525 F.Supp.3d 1287
W.D. Wash.2021Background
- Plaintiffs are Illinois residents who uploaded photos to Flickr while in Illinois; Flickr/Yahoo compiled a large public photo dataset and IBM created the "Diversity in Faces" dataset by selecting ~1 million images and extracting facial-geometry annotations without individuals' consent.
- IBM made the Diversity in Faces dataset available to companies by application; Microsoft applied for, downloaded, and used the dataset to improve its facial-recognition products, allegedly including scans of the plaintiffs.
- Plaintiffs brought a putative class action alleging violations of Illinois' Biometric Information Privacy Act (BIPA) §§ 15(b) and 15(c), plus unjust enrichment and a standalone injunctive-relief claim.
- Microsoft moved to dismiss, arguing (among other things) that BIPA lacks extraterritorial effect here, that application would violate the Dormant Commerce Clause, that facial scans from photos are not covered, that Microsoft merely possessed (not "obtained") the data, and that § 15(c) does not reach indirect profit.
- The court denied dismissal on the extraterritoriality and Dormant Commerce Clause grounds (finding factual development necessary), held that facial scans derived from photographs qualify as "biometric identifiers" under BIPA, found Plaintiffs adequately alleged Microsoft "obtained" the data under § 15(b), deferred ruling on § 15(c) and unjust enrichment pending supplemental briefing, and dismissed the standalone injunctive-relief claim (remedy may be sought through other claims).
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Extraterritorial application of BIPA | Plaintiffs are Illinois residents whose photos were uploaded in Illinois and harms are centered in Illinois | BIPA lacks extraterritorial effect; claims did not "occur primarily and substantially" in Illinois | Denied dismissal; factual inquiry is needed — allegations suffice at pleading stage to proceed to discovery |
| Dormant Commerce Clause | Application of BIPA to protect Illinois residents' privacy is permitted | Applying BIPA here would regulate commerce wholly outside Illinois and burden interstate commerce | Denied dismissal; resolution deferred pending factual development about where misconduct occurred |
| Are facial scans from photographs "biometric identifiers" under BIPA? | Facial-geometry templates derived from photos are scans of face geometry and thus biometric identifiers | Photographs are excluded from the definition and derivatives shouldn't qualify | Held for plaintiffs — facial scans qualify as biometric identifiers; § 15(b) claim survives |
| Does § 15(b) require active collection from the individual (vs. download/possession)? | Microsoft obtained the dataset by applying for and downloading from IBM; that is an "obtain" under § 15(b) | § 15(b) applies only to entities that actively collect directly from individuals; mere possession is insufficient | Held for plaintiffs — "otherwise obtain" covers downloading from IBM; § 15(b) claim survives |
| Meaning of "otherwise profit from" in § 15(c) (sale/profit) | Using dataset to improve products yields commercial value and thus profits from biometric data | § 15(c) targets direct exchange/sale of biometric data for money, not indirect product improvement | Deferred — court requested supplemental briefing and reserved ruling |
| Unjust enrichment (choice-of-law) | Plaintiffs rely on Illinois law recognizing privacy-based unjust enrichment | Microsoft argues Washington law governs and requires a distinct economic expense | Deferred — court found an actual conflict and ordered briefing under Washington's most-significant-relationship test |
| Injunctive relief as a standalone claim | Plaintiffs pleaded an independent injunctive-relief count | Microsoft: injunctive relief is a remedy, not an independent cause of action | Dismissed standalone injunctive-relief claim; remedy may be sought via surviving claims |
Key Cases Cited
- Avery v. State Farm Mut. Auto. Ins. Co., 835 N.E.2d 801 (Ill. 2005) (test for when Illinois statutes have extraterritorial effect)
- Rivera v. Google Inc., 238 F. Supp. 3d 1088 (N.D. Ill. 2017) (holding face templates from photos can be biometric identifiers and analyzing extraterritorial questions)
- In re Facebook Biometric Info. Privacy Litig., 326 F.R.D. 535 (N.D. Cal. 2018) (addressing extraterritorial and related discovery issues in BIPA suits)
- Neals v. PAR Tech. Corp., 419 F. Supp. 3d 1088 (N.D. Ill. 2019) (distinguishable dismissal where plaintiff failed to allege collection in Illinois)
- Figueroa v. Kronos Inc., 454 F. Supp. 3d 772 (N.D. Ill. 2020) (discussing possession v. obtaining biometric data)
- Cousineau v. Microsoft Corp., 992 F. Supp. 2d 1116 (W.D. Wash. 2012) (Washington law on unjust enrichment requiring an economic expense)
- Healy v. Beer Inst., 491 U.S. 324 (U.S. 1989) (Dormant Commerce Clause limits on state regulation of out-of-state commerce)
- Ashcroft v. Iqbal, 556 U.S. 662 (U.S. 2009) (pleading standard for plausibility on motion to dismiss)
- Bell Atl. Corp. v. Twombly, 550 U.S. 544 (U.S. 2007) (context for Rule 12(b)(6) plausibility standard)