Marquez v. Google LLC

IN THE UNITED STATES DISTRICT COURT

FOR THE NORTHERN DISTRICT OF ILLINOIS

EASTERN DIVISION

)

NICHOLAS MARQUEZ, individually

)

and on behalf of all others similarly

)

situated,

)

No. 20 C 4454

)

Plaintiff,

)

Judge Virginia M. Kendall

)

v.

)

)

GOOGLE LLC,

)

Defendant. )

MEMORANDUM OPINION AND ORDER

Before the Court is Plaintiff’s motion to sever and remand his claim under

§ 15(a) of the Illinois Biometric Information Privacy Act to the Circuit Court of Will

County for lack of Article III standing. Plaintiff’s motion to sever and remand is

granted.

BACKGROUND

In May 2015, according to Plaintiff Nicholas Marquez, Defendant Google LLC

(“Google”) released Google Photos, a photo sharing and storage service. (Dkt. 1-1

¶¶ 8, 20). Marquez alleges that the Google Photos app is pre-installed on Google

Android devices and set by default to automatically upload all photos taken on such

devices to the cloud-based Google Photos service. (Dkt. 1-1 at 22). Marquez contends

that every photo uploaded to Google Photo is scanned by “FaceNet” (Google’s

proprietary facial recognition technology) to extract biometric data and create highly

detailed and sophisticated “face models” of those depicted in the photos. (Dkt. 1-1

¶¶ 20–27). According to Marquez, Google collects, stores, and uses this biometric

data without providing notice, obtaining written consent, or publishing data retention

policies. (Dkt. 1-1 ¶¶ 4, 16). Marquez contends he purchased a Google Android, took

photos of himself with the device, and that these photos were automatically uploaded

to Google Photos. (Dkt. 1-1 ¶¶ 32–33). Marquez claims Google used its FaceNet

technology to extract his biometric data from these photos. (Dkt. 1-1 at 34–37).

Marquez alleges that Google never disclosed it would extract his biometric data,

never obtained his written consent to do so, and never afforded him the opportunity

to prohibit or prevent such extraction. (Dkt. 1-1 at 38–40).

Marquez filed this putative class action in the Circuit Court of Will County,

Illinois, against Google alleging violations of the Illinois Biometric Information

Privacy Act (“BIPA”), 740 ILCS 14/1 et seq on March 23, 2020. (Dkt. 1-1). Specifically,

Marquez alleges Google violated both BIPA § 15(a) and BIPA § 15(b). (Dkt. 1-1

¶¶ 46–55). Google timely removed the suit under 28 U.S.C. § 1453(b) on July 29,

2020, premising jurisdiction on the Class Action Fairness Act, 28 U.S.C. § 1332(d).

(Dkt. 1). Marquez moves to sever and remand his claim under BIPA § 15(a) to state

court for lack of Article III standing. (Dkt. 11). Marquez’s motion to sever and

remand is granted.

LEGAL STANDARD

As the party invoking federal jurisdiction, Google bears the burden of

establishing Marquez’s Article III standing. See Tri-State Water Treatment, Inc. v.

Bauer, 845 F.3d 350, 352–53 (7th Cir. 2017) (explaining that “the party seeking

removal . . . bears the burden of establishing federal jurisdiction”); Collier v. SP Plus

Corp., 889 F.3d 894, 896 (7th Cir. 2018) (“As the party invoking federal jurisdiction,

[Defendant] had to establish that all elements of jurisdiction—including Article III

standing—existed at the time of removal.”). To establish that Marquez has Article

III standing, Google must demonstrate that Marquez alleges an injury-in-fact that

was caused by Google and that is redressable by this Court. See Groshek v. Time

Warner Cable, Inc., 865 F.3d 884, 886 (7th Cir. 2017) (quoting Lujan v. Defenders of

Wildlife, 504 U.S. 555, 560 (1992) (“The ‘irreducible constitutional minimum of

standing consists of three elements: injury-in-fact, causation, and redressability.”).

An injury-in-fact is an injury that is “concrete and particularized” and “actual

and imminent, not conjectural or hypothetical.” Spokeo, Inc. v. Robbins, 136 S. Ct.

1540, 1548 (2016). To be concrete, an injury “must be ‘de facto’; that is, it must

actually exist.” Id. (quoting Black’s Law Dictionary 479 (9th ed. 2009). Although

both “tangible” and “intangible” injuries, even those that are “difficult to prove or

measure,” can be concrete, “a bare procedural violation, divorced from any concrete

harm,” does not “satisfy the injury-in-fact requirement of Article III.” Id. at 1548–49.

A statutory violation must present an “‘appreciable risk of harm to the underlying

interest [the legislature] sought to protect by enacting the statute’” to cause a concrete

injury for Article III standing. Groshek, 865 F.3d at 887 (quoting Meyers v. Nicolet

Rest. of De Pere, LLC, 843 F.3d 724, 727 (7th Cir. 2016).

DISCUSSION

BIPA “regulat[es] the collection, use, safeguarding, handling, storage,

retention, and destruction of biometric identifiers and information.” 740 ILCS

14/5(g). “Biometric identifier” is defined to include a “scan of . . . face geometry.” 740

ILCS 14/10. A biometric identifier is particularly sensitive because, unlike other

unique identifiers such as a social security number, it cannot be “changed,” which

means that “once [it is] compromised, the individual has no recourse [and] is at

heightened risk for identity theft.” 740 ILCS 14/5(c). Recognizing this concern,

Illinois adopted BIPA to protect the privacy of biometric data. See Rosenbach v. Six

Flags Entm’t Corp., 129 N.E.3d 1197, 1206–07 (Ill. 2019). BIPA allows a private right

of action by “[a]ny person aggrieved by a violation.” 740 ILCS 14/20.

At issue here is Marquez’s standing to bring his claim under BIPA § 15(a),

which requires private entities that possess biometric data to develop, publish, and

comply with a written policy that includes a retention schedule and destruction

guidelines. 740 ILCS 14/15(a). In Bryant v. Compass Group USA, Inc., the Seventh

Circuit held that “the duty to disclose under section 15(a) is owed to the public

generally, not to particular persons whose biometric information the entity collects.”

958 F.3d 617, 626 (7th Cir. 2020). Because the plaintiff’s claim in Bryan—that the

defendant failed to establish a written retention schedule and destruction

guidelines—did not include “alleg[ations of] particularized harm that resulted from

[Defendant’s] violation of section 15(a),” it amounted to an alleged procedural

violation insufficient to establish Article III standing. Id. Significantly, the Seventh

Circuit’s holding did not extend to “the provision [of BIPA § 15(a)] requiring

compliance with the established retention schedule and destruction guidelines.” Id.

(emphasis added). Google argues that remand of Marquez’s BIPA § 15(a) claim is

inappropriate because Marquez alleges that Google failed to comply with BIPA

§ 15(a)’s deletion requirements and thereby pleads a violation of individual privacy

rights sufficient for Article III standing. (Dkt. 15 at 1).

Marquez does not allege that Google failed to comply with BIPA § 15(a)’s

deletion requirements. First, when quoting the statutory text, the Complaint omits

the portion of BIPA § 15(a) addressing compliance. Compare 740 ILCS § 15(a) with

(Dkt. 1-1 ¶ 15 omitting “[A] private entity in possession of biometric identifiers or

biometric information must comply with its established retention schedule and

destruction guidelines.”) (emphasis added). Second, the Complaint consistently

characterizes Google’s alleged BIPA § 15(a) violation as a failure to “provide a

publicly available written policy regarding its schedule and guidance for the retention

and permanent destruction of individuals’ biometrics.” (Dkt. 1-1 ¶ 16); see also (Dkt.

1-1 ¶ 26 “In direct violation of § 15(a) of the BIPA, Google does not have written,

publicly available policies identifying their retention schedules, or guidelines for

permanently destroying biometric identifiers or information.”); (Dkt. 1-1 ¶ 53 “Google

does not publicly provide a retention schedule or guidelines for permanently

destroying the ‘biometric identifiers’ and ‘biometric information’ of Plaintiff or Class

members.”). Nowhere does the Complaint address compliance with mandated BIPA

§ 15(a) policies or deletion requirements. Google’s argument that “stor[ed]” really

means “failed to delete” in the context of the Complaint’s BIPA § 15(a) pleading is

unconvincing. Storage is not synonymous with a failure to delete, particularly given

the Complaint’s silence as to when Google collected Marquez’s biometric data, how

long Google retained Marquez’s biometric data, and the date of Marquez’s last

interaction with Google. See (Dkt. 1-1). Moreover, the complaint at issue in Bryant

alleged the defendant stored plaintiff’s biometric data and the Seventh Circuit

nonetheless held the plaintiff lacked Article III standing to pursue the BIPA § 15(a)

claim. See Bryant, 958 F.3d at 619–20. Third, on reply Marquez affirms that his

“Section 15(a) claim arises only from allegations that Google failed to publish the

requisite policies—not from any allegations that Google additionally failed to comply

with Section 15(a)’s mandated deletion or retention schedules.” (Dkt. 16 at 2).

Instead, this Complaint is like that at issue in Bryant. Marquez alleges Google

violated BIPA § 15(a) by failing to publish data retention policies. (Dkt. 1-1 ¶¶ 16,

26, 53). See also Bryant,958 F.3d at 619–20, 626. Like the plaintiff in Bryant,

Marquez does not plead any particularized harm which arose out of Google’s alleged

violation of BIPA § 15(a). See Bryant, F.3d at 626. Marquez lacks standing under

Article III to pursue his BIPA § 15(a) claim in federal court. See id.

When a case is filed in state court and removed to federal court, and when the

federal court finds it lacks subject matter jurisdiction, the appropriate disposition is

a remand to state court under 28 U.S.C. § 1447(c). See Collier v. SP Plus Corp., 889

F.3d 894, 897 (7th Cir. 2018). Where, as here, the court lacks jurisdiction only over

a portion of a suit, it should remand only that portion. See Bergquist v. Mann

Bracken, LLP, 592 F.3d 816, 819 (7th Cir. 2010) (“If some portions of a single suit are

within federal jurisdiction, while others are not, the federal court must resolve the

elements within federal jurisdiction and remand the rest.”). Marquez’s BIPA § 15(a)

claim is severed under Federal Rule of Civil Procedure 21 and remanded to the

Circuit Court of Will County. See Fed. R. Civ. P. 21 (“The court may... sever any

claim against a party.”); see also, e.g., Figueroa v. Kronos, Inc., No. 19 C 1306, 2020

WL 4273995, at *5 (N.D. Ill. Jul. 24, 2020) (severing plaintiffs’ BIPA § 15(a) claim

from their BIPA § 15(b) claim and remanding to state court for lack of subject matter

jurisdiction).

CONCLUSION

For the foregoing reasons, Marquez’s motion to sever and remand his claim

under BIPA § 15(a) is granted. The Clerk of Court is directed to remand case to the

Circuit Court of Will County, Illinois, forthwith.

x oO

A paunial |: HKenstot

Aaah f MME

ginia M. Kendall

United States District Judge

Date: October 27, 2020

Page 7 of 7