identify a person.” Rivera, 238 F. Supp. 3d at
`
`5
`
`1097. The facial scans here fall squarely within that definition.5 Accordingly, the court
`
`6
`
`denies Microsoft’s motion to dismiss the BIPA claims on this ground.
`
`7
`
`8
`
`b.
`
`Obtaining Biometric Data Under § 15(b)
`
`Microsoft argues next that § 15(b) of BIPA is only triggered by those who
`
`9
`
`“actively ‘collect’” biometric data, whereas it “merely ‘possess[es]’” the data. (MTD at
`
`10
`
`19-21.) Plaintiffs respond that the complaint contains sufficient allegations to establish
`
`11
`
`how Microsoft obtained and used their biometric data, contending that Microsoft “could
`
`12
`
`not have used the [data] unless it first collected or obtained it.” (Resp. at 18.) The court
`
`13
`
`agrees with Plaintiffs.
`
`14
`
`Again, the analysis begins, and ends, with BIPA’s plain language. The protections
`
`15
`
`under § 15(b) are triggered whenever a private entity “collect[s], capture[s], purchase[s],
`
`16
`
`receive[s] through trade, or otherwise obtain[s]” biometric data. 740 ILCS 14/15(b). The
`
`17
`
`catch-all phrase “otherwise obtain” is not defined by BIPA. See 740 ILCS 14/10. Where
`
`18
`
`a term is undefined, “[i]t is entirely appropriate to employ the dictionary as a resource to
`
`19
`
`ascertain [its] meaning.” Lacey, 904 N.E.2d at 26. “Obtain” is defined as “[t]o come into
`
`20
`
`21
`
`22
`
`
`
`
`5 Because the text is “plain and unambiguous,” the court need not consider Microsoft’s
`legislative history arguments. See Ultsch v. Ill. Mun. Ret. Fund, 874 N.E.2d 1, 10 (Ill. 2007).
`Even if the court considered them, it finds persuasive the Rivera court’s analysis and ultimate
`rejection of similar arguments. See 238 F. Supp. 3d at 1098-100.
`
`ORDER - 15
`
`

`

`Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 16 of 24
`
`
`
`1
`
`the possession of,” or “to get, acquire, or secure.” Obtain, Oxford English Dictionary,
`
`2
`
`https://www.oed.com/view/Entry/130002 (last visited Mar. 9, 2021). “Otherwise” means
`
`3
`
`“[i]n a different manner; in another way, or in other ways.” Black’s Law Dictionary
`
`4
`
`1101 (6th ed. 1990); see also Otherwise, Oxford English Dictionary,
`
`5
`
`https://www.oed.com/view/Entry/133247 (last visited Mar. 9, 2021). Accordingly, in
`
`6
`
`context, § 15(b) is triggered whenever a private entity acquires biometric data in the
`
`7
`
`enumerated ways—collecting, capturing, purchasing, receiving through trade —or gets
`
`8
`
`the biometric data in some other way.
`
`9
`
`Plaintiffs have sufficiently alleged that Microsoft got its biometric data in some
`
`10
`
`other way—namely by applying for and downloading the data set from IBM. ( See
`
`11
`
`Compl. ¶¶ 55-57.) Moreover, Plaintiffs allege that Microsoft used the biometric data to
`
`12
`
`“improve its facial recognition products and technologies.” ( Id. ¶¶ 57-58.) Contrary to
`
`13
`
`Microsoft’s contentions, these allegations establish more than “passive ‘possession .’”
`
`14
`
`(See MTD at 20.) Indeed, Microsoft does not explain how it could have come into
`
`15
`
`possession of or used Plaintiffs’ facial scans without having first obtained it. See
`
`16
`
`Figueroa v. Kronos Inc., 454 F. Supp. 3d 772, 784 (N.D. Ill. 2020) (“[T]o have [stored or
`
`17
`
`used] the data, [the defendant] necessarily first had to ‘obtain’ the data.”). Thus, it makes
`
`18
`
`no difference that § 15(b) does not contain the word “possession” whereas the other
`
`19
`
`provisions do, because even accepting Microsoft’s argument that “only actions trigger
`
`20
`
`[§] 15(b),” Plaintiffs have sufficiently alleged such actions.6 (See MTD at 20.)
`
`21
`
`22
`
`
`
`
`6 Obtaining biometric data via a download could also qualify as “collecting” that data.
`See Collect, Oxford English Dictionary, https://www.oed.com/view/Entry/36263 (last visited
`
`ORDER - 16
`
`

`

`Case 2:20-cv-01082-JLR Document 43 Filed 03/15/21 Page 17 of 24
`
`
`
`1
`
`Nor will the court adopt Microsoft’s proposal that § 15(b) only applies when an
`
`2
`
`entity acquires biometric data “directly from any individual.” (See MTD at 20.) Nothing
`
`3
`
`in the statute’s langu