Hazlitt v. Apple Inc.

IN THE UNITED STATES DISTRICT COURT

FOR THE SOUTHERN DISTRICT OF ILLINOIS

ROSLYN HAZLITT, JANE DOE, by

and through Next Friend JOHN DOE,

RICHARD ROBINSON, and

YOLANDA BROWN, on behalf of

themselves and all other similarly

situated,

Plaintiffs,

v. Case No. 3:20-CV-421-NJR

APPLE INC.,

Defendant.

MEMORANDUM AND ORDER

ROSENSTENGEL, Chief Judge:

On March 2, 2020, Plaintiffs Roslyn Hazlitt, Jane Doe, a minor, by and through

Next Friend John Doe, Richard Robinson, and Yolanda Brown (“Plaintiffs”) filed a

putative Class Action Complaint against Defendant Apple Inc. (“Apple”) in the Circuit

Court for the Twentieth Judicial Circuit in St. Clair County, Illinois. (Doc. 1-1). Plaintiffs

allege Apple violated sections 14/15(a)-(c) of Illinois’s Biometric Information Privacy Act

(BIPA), 740 ILL. COMP. STAT. § 14/1 et seq., by collecting, possessing, and profiting from

Plaintiffs’ facial geometries through the use of its Photos app. (Id. at ¶¶ 1, 3).

Apple subsequently removed the action to this Court under the Class Action

Fairness Act of 2005 and filed a motion to dismiss for lack of standing and for failure to

state a claim. (Docs. 1, 19). The Court initially granted the motion to dismiss in part for

lack of Article III standing and remanded two of Plaintiffs’ three claims to the Twentieth

Judicial Circuit, St. Clair County, Illinois. (Doc. 26). Apple then filed a motion for

reconsideration (Doc. 29),1 while contemporaneously filing a petition for leave to appeal

the remand of Plaintiffs’ BIPA Section 15(c) claim directly with the Seventh Circuit Court

of Appeals. The Seventh Circuit subsequently vacated the Court’s remand order and

instructed the undersigned to reconsider Plaintiffs’ claims in light of Fox v. Dakkota

Integrated Systems, LLC, 980 F.3d 1146 (7th Cir. 2020), and Thornley v. Clearview AI, Inc.,

984 F.3d 1241 (7th Cir. 2021). See Apple Inc. v. Hazlitt, No. 20-8033 (7th Cir.).

Having done so, the Court finds that Plaintiffs have Article III standing to bring

their claims in Counts I and II under BIPA sections 15(a) and 15(b).2 Furthermore, those

claims survive Apple’s motion to dismiss for failure to state a claim. Plaintiffs do not have

Article III standing to bring their claim in Count III under BIPA section 15(c), however,

so that claim will be remanded to state court.

BACKGROUND

A. The Illinois Biometric Information Privacy Act

In 2008, Illinois passed BIPA due to concerns with emerging technology and the

increasing collection and use of biometrics in the business and security screening sectors.

The Illinois legislature recognized that unlike other personal identifiers, like social

security numbers, biometrics are biologically unique to each individual and cannot be

altered or changed once compromised. If this data is compromised, due to the sensitive

1 In light of the current procedural posture of the case, the motion for reconsideration (Doc. 29) is denied

as moot.

2 As requested by the parties in their briefing, where appropriate, the Court incorporates its prior analysis

and conclusions from its now-vacated order of November 12, 2020. (Doc. 26). That analysis pertains to

Plaintiffs’ claims in Count I related to BIPA section 15(b).

nature of biometrics, an individual is at heightened risk for identity theft and lacks

recourse. See 740 ILL. COMP. STAT. §§ 14/5(a)-(c). The Illinois legislature observed an

overwhelming majority of the public is wary of the use of biometrics when such

information is tied to finances and other personal information. While the full

ramifications of biometric technology are unknown, BIPA is intended to serve public

welfare, security, and safety by regulating the “collection, use, safeguarding, handling,

storage, retention, and destruction of biometric identifiers and information.” See 740 ILL.

COMP. STAT. §§ 14/5(d)-(g).

BIPA regulates private entities or “any individual, partnership, corporation,

limited liability company, association, or other group, however organized.” See 740 ILL.

COMP. STAT. §§ 14/10-20. BIPA requires all private entities in possession of biometric

identifiers or biometric information to “develop a written policy, made available to the

public, establishing a retention schedule and guidelines for permanently destroying

biometric identifiers and biometric information when the initial purpose for collecting or

obtaining such identifiers or information has been satisfied or within 3 years of the

individual’s last interaction with the private entity.” 740 ILL. COMP. STAT. § 14/15(a).

Further, private entities are prohibited from collecting, capturing, purchasing, or

receiving through trade, or otherwise obtaining a person’s biometric identifier or

biometric information unless it informs the subject in writing with the specific purpose

and length of time disclosed, and receives a written release, i.e., informed written consent.

740 ILL. COMP. STAT. §§ 14/10, 15(b). Moreover, BIPA prohibits private entities from

selling, leasing, trading, or otherwise profiting from a person’s or customer’s biometric

identifier or information in their possession. 740 ILL. COMP. STAT. § 14/15(b).

BIPA’s definition of “biometric identifier” includes “a retina or iris scan,

fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILL. COMP. STAT. § 14/10.

BIPA excludes writing samples, written signatures, photographs, human biological

samples for valid scientific testing or medical uses, demographic data, tattoo

descriptions, and physical descriptions from the definition for “biometric identifier.” Id.

The Act defines “biometric information” as “any information, regardless of how it is

captured, converted, stored, or shared, based on an individual’s biometric identifier used

to identify an individual.” Id. BIPA further narrows the definition by not including

“information derived from items or procedures excluded under the definition of

biometric identifiers.” Id.

The Illinois legislature devised BIPA to protect consumers against the threat of

irreparable privacy violations, identity theft, and economic injuries stemming from the

use of biometric identifiers and biometric information by private entities. Notably, as a

matter of state law, BIPA creates a private right of action for “[a]ny person aggrieved by

a violation” of the outlined provisions. 740 ILL. COMP. STAT. § 14/20.

B. Plaintiffs’ Complaint

Facial recognition or “faceprinting” uses biological characteristics to verify an

individual’s identity by extracting an individual’s face geometry data in order to confirm

a subsequent match of the individual’s face. (Id. at ¶ 44). Geometric attributes of faces

include distance between the eyes, width of the nose, and other features. (Id. at ¶ 75). Face

geometry is a physiological characteristic and qualifies as a “biometric identifier” under

BIPA. (Id. at ¶ 26).

Plaintiffs allege Apple’s Photos app employs a proprietary software and facial

recognition technology to scan individual face geometries from a user’s photographs

creating a unique “faceprint” for every person detected. (Id. at ¶¶ 2, 27, 67, 77). Apple’s

devices use facial recognition technology to add frequently detected faces to the user’s

“People” album within the Photos app. (Id. at ¶ 67). Further, Apple pre-installs the Photos

app on all devices including phones, tablets, and computers, and the app cannot be

removed or modified. (Id. at ¶¶ 2, 64). This feature of the Photos app allegedly enables

users to “recognize the people, scenes, and objects in [photographs]” and easily sort or

find images of their “favorite subjects—the people in [their lives].” (Id. at ¶¶ 80, 81, 83).

Plaintiffs also allege that the Photos app applies an algorithm to specifically

identify the Apple device user, which creates biometric information as defined by BIPA.

(Id. at ¶ 101). Moreover, device users can “tag” and input names for each of the faces

detected in the People album. (Id. at ¶¶ 146, 147). Apple does not store or transfer all user

biometric identifiers or biometric information on its servers, but rather, as Plaintiffs

allege, on each Apple device locally in a facial recognition database in the solid-state

memory on the device. (Id. at ¶¶ 71, 105, 179).

Plaintiffs allege this conduct presents an imminent threat of serious harm to

Plaintiffs and the proposed class, as Apple does not delete the biometric data it collects

on the devices, even discarded Apple devices. (Id. at ¶ 130). Moreover, Plaintiffs cannot

prevent their devices from collecting their unique and sensitive biometric data (Id. at

¶ 132). And because this information is stored on individual devices, Plaintiffs and the

class members face the imminent threat of disclosure of their biometric data as the result

of a data breach on any Apple device on which their biometric data is stored. (Id. at ¶ 133).

Each named Plaintiff is a resident of Illinois. (Id. at ¶¶ 10-13). According to the

Complaint, each named Plaintiff has used an Apple device to take or store photographs

of themselves or others using the Photos app. (Id. at ¶¶ 2, 143). Furthermore, each named

Plaintiff had their facial geometry scanned from the photographs and their biometric data

collected, stored, and used by Apple. (Id. at ¶ 14). Apple is a California corporation

conducting business throughout Illinois. (Id. at ¶ 15).

Plaintiffs assert three counts of BIPA violations, 740 ILL. COMP. STAT. §§ 14/15(a)-

(c). In Count I, Plaintiffs claim Apple violated BIPA section 14/15(b) by collecting

Plaintiffs’ and Class Members’ biometric identifiers and biometric information, including

scans of facial geometry and related biometric information, without first notifying

Plaintiffs in writing and obtaining informed consent. (Id. at ¶¶ 162-164). In Count II,

Plaintiffs assert Apple violated BIPA section 14/15(a) by possessing biometric identifiers

and biometric information without creating and following a written, publicly available

policy with retention schedules and destruction guidelines. (Id. at ¶ 171). In Count III,

Plaintiffs allege Apple violated BIPA section 14/15(c) by profiting from biometric

identifiers and biometric information it possessed, through marketing and selling its

devices based upon claims of photograph sorting technology. (Id. at ¶¶ 179-181).

Plaintiffs seek to represent a class consisting of all Illinois citizens whose faces

appeared in one or more photos taken or stored on their own, or someone else’s, Apple

device using the Photos app from March 4, 2015, until present. (Id. at ¶ 153). On behalf of

themselves and the putative class, Plaintiffs seek actual damages, statutory damages of

$5,000 for each intentional and reckless violation of BIPA pursuant to 740 ILL. COMP. STAT.

§ 14/20(2), statutory damages of $1,000 for each negligent violation of BIPA pursuant to

740 ILL. COMP. STAT. § 14/20(1), an order enjoining Apple from further violating BIPA,

attorneys’ fees and costs, and pre- and post-judgment interest. (Id. at ¶ 42).

DISCUSSION

I. Article III Standing

Jurisdiction must be established as a threshold matter, due to the nature and limits

of federal judicial power. Steel Co. v. Citizens for a Better Environment, 532 U.S. 83, 94-95,

118 S.Ct. 1003, 140 L.Ed.2d 210 (1998). Without Article III standing, federal courts have

no authority to resolve a case for want of subject matter jurisdiction. MAO-MSO Recovery

II, LLC v. State Farm Mut. Auto. Ins. Co., 935 F.3d 573, 581 (7th Cir. 2019); see also Spokeo,

Inc. v. Robins, 136 S.Ct. 1540, 1547, 194 L.Ed.2d 635 (2016). Article III standing requires:

(1) plaintiffs to suffer an actual or imminent, concrete and particularized injury-in-fact;

(2) a causal connection between the injury and the conduct complained of; and (3) a

likelihood that the injury can be redressed by a favorable decision. Bryant v. Compass Grp.

USA, Inc., 958 F.3d 617, 620-21 (7th Cir. 2020) (citing Lujan v. Defs. of Wildlife, 504 U.S. 555,

560-61, 112 S.Ct. 2130, 119 L.Ed.2d 352 (1992)).

Bare procedural violations separated from any concrete harm do not satisfy the

injury-in-fact requirement. Spokeo, 136 S.Ct. at 1549 (2016). The violation of a procedural

right, conferred by a statute, may sufficiently constitute an injury-in-fact. Id. A statutory

violation, however, must present “an ‘appreciable risk of harm’ to the underlying

concrete interest [the legislature] sought to protect by enacting the statute.” Bryant, 958

F.3d at 621 (quoting Groshek v. Time Warner Cable, Inc., 865 F.3d 884, 887 (7th Cir. 2017)).

Typically the plaintiff bears the burden of demonstrating that the district court has

subject-matter jurisdiction over a case and that it falls within “the Judicial Power”

conferred in Article III. Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1244 (7th Cir. 2021).

“But more generally, the party that wants the federal forum is the one that has the burden

of establishing the court’s authority to hear the case.” Id. In this case, that means Apple

has the burden of establishing that Plaintiffs have standing.

A. Count I – BIPA Section 15(b)

As agreed by the parties, the Court adopts and incorporates its prior analysis and

conclusion regarding Plaintiffs’ standing to bring their section 15(b) claim, as discussed

in the Court’s order of November 12, 2020. (Doc. 26).

B. Count II – BIPA Section 15(a)

BIPA section 15(a) requires private entities that possess biometric information to

develop, publicly disclose, and comply with a data retention schedule, including

providing for the permanent destruction of biometric information after its initial purpose

is satisfied, but in no event later than three years from the person’s last interaction with

the entity. 740 ILL. COMP. STAT. § 14/15(a).

In its previous order, the Court found that, under Bryant v. Compass Group USA,

Inc., Apple’s alleged failure to publicize a retention and destruction policy in violation of

BIPA section 15(a) constitutes a public harm, not a harm particular to Plaintiffs.

See Bryant, 958 F.3d at 626. Because this public harm is not the type of concrete,

particularized injury necessary to satisfy Article III’s requirements, the Court found that

Plaintiffs lack standing to bring their section 15(a) claim in federal court.

After the Court entered its order, the Seventh Circuit Court of Appeals clarified in

Fox v. Dakkota Integrated Systems that its decision in Bryant was limited to allegations

involving a violation of the public disclosure duty in section 15(a). Fox, 980 F.3d at 1154.

But where a plaintiff alleges the defendant has violated “the full panoply of its section

15(a) duties—the duties to develop, publicly disclose, and comply with data retention and

destruction policies—resulting in the wrongful retention of her biometric data,” the

plaintiff has sufficiently pleaded an injury in fact for purposes of Article III. Id. at 1149,

1154-55. This is because the “unlawful retention of biometric data inflicts a privacy injury

in the same sense that an unlawful collection does.” Id. at 1154.

Here, Plaintiffs allege Apple “violated BIPA section 15(a) by possessing Plaintiffs’

and Class members’ biometric identifiers and biometric information, including scans of

face geometry and related biometric information, without creating and following a

written policy . . . establishing and following a retention schedule and destruction

guidelines for Defendant’s possession of biometric identifiers and information.” (Doc. 1-

1 at ¶ 171) (emphasis added).

Under Fox, the allegation that Apple has failed to follow a policy for retaining and

destroying Plaintiffs’ biometric identifiers and information is enough to establish Article

III standing for Plaintiffs’ section 15(a) claim. See id. at 1154-55; see also Neals v. ParTech,

Inc., No. 19-CV-05660, 2021 WL 463100, at *5 (N.D. Ill. Feb. 9, 2021) (plaintiffs’ allegation

that defendant continued to collect and retain biometrics, while failing to adhere to a

retention schedule and to delete biometric information, satisfied the injury in fact

requirement of standing); Wilcosky v. Amazon.com, Inc., No. 19-CV-05061, 2021 WL 410705,

at *6 (N.D. Ill. Feb. 5, 2021) (“Plaintiffs alleged that Amazon unlawfully retained all of

their biometric data in violation of Section 15(a), which is sufficiently particularized to

satisfy Article III.”); Marsh v. CSL Plasma Inc., No. 19 C 6700, 2020 WL 7027720, at *4 (N.D.

Ill. Nov. 30, 2020) (an alleged violation of the Act’s requirement that a collector of

biometric information develop a retention policy satisfies the injury in fact needed for

Article III standing).

Plaintiffs agree that Fox recognizes section 15(a) creates a legally protected interest

in individuals’ biometric data not being retained after the time allowed by the statute. They

point out, however, that in Fox the plaintiff alleged her “former” employer, Dakkota

Integrated Systems, wrongfully retained her biometric data after her employment ended.

That is, once the plaintiff’s employment ended, the retention of her handprint in

conjunction with Dakkota’s biometric timekeeping system was a sufficient privacy

violation to constitute a particularized injury under Article III. Here, however, Plaintiffs

have not alleged that they have ceased using Apple Devices. Therefore, Plaintiffs argue,

they are more akin to a Dakkota employee who continues to use a biometric timekeeping

system, and nothing in Fox suggests that such individuals would have standing to assert

a claim under section 15(a).

The Court is somewhat perplexed by this argument, as it seems to suggest that

Plaintiffs are conceding they could not succeed on the merits of their section 15(a) claim

under Illinois law. Plaintiffs admit they are still interacting with Apple, and they further

allege that the collection of biometric identifiers is automatic and occurs whenever a new

photograph is stored on an Apple Device. (Doc. 1-1 at ¶ 85). Thus, the initial purpose for

the collection of biometric information would appear to continue each time a photo is

taken. If the initial purpose for possessing the biometric information has not been

satisfied, and Plaintiffs have not discontinued their interaction with the company, it

seems as though Apple would have no active, current duty under section 15(a) to comply

with a data retention schedule that provides for the permanent destruction of biometric

information.

Nevertheless, the Court disagrees that Plaintiffs’ continued interaction with Apple

deprives them of Article III standing. Plaintiffs allege that the durability of solid-state

memory in Apple Devices creates a nearly permanent risk of a data breach of biometric

identifiers and information, as the memory can last well past the natural life of the device

user and, perhaps, in perpetuity. (Id. at ¶ 136). Plaintiffs also claim the biometric data may

even persist on discarded Apple Devices, creating the risk of illicit harvesting of the data

far into the future. (Id. at ¶ 138). The Court finds that this alleged unlawful retention of

Plaintiffs’ biometric information, potentially indefinitely, constitutes a privacy injury

such that Plaintiffs have Article III standing to bring their BIPA section 15(a) claims.3

3 If this were not enough, Apple also points to discovery responses that demonstrate each Plaintiff stopped

using at least one Apple Device during the relevant time period. (Doc. 56-1). Thus, if standing turns on

whether Plaintiffs ceased using a “Device,” as opposed to interacting with Apple as a private entity, these

discovery responses establish standing for Plaintiffs’ section 15(a) claims. The Court can consider this new

evidence, even though it is outside the pleadings, because it is relevant to the Court’s subject matter

jurisdiction. See Bazile v. Fin. Sys. of Green Bay, Inc., 983 F.3d 274, 279 (7th Cir. 2020) (noting that where a

party makes a factual attack on the existence of jurisdictional facts underlying the allegations, “the court

may consider and weigh evidence outside the pleadings to determine whether it has power to adjudicate

the action”).

C. Count III – BIPA Section 15(c)

Section 15(c) of BIPA prohibits entities in possession of a person’s or customer’s

biometric identifiers or information from selling, leasing, trading, or otherwise profiting

from that data. 740 ILL. COMP. STAT. § 14/15(c). In this case, Plaintiffs allege Apple violated

section 15(c) by marketing and selling its devices based upon claims that its facial

recognition technology could sort photographs, thus profiting from a person’s or

customer’s biometric data (Doc. 1-1 at ¶ 181). Yet, because Plaintiffs do not allege Apple

sold or otherwise profited from their individual biometric data, the Court, in its earlier

order, found that Plaintiffs failed to allege any particularized or concrete injury.

After the Court entered its order, the Seventh Circuit Court of Appeals issued its

decision in Thornley v. Clearview AI, Inc. In that case, the plaintiffs filed a complaint in

state court on behalf of themselves and as representatives of the following class:

All current Illinois citizens whose biometric identifiers or biometric

information were [sic], without their knowledge, included in the Clearview

AI Database at any time from January 1, 2016 to January 17, 2020 (the “Class

Period”) and who suffered no injury from Defendant’s violation of

Section 15(c) of BIPA other than statutory aggrievement . . . .

Thornley, 984 F.3d at 1246. The complaint further stated that none of the named plaintiffs,

and no class member, “suffered any injury as a result of the violations of Section 15(c) of

BIPA other than the statutory aggrievement alleged in Paragraph 38.” Id. Clearview

removed the case to federal court, but the district court remanded it, holding that the

complaint “raised questions only about a general regulatory rule found in BIPA: no one

may profit in the specified ways from another person’s biometric identifiers or

information.” Id.

Clearview appealed, asserting the Seventh Circuit should equate a person’s

potential injury from the sale of his or her data with the injury from retention of that data

as in Fox, or the injury that occurs when a company fails to obtain written consent to

collect the data, as recognized in Bryant. Id. at 1247. The Seventh Circuit agreed that a

different complaint might present those circumstances, but the plaintiffs at hand took

care in their allegations to assert only “a general, regulatory violation, not something that

is particularized to them and concrete.” Id. at 1247-48. Because the plaintiffs were careful

to allege only bare procedural violations rather than concrete and particularized harm to

them individually, they were entitled to keep their claims in state court. Id. at 1248. The

Seventh Circuit noted that section 15(c) “addresses only the regulated entity—the

collector or holder of the biometric data—and flatly prohibits for-profit transactions.” Id.

at 1247. Indeed, the Court found section 15(c) to be “the same kind of general regulation

as the duty to create and publish a retention and destruction schedule found in section

15(a), at least when the plaintiff asserts no particularized injury resulting from the

commercial transaction.” Id. (citing Bryant, 958 F.3d at 626).

Here, Apple asserts Plaintiffs have alleged concrete and particularized harm

because the Complaint states that Apple “profit[ed] from Plaintiffs’ and Class members’

biometric identifiers and biometric information, including scans of facial geometry and

related biometric information . . . .”; “Plaintiffs incurred injuries that were caused by

Defendant’s conduct”; and “Through its actions, Defendant exposed Plaintiffs and the

Class to imminent threats of serious harm.” (Doc. 1-1 at ¶¶ 181, 184). According to

Apple’s reading of the Complaint, Plaintiffs also allege that any “profit” received from

the sale of devices into Illinois with “the face recognition ‘feature’” was not “lawful”

because the devices “automatically collect biometric information without consent in

violation of BIPA.” (Doc. 1-1 at ¶¶ 43, 103, 117).

The Court does not read the Complaint so broadly. Plaintiffs allege Apple profits

from Plaintiffs’ biometric data because it uses the facial recognition capabilities of its

Photos App to market and sell its devices and software. (Id. at ¶ 3). They further allege

Apple developed the facial recognition feature of the Photos App to “competitively

position its devices and software in the marketplace, compete with other software

applications, and thereby profit.” (Id. at ¶ 43). Additionally, Apple uses the facial

recognition feature “to advertise its operating systems and Apple Devices to potential

users.” (Id. at ¶ 115). Plaintiffs also claim Apple developed the facial recognition feature

“for its Photos App to compete with similar features being offered on other devices,

giving Defendant a competitive edge that allowed Defendant to profit from the sale of

Apple Devices.” (Id. at ¶ 117). Plaintiffs note that BIPA section 15(c) prohibits Apple from

profiting from their biometric information and that Apple did, in fact, profit from the sale

of its Apple Devices as a result of its facial recognition feature. (Id. at ¶¶ 119, 127).

Based on these allegations, the Court previously found that Plaintiffs did not allege

Apple sold or otherwise profited from their individual biometric data. The Court stands

by that analysis. Plaintiffs do not allege the type of particularized harm envisioned by the

Thornley court, or any particularized harm for that matter. Instead, they allege that Apple

used its facial recognition technology to sell more devices, advertise its software, and to

give Apple an edge over competitors—all in an effort to profit from the sale of its Devices.

And while the plaintiffs in Thornley expressly stated that they suffered no injury other

than statutory aggrievement, the Court of Appeals did not find express disavowal of

individual harm to be a requirement. Because Plaintiffs have alleged nothing more than

a regulatory violation, the Court again finds that Plaintiffs lack Article III standing.4

Apple has not met its burden of demonstrating Plaintiffs have standing to bring

their section 15(c) claim in federal court. Accordingly, the Court lacks subject matter

jurisdiction over the claim, and it must be remanded to state court. While Apple urges

the Court to instead dismiss the claim for the reasons set forth in its motion to dismiss,

the adequacy of Plaintiffs’ substantive allegations is a matter for the Illinois state court to

address. See Thornley, 984 F.3d at 1249.

II. Failure to State a Claim

The purpose of a motion to dismiss for failure to state a claim under Rule 12(b)(6)

is to evaluate the adequacy of a complaint, not to determine the merits of the case or

whether a plaintiff will ultimately prevail. Gibson v. City of Chicago, 910 F.2d 1510, 1520

(7th Cir. 1990). To survive a Rule 12(b)(6) motion, a plaintiff only needs to allege enough

facts to state a claim for relief that is plausible on its face. Bell Atlantic Corp. v. Twombly,

550 U.S. 544, 570 (2007). A plaintiff need not plead detailed factual allegations, but must

provide “more than labels and conclusions, and a formulaic recitation of the elements.”

Id. In deciding a motion to dismiss under Rule 12(b)(6), the Court accepts as true all well-

pleaded facts in the complaint and draws all reasonable inferences in the plaintiff’s favor.

4 Having found the case must be remanded, the Court need not address Plaintiffs’ argument that

Defendants are judicially estopped from arguing Plaintiffs do have standing after previously arguing they

do not have standing.

Burke v. 401 N. Wabash Venture, LLC, 714 F.3d 501, 504 (7th Cir. 2013). Taken together, the

factual allegations contained within a complaint must “raise a right to relief above the

speculative level, on the assumption that all the allegations in the complaint are true

(even if doubtful in fact).” Twombly, 550 U.S. at 555 (internal citations omitted).

A. Count I – BIPA Section 15(b)

As agreed by the parties, the Court adopts and incorporates its prior analysis and

conclusion that Plaintiffs have stated a plausible cause of action to survive Apple’s

12(b)(6) motion to dismiss on their section 15(b) claim. (Doc. 26)

B. Count II – BIPA Section 15(a)

BIPA section 15(a) only applies to private entities “in possession” of biometric

identifiers or biometric information. 740 ILL. COMP. STAT. § 14/15(a). Apple argues

Plaintiffs have made only a conclusory allegation that Apple “possessed” such biometric

identifiers or information, without pleading any facts to support their claims. Instead, the

Complaint is rife with allegations that the facial recognition technology runs on the users’

devices and that the biometric data remains in the solid-state memory on the Apple

Device, which is owned and controlled by the user. Apple asserts Plaintiffs have the

choice to erase any or all data stored on their devices, only the plaintiffs know the

identities of anyone in their photos, and there is no suggestion in the Complaint that

Apple reserves the right to access a user’s photos after selling the device. Apple also

disputes Plaintiffs’ theory that Apple is vicariously liable for the actions of the Photos

app, as Apple’s “software agent.” In sum, Apple contends Plaintiffs have failed to

sufficiently allege that it “possesses” Plaintiffs’ biometric identifiers or information.

In response, Plaintiffs argue that Apple is reading into BIPA a “storage”

requirement that plainly does not exist. Because BIPA merely requires that an entity

“possess” biometric data to be liable, not that the entity “store” data on its own servers,

Apple’s argument that it is exempt from BIPA because its biometric data is located in

databases on user devices that Apple alone controls is meritless. Plaintiffs also point out

that the language of the statute itself differentiates between possession and storage.

See 740 ILCS 14/15(e)(1) (requiring entities “in possession of” biometric data to “store,

transmit, and protect [the data] from disclosure”). Thus, any interpretation of the statute

that equates possession with “storage” would render these provisions superfluous,

which violates the basic rules of statutory construction.

BIPA does not define “possession,” so the Court turns to its “popularly

understood meaning” or its “settled legal meaning if one exists.” See 740 ILCS 14/10;

Heard v. Becton, Dickinson & Co., 440 F. Supp. 3d 960, 968 (N.D. Ill. 2020) (citing Rosenbach

v. Six Flags Entm’t Corp., 129 N.E.3d 1197, 1205 (Ill. 2019). “The Illinois Supreme Court has

held that ‘possession, as ordinarily understood, occurs when a person has or takes control

of the subject property or holds the property at his or her disposal.’” Id. (quoting People

v. Ward, 830 N.E.2d 556, 560 (Ill. 2005)). The ordinary definition of possession does not

require exclusive control, “and nothing in BIPA indicates that the ordinary definition of

possession does not apply.” Id.

Here, Plaintiffs allege Apple “possesses” their biometric data because it has

complete and exclusive control over the data on Apple Devices, including what biometric

identifiers are collected, what biometric data is saved, whether biometric identifiers are

used to identify users (creating biometric information), and how long biometric data is

stored. (Doc. 1-1 at ¶ 105). Plaintiffs also claim Apple uses its software to create, gather,

and harvest faceprints, which Apple stores in facial recognition databases that Apple

provided users no knowledge of or control over, and that Apple alone could access the

biometric data or disable its collection. (Id. at ¶¶ 32, 65-104). Users also cannot disable the

collection of biometric data, cannot limit what information is collected or from whom

information is collected, cannot remove the People folder, and cannot delete the database

of facial recognition information that Apple creates or any information in that database.

(Id. at ¶ 110). Finally, Apple only allows users to use Apple Devices on the condition that

it collects biometric data. (Id. at ¶ 112).

As it did in its previous, vacated order—taking all allegations as true and making

all inferences in favor of Plaintiffs—the Court finds Plaintiffs have adequately alleged

that Apple possessed their biometric data such that BIPA section 15(a) applies to it.

Accordingly, the Court will not dismiss Count II at this stage of the proceedings.

III. Intentional or Reckless Violations of BIPA

As agreed by the parties, the Court adopts and incorporates its prior denial of

Apple’s request to strike Plaintiffs’ prayer for enhanced statutory damages, as set forth

in the Court’s order of November 12, 2020. (Doc. 26).

CONCLUSION

The Motion to Dismiss (Doc. 19) filed by Defendant Apple Inc. is GRANTED in

part and DENIED in part. Plaintiffs’ claim in Count II under BIPA section 15(c) is

REMANDED to the Twentieth Judicial Circuit, St. Clair County, Illinois, for lack of

subject matter jurisdiction. Defendant Apple Inc.’s motion to dismiss for lack of Article

III standing and for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6)

as to Counts I and I] is DENIED.

IT IS SO ORDERED.

DATED: June 14, 2021

neff

NANCY J. ROSENSTENGEL

Chief U.S. District Judge

Page 19 of 19