Case Information
UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON AT SEATTLE
STEVEN VANCE, et al., CASE NO. C20-1082JLR Plaintiffs, ORDER GRANTING IN PART AND DENYING IN PART v.
MICROSOFT’S MOTION TO DISMISS MICROSOFT CORPORATION, Defendant.
I. INTRODUCTION
Before the court is Defendant Microsoft Corporation’s (“Microsoft”) motion to dismiss Plaintiffs Steven Vance and Tim Janecyk’s (collectively, “Plaintiffs”) complaint. (MTD (Dkt. # 25); Reply (Dkt. # 34).) Plaintiffs oppose the motion. (Resp. (Dkt. # 37).) Having considered the motion, the parties’ submissions regarding the motion, the //
//
// 1 relevant portions of the record, and the applicable law, [1] the court GRANTS in part and DENIES in part the motion to dismiss.
II. BACKGROUND
Facial recognition technology uses computer artificial intelligence and machine learning algorithms to “detect, recognize, verify and understand characteristics of humans faces.” [2] (Compl. (Dkt. # 1) ¶ 23 (quoting Michele Merler, et al. , Diversity in Faces , IBM Research AI at 1 (Apr. 10, 2019)) (“ Diversity in Faces ”).) However, “significant technical hurdles” hinder the technology’s accuracy, and improving that accuracy relies upon “the use of data-driven deep learning to train increasingly accurate models by using growing amounts of data.” ( Diversity in Faces at 1.) In other words, practice makes perfect: for artificial intelligence to more accurately recognize different faces, “vast quantities of images of a diverse array of faces” must be fed to the underlying machine-learning algorithms. (Compl. ¶ 24.)
Microsoft is one of many companies that have developed and produced facial recognition products. ( ¶¶ 3, 52-53.) Among these products are its Cognitive Services Face Application Program Interface and its Face Artificial Intelligence service that allow customers to embed facial recognition technology into their applications. ( ¶ 53.) Microsoft conducts “extensive business within Illinois” related to facial recognition, including selling its facial recognition products through an Illinois -based vendor; working with an Illinois-based business to build new applications for facial recognition technology; and working with Illinois entities to build a “digital transformation institute” that accelerates the use of artificial intelligence throughout society. ( Id. ¶ 59.)
Plaintiffs are Illinois residents who, starting in 2008, uploaded photos of themselves to the photo-sharing website Flickr. ( Id. ¶¶ 6-7, 28, 60-61, 69.) Both were in Illinois when uploading the photos. ( Id. ¶¶ 60, 69.) Unbeknownst to Plaintiffs, Flickr, through its parent company Yahoo!, compiled hundreds of millions of photographs posted on its platform, including those of Plaintiffs and other Illinois residents, into a dataset (“Flickr dataset”) that it then made publicly available to “help improve the accuracy and reliability of facial recognition technology.” ( Id. ¶¶ 29-32.)
Utilizing the Flickr dataset, International Business Machines Corporation (“IBM”) selected one million images to create a new dataset called Diversity in Faces in an effort to reduce bias in facial recognition. ( ¶ 40.) IBM scanned the “facial geometry” of the images and created a “comprehensive set of annotations of intrinsic facial features ,” including craniofacial distances, areas and ratios, facial symmetry and contrast, skin color, age and gender predictions, subjective annotations, and pose and resolution. ( Id. ¶ 41 (citing Diversity in Faces at 2).) Ultimately, IBM utilized “19 facial landmark points” to determine “68 key points for each face” and to extract “craniofacial features” for each image in the dataset. ( ¶¶ 42-43 (citing Diversity in Faces at 9).) Again, the Diversity in Faces dataset included the facial scans of Plaintiffs and other Illinois //
residents, but like Flickr and Yahoo!, IBM did not seek or receive per mission from individuals whose faces were analyzed. ( Id. ¶¶ 44-45.)
IBM made the Diversity in Faces dataset available to other companies seeking to improve their facial recognition technology. ( Id. ¶ 47.) To obtain the dataset, companies applied for permission via an online questionnaire, and if IBM granted access, IBM would send a link for companies to download the dataset. ( Id. ¶ 48.) Those with the dataset, and the corresponding information, could “identify the Flickr user who uploaded the photograph,” “view the Flickr user’s homepage,” and “view each photograph’s metadata, including any available [information] relating to where the photograph was taken or uploaded.” ( Id. ¶ 51.) Microsoft applied for and downloaded the dataset from IBM. ( Id. ¶ 55.) Microsoft used the dataset to improve “the fairness and accuracy of its facial recognition products,” which “improve[d] the effectiveness” of those products and made them “more valuable in the commercial marketplace.” ( Id. ¶¶ 57-58.) Once again, the dataset downloaded by Microsoft contained Plaintiffs ’ information, but Microsoft did not inform or obtain permission from Plaintiffs. ( Id. ¶¶ 56, 65-66, 73-74.)
Plaintiffs bring a class action suit against Microsoft for violating Illinois’s Biometric Information Privacy Act, 740 ILCS 14/1, et seq. (“BIPA”), which regulates the collection, storage and use of biometric identifiers and biometric information (collectively, “biometric data”). ( ¶¶ 4, 17.) Specifically, they allege violations of two BIPA provisions: (1) Microsoft violated § 15(b) by collecting and obtaining biometric data without providing the requisite information or obtaining written releases; and (2) Microsoft violated § 15(c) by unlawfully profiting from individuals’ biometric data. ( ¶¶ 93-106.) Plaintiffs additionally bring an unjust enrichment claim ( id. ¶¶ 107-16) and a separate count for injunctive relief ( id. ¶¶ 117-22).
III. ANALYSIS
When considering a motion to dismiss under Rule 12(b)(6), the court construes the
complaint in the light most favorable to the nonmoving party.
Livid Holdings Ltd. v.
Salomon Smith Barney, Inc.
,
Microsoft moves to dismiss all of Plaintiffs’ claims in its instant motion. ( See MTD.) The court addresses the arguments pertaining to each claim in turn.
A. BIPA Claims
In urging the court to dismiss Plaintiffs’ two BIPA claims, Microsoft first challenges the applicability of BIPA. (MTD at 6-15.) It argues that BIPA does not have extraterritorial effect here and that if it did, BIPA would violate the Dormant Commerce Clause. ( Id. ) Even if BIPA applies, Microsoft contends that Plaintiffs fail to state a claim. ( Id. at 16-22.) The court addresses each argument in turn.
1. Illinois Extraterritorial Doctrine
Microsoft first argues that BIPA was not intended to have exterritorial effect and thus could not apply here because Plaintiffs have not established that the claim occurred in Illinois. ( at 6-9.) The court, like many others that have considered this argument, determines that at this early stage, it cannot dismiss the BIPA claims on this basis.
The parties agree that an Illinois statute does not have an “extraterritorial effect unless a clear intent in this respect appears from the express provisions of the statute.” Avery v. State Farm Mutual Auto. Ins. Co. , 835 N.E.2d 801, 852 (Ill. 2005); (MTD at 6; see Resp. at 4-5.) They further agree that BIPA does not have such an express provision and thus is not authorized to have extraterritorial effect. (MTD at 6; see Resp. at 4-5); see Rivera v. Google Inc. , 238 F. Supp. 3d 1088, 1100 (N.D. Ill. 2017). Noneth eless, Plaintiffs may assert BIPA claims if they sufficiently allege that Microsoft’s purported violations “occur[red] primarily and substantially in Illinois.” See Avery , 835 N.E.2d at 853. The parties disagree on whether Plaintiffs have done so.
There is “no single formula or bright-line test for determining whether a transaction occurs within [Illinois].” at 854. Instead, “each case must be decided on its own facts.” Id. Courts consider a myriad of factors, including the plaintiff’s residency, the location of harm, where communications between parties occurred, and where a company is carrying out the aggrieved policy. Id. For transactions occurring on the Internet, courts may need to consider Internet-specific factors, such as where the site or information was accessed, or where the corporation operates the online practice. See Rivera , 238 F. Supp. 3d at 1101. As illustrated by these factors, whether events occurred primarily and substantially in Illinois is a “highly fact-based analysis that is generally inappropriate for the motion to dismiss stage.” Vance v. IBM Corp. , No. 20 C 577, 2020 WL 5530134, at *3 (N.D. Ill. Sept. 15, 2020) (“ IBM ”).
Accordingly, the majority of courts in BIPA cases to consider the issue at this
stage have denied the motion to dismiss, opting instead to allow discovery for more
information regarding the extent to which the alleged misconduct occurred in Illinois.
See, e.g.
,
Monroy v. Shutterfly, Inc.
, No. 16 C 10984,
While Microsoft is correct that Plaintiffs do not allege where Microsoft obtained
the dataset (
see
MTD at 7), that fact alone may not be dispositive.
See Rivera
, 238 F.
Supp. 3d at 1102 (citing
Avery
,
Microsoft attempts to distinguish those previous cases by arguing that they involve
plaintiffs who “uploaded a photo directly to the defendant’s systems ,” whereas Plaintiffs
did not upload anything directly to Microsoft’s systems. (MTD at 8 (bolding and italics
1
removed).) This argument is unavailing for two reasons. First, Microsoft’s distinction
does not hold true for all cases. In
IBM
—a suit brought by Plaintiffs against IBM for its
part in this chain—the court found dismissal premature even though Plaintiffs did not
upload anything directly to IBM’s systems.
See
The authority Microsoft relies upon are easily distinguishable. In Neals v. PAR Tech. Corp. , 419 F. Supp. 3d 1088 (N.D. Ill. 2019), the plaintiff did not allege that her biometric information was collected in Illinois, and thus, the court could not reason ably infer any connection with Illinois. [3] at 1091. Plaintiffs here have explicitly pleaded their connection with Illinois. (Compl. ¶¶ 6-7, 60-61, 69.) Similarly, in Tarzian v. Kraft //
Heinz Foods Co.
, No. 18 C 7148,
In sum, more discovery is needed to explore whether and to what extent Microsoft’s alleged acts involving the Diversity in Faces dataset occurred in Illinois. For now, Plaintiffs’ allegations are sufficient to withstand dismissal.
2. Dormant Commerce Clause
Building on its extraterritoriality argument, Microsoft next argues that applying BIPA as Plaintiffs allege here would violate the Dormant Commerce Clause. (MTD at 9-15.) Specifically, because Microsoft maintains that it has not “engaged in any relevant conduct in Illinois,” it contends that Plaintiffs’ BIPA claims would allow Illinois law to control transactions outside its boundaries. ( at 10 (bolding and italics removed).)
The Commerce Clause has “long been understood to have a ‘negative’ aspect that
denies the States the power unjustifiably to discriminate against or burden the interstate
flow of articles of commerce,” known as the Dormant Commerce Clause.
Or. Waste
Sys., Inc. v. Dep’t of Env’t Quality of State of Or.
, 511 U.S. 93, 98 (1994);
Daniels
Sharpsmart, Inc. v. Smith
,
As many courts have observed, the Dormant Commerce Clause argument is
directly related to the extraterritoriality effect argument, as both hinge on where the
alleged misconduct takes place.
See In re Facebook
, 2018 WL 2197546, at *4. Thus,
unsurprisingly, most courts in this context have found that the Dormant Commerce
Clause argument is “more properly addressed on a motion for summary judgment.”
See,
e.g.
,
IBM
, 2020 WL 5530134, at *4. In
IBM
, the court concluded that it “need[s] more
detailed facts regarding IBM’s processes to know the extent to which IBM’s actions
occurred in Illinois and whether the Dormant Commerce Clause bars this suit.” ;
see
also Rivera
, 238 F. Supp. 3d at 1104 (“Whether the [BIPA] is nevertheless being
summoned here to control commercial conduct wholly outside Illinois is not possible to
figure out without a better factual understanding of what is happening in the Google
Photos face-scan process.”);
Monroy
,
Again, the court agrees with those that have previously considered the issue. At
this point, the court needs more information about the technology behind how Microsoft
obtained, stores, or uses the Diversity in Faces dataset to conclude that applying BIPA
would run afoul of the Dormant Commerce Clause. Nor does the court have an adequate
basis for determining whether applying BIPA here would, as Microsoft argues, displ ace
the policies of other states. ( MTD at 12-15.) As discussed above, the fact that
Plaintiffs did not directly interact with Microsoft’s systems does not affect the need for
more detailed facts about Microsoft’s processes.
See IBM
,
3. Failure to State a Claim
Finally, Microsoft contends that Plaintiffs fail to state a claim for three reasons.
(MTD at 16-22.) Microsoft first maintains that BIPA does not apply to photographs, and thus, Plaintiffs cannot bring a claim under either §§ 15(b) or 15(c) for facial scans derived from their photographs. ( at 16-19.) Alternatively, Microsoft argues that § 15(b) only applies to “entities who actively ‘collect’” biometric data and that § 15(c) only applies to “the direct provision of biometric data in exchange for money” —neither of which are alleged here. ( at 19-22.) The court disagrees and reviews each contention in turn.
a. BIPA’s Applicability to Photographs BIPA prohibits private entities from gathering or using “biometric identifier[s]” or “biometric information” without notice and consent. 740 ILCS 14/15. A “[b]iometric identifier” is “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILCS 14/10. Biometric identifiers “do not include writing samples, written signatures, photographs, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions such as height, weight, hair color, or eye color.” Id. “Biometric information” means “any information . . . based on an individual’s biometric identifier used to identify an individual” but “does not include information derived from items . . . excluded under the definition of biometric identifiers.” Microsoft reasons that because photographs are not “biometric identifiers,” and “biometric information” does not include information derived from photographs, Plaintiffs’ facial scans created from their photographs do not qualify as either biometric identifiers or biometric information. (MTD at 16.) The court disagrees and holds that the facial scans are “biometric identifiers” under BIPA.
This is not the first—or second, or third, or even fourth—time that defendants
have challenged BIPA’s applicability to facial scans derived from photographs. Every
court has rejected Microsoft’s argument.
[4]
See, e.g.
,
Monroy
, 2017 WL 4099846, at *3
(calling defendant’s reading “sensible enough at first blush” but concluding “it begins to
unravel under scrutiny”). The reason lies in the statute’s plain language, where the
statutory interpretation analysis must begin.
See Lacey v. Village of Palatine
, 904 N.E.2d
18, 25 (Ill. 2009). The court gives the language its plain and ordinary meaning.
Hadley
v. Ill. Dep’t of Corrections
,
Here, the “comprehensive set of annotations of intrinsic facial features” (Compl.
¶ 41) is one of the biometric identifiers listed in BIPA’s plain text: a “scan of . . . face
geometry,” 740 ILCS 14/10;
see, e.g.
,
Rivera
,
At base, Microsoft takes issue with how these scans are captured. It argues that
only scans taken in-person, not from photographs, are biometric identifiers. (
See
MTD at
18.) Put another way, Microsoft wishes to apply the same limitation that is placed on
biometric information to biometric identifiers. 740 ILCS 14/10. But the Illinois
legislature chose not to use terms such as “derived from” when defining biometric
identifier.
See Rivera
, 238 F. Supp. 3d at 1097 (“It would have been simple enough for
the Illinois legislature to include similar ‘based on’ or ‘derived from’ language in the
definition of ‘biometric identifier’ but it did not.” );
see also Dana Tank Container, Inc. v.
Hum. Rts. Comm’n
,
b. Obtaining Biometric Data Under § 15(b) Microsoft argues next that § 15(b) of BIPA is only triggered by those who “actively ‘collect’” biometric data, whereas it “merely ‘possess[es]’” the data. (MTD at 19-21.) Plaintiffs respond that the complaint contains sufficient allegations to establish how Microsoft obtained and used their biometric data, contending that Microsoft “could not have used the [data] unless it first collected or obtained it.” (Resp. at 18.) The court agrees with Plaintiffs.
Again, the analysis begins, and ends, with BIPA’s plain language. The protections under § 15(b) are triggered whenever a private entity “collect[s], capture[s], purchase[s], receive[s] through trade, or otherwise obtain[s]” biometric data. 740 ILCS 14/15(b). The catch-all phrase “otherwise obtain” is not defined by BIPA. See 740 ILCS 14/10. Where a term is undefined, “[i]t is entirely appropriate to employ the dictionary as a resource to ascertain [its] meaning.” Lacey , 904 N.E.2d at 26. “Obtain” is defined as “[t]o come into 1 the possession of,” or “to get, acquire, or secure.” Obtain , Oxford English Dictionary, https://www.oed.com/view/Entry/130002 (last visited Mar. 9, 2021). “Otherwise” means “[i]n a different manner; in another way, or in other ways.” Black’s Law Dictionary 1101 (6th ed. 1990); see also Otherwise , Oxford English Dictionary, https://www.oed.com/view/Entry/133247 (last visited Mar. 9, 2021). Accordingly, in context, § 15(b) is triggered whenever a private entity acquires biometric data in the enumerated ways—collecting, capturing, purchasing, receiving through trade —or gets the biometric data in some other way.
Plaintiffs have sufficiently alleged that Microsoft got its biometric data in some
other way—namely by applying for and downloading the data set from IBM. (
See
Compl. ¶¶ 55-57.) Moreover, Plaintiffs allege that Microsoft used the biometric data to
“improve its facial recognition products and technologies.” ( ¶¶ 57-58.) Contrary to
Microsoft’s contentions, these allegations establish more than “passive ‘possession .’”
(
See
MTD at 20.) Indeed, Microsoft does not explain how it could have come into
possession of or used Plaintiffs’ facial scans without having first obtained it.
See
Figueroa v. Kronos Inc.
,
This straightforward reading of the text does not, as Microsoft fears, produce an absurd result. ( See MTD at 20-21.) BIPA obligates any private entity that obtains a person’s biometric identifier to comply with certain requirements to protect th at person’s privacy interests. 740 ILCS 14/5 (recognizing public’s wariness of use of biometrics and need for regulation for public welfare, security and safety). Whether that biometric information comes from an individual or is part of a large datas et, there is nothing absurd about requiring any entity that obtains such information to comply with the safeguards //
//
Mar. 9, 2021) (defining “collect” as “to gather together”). Because the court finds that Microsoft’s actions qualify under “otherwise obtain,” it need not determine whether these actions could also fall with the meaning of the enumerated terms. 1 that the Illinois legislature deemed necessary. [7] See Neals , 419 F. Supp. 3d at 1092; 740 ILCS 14/5(g). Although complying with BIPA requires entities like Microsoft to take additional steps before acquiring biometric data, the court does not believe that “under Plaintiffs’ reading of the statute, no entity could safely download any large biometric dataset.” ( See MTD at 21 (bolding and italics removed).)
Microsoft relies solely on cases in the employment context ( see id. at 20), and the court acknowledges that there is a “split on . . . whether BIPA governs outside vendors” who provide biometric timekeeping systems to employers, see Figueroa , 454 F. Supp. 3d at 783-84. Analogizing itself to these third-party vendors, Microsoft argues that it also has no relationship with those whose facial scans are in the dataset. The court is unpersuaded. As a preliminary matter, the court observes that most of these cases focus on, as expected, circumstances specific to employment and do not purport to extend beyond that context. [8] See Cameron v. Polar Tech. Indus., Inc. & ADP, LLC , No. 2019-CH-000013 (Ill. Cir. Ct. Aug. 23, 2019) at 33:22-34:3. [9] But more importantly, these cases concern complaints that do not sufficiently plead the role of the third -party, thus warranting dismissal. In Namuwonge v. Kronos, Inc. , the plaintiff alleged that only //
the employer, not the third-party vendor, obtained her fingerprints.
In sum, § 15(b) applies when a private entity collects, captures, purchases, trades for, or gets biometric data in some other way. Plaintiffs allege that Microsoft got the biometric data in some other way by applying for and downloading it from IBM and then used that data to improve its own products. (Compl. ¶¶ 48-49, 55-58.) Such allegations suffice to trigger § 15(b).
c. Profit Under § 15(c) Lastly, Microsoft contends that § 15(c) of BIPA does not apply be cause Plaintiffs have not alleged that it has exchanged biometric data for a pecuniary benefit. (MTD at 21-22.) Section 15(c) states that no private entity may “sell, lease, trade, or otherwise profit from” the biometric data in its possession. 740 ILCS 14/15(c). Microsoft argues that sell, lease, trade, and profit “all contemplate the direct provision of biometric data in exchange for money,” which doesn’t reach the “indirect ‘profit’” of improving its facial //
1 recognition products. (MTD at 22.) The court determines that supplemental briefing is needed and thus defers ruling on the issue.
The question of what “otherwise profit from” means in § 15(c) is a novel issue. However, neither party spends more than a page briefing the issue, nor do they offer any authority analyzing this provision. [10] ( See MTD at 21-22; Resp. at 22-23; Reply at 10-11.) The parties focus instead on the doctrine of ejusdem generis and whether it applies to verbs. ( See MTD at 22; Resp. at 22; Reply at 11.) The court additionally recognizes that the parties’ briefing was completed in the fall of 2020, and there is the possibility that more recent case law has analyzed this issue since that time. Thus, the court finds additional briefing would be beneficial and defers ruling on this issue. The court directs the parties to file responses to this order addressing t he definition of “otherwise profit from” in the context of § 15(c), including an analysis of any recent case law that bears on the issue. The parties’ responses for this issue and the choice-of-law issue, see infra § III.B, shall total no more than 15 pages and be filed by Friday, March 26, 2021, at 5:00 p.m. There shall be no replies unless otherwise ordered by the court. B. Unjust Enrichment Claim
Microsoft next challenges Plaintiffs’ unjust enrichment claim as insufficiently pleaded under Washington law. (MTD at 22-24.) Plaintiffs respond that the claim is //
sufficiently pleaded under Illinois law. (Resp. at 23-24.) Thus, the court must resolve a choice-of-law question before determining whether the unjust enrichment claim survive s.
A federal court sitting in diversity applies the choice -of-law rules of its forum state
to determine which substantive law controls.
Kohlrautz v. Oilmen Participation Corp.
,
An actual conflict between Washington and Illinois law exists over whether
Plaintiffs must plead that they suffered an economic expense distinct from a privacy
harm. An actual conflict exists when the two laws “could produc e different outcomes on
the same legal issue.” at 550. In Washington, alleging a non-economic loss, such as a
loss of privacy, is insufficient because “Washington courts have not applied the doctrine
of unjust enrichment outside the context of an ‘exp ense’ stemming from some tangible
economic loss to a plaintiff.”
Cousineau v. Microsoft Corp.
,
over their biometric data” sufficiently states an unjust enrichment claim. Vance , 2020 WL 5530134, at *5. Microsoft does not argue otherwise. ( See MTD at 22-24; Reply at 12.) Because the two laws would produce different outcomes on this legal issue, the court determines that there is an actual conflict between Washington and Illinois law.
Because there is an actual conflict, the court must apply Washington’s “most
significant relationship” test to determine which law governs.
Coe v. Philips Oral
Healthcare Inc.
, No. C13-0518MJP, 2014 WL 5162912, at *3 (W.D. Wash. Oct. 14,
2014). First, the court considers the states’ relevant contacts to the cause of action, and if
those contacts are balanced, the court must then consider “the interests and public
policies of [the two] states and . . . the manner and extent of such policies as they relate to
the transaction in issue.”
Johnson
,
The court concludes that further briefing from the parties on this issue would be beneficial. Accordingly, the court defers ruling on Microsoft’s motion to dismiss Plaintiffs’ unjust enrichment claim. The court further directs the parties to file responses to this order on the question of which state law should govern under Washington’s “most significant relationship” test. In particular, the parties should touch on how the contacts analysis differs, if at all, for an unjust enrichment claim in a privacy suit and address whether further factual development is needed to analyze the states’ relevant contac ts. The parties’ responses addressing the choice-of-law issue and the aforementioned § 15(c) issue, see supra § III.A.3.c, shall total no more than 15 pages and be filed by Friday, March 26, 2021, at 5:00 p.m . There shall be no replies unless otherwise ordered . C. Injunctive Relief
Lastly, Microsoft asserts that Plaintiffs’ count for injunctive relief must be dismissed. (MTD at 24.) The court agrees that “[i]njunctive relief is a remedy, not a cause of action.” Edifecs Inc. v. TIBCO Software Inc. , No. C10-0330RSM, 2011 WL 1045645, at *3 (W.D. Wash. 2011). Plaintiffs do not argue otherwise. ( Resp.) Accordingly, the court dismisses Plaintiffs’ standalone injunctive relief claim, but Plaintiffs may pursue injunctive relief in connection with its other claims.
//
//
//
//
//
//
//
//
// IV. CONCLUSION For the foregoing reasons, the court GRANTS in part and DENIES in part Microsoft’s motion to dismiss (Dkt. # 25). Specifically, the court GRANTS the motion to dismiss Plaintiffs’ injunctive relief claim but DENIES the motion as it applies to Plaintiffs’ BIPA § 15(b) claim. The court DEFERS ruling on Plaintiffs’ BIPA § 15(c) and unjust enrichment claims and further DIRECTS the parties to file responses on those two issues as identified above. These responses shall not exceed 15 pages and must be filed by Friday, March 26, 2021, at 5:00 p.m .
Dated this 15th day of March, 2021.
A JAMES L. ROBART United States District Judge
Notes
[1] Both parties request oral argument (MTD at 1; Resp. at 1), but the court finds oral argument unnecessary to its disposition of the motion, see Local Rules W.D. Wash. LCR 7(b)(4).
[2] For the purposes of a motion to dismiss, the court accepts all well-pleaded allegations in
Plaintiffs’ complaint as true and draws all reasonable inferences in favor of Plaintiffs.
See Wyler
Summit P’ship v. Turner Broad. Sys., Inc.
,
[3] Like Microsoft, the defendant in
Neals
was a non-resident corporation with no
allegations that it had property or stored data in Illinois.
[4] Recognizing the weight of authority against it, Microsoft maintains that all those cases
were wrongly decided. (MTD at 17-18.) For instance, Microsoft states that
Rivera
did not
“properly account for BIPA Section 5,” which lists only in-person transactions as examples that
are regulated. ( at 18.) Not so.
See Rivera
,
[5] Because the text is “plain and unambiguous,” the court need not consider Microsoft’s
21
legislative history arguments.
See Ultsch v. Ill. Mun. Ret. Fund
,
[6] Obtaining biometric data via a download could also qualify as “collecting” that data. See Collect , Oxford English Dictionary, https://www.oed.com/view/Entry/36263 (last visited
[7] Indeed, it stands to reason that if the Illinois legislature were concerned about individual collection of biometric data that could compromise identity—which Microsoft seems to have no qualms with ( see MTD at 20-21)—the legislature would be equally, if not more concerned about that data being shared in large swaths accessible through download.
[8] BIPA may very well treat the use of biometric data in employment differently, as the statute defines “written release” differently in the employment context. See 740 ILCS 14/10. 21
[9] Microsoft attaches the transcript of the Cameron court’s oral ruling as an exhibit to its motion to dismiss. ( MTD, Ex. E.)
[10] The court acknowledges that Plaintiffs filed a Notice of Supplemental Authority 21 identifying a recent case that may bear on this analysis. ( Not. of Supp. Authority (Dkt. # 35).) However, neither party has had a chance to meaningfully apply the identified case to the allegations here.