MELISSA THORNLEY, еt al., Plaintiffs-Appellees, v. CLEARVIEW AI, INC., Defendant-Appellant.
No. 20-3249
United States Court of Appeals For the Seventh Circuit
ARGUED JANUARY 4, 2021 — DECIDED JANUARY 14, 2021
Before EASTERBROOK, WOOD, and HAMILTON, Circuit Judges.
Appeal from the United States District Court for the Northern District of Illinois, Eastern Division. No. 20-cv-3843 — Sharon Johnson Coleman, Judge.
The question now before us is whether, on the allegations of the operative complaint, the plaintiffs—Melissa Thornley and others, on behalf of themselves and a proposed class—have shown standing. (For convenience, we refer only to Thornley, unless the context requires otherwise.) Oddly, Thornley insists that she lacks standing, and it is the defendant, Clearview AI, Inс., that is championing her right to sue in federal court. That peculiar line-up exists for reasons that only a civil procedure buff could love: the case started out in an Illinois state court, but Clearview removed it to federal court. Thornley wants to return to state court to litigate the BIPA claims, but Clearview prefers a federal forum. The case may stay in federal court, however, only if the more stringent federal standards for standing can be satisfied; Illinois (as is its right) has a more liberal attitude toward the kinds of cases its courts are authorized to entertain. The district court held that Thornley has alleged only a bare statutory violation, not the kind of concrete and particularized harm that would support standing, and thus ordered the action remanded to the state court. Because the case meets the criteria of the Class Action Fairness Act,
Our description of the factual background of the case is necessarily brief because we have only the pleadings before us. We accept Thornley‘s account for present purposes. Clearview is in a business that would have been impossible to imagine a generation ago. Foundеd in 2017, it designed a facial recognition tool that takes advantage of the enormous amount of information that floats around the Internet. Users may download an application (“App“) that gives them access to Clearview‘s database.
Clearview uses a proprietary algorithm to “scrape” pictures from social media sites such as Facebook, Twitter, Instagram, LinkedIn, and Venmo. The materials that it uses are all publicly available. The scraping process is not designed, however, simply to store photographs. Instead, Clearview‘s software harvests from each scraped photograph the biometric facial scan and associated metadata (for instance, time and place stamps), and that information is put onto its database. The database, which is stored on servers in New York and New Jersey, at this point contains literally billions of entries.
Clearview offers access to this database for users who wish to find out more about someone in a photograph—perhaps to identify an unknown person, or perhaps to confirm the identity of a person of interest. Many, though not all, of its clients are law-enforcement agencies. The user purchases access to Clearview‘s resources and, using the App, uploads her photograph to its site. Clearview then creates a digital facial scan of the person in the photograph and compares the new facial scan to those in its vast database. If it finds a match, it returns a geotagged photograph (not the facial scan) to the
In the beginning, Clearview appears to have kept a rather low profile. But on January 18, 2020, The New York Times published an article about Clearview and its extensive database. See Kashmir Hill, “The Secretive Company That Might End Privacy as We Know It,” The New York Times, Jan. 18, 2020, https://www.nytimes.com/2020/01/18/technology/clearview-privacy-facial-recognition.html. A rash of lawsuits followed in the wake of the article. See, e.g., Mutnick v. Clearview AI, Inc., No. 1:20-cv-00512 (N.D. Ill.); Roberson v. Clearview AI, Inc., No. 1:20-cv-00111 (E.D. Va.); Calderon v. Clearview AI, Inc., No. 1:20-cv-01296 (S.D.N.Y.); Burke v. Clearview AI, Inc., No. 3:20-cv-00370 (S.D. Cal.). This case was one of them. Notably, Thornley did not choose a federal forum; instead, she filed her case in state court—specifically, the Circuit Court of Cook County. Her initial complaint, filed on behalf of herself and a class on March 19, 2020, asserted violations of three subsections of BIPA:
In certain circumstances, met here, plaintiffs are entitled to take that action without leave of court should they so desire. See
II
Ordinarily, it is the plaintiff who bears the burdеn of demonstrating that the district court has subject-matter jurisdiction over her case and that it falls within “the Judicial Power” conferred in Article III. But more generally, the party that wants the federal forum is the one that has the burden of establishing the court‘s authority to hear the case. See Schur v. L.A. Weight Loss Centers, Inc., 577 F.3d 752, 758 (7th Cir. 2009); Brill v. Countrywide Home Loans, Inc., 427 F.3d 446, 447 (7th Cir. 2005). As applied here, that means that Clearview must show that Thornley (as well as her co-plaintiffs) has Article III standing.
The Supreme Court‘s most recent restatement of the rules governing standing appears in Thole v. U.S. Bank N.A., 140 S. Ct. 1615 (2020):
To establish standing under Article III of the Constitution, a plaintiff must demonstrate (1) that he or she
suffered an injury in fact that is concrete, particularized, and actual or imminent, (2) that the injury was caused by the defendant, and (3) that the injury would likely be redressed by the requested judicial relief.
Id. at 1618, citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 560–61 (1992). See also Spokeo, 136 S. Ct. at 1547. In the case before us, there is no serious dispute about the second and third of those requirements: whatever injury Thornley suffered occurred at Clearview‘s hands, and one can imagine a number of ways in which that injury could be remedied by a court. We say this not because the parties have agreed on those points. No such agreement would be binding on the court. But the record tells us enough about the nature and source of the injury to support this conclusion. We thus focus exclusively on the injury-in-fаct requirement.
This appeal is far from our first encounter with BIPA, though we have not had occasion in the past to consider section 15(c). Our earlier cases, however, provide important context for our consideration of the standing issue presented here, and so we take a moment to review their central holdings.
The first in this line was Miller v. Southwest Airlines Co., 926 F.3d 898 (7th Cir. 2019). The immediate question was whether employees of Southwest Airlines who contended that the company had violated BIPA in the operation of its timekeeping system had to present their claims to an adjustment board, as spelled out in the Railway Labor Act, or if the court was the рroper forum. Id. at 900. Before the court could reach that issue, however, it had to decide whether the employees had standing under Article III to pursue the litigation. It concluded that they did. If there were some problem in the use of
The prospect of a material change in workers’ terms and conditions of employment gives these suits a concrete dimension that Spokeo, Groshek [v. Time Warner Cable, Inc., 865 F.3d 884 (7th Cir. 2017)], and Casillas [v. Madison Ave. Assocs., Inc., 926 F.3d 329 (7th Cir. 2019)] lacked. Either the discontinuation of the practice, or the need for the air carriers to agree to higher wages to induсe unions to consent, presents more than a bare procedural dispute. See Robertson v. Allied Solutions, LLC, 902 F.3d 690, 697 (7th Cir. 2018) (“Article III‘s strictures are met not only when a plaintiff complains of being deprived of some benefit, but also when a plaintiff complains that she was deprived of a chance to obtain a benefit.“).
Id. at 902. The Miller opinion did not distinguish further among the various subsections of BIPA § 15.
We returned to BIPA in Bryant v. Compass Group USA, Inc., 958 F.3d 617 (7th Cir. 2020). There the plaintiff‘s employer had installed in its cafeteria some “Smart Market” vending machines owned by the defendant, Compass Group. In order to use the machines, a patron had to establish an account using her fingerprint. Section 15(a) of BIPA requires collectоrs of biometric information to make publicly available a retention schedule and guidelines for permanently destroying the information they obtain. Section 15(b) of BIPA requires the collector to inform those from whom it is collecting information that it is doing so, and to disclose the purpose of the collection and the length of the retention. It also requires the collector to obtain written consent from the affected person. Bryant
Our decision hewed closely to the facts and allegations before us. As amended on the petition for rеhearing, the opinion emphasized that Bryant‘s claim under section 15(a) rested exclusively on Compass‘s failure to develop a “written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information[.]” Id. § 15(a). We found that this duty is “owed to the public generally, not to particular persons whose biometric data the entity collects.” 958 F.3d at 626. In other words, Bryant‘s injury in this respect was not particularized, and thus it did not demonstrate injury-in-fact for Article III purposes. We left open the question whether a different allegation under seсtion 15(a)—one based on the language requiring a collector to comply with its established retention and destruction criteria—might call for a different result. Finally, we found that Bryant‘s allegations that Compass had violated section 15(b)‘s requirement both to inform those from whom it was collecting data that it was doing so and why, and to obtain their written consent, was both concrete and particularized, and thus were enough to support standing.
The question under section 15(a) that we reserved in Bryant did not remain unexamined for long. In Fox v. Dakkota Integrated Systems, LLC, 980 F.3d 1146 (7th Cir. 2020), plaintiff Fox contended that Dakkota, her former employer, had violated section 15(a) by failing to comply with its data retention and destruction policies. As in this case, Fox had initiаted her action in state court, Dakkota had removed to federal court, and the question before us was whether the case had to be
Two other points are important to understanding our approach to these cases. First, an important corollary to the rule that injury-in-fact must be both concrete and particularized, see Spokeo, 136 S. Ct. at 1548–49, is the requirement that “the plaintiff must clearly allege facts demonstrating each element.” Id. at 1547 (cleaned up). In other words, allegations matter. One plaintiff may fail to allege a particularized harm to himself, while another may assert one. For example, in Casillas (which dealt with the Fair Debt Collection Practices Act, not BIPA), we gave dispositive weight to the fact that the plaintiff had not pleaded that her receipt of a letter that allegedly failed to comply with the statute had caused her any harm—indeed, had any effect whatsoever on her. 926 F.3d at 334–35. As the case reached us, “Casillas had no more use for the notice than she would have had for directions accompanying a product that she had no plans to assemble.” Id. at 334. That was not enough to support her standing to sue, but nothing in the opinion implied that every recipiеnt of a similarly nonconforming letter would be in the same position. Similarly, as the difference between the treatment of section 15(a)
Second, the fact that a “bare procedural violation” does not suffice to support an injury-in-fact made some people wonder whether there is a distinction between alleged procedural injuries and alleged substantive injuries. We clarified in Larkin v. Finance System of Green Bay, Inc., 982 F.3d 1060, 1066 (7th Cir. 2020), that no such line exists. Article III must be satisfied no matter what kind of violation is asserted.
III
Thornley‘s complaint raises only one claim under BIPA: that Clearview violated section 15(c). (The fact that she had filed the earlier action and then voluntarily dismissed it is of no legal relevance, except for purposes of the two-dismissal rule, which has not been triggered here.) That subpart reads as follows:
(c) No private entity in possession of a biometric identifier or biometric information may sell, lease, trade, or otherwise profit from a person‘s or a customer‘s biometric identifier or biometric information.
All current Illinois citizens whose biometric identifiers or biometric information were [sic], without their knowledge, included in the Clearview AI Database at
any time from January 1, 2016 to January 17, 2020 (the “Class Period“) and who suffered no injury from Defendant‘s violation of Section 15(c) of BIPA other than statutory aggrievement … .
Similarly, the complaint concedes that none of the named plaintiffs, and no class membеr, “suffered any injury as a result of the violations of Section 15(c) of BIPA other than the statutory aggrievement alleged in Paragraph 38.” Complaint, ¶ 39.
Taking the position that these allegations did not suffice to show a lack of Article III standing, Clearview removed the case to federal court. The district court saw things differently. Noting that a plaintiff is the master of her own complaint, the court held that the particular allegations before it raised questions only about a general regulatory rule found in BIPA: no one may profit in the specified ways from another person‘s biometric identifiers or information.
On appeal, Clеarview urges us to equate a person‘s potential injury from the sale (or lease, etc.) of her data with the injury from retention of that data that we recognized in Fox, or the injury we recognized in Bryant from the collection of that data and the failure to obtain written consent. We have no quarrel with the idea that a different complaint might reflect that type of equivalence. A plaintiff might assert, for example, that by selling her data, the collector has deprived her of the opportunity to profit from her biometric information. Or a plaintiff could assert that the act of selling her data amplified the invasion of her privacy that occurred when the data was first collected, by disseminating it to some unspecified number of other people. Perhaps a plaintiff might assert that the scraping of data from social media sites raises the cost of
Without any such allegations of concrete and particularized harm to the plaintiffs, we are left with a general rule that prohibits the operation of a mаrket in biometric identifiers and information. If it is not profitable to collect or hold that data, one can assume that the incentive to collect it or hold it will be significantly reduced. Much the same rationale supports other laws that are directed against market transactions. Regulations implementing the Eagle Protection Act and the Migratory Bird Treaty Act, for example, permit the possession or transportation of certain migratory birds, and their parts, nests, or eggs, but they state that these items “may not be imported, exported, purchased, sold, bartered, or offered for purchase, sale, trade, or barter.” Andrus v. Allard, 444 U.S. 51, 54 (1979) (citing
One final question remains: may the plaintiffs, by seeking to represent a class that includes only persons who suffered no injury from the alleged violation of section 15(c), prevent the district court from taking a broader view of the case? We wondered whether such a holding would be consistent with the Supreme Court‘s decision in Standard Fire Insurance Co. v. Knowles, 568 U.S. 588 (2013). That case involved a putative class action that was commenced in an Arkansas state court against Standard Fire; plaintiffs alleged that underpayments had injured “hundreds, and possibly thousands” of policyholders. Id. at 591. Relying on the Class Action Fairness Act, which confers jurisdiction on the district courts in cases where minimal diversity exists and the amount in controversy exceeds $5,000,000,
The Supreme Court held that the stipulation was not, and could not be, binding on the plaintiff class, аnd thus that it was ineffective to defeat the removal. It explained that “a plaintiff who files a proposed class action cannot legally bind members of the proposed class before the class is certified.” Id. at 593. Because the district court had not evaluated the adequacy of the amount in controversy independently from the stipulation, the Court remanded for further proceedings.
The situation in Thornley‘s case is different. She does not contest either the existence of minimal diversity (she is a citizen of Illinois, and Clearview is a citizen of Delaware and New York) or the fact that more than $5,000,000 is at stake. Instead, she has simply offered a class definition that is narrower than it might have been. We have no reason to believe that the district court, acting on its own initiative, would certify a different and broader class; to that extent, the rule that the plaintiff controls her own case applies. And unlike the situation in Standard Fire, people who fall outside Thornley‘s class definition are totally unaffected by this litigation. If they wish to sue Clearview, either alone or under a class definition that includes an allegation of injury, they are free to do so. Indeed, as we noted earlier, there are a number of class actions pending against Clearview, many of which appear to be broader than this one. We know of nothing that would prevent a putative class representative from taking a conservative approach to class definition. And if the plaintiffs change their tune in the state court, Clearview will be able to attempt to remove again to federal court, though we do not predict the outcome of such an effort. See
Our job is to decide whether Thornley and her co-plaintiffs have Article III standing to pursue the case they have presented in their complaint. We have concluded that they do not: thеy have described only a general, regulatory violation, not something that is particularized to them and concrete. It is no secret to anyone that they took care in their allegations, and especially in the scope of the proposed class they would like to represent, to steer clear of federal court. But in general, plaintiffs may do this. As long as their allegations are in good faith, they may include non-diverse parties as defendants. Outside of the clumsily named area of “complete preemption,” they may choose to rely exclusively on state law and avoid fedеral-question jurisdiction. And here, they may take advantage of the fact that Illinois permits BIPA cases that allege bare statutory violations, without any further need to allege or show injury. See Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186 ¶¶ 22–23.
We express no opinion on the adequacy of Thornley‘s complaint as a matter of Illinois law. That will be for the state court to address. We hold only that on the basis of the allegations of this complaint, the district court correctly decided that Thornley and the other plaintiffs did not present a case that lies within the boundaries set by Article III, and so the court properly remanded the case to the state court.
AFFIRMED.
First, our decision has been determined by the choices that these plaintiffs have made to narrow both their claims and the scope of their proposed class. Judge Wood‘s opinion recognizes that other plaintiffs might well establish standing for other alleged violations of Section 15(c). Ante at 11–12. Add to those possibilities a person who has consented to collection, retention, and use of her biometric information, perhaps for non-profit scientific research, but who objects to the sale of her data to a third party. The resulting injury in such cases would be comparable to injuries in invasion-of-privacy and unjust-enrichment cases that the law has long recognized. See Restatement (Second) of Torts § 652C (1977) (appropriation of another‘s name or likeness for one‘s own use or benefit); Restatement of Restitution § 136 (1937) (“A person who has tortiously used a trade name, trade secret, franchise, profit a prendre, or other similar interest of another, is under a duty to restitution for the value of the benefit received thereby.“); see also Robertson v. Allied Solutions, LLC, 902 F.3d 690, 697 (7th Cir. 2018) (plaintiff may show standing by alleging she was deprived of a benefit but also by alleging she was deprived of a chance to obtain a benefit). In fact, the misuse of a person‘s biometric information presents an especially dangerous modern version of these traditional injuries. A victim of identity theft can obtain a new email address or even Social Security number, but “biometric identifiers … are immutable, and once compromised, are compromised forever.” Fox v. Dakkota Integrated Systems LLC, 980 F.3d 1146, 1155 (7th Cir. 2020)).
Third, the briefs in this case address very recent decisions by this court finding that private plaintiffs lacked standing when they alleged intangible harm based on violations of other consumer-protection statutes. See Nettles v. Midland Funding, LLC, 983 F.3d 896 (7th Cir. 2020) (FDCPA); Bazile v. Finance System of Green Bay, Inc., 983 F.3d 274 (7th Cir. 2020) (FDCPA); Spuhler v. State Collection Service, Inc., 983 F.3d 282 (7th Cir. 2020) (FDCPA); Gunn v. Thrasher, Buschmann & Voelkel, P.C., 982 F.3d 1069 (7th Cir. 2020) (FDCPA); Brunett v. Convergent Outsourcing, Inc., 982 F.3d 1067 (7th Cir. 2020) (FDCPA); Larkin, 982 F.3d at 1066; Groshek v. Time Warner Cable, Inc., 865 F.3d 884 (7th Cir. 2017) (Fair Credit Reporting Act). The most recent cases under the Fair Debt Collection Practices Act rely on our decision creating a circuit split in Casillas v. Madison Avenue Associates, Inc., 926 F.3d 329, 335–36 (7th Cir. 2019), disagreeing with Macy v. GC Services Ltd. P‘Ship, 897 F.3d 747 (6th Cir. 2018); see also Casillas, 926
On the other side of this issue over standing for intangible harms to consumers, see our previous cases under the Biometric Information Privacy Act discussed in Judge Wood‘s opinion, including Fox v. Dakkota Integrated Systems, LLC, 980 F.3d 1146 (7th Cir. 2020); Bryant v. Compass Group USA, Inc., 958 F.3d 617 (7th Cir. 2020); and Miller v. Southwest Airlines Co., 926 F.3d 898 (7th Cir. 2019), as well as Gadelhak v. AT&T Services, Inc., 950 F.3d 458, 462–63 (7th Cir. 2020) (unwelcome text messages under Telephone Consumer Protection Act), and Lavallee v. Med-1 Solutions, 932 F.3d 1049, 1053 (7th Cir. 2019) (omitted notice of rights under FDCPA). I confess that I have not yet been able to extract from these different lines of cases a consistently predictable rule or standard.
Much of the debate over standing in these cases stems from the Supreme Court‘s decision in Spokeo, Inc. v. Robbins, 136 S. Ct. 1540 (2016), a decision on standing under the Fair Credit Reporting Act. The Court told us that standing requires “concrete” injury but that “intangible injuries can nevertheless be concrete.” Id. at 1548–49. This Delphic instruction raised more questions than it answеred. Many arise under federal consumer-protection statutes that use common regulatory techniques: ensure that the consumer/debtor/borrower/investor/retiree has accurate and reliable information for her decisions, and require specific procedures, including notice and opportunity to respond before adverse action is taken that may affect her.
The lower federal courts have already spilled a great deal of ink interpreting the Supreme Court‘s statement in Spokeo
At the same time, Spokeo taught that “both history and the judgment of Congress play important roles” in determining whether an intangible injury can be sufficiently concrete to support standing. Id. at 1549, discussing Lujan v. Defenders of Wildlife, 504 U.S. 555, 578 (1992) (Congress “may elevat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law“), and id. at 580 (opinion of Kennedy, J.) (“Congress has the power to define injuries and articulate chains of causation that will give rise to a case or controversy where none existed before.“).
The legislative power of Congress to protect consumers (and debtors, borrowers, investors, etc.) by granting informational and procedural rights, as well as private rights of action to enforce them, has enormous practical importance. That importance is only growing with the pace of technological change. To illustrate, one need only imagine Congress soon trying to draft a federal cousin to the Illinois statute we consider here. It will need to decide whether to create a private right of action to enforce individual rights rather than leave enforcement entirely to a federal agency. Many post-Spokeo decisions in this and other circuits impose constitutional limits that will make that a difficult task.
With respect, I believe that several of our recent opinions take Spokeo too far. Those opinions do not give sufficient
I will not belabor the point further here, particularly in light of the time constraints imposed on deciding this appeal under