throbber
Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 1 of 30
`
`THE HONORABLE JOHN H. CHUN
`
`UNITED STATES DISTRICT COURT
`WESTERN DISTRICT OF WASHINGTON
`AT SEATTLE
`
`No. 2:22-cv-00269-JHC
`
`AMAZON WEB SERVICES, INC.’S
`RULE 12(b)(6) MOTION TO
`DISMISS AND RULE 12(f) MOTION
`TO STRIKE CLASS ALLEGATIONS
`
`NOTE ON MOTION CALENDAR:
`June 10, 2022
`
`ORAL ARGUMENT REQUESTED
`
`JACINDA DORIAN, individually, and
`on behalf of all others similarly situated,
`Plaintiff,
`
`v.
`AMAZON WEB SERVICES, INC.,
`Defendant.
`
`MOTION TO DISMISS AND
`MOTION TO STRIKE CLASS ALLEGATIONS
`(No. 2:22-cv-00269-JHC)
`
`Perkins Coie LLP
`1201 Third Avenue, Suite 4900
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`
`
`
`
`
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`

`

`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 2 of 30
`
`
`
`TABLE OF CONTENTS
`
`Page
`INTRODUCTION .......................................................................................................................... 1 
`BACKGROUND ............................................................................................................................ 3 
`A. 
`The Illinois Biometric Information Privacy Act (“BIPA”) ..................................... 3 
`B. 
`Amazon Web Services (“AWS”), Rekognition, and ProctorU ............................... 4 
`C. 
`Plaintiff’s Claims Against AWS ............................................................................. 5 
`MOTION TO DISMISS UNDER RULE 12(b)(6) ......................................................................... 6 
`A. 
`AWS Did Not “Possess” or “Collect” Plaintiff’s Data ........................................... 6 
`Plaintiff alleges no facts showing that AWS “possessed”
`1. 
`her data. ....................................................................................................... 7 
`Plaintiff alleges no facts showing that AWS “collected” her
`data. ........................................................................................................... 11 
`Plaintiff’s Claims Should Be Dismissed Under the Illinois
`Extraterritoriality Doctrine and the U.S. Constitution’s Dormant
`Commerce Clause ................................................................................................. 15 
`1. 
`Plaintiff’s claims violate the extraterritoriality doctrine. .......................... 15 
`2. 
`Adopting Plaintiff’s sweeping interpretation of BIPA
`would violate the U.S. Constitution’s Dormant Commerce
`Clause. ....................................................................................................... 18 
`BIPA’s Financial Institutions Exemption Bars Plaintiff’s Claims ....................... 18 
`BIPA may not be applied to “financial institutions,” which
`1. 
`includes colleges and universities that administer financial
`aid. ............................................................................................................. 19 
`Allowing Plaintiff’s claims to proceed would
`impermissibly apply BIPA’s requirements to the Colleges,
`which are financial institutions. ................................................................ 19 
`Plaintiff Cannot Be “Aggrieved” by AWS’s Alleged Violation of
`Section 15(a) ......................................................................................................... 21 
`MOTION TO STRIKE CLASS ALLEGATIONS UNDER RULE 12(f) .................................... 22 
`CONCLUSION ............................................................................................................................. 24 
`
`2. 
`
`2. 
`
`B. 
`
`C. 
`
`D. 
`
`MOTION TO DISMISS AND
`MOTION TO STRIKE CLASS ALLEGATIONS
`(No. 2:22-cv-00269-JHC) – i
`
`
`
`Perkins Coie LLP
`1201 Third Avenue, Suite 4900
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`

`

`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 3 of 30
`
`TABLE OF AUTHORITIES
`
`Page(s)
`
`
`
`
`CASES
`
`Abdelfattah v. Carrington Mortg. Servs. LLC,
`No. C-12-04656-RMW, 2013 WL 5718463 (N.D. Cal. Oct. 21, 2013) ..................................22
`
`Am. Sur. Co. v. Jones,
`51 N.E.2d 122 (Ill. 1943) .........................................................................................................21
`
`Amchem Prod., Inc. v. Windsor,
`521 U.S. 591 (1997) .................................................................................................................24
`
`Ashcroft v. Iqbal,
`556 U.S. 662 (2009) ...................................................................................................................6
`
`Avery v. State Farm Mut. Auto. Ins. Co.,
`216 Ill. 2d 100 (2005) ..........................................................................................................2, 15
`
`Balistreri v. Pacifica Police Dep’t,
`901 F.2d 696 (9th Cir. 1988) .....................................................................................................6
`
`Bernal v. ADP, LLC,
`No. 2017-CH-12364, 2019 WL 5028609 (Ill. Cir. Ct. Aug. 23, 2019) ...................................13
`
`Bryant v. Compass Grp. USA, Inc.,
`503 F. Supp. 3d 597 (N.D. Ill. 2020) .......................................................................................19
`
`Bryant v. Compass Grp. USA, Inc.,
`958 F.3d 617 (7th Cir. 2020) ...................................................................................................22
`
`Cashatt v. Ford Motor Co.,
`No. 3:19-CV-05886-RBL, 2020 WL 1987077 (W.D. Wash. Apr. 27, 2020) .........................24
`
`Chestnut Corp. v. Pestine, Brinati, Gamer, Ltd.,
`667 N.E.2d 543 (Ill. App. Ct. 1996) ........................................................................................21
`
`Doe v. Northwestern Univ.,
`No. 21 C 1579, 2022 WL 1485905 (N.D. Ill. Feb. 22, 2022) ............................................19, 20
`
`Duerr v. Bradley Univ.,
`No. 1:21-CV-01096-SLD-JEH, 2022 WL 1487747 (C.D. Ill. Mar. 10, 2022) ..................19, 20
`
`Figueroa v. Kronos Inc.,
`454 F. Supp. 3d 772 (N.D. Ill. 2020) .......................................................................................13
`
`MOTION TO DISMISS AND
`MOTION TO STRIKE CLASS ALLEGATIONS
`(No. 2:22-cv-00269-JHC) – ii
`
`
`
`Perkins Coie LLP
`1201 Third Avenue, Suite 4900
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`

`

`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 4 of 30
`
`
`
`Healy v. Beer Inst., Inc.,
`491 U.S. 324 (1989) .................................................................................................................18
`
`Heard v. Becton, Dickinson & Co.,
`524 F. Supp. 3d 831 (N.D. Ill. 2021) .........................................................................................9
`
`Heard v. Becton, Dickinson & Company,
`440 F. Supp. 3d 960 (N.D. Ill. 2020) ...................................................................................9, 12
`
`In re Coinstar Inc. S’holder Derivative Litig.,
`No. C11-133 MJP, 2011 WL 5553778 (W.D. Wash. Nov. 14, 2011) .....................................16
`
`In re Facebook Biometric Info. Priv. Litig.,
`326 F.R.D. 535 (N.D. Cal. 2018) .............................................................................................21
`
`Jacobs v. Hanwha Techwin America, Inc.,
`No. 21 C 866, 2021 WL 3172967 (N.D. Ill. July 27, 2021) ..........................................9, 12, 13
`
`Knievel v. ESPN,
`393 F.3d 1068 (9th Cir. 2005) ...................................................................................................7
`
`Lapekas v. Kaiser Found. Health Plan, Inc.,
`No. 10-CV-5984-VBF-FMOx, 2011 WL 13217477 (C.D. Cal. May 25, 2011) .....................24
`
`Linehan v. AllianceOne Receivables Mgmt., Inc.,
`No. C15-1012-JCC, 2016 WL 9526500 (W.D. Wash. Nov. 22, 2016) ...................................22
`
`Loomis v. Slendertone Distrib., Inc.,
`420 F. Supp. 3d 1046 (S.D. Cal. 2019) ......................................................................................7
`
`McGoveran v. Amazon Web Servs., Inc.,
`No. 20-cv-1399-LPS, 2021 WL 4502089 (D. Del. Sept. 30, 2021) ......................15, 16, 17, 18
`
`Miller v. Dollar Tree Stores, Inc.,
`No. CV-06-019-RHW, 2006 WL 8438078 (E.D. Wash. Oct. 13, 2006) .................................23
`
`Namuwonge v. Kronos, Inc.,
`418 F. Supp. 3d 279 (N.D. Ill. 2019) .................................................................................12, 13
`
`Parsons v. Ryan,
`754 F.3d 657 (9th Cir. 2014) ...................................................................................................22
`
`People v. Ward,
`830 N.E.2d 556 (Ill. 2005) .....................................................................................................7, 8
`
`Poshville, Inc. v. Pawnee Leasing,
`No. 2:21-CV-01465-SVW-AGR, 2021 WL 4776708 (C.D. Cal. July 15, 2021) ....................24
`MOTION TO DISMISS AND
`Perkins Coie LLP
`MOTION TO STRIKE CLASS ALLEGATIONS
`1201 Third Avenue, Suite 4900
`(No. 2:22-cv-00269-JHC) – iii
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`
`
`
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`

`

`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 5 of 30
`
`
`
`Rosenbach v. Six Flags Ent. Corp.,
`129 N.E.3d 1197 (Ill. 2019) .................................................................................................7, 21
`
`Sam Francis Foundation v. Christies, Inc.,
`784 F.3d 1320 (9th Cir. 2015) .................................................................................................18
`
`Solon v. Midwest Med. Recs. Ass’n, Inc.,
`236 Ill. 2d 433 (2010) ..........................................................................................................9, 13
`
`Stevenson v. FedEx Ground Package Sys., Inc.,
`69 F. Supp. 3d 792 (N.D. Ill. 2014) .........................................................................................21
`
`Thakkar v. ProctorU, Inc.,
`No. 21-CV-2051, 2021 WL 5507041 (C.D. Ill. Nov. 23, 2021) ................................................1
`
`United States v. Cotterman,
`709 F.3d 952 (9th Cir. 2013) .....................................................................................................4
`
`United States v. Kuchinski,
`469 F.3d 853 (9th Cir. 2006) .................................................................................................7, 8
`
`Wal-Mart Stores, Inc. v. Dukes,
`564 U.S. 338 (2011) .................................................................................................................23
`
`Williams v. Nat’l Football League,
`No. C14-1089 MJP, 2014 WL 5514378 (W.D. Wash. Oct. 31, 2014) ......................................6
`
`Zellmer v. Facebook, Inc.,
`No. 3:18-cv-01880-JD, 2022 WL 976981 (N.D. Cal. Mar. 31, 2022) ..............................14, 15
`
`STATUTES
`
`740 ILCS 14/5(a) .............................................................................................................................3
`
`740 ILCS 14/5(d) .............................................................................................................................3
`
`740 ILCS 14/10 ..........................................................................................................................3, 23
`
`740 ILCS 14/15(a) ................................................................................................................. passim
`
`740 ILCS 14/15(b) ................................................................................................................. passim
`
`740 ILCS 14/20 ..............................................................................................................................21
`
`740 ILCS 14/20(1) ...........................................................................................................................4
`
`740 ILCS 14/20(2) ...........................................................................................................................4
`
`MOTION TO DISMISS AND
`MOTION TO STRIKE CLASS ALLEGATIONS
`(No. 2:22-cv-00269-JHC) – iv
`
`
`
`
`
`Perkins Coie LLP
`1201 Third Avenue, Suite 4900
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`

`

`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 6 of 30
`
`
`
`740 ILCS 14/20(3) ...........................................................................................................................4
`
`740 ILCS 14/25(c) ................................................................................................................. passim
`
`RULES
`
`Fed. R. Civ. P. 12(b)(6)..........................................................................................................1, 6, 24
`
`Fed. R. Civ. P. 12(f) .............................................................................................................2, 22, 24
`
`Fed. R. Civ. P. 23(b)(2)..................................................................................................................22
`
`Fed. R. Civ. P. 23(b)(3)..................................................................................................................22
`
`MOTION TO DISMISS AND
`MOTION TO STRIKE CLASS ALLEGATIONS
`(No. 2:22-cv-00269-JHC) – v
`
`
`
`
`
`Perkins Coie LLP
`1201 Third Avenue, Suite 4900
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`

`

`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 7 of 30
`
`
`
`INTRODUCTION
`This case is a brazen attempt to expand the Illinois Biometric Information Privacy Act
`(“BIPA”) far beyond what its authors could have possibly intended. It should be dismissed in its
`entirety and with prejudice under Federal Rule of Civil Procedure (“Rule”) 12(b)(6).
`Plaintiff Jacinda Dorian is an Illinois resident. She claims that she took multiple remote
`tests (i.e., “take home” tests) while attending two colleges in Illinois. To protect the integrity of
`those tests, her colleges required her to use an online test proctoring service provided by
`ProctorU, Inc. ProctorU, in turn, required Plaintiff to submit an image of herself, and an image of
`a valid identification document, to ProctorU. According to Plaintiff, ProctorU then uploaded
`those images to its Amazon Web Services (“AWS”) account and used AWS’s Rekognition
`software to compare the images in order to verify Plaintiff’s identity.
`Plaintiff does not allege that she interacted with AWS in any way, or that AWS was even
`aware of her use of ProctorU’s service. Nor does she allege that AWS, a Delaware corporation
`with its headquarters in Seattle, committed a single act in Illinois. Nevertheless, Plaintiff seeks to
`hold AWS liable under BIPA, an Illinois law that governs the possession and collection of
`biometric data. Curiously, Plaintiff has chosen not to sue her colleges, which “requir[ed]” her to
`use ProctorU’s service, or ProctorU, which “required” her to submit images of herself and then
`analyzed those images to confirm her identity—suggesting strongly that this case is motivated by
`AWS’s deep pockets rather than any actual harm to Plaintiff. Compl. ¶¶ 38, 39.1
`
`
`1 Notably, Plaintiff does not allege that ProctorU failed to meet BIPA’s requirements
`when collecting and processing her images. In fact, discovery will show that ProctorU did
`comply with BIPA, which will provide an additional basis for dismissing Plaintiff’s claims
`against AWS. See Thakkar v. ProctorU, Inc., No. 21-CV-2051, 2021 WL 5507041, at *1 (C.D.
`Ill. Nov. 23, 2021) (explaining that, “[b]efore taking any online exam proctored by ProctorU,
`test-takers must affirmatively consent to ProctorU’s Terms of Service” and Privacy Policy); see
`also id., Dkt. 21-1 (Ex. 1) ¶ 3 (ProctorU’s Terms of Service, which inform test-takers like
`Plaintiff that their use of ProctorU’s service is governed by ProctorU’s Terms of Service and
`ProctorU’s Privacy Policy); id., Dkt. 21-1 (Ex. 2) at 2 (ProctorU’s Privacy Policy, which informs
`test-takers, among other things, that ProctorU’s service “require[s] you to share your photo ID on
`camera,” and that ProctorU “use[s] that ID in conjunction with biometric facial recognition
`software to authenticate your identity”).
`CERTIFICATE OF SERVICE
`(No. 2:22-cv-00269-JHC) – 1
`
`Perkins Coie LLP
`1201 Third Avenue, Suite 4900
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`

`

`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 8 of 30
`
`
`
`In any case, Plaintiff’s novel attempt to sue AWS, which acted as nothing more than a
`“behind-the-scenes” cloud-services provider for ProctorU, fails for multiple reasons. Id. ¶ 5.
`First, Plaintiff’s attempt to sweep mere back-end service providers into BIPA’s scope is
`inconsistent with any rational reading of the law. Plaintiff does not, and cannot, allege that AWS
`“possessed” or “collected” her data within the meaning of BIPA, and she therefore cannot allege
`that BIPA applies to AWS at all. Further, interpreting BIPA to apply to AWS in this case would
`produce absurd and unworkable results that this Court cannot condone.
`Second, BIPA does not apply outside Illinois, so Plaintiff must allege that AWS’s
`purported violations “occurred primarily and substantially in Illinois.” Avery v. State Farm Mut.
`Auto. Ins., 216 Ill. 2d 100, 187 (2005). But Plaintiff does not allege that AWS engaged in any
`conduct in Illinois. And applying BIPA to AWS’s wholly out-of-state conduct, as Plaintiff seeks
`to do, would violate the U.S. Constitution’s Dormant Commerce Clause.
`Third, BIPA itself provides that the law’s requirements may not be applied “in any
`manner” to “financial institutions” subject to the federal Gramm-Leach-Bliley Act, 740 ILCS
`14/25(c), which includes Plaintiff’s colleges. Forcing AWS to comply with BIPA’s requirements
`in this context inevitably would force Plaintiff’s colleges to comply with BIPA, too. The plain
`language of BIPA forbids that result and requires dismissal of Plaintiff’s claims.
`Fourth, Plaintiff is not “aggrieved” by AWS’s purported failure to publish a biometric
`data retention policy under Section 15(a) of BIPA—an essential element of her claim. Plaintiff’s
`Section 15(a) claim must be dismissed for that additional and independent reason.
`Finally, even if Plaintiff could adequately allege BIPA claims against AWS (she cannot),
`her class allegations must be stricken under Rule 12(f) because they are patently overbroad.
`Plaintiff may or may not have valid BIPA claims against her colleges or against
`ProctorU, the entities that required her to do the things of which she complains. But she certainly
`has no claims against AWS, which has no relationship to Plaintiff and merely acted as a back-
`end, out-of-state service provider for ProctorU. Plaintiff’s claims should be dismissed.
`
`MOTION TO DISMISS AND
`MOTION TO STRIKE CLASS ALLEGATIONS
`(No. 2:22-cv-00269-JHC) – 2
`
`
`
`
`
`Perkins Coie LLP
`1201 Third Avenue, Suite 4900
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`

`

`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 9 of 30
`
`
`
`A.
`
`BACKGROUND
`The Illinois Biometric Information Privacy Act (“BIPA”)
`Plaintiff’s claims arise exclusively under BIPA, an Illinois state law. BIPA was enacted
`in 2008 in reaction to the growing use of biometric technology “in the business and security
`screening sectors,” and to address the concerns of members of the public who were “weary of the
`use of biometrics when such information is tied to finances and other personal information.”
`740 ILCS 14/5(a), (d). Recognizing that “[t]he use of biometrics . . . appear[ed] to promise
`streamlined financial transactions and security screenings,” the Illinois General Assembly sought
`to allay the public’s concerns by regulating private companies’ use of such data. Id.
`BIPA specifically regulates “biometric identifiers” and “biometric information.”
`A “biometric identifier” means a “retina or iris scan, fingerprint, voiceprint, or scan of hand or
`face geometry.” 740 ILCS 14/10. “Biometric information” means any information “based on” a
`biometric identifier. Id. For brevity, AWS refers to “biometric identifiers” and “biometric
`information” collectively as “biometric data.”2
`Equally important, BIPA does not prohibit the collection and use of biometric data
`entirely. Rather, it imposes requirements and obligations on private entities if they engage in
`certain activities with respect to biometric data. For example, under Section 15(a) of BIPA,
`companies “in possession” of biometric data must develop and comply with “a written policy,
`made available to the public, establishing a retention schedule and guidelines for permanently
`destroying” biometric data within certain timeframes set out in the law. 740 ILCS 14/15(a). And
`under Section 15(b), companies that “collect . . . or otherwise obtain” biometric data must
`provide certain notices and obtain consent before doing so. 740 ILCS 14/15(b).
`
`
`2 By referring to “biometric data” throughout this motion, AWS does not in any way
`concede that it collected, possessed, stored, or otherwise obtained or used any data governed by
`BIPA. Further, AWS specifically reserves the right to argue, at the appropriate time, that even if
`it did collect, possess, store, or otherwise obtain or use any data regarding Plaintiff—a point
`AWS does not concede—no such data qualifies as “biometric identifiers” or “biometric
`information” within the meaning of BIPA.
`MOTION TO DISMISS AND
`MOTION TO STRIKE CLASS ALLEGATIONS
`(No. 2:22-cv-00269-JHC) – 3
`
`Perkins Coie LLP
`1201 Third Avenue, Suite 4900
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`
`
`
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`

`

`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 10 of 30
`
`
`
`BIPA’s penalties are harsh. “Any person aggrieved” by a violation of the law may sue for
`actual damages or, alternatively, liquidated damages of $1,000 per violation (for negligent
`violations) or $5,000 per violation (for “intentional[]” or reckless[]” violations). 740 ILCS at
`14/20(1), (2). A prevailing party also may recover attorneys’ fees and costs. See 740 ILCS
`14/20(3). The potential for enormous recoveries has inspired a wave of more than 1,500 putative
`BIPA class actions in recent years. See Declaration of Ryan Spear (“Spear Decl.”) ¶ 2; see also
`id., Ex. A (U.S. Chamber of Commerce Institute for Legal Reform, A Bad Match: Illinois and
`the Biometric Information Privacy Act at 4, 7 (Oct. 2021)) (noting the “exponential growth in
`BIPA litigation,” which has disproportionately targeted “small companies” in Illinois).
`
`B.
`
`Amazon Web Services (“AWS”), Rekognition, and ProctorU
`AWS is “one of the largest providers of cloud computing services,” offering its customers
`“over 200 cloud-based services from data centers globally.” Compl. ¶¶ 1-2. As the Ninth Circuit
`has explained, the term “cloud computing” is “based on the industry usage of a cloud as a
`metaphor for the ethereal internet. . . . An external cloud platform is storage or software access
`that is essentially rented from (or outsourced to) a remote public cloud service provider, such as
`Amazon or Google.” United States v. Cotterman, 709 F.3d 952, 965 n.12 (9th Cir. 2013)
`(internal quotation marks and citation omitted). In practical terms, AWS’s cloud services allow
`AWS customers, like ProctorU, to remotely access, use, and control computer servers maintained
`by AWS to store and process the customers’ own data, however the customers see fit. “Millions
`of customers—from startups to the largest enterprises—use AWS every day.” Compl. ¶ 2.
`One of the cloud-based services that AWS provides to its customers is a software product
`called “Rekognition.” Id. ¶ 3. According to Plaintiff, Rekognition “uses machine vision and
`algorithmic classification techniques” to analyze electronic images, including images of faces.
`Id. Plaintiff alleges that AWS customers may upload electronic images to their cloud-storage
`accounts at AWS (known as “S3 buckets”) and then run a Rekognition command called “index-
`faces” to extract biometric data from those images of faces. Id. ¶¶ 24-29. Plaintiff further alleges
`
`MOTION TO DISMISS AND
`MOTION TO STRIKE CLASS ALLEGATIONS
`(No. 2:22-cv-00269-JHC) – 4
`
`
`
`
`
`Perkins Coie LLP
`1201 Third Avenue, Suite 4900
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`

`

`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 11 of 30
`
`
`
`that AWS customers may then use Rekognition’s “face-matching” command to determine
`whether the same person appears in two or more images, and to generate a “similarity” score,
`i.e., “a confidence measurement to indicate how strongly Rekognition believes these faces
`match.” Id. ¶ 31.
`ProctorU is one of “[t]housands” of companies that incorporate Rekognition into their
`own products and services. Id. ¶¶ 4, 33. ProctorU allegedly “develops and licenses online test
`proctoring software for use by students and educational facilities.” Id. ¶ 33. When a “student
`takes a test using ProctorU’s proctoring software, ProctorU requires students to show their faces
`and their photo IDs on camera to help verify their identities.” Id. ¶ 34. And “when [those
`students] upload their images to ProctorU,” ProctorU “uses Rekognition” to compare the images
`and confirm test-takers’ identities based on those images. Id. ¶ 35.
`Importantly, Plaintiff (1) does not allege that AWS plays any role in this process beyond
`allowing ProctorU to access Rekognition and ProctorU’s S3 buckets; (2) does not allege that
`ProctorU’s S3 buckets are located in Illinois, or that AWS engaged in any conduct in Illinois;
`(3) does not allege that AWS controls the data in ProctorU’s S3 buckets or is able to access it;
`and (4) does not allege that AWS interacts with or could interact with ProctorU’s users. Indeed,
`Plaintiff does not even allege that AWS knows when ProctorU collects and stores students’ data,
`let alone that AWS knows when ProctorU collects and stores data from students in Illinois.
`
`C.
`
`Plaintiff’s Claims Against AWS
`Plaintiff’s claims are based entirely on her use of ProctorU’s service. Plaintiff alleges that
`she “took multiple tests” at two Illinois schools (the “Colleges”) between 2017 and 2019. Id. ¶¶
`37, 38. The Colleges “requir[ed]” Plaintiff to use ProctorU’s service to take her tests. Id. ¶ 38.
`ProctorU, in turn, “required” Plaintiff “to submit her image as well as an image of a valid
`identification document in order to be identified.” Id. ¶ 39; see also id. ¶ 34 (ProctorU “requires”
`students to submit images to ProctorU). Plaintiff alleges that ProctorU then used the Rekognition
`service to confirm her identity based on the images she submitted to ProctorU. See id. ¶ 40.
`
`MOTION TO DISMISS AND
`MOTION TO STRIKE CLASS ALLEGATIONS
`(No. 2:22-cv-00269-JHC) – 5
`
`
`
`
`
`Perkins Coie LLP
`1201 Third Avenue, Suite 4900
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`

`

`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 12 of 30
`
`
`
`Based on those allegations, Plaintiff asserts two claims against AWS. First, she alleges
`that AWS violated Section 15(a) of BIPA by “possess[ing]” her biometric data—that is, the data
`ProctorU collected and then uploaded to ProctorU’s S3 bucket—without publishing “a publicly-
`available retention and deletion schedule.” Id. ¶ 43. Second, Plaintiff alleges that AWS violated
`Section 15(b) of BIPA by “collect[ing]” that same data without providing the notice, and
`obtaining the consent, that Section 15(b) requires when companies collect biometric data. See id.
`¶¶ 41-42. Plaintiff asserts both claims on behalf of herself and “[a]ll Illinois residents who had
`their biometric information or biometric identifiers collected, captured, received, possessed, or
`otherwise obtained by Amazon’s Rekognition service and stored in AWS’s servers.” Id. ¶ 44.
`For the reasons below, Plaintiff’s claims should be dismissed, and Plaintiff’s improper
`class allegations should be stricken.
`
`A.
`
`MOTION TO DISMISS UNDER RULE 12(b)(6)
`AWS Did Not “Possess” or “Collect” Plaintiff’s Data
`As a threshold matter, Plaintiff’s BIPA claims fail because she cannot allege the most
`essential elements of those claims. Plaintiff cannot allege that AWS “possessed” her data for
`purposes of Section 15(a) because she cannot allege that AWS exercised any control or authority
`over that data. Similarly, Plaintiff cannot allege that AWS “collected” her data under Section
`15(b) because Plaintiff’s own allegations make clear that AWS never took any active steps to
`acquire or obtain her data; rather, it was ProctorU that collected Plaintiff’s data. And as
`explained below, departing from those common-sense readings of BIPA’s language would lead
`to a series of absurd and unworkable results. Plaintiff’s claims should therefore be dismissed.3
`
`3 As the Court knows, dismissal under Rule 12(b)(6) “can be based on the lack of a
`cognizable legal theory or the absence of sufficient facts alleged under a cognizable legal
`theory.” Balistreri v. Pacifica Police Dep’t, 901 F.2d 696, 699 (9th Cir. 1988). “To survive a
`motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to state a
`claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (internal
`quotation marks and citation omitted). Dismissal should be with prejudice where, as here, the
`flaws in a complaint could not be cured by repleading. See, e.g., Williams v. Nat’l Football
`League, No. C14-1089, 2014 WL 5514378, at *4 (W.D. Wash. Oct. 31, 2014), aff’d, 671 F.
`App’x 424 (9th Cir. 2016).
`MOTION TO DISMISS AND
`MOTION TO STRIKE CLASS ALLEGATIONS
`(No. 2:22-cv-00269-JHC) – 6
`
`
`
`
`
`Perkins Coie LLP
`1201 Third Avenue, Suite 4900
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`

`

`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 13 of 30
`
`
`
`1.
`Plaintiff alleges no facts showing that AWS “possessed” her data.
`Section 15(a) applies only to private entities “in possession of” biometric data. 740 ILCS
`14/15(a). But Plaintiff does not, and cannot, allege any facts showing that AWS possessed her
`data within the meaning of Section 15(a).
`BIPA does not define “possession.” Courts therefore “assume the legislature intended for
`it to have its popularly understood meaning.” Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d
`1197, 1205 (Ill. 2019) (citations omitted). The Illinois Supreme Court has explained that
`“possession, as ordinarily understood, occurs when a person has or takes control of the subject
`property or holds the property at his or her disposal.” People v. Ward, 830 N.E.2d 556, 560 (Ill.
`2005) (internal quotation marks omitted) (emphasis added); see also Ill. Crim. Pattern Jury Instr.
`4.16 (“actual possession” is “immediate and exclusive control over a thing” and “constructive
`possession” is “both the power and the intention to exercise control over a thing”). The Ninth
`Circuit interprets “possession” similarly. See, e.g., United States v. Kuchinski, 469 F.3d 853, 861
`(9th Cir. 2006) (possession in “electronic context[s]” requires a showing that the person
`“exercises dominion and control over” the relevant material); Ninth Cir. Crim. Model Jury Instr.
`6.15 (“A person has possession of something if the person knows of its presence and has
`physical control of it, or knows of its presence and has the power and intention to control it.”).
`Here, Plaintiff does not allege that AWS controlled or held at its disposal the data that
`Proctor U allegedly uploaded to its S3 bucket. See Ward, 830 N.E.2d at 560. In fact, Plaintiff
`does not even allege that AWS “kn[ew] of [the] presence” of that data, Ninth Cir. Crim. Model
`Jury Instr. 6.15—an unsurprising omission, given that AWS has “[m]illions” of customers,
`Compl. ¶ 2, each of which may have up to 1,000 S3 buckets in their accounts, see Spear

This document is available on Docket Alarm but you must sign up to view it.


Or .

Accessing this document will incur an additional charge of $.

After purchase, you can access this document again without charge.

Accept $ Charge
throbber

Still Working On It

This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.

Give it another minute or two to complete, and then try the refresh button.

throbber

A few More Minutes ... Still Working

It can take up to 5 minutes for us to download a document if the court servers are running slowly.

Thank you for your continued patience.

This document could not be displayed.

We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.

Your account does not support viewing this document.

You need a Paid Account to view this document. Click here to change your account type.

Your account does not support viewing this document.

Set your membership status to view this document.

With a Docket Alarm membership, you'll get a whole lot more, including:

  • Up-to-date information for this case.
  • Email alerts whenever there is an update.
  • Full text search for other cases.
  • Get email alerts whenever a new case matches your search.

Become a Member

One Moment Please

The filing “” is large (MB) and is being downloaded.

Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.

Your document is on its way!

If you do not receive the document in five minutes, contact support at support@docketalarm.com.

Sealed Document

We are unable to display this document, it may be under a court ordered seal.

If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.


Access Government Site

We are redirecting you
to a mobile optimized page.





Document Unreadable or Corrupt

Refresh this Document
Go to the Docket

We are unable to display this document.

Refresh this Document
Go to the Docket