`
`THE HONORABLE JOHN H. CHUN
`
`UNITED STATES DISTRICT COURT
`WESTERN DISTRICT OF WASHINGTON
`AT SEATTLE
`
`No. 2:22-cv-00269-JHC
`
`AMAZON WEB SERVICES, INC.’S
`RULE 12(b)(6) MOTION TO
`DISMISS AND RULE 12(f) MOTION
`TO STRIKE CLASS ALLEGATIONS
`
`NOTE ON MOTION CALENDAR:
`June 10, 2022
`
`ORAL ARGUMENT REQUESTED
`
`JACINDA DORIAN, individually, and
`on behalf of all others similarly situated,
`Plaintiff,
`
`v.
`AMAZON WEB SERVICES, INC.,
`Defendant.
`
`MOTION TO DISMISS AND
`MOTION TO STRIKE CLASS ALLEGATIONS
`(No. 2:22-cv-00269-JHC)
`
`Perkins Coie LLP
`1201 Third Avenue, Suite 4900
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`
`
`
`
`
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`
`
`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 2 of 30
`
`
`
`TABLE OF CONTENTS
`
`Page
`INTRODUCTION .......................................................................................................................... 1
`BACKGROUND ............................................................................................................................ 3
`A.
`The Illinois Biometric Information Privacy Act (“BIPA”) ..................................... 3
`B.
`Amazon Web Services (“AWS”), Rekognition, and ProctorU ............................... 4
`C.
`Plaintiff’s Claims Against AWS ............................................................................. 5
`MOTION TO DISMISS UNDER RULE 12(b)(6) ......................................................................... 6
`A.
`AWS Did Not “Possess” or “Collect” Plaintiff’s Data ........................................... 6
`Plaintiff alleges no facts showing that AWS “possessed”
`1.
`her data. ....................................................................................................... 7
`Plaintiff alleges no facts showing that AWS “collected” her
`data. ........................................................................................................... 11
`Plaintiff’s Claims Should Be Dismissed Under the Illinois
`Extraterritoriality Doctrine and the U.S. Constitution’s Dormant
`Commerce Clause ................................................................................................. 15
`1.
`Plaintiff’s claims violate the extraterritoriality doctrine. .......................... 15
`2.
`Adopting Plaintiff’s sweeping interpretation of BIPA
`would violate the U.S. Constitution’s Dormant Commerce
`Clause. ....................................................................................................... 18
`BIPA’s Financial Institutions Exemption Bars Plaintiff’s Claims ....................... 18
`BIPA may not be applied to “financial institutions,” which
`1.
`includes colleges and universities that administer financial
`aid. ............................................................................................................. 19
`Allowing Plaintiff’s claims to proceed would
`impermissibly apply BIPA’s requirements to the Colleges,
`which are financial institutions. ................................................................ 19
`Plaintiff Cannot Be “Aggrieved” by AWS’s Alleged Violation of
`Section 15(a) ......................................................................................................... 21
`MOTION TO STRIKE CLASS ALLEGATIONS UNDER RULE 12(f) .................................... 22
`CONCLUSION ............................................................................................................................. 24
`
`2.
`
`2.
`
`B.
`
`C.
`
`D.
`
`MOTION TO DISMISS AND
`MOTION TO STRIKE CLASS ALLEGATIONS
`(No. 2:22-cv-00269-JHC) – i
`
`
`
`Perkins Coie LLP
`1201 Third Avenue, Suite 4900
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`
`
`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 3 of 30
`
`TABLE OF AUTHORITIES
`
`Page(s)
`
`
`
`
`CASES
`
`Abdelfattah v. Carrington Mortg. Servs. LLC,
`No. C-12-04656-RMW, 2013 WL 5718463 (N.D. Cal. Oct. 21, 2013) ..................................22
`
`Am. Sur. Co. v. Jones,
`51 N.E.2d 122 (Ill. 1943) .........................................................................................................21
`
`Amchem Prod., Inc. v. Windsor,
`521 U.S. 591 (1997) .................................................................................................................24
`
`Ashcroft v. Iqbal,
`556 U.S. 662 (2009) ...................................................................................................................6
`
`Avery v. State Farm Mut. Auto. Ins. Co.,
`216 Ill. 2d 100 (2005) ..........................................................................................................2, 15
`
`Balistreri v. Pacifica Police Dep’t,
`901 F.2d 696 (9th Cir. 1988) .....................................................................................................6
`
`Bernal v. ADP, LLC,
`No. 2017-CH-12364, 2019 WL 5028609 (Ill. Cir. Ct. Aug. 23, 2019) ...................................13
`
`Bryant v. Compass Grp. USA, Inc.,
`503 F. Supp. 3d 597 (N.D. Ill. 2020) .......................................................................................19
`
`Bryant v. Compass Grp. USA, Inc.,
`958 F.3d 617 (7th Cir. 2020) ...................................................................................................22
`
`Cashatt v. Ford Motor Co.,
`No. 3:19-CV-05886-RBL, 2020 WL 1987077 (W.D. Wash. Apr. 27, 2020) .........................24
`
`Chestnut Corp. v. Pestine, Brinati, Gamer, Ltd.,
`667 N.E.2d 543 (Ill. App. Ct. 1996) ........................................................................................21
`
`Doe v. Northwestern Univ.,
`No. 21 C 1579, 2022 WL 1485905 (N.D. Ill. Feb. 22, 2022) ............................................19, 20
`
`Duerr v. Bradley Univ.,
`No. 1:21-CV-01096-SLD-JEH, 2022 WL 1487747 (C.D. Ill. Mar. 10, 2022) ..................19, 20
`
`Figueroa v. Kronos Inc.,
`454 F. Supp. 3d 772 (N.D. Ill. 2020) .......................................................................................13
`
`MOTION TO DISMISS AND
`MOTION TO STRIKE CLASS ALLEGATIONS
`(No. 2:22-cv-00269-JHC) – ii
`
`
`
`Perkins Coie LLP
`1201 Third Avenue, Suite 4900
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`
`
`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 4 of 30
`
`
`
`Healy v. Beer Inst., Inc.,
`491 U.S. 324 (1989) .................................................................................................................18
`
`Heard v. Becton, Dickinson & Co.,
`524 F. Supp. 3d 831 (N.D. Ill. 2021) .........................................................................................9
`
`Heard v. Becton, Dickinson & Company,
`440 F. Supp. 3d 960 (N.D. Ill. 2020) ...................................................................................9, 12
`
`In re Coinstar Inc. S’holder Derivative Litig.,
`No. C11-133 MJP, 2011 WL 5553778 (W.D. Wash. Nov. 14, 2011) .....................................16
`
`In re Facebook Biometric Info. Priv. Litig.,
`326 F.R.D. 535 (N.D. Cal. 2018) .............................................................................................21
`
`Jacobs v. Hanwha Techwin America, Inc.,
`No. 21 C 866, 2021 WL 3172967 (N.D. Ill. July 27, 2021) ..........................................9, 12, 13
`
`Knievel v. ESPN,
`393 F.3d 1068 (9th Cir. 2005) ...................................................................................................7
`
`Lapekas v. Kaiser Found. Health Plan, Inc.,
`No. 10-CV-5984-VBF-FMOx, 2011 WL 13217477 (C.D. Cal. May 25, 2011) .....................24
`
`Linehan v. AllianceOne Receivables Mgmt., Inc.,
`No. C15-1012-JCC, 2016 WL 9526500 (W.D. Wash. Nov. 22, 2016) ...................................22
`
`Loomis v. Slendertone Distrib., Inc.,
`420 F. Supp. 3d 1046 (S.D. Cal. 2019) ......................................................................................7
`
`McGoveran v. Amazon Web Servs., Inc.,
`No. 20-cv-1399-LPS, 2021 WL 4502089 (D. Del. Sept. 30, 2021) ......................15, 16, 17, 18
`
`Miller v. Dollar Tree Stores, Inc.,
`No. CV-06-019-RHW, 2006 WL 8438078 (E.D. Wash. Oct. 13, 2006) .................................23
`
`Namuwonge v. Kronos, Inc.,
`418 F. Supp. 3d 279 (N.D. Ill. 2019) .................................................................................12, 13
`
`Parsons v. Ryan,
`754 F.3d 657 (9th Cir. 2014) ...................................................................................................22
`
`People v. Ward,
`830 N.E.2d 556 (Ill. 2005) .....................................................................................................7, 8
`
`Poshville, Inc. v. Pawnee Leasing,
`No. 2:21-CV-01465-SVW-AGR, 2021 WL 4776708 (C.D. Cal. July 15, 2021) ....................24
`MOTION TO DISMISS AND
`Perkins Coie LLP
`MOTION TO STRIKE CLASS ALLEGATIONS
`1201 Third Avenue, Suite 4900
`(No. 2:22-cv-00269-JHC) – iii
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`
`
`
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`
`
`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 5 of 30
`
`
`
`Rosenbach v. Six Flags Ent. Corp.,
`129 N.E.3d 1197 (Ill. 2019) .................................................................................................7, 21
`
`Sam Francis Foundation v. Christies, Inc.,
`784 F.3d 1320 (9th Cir. 2015) .................................................................................................18
`
`Solon v. Midwest Med. Recs. Ass’n, Inc.,
`236 Ill. 2d 433 (2010) ..........................................................................................................9, 13
`
`Stevenson v. FedEx Ground Package Sys., Inc.,
`69 F. Supp. 3d 792 (N.D. Ill. 2014) .........................................................................................21
`
`Thakkar v. ProctorU, Inc.,
`No. 21-CV-2051, 2021 WL 5507041 (C.D. Ill. Nov. 23, 2021) ................................................1
`
`United States v. Cotterman,
`709 F.3d 952 (9th Cir. 2013) .....................................................................................................4
`
`United States v. Kuchinski,
`469 F.3d 853 (9th Cir. 2006) .................................................................................................7, 8
`
`Wal-Mart Stores, Inc. v. Dukes,
`564 U.S. 338 (2011) .................................................................................................................23
`
`Williams v. Nat’l Football League,
`No. C14-1089 MJP, 2014 WL 5514378 (W.D. Wash. Oct. 31, 2014) ......................................6
`
`Zellmer v. Facebook, Inc.,
`No. 3:18-cv-01880-JD, 2022 WL 976981 (N.D. Cal. Mar. 31, 2022) ..............................14, 15
`
`STATUTES
`
`740 ILCS 14/5(a) .............................................................................................................................3
`
`740 ILCS 14/5(d) .............................................................................................................................3
`
`740 ILCS 14/10 ..........................................................................................................................3, 23
`
`740 ILCS 14/15(a) ................................................................................................................. passim
`
`740 ILCS 14/15(b) ................................................................................................................. passim
`
`740 ILCS 14/20 ..............................................................................................................................21
`
`740 ILCS 14/20(1) ...........................................................................................................................4
`
`740 ILCS 14/20(2) ...........................................................................................................................4
`
`MOTION TO DISMISS AND
`MOTION TO STRIKE CLASS ALLEGATIONS
`(No. 2:22-cv-00269-JHC) – iv
`
`
`
`
`
`Perkins Coie LLP
`1201 Third Avenue, Suite 4900
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`
`
`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 6 of 30
`
`
`
`740 ILCS 14/20(3) ...........................................................................................................................4
`
`740 ILCS 14/25(c) ................................................................................................................. passim
`
`RULES
`
`Fed. R. Civ. P. 12(b)(6)..........................................................................................................1, 6, 24
`
`Fed. R. Civ. P. 12(f) .............................................................................................................2, 22, 24
`
`Fed. R. Civ. P. 23(b)(2)..................................................................................................................22
`
`Fed. R. Civ. P. 23(b)(3)..................................................................................................................22
`
`MOTION TO DISMISS AND
`MOTION TO STRIKE CLASS ALLEGATIONS
`(No. 2:22-cv-00269-JHC) – v
`
`
`
`
`
`Perkins Coie LLP
`1201 Third Avenue, Suite 4900
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`
`
`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 7 of 30
`
`
`
`INTRODUCTION
`This case is a brazen attempt to expand the Illinois Biometric Information Privacy Act
`(“BIPA”) far beyond what its authors could have possibly intended. It should be dismissed in its
`entirety and with prejudice under Federal Rule of Civil Procedure (“Rule”) 12(b)(6).
`Plaintiff Jacinda Dorian is an Illinois resident. She claims that she took multiple remote
`tests (i.e., “take home” tests) while attending two colleges in Illinois. To protect the integrity of
`those tests, her colleges required her to use an online test proctoring service provided by
`ProctorU, Inc. ProctorU, in turn, required Plaintiff to submit an image of herself, and an image of
`a valid identification document, to ProctorU. According to Plaintiff, ProctorU then uploaded
`those images to its Amazon Web Services (“AWS”) account and used AWS’s Rekognition
`software to compare the images in order to verify Plaintiff’s identity.
`Plaintiff does not allege that she interacted with AWS in any way, or that AWS was even
`aware of her use of ProctorU’s service. Nor does she allege that AWS, a Delaware corporation
`with its headquarters in Seattle, committed a single act in Illinois. Nevertheless, Plaintiff seeks to
`hold AWS liable under BIPA, an Illinois law that governs the possession and collection of
`biometric data. Curiously, Plaintiff has chosen not to sue her colleges, which “requir[ed]” her to
`use ProctorU’s service, or ProctorU, which “required” her to submit images of herself and then
`analyzed those images to confirm her identity—suggesting strongly that this case is motivated by
`AWS’s deep pockets rather than any actual harm to Plaintiff. Compl. ¶¶ 38, 39.1
`
`
`1 Notably, Plaintiff does not allege that ProctorU failed to meet BIPA’s requirements
`when collecting and processing her images. In fact, discovery will show that ProctorU did
`comply with BIPA, which will provide an additional basis for dismissing Plaintiff’s claims
`against AWS. See Thakkar v. ProctorU, Inc., No. 21-CV-2051, 2021 WL 5507041, at *1 (C.D.
`Ill. Nov. 23, 2021) (explaining that, “[b]efore taking any online exam proctored by ProctorU,
`test-takers must affirmatively consent to ProctorU’s Terms of Service” and Privacy Policy); see
`also id., Dkt. 21-1 (Ex. 1) ¶ 3 (ProctorU’s Terms of Service, which inform test-takers like
`Plaintiff that their use of ProctorU’s service is governed by ProctorU’s Terms of Service and
`ProctorU’s Privacy Policy); id., Dkt. 21-1 (Ex. 2) at 2 (ProctorU’s Privacy Policy, which informs
`test-takers, among other things, that ProctorU’s service “require[s] you to share your photo ID on
`camera,” and that ProctorU “use[s] that ID in conjunction with biometric facial recognition
`software to authenticate your identity”).
`CERTIFICATE OF SERVICE
`(No. 2:22-cv-00269-JHC) – 1
`
`Perkins Coie LLP
`1201 Third Avenue, Suite 4900
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`
`
`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 8 of 30
`
`
`
`In any case, Plaintiff’s novel attempt to sue AWS, which acted as nothing more than a
`“behind-the-scenes” cloud-services provider for ProctorU, fails for multiple reasons. Id. ¶ 5.
`First, Plaintiff’s attempt to sweep mere back-end service providers into BIPA’s scope is
`inconsistent with any rational reading of the law. Plaintiff does not, and cannot, allege that AWS
`“possessed” or “collected” her data within the meaning of BIPA, and she therefore cannot allege
`that BIPA applies to AWS at all. Further, interpreting BIPA to apply to AWS in this case would
`produce absurd and unworkable results that this Court cannot condone.
`Second, BIPA does not apply outside Illinois, so Plaintiff must allege that AWS’s
`purported violations “occurred primarily and substantially in Illinois.” Avery v. State Farm Mut.
`Auto. Ins., 216 Ill. 2d 100, 187 (2005). But Plaintiff does not allege that AWS engaged in any
`conduct in Illinois. And applying BIPA to AWS’s wholly out-of-state conduct, as Plaintiff seeks
`to do, would violate the U.S. Constitution’s Dormant Commerce Clause.
`Third, BIPA itself provides that the law’s requirements may not be applied “in any
`manner” to “financial institutions” subject to the federal Gramm-Leach-Bliley Act, 740 ILCS
`14/25(c), which includes Plaintiff’s colleges. Forcing AWS to comply with BIPA’s requirements
`in this context inevitably would force Plaintiff’s colleges to comply with BIPA, too. The plain
`language of BIPA forbids that result and requires dismissal of Plaintiff’s claims.
`Fourth, Plaintiff is not “aggrieved” by AWS’s purported failure to publish a biometric
`data retention policy under Section 15(a) of BIPA—an essential element of her claim. Plaintiff’s
`Section 15(a) claim must be dismissed for that additional and independent reason.
`Finally, even if Plaintiff could adequately allege BIPA claims against AWS (she cannot),
`her class allegations must be stricken under Rule 12(f) because they are patently overbroad.
`Plaintiff may or may not have valid BIPA claims against her colleges or against
`ProctorU, the entities that required her to do the things of which she complains. But she certainly
`has no claims against AWS, which has no relationship to Plaintiff and merely acted as a back-
`end, out-of-state service provider for ProctorU. Plaintiff’s claims should be dismissed.
`
`MOTION TO DISMISS AND
`MOTION TO STRIKE CLASS ALLEGATIONS
`(No. 2:22-cv-00269-JHC) – 2
`
`
`
`
`
`Perkins Coie LLP
`1201 Third Avenue, Suite 4900
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`
`
`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 9 of 30
`
`
`
`A.
`
`BACKGROUND
`The Illinois Biometric Information Privacy Act (“BIPA”)
`Plaintiff’s claims arise exclusively under BIPA, an Illinois state law. BIPA was enacted
`in 2008 in reaction to the growing use of biometric technology “in the business and security
`screening sectors,” and to address the concerns of members of the public who were “weary of the
`use of biometrics when such information is tied to finances and other personal information.”
`740 ILCS 14/5(a), (d). Recognizing that “[t]he use of biometrics . . . appear[ed] to promise
`streamlined financial transactions and security screenings,” the Illinois General Assembly sought
`to allay the public’s concerns by regulating private companies’ use of such data. Id.
`BIPA specifically regulates “biometric identifiers” and “biometric information.”
`A “biometric identifier” means a “retina or iris scan, fingerprint, voiceprint, or scan of hand or
`face geometry.” 740 ILCS 14/10. “Biometric information” means any information “based on” a
`biometric identifier. Id. For brevity, AWS refers to “biometric identifiers” and “biometric
`information” collectively as “biometric data.”2
`Equally important, BIPA does not prohibit the collection and use of biometric data
`entirely. Rather, it imposes requirements and obligations on private entities if they engage in
`certain activities with respect to biometric data. For example, under Section 15(a) of BIPA,
`companies “in possession” of biometric data must develop and comply with “a written policy,
`made available to the public, establishing a retention schedule and guidelines for permanently
`destroying” biometric data within certain timeframes set out in the law. 740 ILCS 14/15(a). And
`under Section 15(b), companies that “collect . . . or otherwise obtain” biometric data must
`provide certain notices and obtain consent before doing so. 740 ILCS 14/15(b).
`
`
`2 By referring to “biometric data” throughout this motion, AWS does not in any way
`concede that it collected, possessed, stored, or otherwise obtained or used any data governed by
`BIPA. Further, AWS specifically reserves the right to argue, at the appropriate time, that even if
`it did collect, possess, store, or otherwise obtain or use any data regarding Plaintiff—a point
`AWS does not concede—no such data qualifies as “biometric identifiers” or “biometric
`information” within the meaning of BIPA.
`MOTION TO DISMISS AND
`MOTION TO STRIKE CLASS ALLEGATIONS
`(No. 2:22-cv-00269-JHC) – 3
`
`Perkins Coie LLP
`1201 Third Avenue, Suite 4900
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`
`
`
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`
`
`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 10 of 30
`
`
`
`BIPA’s penalties are harsh. “Any person aggrieved” by a violation of the law may sue for
`actual damages or, alternatively, liquidated damages of $1,000 per violation (for negligent
`violations) or $5,000 per violation (for “intentional[]” or reckless[]” violations). 740 ILCS at
`14/20(1), (2). A prevailing party also may recover attorneys’ fees and costs. See 740 ILCS
`14/20(3). The potential for enormous recoveries has inspired a wave of more than 1,500 putative
`BIPA class actions in recent years. See Declaration of Ryan Spear (“Spear Decl.”) ¶ 2; see also
`id., Ex. A (U.S. Chamber of Commerce Institute for Legal Reform, A Bad Match: Illinois and
`the Biometric Information Privacy Act at 4, 7 (Oct. 2021)) (noting the “exponential growth in
`BIPA litigation,” which has disproportionately targeted “small companies” in Illinois).
`
`B.
`
`Amazon Web Services (“AWS”), Rekognition, and ProctorU
`AWS is “one of the largest providers of cloud computing services,” offering its customers
`“over 200 cloud-based services from data centers globally.” Compl. ¶¶ 1-2. As the Ninth Circuit
`has explained, the term “cloud computing” is “based on the industry usage of a cloud as a
`metaphor for the ethereal internet. . . . An external cloud platform is storage or software access
`that is essentially rented from (or outsourced to) a remote public cloud service provider, such as
`Amazon or Google.” United States v. Cotterman, 709 F.3d 952, 965 n.12 (9th Cir. 2013)
`(internal quotation marks and citation omitted). In practical terms, AWS’s cloud services allow
`AWS customers, like ProctorU, to remotely access, use, and control computer servers maintained
`by AWS to store and process the customers’ own data, however the customers see fit. “Millions
`of customers—from startups to the largest enterprises—use AWS every day.” Compl. ¶ 2.
`One of the cloud-based services that AWS provides to its customers is a software product
`called “Rekognition.” Id. ¶ 3. According to Plaintiff, Rekognition “uses machine vision and
`algorithmic classification techniques” to analyze electronic images, including images of faces.
`Id. Plaintiff alleges that AWS customers may upload electronic images to their cloud-storage
`accounts at AWS (known as “S3 buckets”) and then run a Rekognition command called “index-
`faces” to extract biometric data from those images of faces. Id. ¶¶ 24-29. Plaintiff further alleges
`
`MOTION TO DISMISS AND
`MOTION TO STRIKE CLASS ALLEGATIONS
`(No. 2:22-cv-00269-JHC) – 4
`
`
`
`
`
`Perkins Coie LLP
`1201 Third Avenue, Suite 4900
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`
`
`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 11 of 30
`
`
`
`that AWS customers may then use Rekognition’s “face-matching” command to determine
`whether the same person appears in two or more images, and to generate a “similarity” score,
`i.e., “a confidence measurement to indicate how strongly Rekognition believes these faces
`match.” Id. ¶ 31.
`ProctorU is one of “[t]housands” of companies that incorporate Rekognition into their
`own products and services. Id. ¶¶ 4, 33. ProctorU allegedly “develops and licenses online test
`proctoring software for use by students and educational facilities.” Id. ¶ 33. When a “student
`takes a test using ProctorU’s proctoring software, ProctorU requires students to show their faces
`and their photo IDs on camera to help verify their identities.” Id. ¶ 34. And “when [those
`students] upload their images to ProctorU,” ProctorU “uses Rekognition” to compare the images
`and confirm test-takers’ identities based on those images. Id. ¶ 35.
`Importantly, Plaintiff (1) does not allege that AWS plays any role in this process beyond
`allowing ProctorU to access Rekognition and ProctorU’s S3 buckets; (2) does not allege that
`ProctorU’s S3 buckets are located in Illinois, or that AWS engaged in any conduct in Illinois;
`(3) does not allege that AWS controls the data in ProctorU’s S3 buckets or is able to access it;
`and (4) does not allege that AWS interacts with or could interact with ProctorU’s users. Indeed,
`Plaintiff does not even allege that AWS knows when ProctorU collects and stores students’ data,
`let alone that AWS knows when ProctorU collects and stores data from students in Illinois.
`
`C.
`
`Plaintiff’s Claims Against AWS
`Plaintiff’s claims are based entirely on her use of ProctorU’s service. Plaintiff alleges that
`she “took multiple tests” at two Illinois schools (the “Colleges”) between 2017 and 2019. Id. ¶¶
`37, 38. The Colleges “requir[ed]” Plaintiff to use ProctorU’s service to take her tests. Id. ¶ 38.
`ProctorU, in turn, “required” Plaintiff “to submit her image as well as an image of a valid
`identification document in order to be identified.” Id. ¶ 39; see also id. ¶ 34 (ProctorU “requires”
`students to submit images to ProctorU). Plaintiff alleges that ProctorU then used the Rekognition
`service to confirm her identity based on the images she submitted to ProctorU. See id. ¶ 40.
`
`MOTION TO DISMISS AND
`MOTION TO STRIKE CLASS ALLEGATIONS
`(No. 2:22-cv-00269-JHC) – 5
`
`
`
`
`
`Perkins Coie LLP
`1201 Third Avenue, Suite 4900
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`
`
`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 12 of 30
`
`
`
`Based on those allegations, Plaintiff asserts two claims against AWS. First, she alleges
`that AWS violated Section 15(a) of BIPA by “possess[ing]” her biometric data—that is, the data
`ProctorU collected and then uploaded to ProctorU’s S3 bucket—without publishing “a publicly-
`available retention and deletion schedule.” Id. ¶ 43. Second, Plaintiff alleges that AWS violated
`Section 15(b) of BIPA by “collect[ing]” that same data without providing the notice, and
`obtaining the consent, that Section 15(b) requires when companies collect biometric data. See id.
`¶¶ 41-42. Plaintiff asserts both claims on behalf of herself and “[a]ll Illinois residents who had
`their biometric information or biometric identifiers collected, captured, received, possessed, or
`otherwise obtained by Amazon’s Rekognition service and stored in AWS’s servers.” Id. ¶ 44.
`For the reasons below, Plaintiff’s claims should be dismissed, and Plaintiff’s improper
`class allegations should be stricken.
`
`A.
`
`MOTION TO DISMISS UNDER RULE 12(b)(6)
`AWS Did Not “Possess” or “Collect” Plaintiff’s Data
`As a threshold matter, Plaintiff’s BIPA claims fail because she cannot allege the most
`essential elements of those claims. Plaintiff cannot allege that AWS “possessed” her data for
`purposes of Section 15(a) because she cannot allege that AWS exercised any control or authority
`over that data. Similarly, Plaintiff cannot allege that AWS “collected” her data under Section
`15(b) because Plaintiff’s own allegations make clear that AWS never took any active steps to
`acquire or obtain her data; rather, it was ProctorU that collected Plaintiff’s data. And as
`explained below, departing from those common-sense readings of BIPA’s language would lead
`to a series of absurd and unworkable results. Plaintiff’s claims should therefore be dismissed.3
`
`3 As the Court knows, dismissal under Rule 12(b)(6) “can be based on the lack of a
`cognizable legal theory or the absence of sufficient facts alleged under a cognizable legal
`theory.” Balistreri v. Pacifica Police Dep’t, 901 F.2d 696, 699 (9th Cir. 1988). “To survive a
`motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to state a
`claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (internal
`quotation marks and citation omitted). Dismissal should be with prejudice where, as here, the
`flaws in a complaint could not be cured by repleading. See, e.g., Williams v. Nat’l Football
`League, No. C14-1089, 2014 WL 5514378, at *4 (W.D. Wash. Oct. 31, 2014), aff’d, 671 F.
`App’x 424 (9th Cir. 2016).
`MOTION TO DISMISS AND
`MOTION TO STRIKE CLASS ALLEGATIONS
`(No. 2:22-cv-00269-JHC) – 6
`
`
`
`
`
`Perkins Coie LLP
`1201 Third Avenue, Suite 4900
`Seattle, Washington 98101-3099
`Phone: 206.359.8000
`Fax: 206.359.9000
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`
`
`
`Case 2:22-cv-00269-JHC Document 21 Filed 05/16/22 Page 13 of 30
`
`
`
`1.
`Plaintiff alleges no facts showing that AWS “possessed” her data.
`Section 15(a) applies only to private entities “in possession of” biometric data. 740 ILCS
`14/15(a). But Plaintiff does not, and cannot, allege any facts showing that AWS possessed her
`data within the meaning of Section 15(a).
`BIPA does not define “possession.” Courts therefore “assume the legislature intended for
`it to have its popularly understood meaning.” Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d
`1197, 1205 (Ill. 2019) (citations omitted). The Illinois Supreme Court has explained that
`“possession, as ordinarily understood, occurs when a person has or takes control of the subject
`property or holds the property at his or her disposal.” People v. Ward, 830 N.E.2d 556, 560 (Ill.
`2005) (internal quotation marks omitted) (emphasis added); see also Ill. Crim. Pattern Jury Instr.
`4.16 (“actual possession” is “immediate and exclusive control over a thing” and “constructive
`possession” is “both the power and the intention to exercise control over a thing”). The Ninth
`Circuit interprets “possession” similarly. See, e.g., United States v. Kuchinski, 469 F.3d 853, 861
`(9th Cir. 2006) (possession in “electronic context[s]” requires a showing that the person
`“exercises dominion and control over” the relevant material); Ninth Cir. Crim. Model Jury Instr.
`6.15 (“A person has possession of something if the person knows of its presence and has
`physical control of it, or knows of its presence and has the power and intention to control it.”).
`Here, Plaintiff does not allege that AWS controlled or held at its disposal the data that
`Proctor U allegedly uploaded to its S3 bucket. See Ward, 830 N.E.2d at 560. In fact, Plaintiff
`does not even allege that AWS “kn[ew] of [the] presence” of that data, Ninth Cir. Crim. Model
`Jury Instr. 6.15—an unsurprising omission, given that AWS has “[m]illions” of customers,
`Compl. ¶ 2, each of which may have up to 1,000 S3 buckets in their accounts, see Spear