Kuklineski v. Binance Capital Management Co., Ltd.

IN THE UNITED STATES DISTRICT COURT

FOR THE SOUTHERN DISTRICT OF ILLINOIS

KAMIL KUKLINSKI, Individually,

and on Behalf of All Others

Similarly Situated,

Plaintiff,

v. Case No. 21-cv-001425-SPM

BINANCE CAPITAL

MANAGEMENT CO., LTD , BAM

TRADING SERVICES INC. d/b/a

Binance.US, and JUMIO

CORPORATION

Defendants.

MEMORANDUM AND ORDER

McGLYNN, District Judge:

Plaintiff Kamil Kuklinski (“Kuklinski”) brings a proposed class action against

defendants Binance Capital Management Co., Ltd. d/b/a Binance (“BCM”), BAM

Trading Services, Inc. d/b/a Binance.US (“BAM”), and Jumio Corporation (“Jumio”)

for alleged violations of the Illinois Biometric Privacy Act (“BIPA”), codified at 740

ILCS §14/1, et seq. All three defendants have filed separate motions to dismiss the

complaint, which are currently pending before the Court. (Docs. 53-55). For the

reasons set forth below, the Court grants the motion to dismiss filed by BCM and

denies the motions filed by BAM and Jumio.

The Illinois Biometric Information Privacy Act

The Illinois General Assembly enacted the Illinois Biometric Information

Page 1 of 29

Privacy Act (“BIPA”), in 2008 to protect a person’s privacy interests in his “biometric

identifiers”, which includes fingerprints, retina and iris scans, hand scans and facial

geometry. 740 ILCS 14/1, et seq. (2008); Fox v. Dakkota Intefrated Systems, LLC., 980

F.3d 1146 (2020). BIPA was created in response to the growing use of biometrics “in

the business and security screening sectors”. 740 ILCS 14/5. In fact, the legislative

findings refer to the immutability of biometric identifiers and the risk of identity

theft, and state the following, “Biometrics are unlike other unique identifiers that are

used to access finances or other sensitive information. For example, social security

numbers, when compromised, can be changed. Biometrics, however, are biologically

unique to the individual; therefore, once compromised, the individual has no recourse,

is at heightened risk for identity theft, and is likely to withdraw from biometric-

facilitated transactions.” 740 ILCS 14/5(c). Because “the full ramifications of

biometric technology are not fully known”, the General Assembly found that “the

public welfare, security, and safety will be served by regulating the collection, use,

safeguarding, handling, storage, retention, and destruction of biometric identifiers

and information.” Id. §§14/5 (f)-(g).

Section 15 of the Act comprehensively regulates the collection, use, retention,

disclosure and dissemination of biometric identifiers. 740 ILCS 14/15. Specifically, §

15(a) of BIPA states:

“A private entity in possession of biometric identifiers or information

must develop a written policy, made available to the public, establishing

a retention schedule and guidelines for permanently destroying

biometric identifiers and biometric information when the initial purpose

for collecting or obtaining such identifiers or information has been

satisfied or within 3 years of the individual’s last interaction with the

Page 2 of 29

private entity, whichever comes first.” 740 ILCS 15/15(a).

Section 15(b) of the Act deals with informed consent and prohibits private

entities from collecting, capturing, or otherwise obtaining a person’s biometric

identifiers or information without the person’s informed written consent. Id. § 15(b).

In other words, the collection of biometric identifiers or information is barred unless

the collector first informs the person “in writing of the specific purpose and length of

term for which the data is being collected, stored, and used” and “receives a written

release” from the person or his legally authorized representative. Id.

PROCEDURAL HISTORY

On October 5, 2021, Kuklinski filed a two-count class action Complaint against

defendants herein in the Twentieth Judicial Circuit, St. Clair County, Illinois (Doc.

1-1). Count I asserted violations of the Illinois Biometric Information Privacy Act,

while Count II asserted unjust enrichment (Id.). The action was brought pursuant to

735 ILCS §5/2-801 on behalf of Kuklinski and the following putative class: “All Illinois

Binance.US users and account holders whose facial and biometric data were

collected prior to May 25, 2021” (Id.).

On November 12, 2021, BAM timely removed Kuklinski’s action to this Court

under 28 U.S.C. § 1332(d), diversity of citizenship, and 28 U.S.C. § 1453, CAFA (Doc.

1). On January 31, 2022, defendants filed their initial motions to dismiss; however,

prior to ruling on the respective motions, Kuklinski obtained leave to amend the

complaint, and on February 22, 2022, the amended complaint was filed (Doc. 45).

Page 3 of 29

On March 15, 2022, all three motions to dismiss the first amended complaint

were filed herein (Docs. 53-55). Jumio’s motion was brought pursuant to Rule 12(b)(6)

of the Federal Rules of Civil Procedure and asserted five (5) grounds for dismissal

(Doc. 53). BCM filed its motion pursuant to Rule 12(b)(2) of the Federal Rules of Civil,

arguing that plaintiff’s allegations are insufficient to show personal jurisdiction (Doc.

54). Alternatively, BCM claims plaintiff did not adequately plead a cause of action

against it and seeks dismissal under Rule 12(b)(6) (Id.). Within its motion which was

also brought pursuant to Rule 12(b)(6), BAM asserts four arguments for dismissal of

the BIPA claims (Doc. 55).

FACTUAL BACKGROUND

The facts alleged by Kuklinski are accepted as true for purposes of defendants’

motions1. FED. R. CIV. P. 10(c); Arnett v. Webster, 658 F.3d 742, 751-52 (7th Cir.

2011). This Court will summarize what it deems necessary to address this motion.

Within the first amended complaint, plaintiff alleges an aider, abettor, and co-

conspirator relationship amongst the three defendants (Doc. 45, ¶ 20). Plaintiff also

claims each defendant acted as the agent, employee, representative, partner, joint-

venturer of the other defendants; however, these are legal conclusions to be

determined by the Court (Id.).

BCM is a digital asset marketplace or cryptocurrency exchange which allows

account holders using the company platform to purchase over 500 types of

cryptocurrency (Id., ¶ 1). BCM was founded in 2017 and is considered the world’s

1 The factual information was taken directly from the complaint (Doc.1) and will be cited accordingly.

Page 4 of 29

largest cryptocurrency exchange by volume (Id.). Cryptocurrency is not legal tender

in the United States and is not considered “money” or a “security” (Id., ¶ 2). BCM

was founded in China, but later company headquarters were moved (Id., ¶ 17).

Although BCM claims to operate in a decentralized matter, BCM is a registered entity

in the British Virgin Islands (Id.).

In June of 2019, BCM began ending trade for U.S. customers, and in

September 2019, partnered with BAM to launch trading services for users within the

U.S. (Id., ¶¶ 3, 4). BAM is a digital asset marketplace or cryptocurrency exchange

which allows Illinois account holders to purchase various cryptocurrencies when

using the company’s platform (Id., ¶ 5). Both BAM and BCM collect fees for the

purchase and sale of cryptocurrency by its account holders (Id., ¶ 6). BAM is a foreign

corporation headquartered in California and operating under the laws of Delaware

(Id., ¶ 18).

To begin trading on BAM, users can either download the application onto a

mobile device or visit the BAM website to sign up for a desktop account (Id., ¶ 7).

Once the application is downloaded or the website is visited, users must create an

account by inputting both personal and private information about their identity (Id.,

¶ 8).

BAM utilized Jumio’s software as part of its identity verification process, which

required taking images of a user’s driver’s license or other photo identification, along

with a “selfie” of the user to capture, analyze and compare biometric data of the user’s

facial features (Id., ¶ 9). The identity verification process was used to avoid

Page 5 of 29

fraudulent activity and/or prohibit unauthorized users from accessing the BAM

exchange (Id., ¶ 10).

Jumio is a foreign corporation operating under the laws of Delaware and

headquartered in California (Id., ¶ 19). The capture process utilized by BAM was

leased, owned, issued, created, or otherwise implemented by Jumio since at least

2018 (Id., ¶ 19). BAM’s website and application displayed “Powered by Jumio” during

the identify verification process (Id., Id.).

Facial features are personal biometric data, as the identifiers include a “scan

… of face geometry” (Id., ¶¶ 12, 13). This identity verification process of obtaining

and collecting a user’s biometric data without proper notice and consent is unlawful

pursuant to BIPA, 740 ILCS § 14/1 et seq. (Id., ¶ 11). BCM, BAM, and Jumio all

obtained biometric identifiers and information from users of BAM, without first

notifying them, without disclosing the length for collection, storage and use, and

without obtaining proper written consent - all of which constituted violations of the

law under BIPA (Id., ¶ 15).

Kuklinski is a resident of Cook County, Illinois (Id., ¶ 16). On or about March

15, 2021, he downloaded the BAM application for his iPhone and created an account

while he was on Cook County, Illinois (Id., ¶ 26). During the account creation process,

Kuklinski entered his personal information, including his name, birthdate and home

address (Id., ¶ 27). He was also prompted to review and accept a “Self-Directed

Custodial Account Agreement” for an entity known as Prime Trust, LLC that had no

reference to collection of any biometric data (Id., ¶ 28). Kuklinski was then prompted

Page 6 of 29

to take a photograph of his driver’s license or other state identification card2 (Id., ¶

29). After submitting his driver’s license photo, Kuklinski was prompted to take a

photograph of his face with the language popping up “Capture your Face” and “Center

your face in the frame and follow the on-screen instructions.” (Id., ¶ 30). When his

face was close enough and positioned correctly within the provided oval, the screen

flashed “Scanning completed.” (Id.). The next screen stated, “Analyzing biometric

data,” “Uploading your documents”, and “This should only take a couple of seconds,

depending on your network connectivity.” (Id., ¶ 31).

While creating his account with BAM, Kuklinski was not given proper notice

that the uploaded images would capture and store his biometric data, including facial

geometry, nor was he informed in writing that his biometric data was being collected,

or the purpose and length of time of the collection, storage, and usage (Id., ¶¶ 32, 33).

Kuklinski did not sign a written release under BIPA regarding the collection of his

biometric data by BAM or Jumio (Id., ¶ 34).

On or about May 25, 2021, which this Court is constrained to note was more

than two (2) months after Kuklinski created his account, the BAM application was

updated to version 2.4.5, which included the following notification prior to activating

the desktop or mobile camera application:

By clicking “Continue” you consent to Jumio collecting

and disclosing your biometric data pursuant to its

Privacy Policy (Id., ¶ 35).

2 Once the camera was activated within the BAM application, the text read “Scan Document”,

“Powered by Jumio”, “Scan identity Card Front”, and “Scan identity Card Back”.

Page 7 of 29

Prior versions of the BAM software did not display the warning and/or notice;

however, Jumio was mentioned during the downloading process with the phrase,

“Powered by Jumio” (Id., ¶¶ 36, 37). Jumio’s website describes its biometric data

authentication process in a video on its website (Id., ¶ 38). Kuklinski was not advised

as to how his biometric data was being collected and stored, nor was he advised that

Jumio was collecting that data on behalf of BAM (Id., ¶ 39).

BAM has a Terms of Use document on its website, but it does not mention the

collection of biometric data by its application or website (Id., ¶ 40). Additionally,

Kuklinski was not required to scroll through the Terms of Use, nor was assent

obtained that he had read the document much less even seen it (Id.). BAM maintains

a Privacy Policy on its website, but it makes no mention of the collection of biometric

data (Id., ¶ 43).

Jumio also has a Privacy Policy on its website which references the collection

of biometric data and states, “Jumio makes the Services available to third parties for

integration into those third parties’ websites, applications, and online services” (Id., ¶

41). Jumio’s policy further states, “to fully understand how your information will be

handled when you use the Services, you must review not just this Policy, but also the

privacy policy of the third party with whom you are dealing directly (the “Customer

Data Controller”).” (Id., ¶ 42).

Page 8 of 29

LEGAL STANDARDS

I. Rule 12(b)(2) of the Federal Rules of Civil Procedure

A motion to dismiss under Rule 12(b)(2) challenges whether the Court has

jurisdiction over a party. Fed.R.Civ.P. 12(b)(2). The party asserting jurisdiction has

the burden of proof. Tamburo v. Dworkin, 601 F.3d 693 (7th Cir. 2010). The Court

may consider affidavits and other competent evidence submitted by the parties.

Purdue Research Found. v. Sanofi–Synthelabo, S.A., 338 F.3d 773 (7th Cir. 2003). If

the Court rules on the motion without a hearing, the plaintiff need only establish a

prima facie case of personal jurisdiction as the Court will “read the complaint

liberally, in its entirety, and with every inference drawn in favor of the plaintiff.”

GCIU–Emp'r Ret. Fund v. Goldfarb Corp., 565 F.3d 1018 (7th Cir. 2009); Central

States, Se. & Sw. Areas Pension Fund v. Phencorp Reinsurance Co., 440 F.3d 870 (7th

Cir. 2006) (quoting Textor v. Bd. of Regents of N. Ill. Univ., 711 F.2d 1387 (7th Cir.

1983)). “[O]nce the defendant has submitted affidavits or other evidence in opposition

to the exercise of jurisdiction,” however, “the plaintiff must go beyond the pleadings

and submit affirmative evidence supporting the exercise of jurisdiction.” Purdue, 338

F.3d at 783. Any dispute concerning relevant facts is resolved in the plaintiff's favor.

Id. at 782–83.

II. Rule 12(b)(6) of the Federal Rules of Civil Procedure

To survive a Rule 12(b)(6) motion to dismiss, a complaint must comply with

Rule 8(a) by providing “a short and plain statement of the claim showing that the

pleader is entitled to relief.” Fed.R.Civ.P. 8(a)(2). A motion to dismiss should be

Page 9 of 29

granted if the plaintiff fails to “state a claim to relief that is plausible on its

face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Bell Atl. Corp. v.

Twombly, 550 U.S. 544, 570 (2007)). The factual allegations in a complaint must

“raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555–56; see

also Swanson v. Citibank, N.A., 614 F.3d 400, 404 (7th Cir.2010) (“[P]laintiff must

give enough details about the subject-matter of the case to present a story that holds

together.”). For purposes of a motion to dismiss, the court takes all facts alleged in

the complaint as true and draws all reasonable inferences from those facts in the

plaintiff's favor, although conclusory allegations that merely recite the elements of a

claim are not entitled to this presumption of truth. Virnich v. Vorwald, 664 F.3d 206,

212 (7th Cir.2011).

ANALYSIS

Each defendant herein has filed its own Motion to Dismiss. The Court will

address them individually.

I. Binance Capital Management Co. Ltd. d/b/a Binance (“BCM”)

BCM raises two main arguments in its motion to dismiss (Doc. 54). First, BCM

argues that the amended complaint must be dismissed because the Court lacks

personal jurisdiction (Id.). Second, and in the alternative, BCM contends that the

amended complaint should be dismissed because Kuklinski does not adequately plead

any claims against it (Id.).

In response, Kuklinski raises the “alter ego” theory, arguing that because BAM

is the alter ego of BCM, the Court may exercise jurisdiction (Doc. 63). Kuklinski

Page 10 of 29

further avers that he has stated a cause of action under BIPA and for unjust

enrichment against BAM, and that said conduct is imputed to BCM (Id.).

BCM filed a reply doubling down on the lack of personal jurisdiction over BCM

(Doc. 64). BCM also argued that neither a BIPA claim nor an unjust enrichment claim

was adequately pled (Id.).

A. Personal Jurisdiction

Personal jurisdiction refers to a court's “power to bring a person into its

adjudicative process.” N. Grain Mktg., LLC v. Greving, 743 F.3d 487, 491 (7th

Cir.2014) (quoting Black' s Law Dictionary 930 (9th ed. 2009)). The scope of a federal

district court's personal jurisdiction over a defendant in a diversity case is, in the first

instance, defined by the jurisdiction of courts of general jurisdiction in the state where

the district court is located – Illinois, in this case. Fed. R.Civ.P. 4(k)(1)(A).

Illinois permits its courts to exercise jurisdiction based on a variety of

conditions not relevant here, but for purposes of this motion, it suffices to say that

Illinois state courts may exercise jurisdiction “on any other basis now or hereafter

permitted by the Illinois Constitution and the Constitution of the United States.” 735

Ill. Comp. Stat. § 5/2–209(c). Thus, the scope of this Court's personal jurisdiction over

BCM is, ultimately, defined by the Due Process Clause. If an Illinois court may

constitutionally exercise personal jurisdiction over a defendant, so may this Court.

The plaintiff has the burden of establishing personal jurisdiction. N. Grain

Mktg., 743 F.3d at 491–92. Courts recognize two types of personal jurisdiction –

general and specific. Daimler AG v. Bauman, –– U.S. ––, 134 S.Ct. 746, 751 (2014).

Page 11 of 29

General jurisdiction is “all-purpose” while specific jurisdiction is case-specific. Id.

(quoting Goodyear Dunlop Tires Operations, S.A. v. Brown, –– U.S. ––, 131 S.Ct.

2846, 2851 (2011)).

1. General Jurisdiction

General, or “all-purpose,” jurisdiction exists “where a foreign corporation's

continuous corporate operations within a state [are] so substantial and of such a

nature as to justify suit against it on causes of action arising from dealings entirely

distinct from those activities.” Daimler, 134 S.Ct. at 754 (quoting Int'l Shoe Co. v.

Washington, 326 U.S. 310, 318 (1945)). In Goodyear, the Court elaborated on the

nature of the relationship required between a corporation and forum to establish

general jurisdiction and held, “A court may assert general jurisdiction over foreign

(sister-state or foreign-country) corporations to hear any and all claims against them

when their affiliations with the state are so ‘continuous and systematic’ as to render

them essentially at home in the forum State.” –– U.S. ––, 131 S.Ct. 2846, 2851

(2011) (quoting Int'l Shoe, 326 U.S. at 317). Consistent with its use of the phrase “at

home”, the Goodyear Court noted that domicile is the touchstone of general

jurisdiction for both individuals and corporations, so a corporation's place of

incorporation and principal place of business, which define its domicile, are the

paradigmatic fora states in which a corporation should be deemed to be “at

home.” 131 S.Ct. at 2853–54.

In other words, Goodyear made clear that only a limited set of affiliations with

a forum will automatically render a defendant amenable to all-purpose jurisdiction

Page 12 of 29

there. Daimler, 134 S.Ct. at 760. Although general jurisdiction is not limited to those

states, it requires “an equivalent place.” Id. at 2853. That is to say, as the Court

subsequently elaborated in Daimler, that general jurisdiction “requires affiliations so

continuous and systematic as to render [the foreign corporation] ... comparable to a

domestic enterprise in [the forum] State.” 134 S.Ct. at 758 n. 11 (first alteration in

original) (citation and internal quotation marks omitted).

In support of its motion, BCM provided an Affidavit from Samantha Chan,

Director of Compliance (Doc. 54-1). Within the Affidavit, Ms. Chan declares that BCM

is organized under the laws of the British Virgin Islands. In other words, BCM is

neither registered in Illinois nor licensed to do business in Illinois. Ms. Chan further

avers that BCM has no affiliation to Illinois, including but not limited to, office, agent,

employee, bank account, real estate, subsidiary and/or records. She further states

that BCM is neither the parent company of BAM nor is BAM a wholly or partially

owned subsidiary of BCM (Id.). Instead, BCM and BAM are separate entities (Id.).

The Affidavit is unrebutted. Kuklinski does not provide any evidence,

contradictory or otherwise. As such, there is no general jurisdiction as BCM is not

“at home” in Illinois.

2. Specific Jurisdiction

A court sitting in Illinois has specific personal jurisdiction over a nonresident

defendant consistent with due process if two conditions are satisfied: the defendant

must have (i) minimum contacts with the state such that (ii) exercising personal

jurisdiction does not offend traditional notions of fair play and substantial

Page 13 of 29

justice. Asahi Metal Indus. Co. v. Superior Court of Cal., 480 U.S. 102, 109 (1987). To

decide whether specific personal jurisdiction may be exercised, a court must engage

in three distinct steps: (1) identify the contacts the defendant has with the forum; (2)

analyze whether these contacts meet constitutional minimums and whether

exercising jurisdiction on the basis of these minimum contacts sufficiently comports

with fairness and justice; (3) determine whether the sufficient minimum contacts, if

any, arise out of or are related to the causes of action involved in the suit. Burger

King Corporation v. Rudzewicz, 471 U.S. 462 (1985).

The contacts must be established by the purposeful acts of the defendant, and

not the “unilateral activity of another party”. Helicopteros Nacionales de Colombia,

S.A. v. Hall, 466 U.S. 408 (1984); Wilson v. Humphreys (Cayman) Ltd., 916 F.2d 1239

(7th Cir. 1990). Critical to the analysis is a showing that the defendant reasonably

anticipated being haled into court in the forum state, and not as a result of random,

fortuitous or attenuated contacts. World-Wide Volkswagon Corp. v. Woodson, 444

U.S. 286 (1980).

As the Affiant declares, BCM has no contacts with Illinois, much less than the

minimum amount required to anticipate defending an Illinois cause of action (Doc.

54-1). Accordingly, there is no need to go past step one in determining whether the

Court has specific jurisdiction over BCM.

Page 14 of 29

3. Alter Ego

Because there is no personal jurisdiction – general or specific – over BCM,

plaintiff next contends that jurisdiction is imputed via BAM (Doc. 63). Specifically,

plaintiff asserts that BAM is the “alter ego” of BCM (Id.).

Generally, corporate ownership alone is not sufficient to convey personal

jurisdiction and the jurisdictional contacts of a subsidiary corporation cannot be

imputed to a parent. Central States, S.E. & S.W. Areas Pension Fund v. Reimer

Express World Corp., 230 F.3d 934, 943–944 (7th Cir.2000). Notwithstanding the

foregoing, there are circumstances under which jurisdictional contact can be carried

over – these are where there is evidence to justify piercing the corporate veil or when

there is an agency relationship.

A 12(b)(2) motion to dismiss for lack of personal jurisdiction, such as this one,

requires the nonmovant to “go beyond the pleadings and submit affirmative evidence

supporting the exercise of jurisdiction.” Purdue Research Found., 338 F.3d at 783. A

plaintiff cannot merely rely on unsubstantiated allegations that BCM is an alter

ego of BAM. Taurus IP v. DaimlerChrysler Corp., 519 F.Supp.2d 905, 918

(W.D.Wis.2007). Rather, plaintiff must submit affirmative evidence demonstrating

that: (1) BCM is BAM’s alter ego; and (2) BCM had minimum contacts with Illinois

for this court to exercise personal jurisdiction.

Plaintiff has not provided any evidence3 to support its contention. Kuklinski

has not shown that BCM created BAM to manipulate its corporate structure to avoid

3 The October 29, 2020 Forbes article cited within the amended complaint contains theories and

Page 15 of 29

U.S. law. Instead, plaintiff asserted bare allegations in an attempt to raise the alter

ego theory to support jurisdiction. Plaintiff needed to go further and show that

corporate formalities were not observed. While it may be true that they were not,

plaintiff offers no evidence. Even resolving all facts in favor of plaintiff, the record is

insufficient to support a finding that BCM was BAM’s alter ego.

Even assuming plaintiff had met his burden with respect to the alter ego

theory, his argument still falls short since plaintiff also fails to offer any evidence that

BCM has the necessary minimum contacts with Illinois. See Purdue Research

Found., 338 F.3d at 782 (“[O]nce the defendant has submitted affidavits or other

evidence in opposition to the exercise of jurisdiction, the plaintiff must go beyond the

pleadings and submit affirmative evidence supporting the exercise of jurisdiction.”).

In light of the foregoing, this Court grants BCM’s Motion to Dismiss for lack of

personal jurisdiction. Whether or not there is general jurisdiction over BAM does not

confer general jurisdiction over BCM. Accordingly, the Court does not need to address the

alternative argument that plaintiff failed to state causes of action under BIPA and for unjust

enrichment. Furthermore, because the parties have engaged in jurisdictional discovery and seek to

move forward on the other defendants, this dismissal is with prejudice.

II. BAM Trading Services, Inc. d/b/a Binance.US (“BAM”)

In its motion, which was brought pursuant to Rule 12(b)(6), BAM argues that

plaintiff failed to state any cause of action so the BIPA claims as well as the claims

for unjust enrichment should be dismissed (Doc. 55). As for BIPA, BAM first claims

conjecture surrounding BCM and BAM; however, it is not evidence in support of any proposition.

Page 16 of 29

to be a “financial institution” and BIPA does not apply to financial institutions.

Second, BAM claims California law, not Illinois law applies. Third, BAM argues that

BIPA does not apply extraterritorially. Finally, BAM claims that plaintiff did not

adequately allege that BAM violated BIPA. BAM also claims that the unjust

enrichment claim is derivative of the BIPA action and that plaintiff did not

adequately plead that BAM was unjustly enriched.

A. BIPA

1. Financial Institution

As set forth infra, BIPA is an Illinois law that regulates how private entities

may collect and handle individuals’ biometric data. Although BIPA generally imposes

its regulations on any “private entity” that might collect or handle biometric

data, section 25(c) contains an important limitation on BIPA's scope:

“Nothing in this Act shall be deemed to apply in any manner to a

financial institution or an affiliate of a financial institution that is

subject to Title V of the federal Gramm–Leach–Bliley Act of 1999

and the rules promulgated thereunder.” 740 ILCS § 14/25.

Title V of the Gramm-Leach-Bliley Act (“GLBA”), 15 U.S.C. §§ 6801 et seq., is

a federal privacy law that regulates how “financial institutions” handle certain

customer information. See 15 U.S.C. § 6801(a) (statement of policy); see also Am. Bar

Ass'n v. FTC, 430 F.3d 457, 459 (D.C. Cir. 2005). The GLBA provides that “[i]t is the

policy of the Congress that each financial institution has an affirmative and

continuing obligation to respect the privacy of its customers and to protect the

security and confidentiality of those customers' nonpublic personal information.” 15

U.S.C. § 6801(a).

Page 17 of 29

It is important to note that the BIPA exemption is not for all financial

institutions. Stauffer v. Innovative Heights Fairview Heights, LLC, 480 F. Suppl. 888,

902 (S.D. Ill. 2020). Instead, the exemption is for those that are already covered by

another law, similar to BIPA, that requires financial institutions to explain their

information-gathering practices and how they safeguard sensitive data to their

customers. Id.

The legislature enacted BIPA to “protect Illinois residents’ privacy interests in

their biometric information.” 740 ILCS 14/1 et seq. Other than referencing the GLBA,

BIPA does not define the term “financial-institution”. Furthermore, neither the

Illinois Supreme Court nor any Illinois appellate court has discussed the scope of the

exemption.

It seems doubtful that BAM would be designated as a “financial institution”

and, therefore, exempt from BIPA. BIPA's financial institution exemption is explicit

in that BIPA does not apply to financial institutions already subjected to

GLBA. See 740 ILCS 14/25(c). The Federal Trade Commission describes the type of

financial institutions that must comply with GLBA, which includes “all businesses,

regardless of size, that are ‘significantly engaged’ in providing financial products or

services. This includes, for example, check-cashing businesses, payday lenders,

mortgage brokers, nonbank lenders, personal property or real estate appraisers,

professional tax preparers, and courier services.”4 Nowhere in the Complaint is BAM

4 See Federal Trade Commission, Gramm-Leach-Bliley Act, https://www.ftc.gov/tips-advice/business-

center/guidance/financial-institutions-customer-information-complying.

Page 18 of 29

described as a financial institution, that is engaged in any of the aforementioned

activities that would subject it to GLBA.

2. California Law

BAM next argues that California law should be applied (Doc. 55). It is well

settled that a federal court exercising diversity jurisdiction5 applies the choice-of-

law rules of the state in which it sits—here, Illinois. See Heiman v. Bimbo Foods

Bakeries Distrib. Co., 902 F.3d 715, 718 (7th Cir. 2018) (citing Klaxon Co. v. Stentor

Elec. Mfg. Co., 313 U.S. 487, 496 (1941)).

Under Illinois choice-of-law rules, this state's laws presumptively apply to a

dispute unless there is an actual conflict with another state's laws or the parties agree

that forum-state law does not apply. See Sosa v. Onfido, Inc., 8 F.4th 631, 637 (7th

Cir. 2021). Indeed, Illinois courts typically enforce a contractual choice-of-law

provision unless (1) doing so would violate fundamental Illinois public policy, and (2)

Illinois has a materially greater interest in the litigation than the other state. Smurfit

Newsprint Corp. v. Se. Paper Mfg., 368 F.3d 944, 949 (7th Cir. 2004) (citing English

Co. v. Nw. Envirocon, Inc., 663 N.E.2d 448, 452 (Ill. App. Ct 2. 1996)). A court may

also decline to enforce a contractual choice-of-law “if the contract's legality is fairly in

doubt, for example, if the contract is unconscionable, or if there is some other issue

as to the validity of the very formation of the contract.” Life Plans, Inc. v. Sec. Life of

Denver Ins. Co., 800 F.3d 343, 357 (7th Cir. 2015). BAM contends that the parties

5 On November 12, 2021, BAM removed this case from Illinois state court pursuant to 28 U.S.C. §

1332(d) - diversity of citizenship, and 28 U.S.C. § 1453 – CAFA.

Page 19 of 29

have entered into a contractual agreement and points to the choice-of-law

provision contained in the Terms of Use, which states that California law applies to

“contracts executed and to be wholly performed within such State”.

This Court rejects BAM’s argument. First, BIPA is an Illinois statute that was

enacted to protect state residents’ right to privacy in and control over their biometric

identifiers and information. 740 ILCS 14/1 et seq. To apply California law would likely

foreclose every one of Kuklinski’s claims against BAM. Second, there is a question as

to whether the entirety of the purported contract was performed wholly within

California, since Kuklinski was in Illinois when he downloaded the BAM application.

3. Extraterritorial Application

BAM argues that Kuklinski’s complaint is barred by the

“extraterritorial doctrine” (Doc. 55). Under Illinois law, a “statute is without

extraterritorial effect unless a clear intent in this respect appears from the express

provisions of the statute.” Avery v. State Farm Mut. Auto. Ins. Co., 216 Ill. 2d 100,

184–85 (2005)). In the absence of such an intent, a plaintiff may only maintain a cause

of action under an Illinois statute if “the circumstances that relate to the disputed

transaction occur[red] primarily and substantially in Illinois.” Id. at 187; see

also Morrison v. YTB Int'l, Inc., 649 F.3d 533, 536 (7th Cir. 2011).

As oft-cited, BIPA was enacted to “protect Illinois residents’ highly sensitive

biometric information from unauthorized collection and disclosure”. See 740 ILCS

14/5(c). The statute itself is silent on the intent surrounding extraterritorial effect;

therefore, the Court must determine whether the complained conduct “occurred

Page 20 of 29

primarily and substantially in Illinois.” Avery, 216 Ill.2d at 187.

There is no bright line rule for determining where the conduct complained of

“occurred primarily and substantially”; however, both our sister district to the north

as well as the Ninth Circuit have upheld cases involving Illinois residents having

their biometric information collected in Illinois. See Rivera v. Google Inc., 238

F.Supp.3d 1088, 1101 (N.D. Ill. 2017) (Courts look to the residency of the plaintiff,

the location of harm, communications between parties (where sent and where

received), and where a company policy is carried out); see also Patel v. Facebook, Inc.,

932 F.3d 1264, 1275-76 (9th Cir. 2019) (rejecting Facebook's argument that because

its servers are located outside Illinois, the necessary elements of a BIPA violation

occurred extraterritorially, and reasoning that the Illinois legislature contemplated

the statute's application to individuals who reside in Illinois and used Facebook in

Illinois, even if some relevant activities occurred outside the state).

In this case, Kuklinski is an Illinois resident, and as hereinbefore mentioned,

BIPA was enacted to protect the rights of Illinois residents. Moreover, Kuklinski

alleges that he downloaded the BAM application and created the BAM account while

he was in Illinois. Accordingly, this Court finds that the relevant events in this case

occurred primarily and substantially in Illinois.

4. Fails to State a Claim

In a last ditch effort to support dismissal, BAM argues that Kuklinski did not

adequately allege a violation of BIPA in accordance with Rule 8 of the Federal Rules

of Civil Procedure (Doc. 55). Specifically, BAM raises concerns that Kuklinski has

Page 21 of 29

lumped it together with BCM and Jumio and has not attributed the alleged violative

conduct to any specific defendant (Id., p. 16).

Unlike Rule 9(b), which requires claims of fraud and/or mistake be pled with

particularity, Rule 8(a) states as follows:

“(a) Claim for Relief. A pleading that states a claim for relief

must contain:

(1) a short and plain statement of the grounds for the court's

jurisdiction, unless the court already has jurisdiction and the

claim needs no new jurisdictional support;

(2) a short and plain statement of the claim showing that the

pleader is entitled to relief; and

(3) a demand for the relief sought, which may include relief in the

alternative or different types of relief.” Fed. R. Civ. P. 8(a).

Additionally, Rule 8(d)(1) specifies that a pleading must be simple, concise, and

direct while Rule 8(d)(2) and 8(d)(3) allow for alternative statements of a claim as

well as inconsistent claims.

A complaint must “give the defendant fair notice of what the ... claim is and

the grounds upon which it rests,” and its “[f]actual allegations must ... raise a right

to relief above the speculative level.” Pisciotta v. Old Nat'l Bancorp, 499 F.3d 629,

633 (7th Cir. 2007). “There is no ‘group pleading’ doctrine per se that either permits

or forbids allegations against defendants collectively.” Robles v. City of Chicago, 354

F. Supp. 3d 873, 875 (N.D. Ill. 2019). Notice is what counts. Id. Instead, the Complaint

must include “enough facts to state a claim to relief that is plausible on its face.” Bell

Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007); see Fed. R. Civ. P. 8(a)(2). Stated

otherwise, a facially plausible complaint is one which permits “the court to draw the

Page 22 of 29

reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft

v. Iqbal, 556 U.S. 662, 678 (2009). Where the actions of “multiple defendants [are] so

intertwined that no one from the outside could possibly separate the different

subsidiaries' alleged [mis]conduct,” a complaint can comply with Rule 8’s notice

pleading requirement without detailing each defendant’s behavior. Acantha LLC v.

Depuy Synthes Sales, Inc., 2016 WL 8201781 (E.D. Wis. July 28, 2016).

BIPA does not require heightened pleading. In this case, BAM was placed on

notice of the potential liability under BIPA. Accordingly, this Court finds that

Kuklinski has adequately alleged a cause of action against BAM. Indeed, all a

plaintiff must do is allege that defendants collected, captured, purchased, received,

or obtained their fingerprints without complying with BIPA’s requirements. See

Roberson v. Maestro Consulting Services LLC, 507 F.Supp.3d 998, 1018 (S.D. Ill.

2020). Accordingly, for purposes of this 12(b)(6) motion, Kuklinski has pled sufficient

facts to state a cause of action against BAM.

B. Unjust Enrichment

Next, BAM moves to dismiss Kuklinski’s unjust enrichment claim alleged in

the amended class action complaint (Doc. 55). In particular, BAM argues that the

unjust enrichment claim is derivative of the BIPA claim (Id.). BAM further asserts

that Kuklinski did not adequately plead his unjust enrichment claim (Id.).

It is true that under Illinois law, unjust enrichment “is not a separate cause of

action that, standing alone, would justify an action for recovery.” Toushin v. Ruggiero,

2021 WL 2718495 (Ill.App.Ct. 1st Dist. 2021) (quoting Mulligan v. QVC, Inc., 888

Page 23 of 29

N.E.2d 1190, 1200 (Ill.App.Ct. 1st Dist. 2008)). “[I]f an unjust enrichment claim rests

on the same improper conduct alleged in another claim, then the unjust enrichment

claim will be tied to this related claim—and, of course, unjust enrichment will stand

or fall with the related claim.” Cleary v. Philip Morris Inc., 656 F.3d 511, 517 (7th

Cir. 2011). Because plaintiffs have sufficiently alleged their BIPA claims, the Court

also denies BAM’s motion to dismiss the unjust enrichment claim that is secondary

to the BIPA claims.

III. Jumio Corporation (“Jumio”)

Jumio offers software to businesses, including BAM, to help them verify the

identities of their customers. In its motion to dismiss, Jumio asserts the following five

reasons for dismissal: (1) BIPA does not apply to this case because BAM is a financial

institution subject to GLBA; (2) BIPA has no extraterritorial application; (3) Jumio

has developed a publicly available retention policy; (4) Claims against Jumio before

March 24, 2019 are preempted by settlement in Prelipceanu v. Jumio Corporation,

2018-CH-15883 (Cook County, IL July 21, 2020); and, (5) Application of BIPA against

Jumio violates the First Amendment (Doc. 53).

On March 13, 2023, this Court granted Kuklinski’s Motion for Leave to File

Supplemental Authority (Doc. 80), allowing submission of the recent decision from

the Northern District of Illinois, to wit: Davis v. Jumio Corporation, 22-cv-00776

(N.D.Ill. February 14, 2023) (Doc. 83). While the Court has reviewed the Davis

decision, it is important to note that Davis did not involve all of the parties in this

case nor is it considered binding authority.

Page 24 of 29

1. Financial Institution

Jumio first argues that Kuklinski’s claims against it should be dismissed

because BIPA does not apply to financial institutions; in other words, because BIPA

cannot be applied against BAM, any application against Jumio would also be

unlawful (Doc. 53). In response, Kuklinski counters that BAM is a cryptocurrency

exchange and not a financial institution, that BIPA is applicable to BAM, and

consequently applicable to Jumio (Doc. 62).

This Court went thru the financial institution analysis infra (Section II, A, 1)

and determined that BAM was NOT exempt under BIPA. Accordingly, this Court

extends that determination to Jumio’s motion and does not accept this argument.

2. No Extraterritorial Application

Jumio next argues that BIPA does not apply extraterritorially (Doc. 53). Jumio

further contends that Kuklinski did not sufficiently allege that the relevant conduct

occurred primarily and substantially in Illinois (Id.). In response, Kuklinski outlined

the paragraphs within the amended complaint where Jumio’s conduct was alleged in

violation of BIPA, and also identified the specific paragraphs wherein Kuklinski, an

Illinois resident, downloaded the BAM application that contained the Jumio software

and created his BAM account while in Illinois (Doc. 62). Kuklinski’s response also

reiterated that he downloaded the BAM application while in Cook County, IL.

It is true that BIPA does not apply extraterritorially; however, this Court has

determined, albeit with respect to BAM (See II, A, 3, infra), that the relevant events

in this case occurred primarily and substantially in Illinois by an Illinois resident.

Page 25 of 29

Accordingly, there are sufficient facts alleged to plausibly support Kuklinski’s claim

that the conduct against Jumio also occurred in Illinois to deny dismissal and proceed

to discovery.

3. Retention Policy

Jumio’s third argument questions Kuklinski’s claims under BIPA §14/15(a)

because Jumio claims to have complied with the required privacy and retention policy

(Doc. 53). Section 15(a) of BIPA requires a private entity in possession of biometric

data to develop, publicly disclose, and comply with a retention schedule and

guidelines for destroying the data within specified time limits. 740 ILCS 14/15(a).

This case originated on October 4, 20216. Kuklinski downloaded the BAM

application on March 15, 2021 (Doc. 45, ¶ 26). While Jumio attached its privacy policy

to the motion to dismiss, it did not indicate when said policy went into effect (Doc. 53-

6). The mere fact that Jumio may or may not have complied with BIPA does not bely

the fact that there may have been a violation of the Biometric Act. In fact, the Illinois

Supreme Court has held the opposite. See Rosenbach v. Six Flags Entertainment

Corporation, et al., 129 N.E.2d 1197 (Ill. 2019) (A person need not have sustained

actual damage beyond violation of his or her rights under [the Biometric Act] in order

to bring an action under it; the violation, in itself, is sufficient to support the

individual's or customer's statutory cause of action.). Furthermore, questions arise as

to whether said policy even complies with BIPA.

6 The case was filed in the Circuit Court for the Twentieth Judicial Circuit, St. Clair County, Illinois,

to wit: 21L962.

Page 26 of 29

4. Cook County Settlement

Jumio’s next argument is that any claims based on the period of time before

June 23, 2019 are preempted by the class action settlement in Prelipceanu v. Jumio,

2018-CH-15883 (Cook County, IL, July 21, 2020). Specifically, the Prelipceanu

settlement class was designated as follows: “All individuals in Illinois whose

Biometrics or photos were collected, captured, purchased, received through trade,

otherwise obtained or in the possession of Jumio and/or any of its parents,

subsidiaries, or agents, or their technology, at any time between December 21, 2013

and December 23, 2019.” (Doc. 53-1).

Kuklinski does not address this argument, which can be deemed as

acquiescence. See Alioto v. Town of Lisbon, 651 F.3d 715 (7th Cir. 2011) (a person

waives an argument by failing to make it before the district court); Goodpaster v. City

of Indianapolis, 736 F.3d 1060, 1075 (7th Cir. 2013) (claims waived where party

asserting them did not provide the district court with any basis to decide them and

did not respond to [the opposing party's] arguments”).

Within the amended complaint, Kuklinski asserts the action is being brought

on his behalf and the following Illinois class, “All Illinois users and account holders

whose facial and biometric data have been collected by the Binance.US applications,

software and website.” (Doc. 45, ¶ 48). While Kuklinski did not expressly raise any

dates or time parameters within the amended complaint, this Court will consider

whether any potential recovery will be limited to claims arising after June 23, 2019

at a more appropriate time.

Page 27 of 29

5. First Amendment

Jumio’s last argument is that interpreting BIPA 14/15(b) to apply to Jumio’s

conduct would render BIPA unconstitutional (Doc. 53). Specifically, Jumio claims

that the First Amendment protects the right to make recordings and that BIPA

interferes with this right; however, this argument is unpersuasive.

Kuklinski counters and points to a recent decision from the Northern District

wherein the Court went through an in depth analysis of the First Amendment as

applied to BIPA § 14/15 (b) and found no restrictive speech, or if there was restrictive

speech, it was a content-neutral restriction that satisfied the intermediate level of

scrutiny. Sosa v. Onfido, Inc., 600 F.Supp. 3d 859 (N.D. Ill. 2022).

This Court concurs with the Sosa decision analysis and decision. Accordingly,

Jumio’s motion fails.

CONCLUSION

In light of the forgoing, this Court does not have jurisdiction over BCM;

however, Kuklinski has sufficiently pled causes of action against BAM and Jumio and

has plausibly alleged that he is entitled to relief. This is the pleading stage, not the

proving stage. Because the purpose of a Rule 12(b)(6) motion to dismiss is to test the

sufficiency of the complaint, not to resolve the case on the merits, any disputed issues

may be better suited for disposition on a motion for summary judgment, after the case

has been more fully developed through discovery.

Accordingly, the motion to dismiss for lack of jurisdiction filed by Binance

Capital Management Co. is GRANTED with prejudice; however, the motions to

Page 28 of 29

dismiss filed by defendants BAM Trading Services Inc. and Jumio Corporation are

DENIED. BAM and Jumio shall answer the amended complaint within 14 days, or

by April 19, 2023.

Finally, this Court lifts the stay that was entered on July 29, 2022.

Additionally, because many of the deadlines set forth in the Scheduling Order were

delayed by the stay, the presumptive trial is extended from February 2024 to

November 2024. As such, the parties shall submit an Amended Joint Report of the

Parties and Proposed Scheduling and Discovery Order within 21 days, or by April 26,

2023.

IT IS SO ORDERED.

DATED: April 4, 2023

/s/ Stephen P. McGlynn_

STEPHEN P. McGLYNN

U.S. District Judge

Page 29 of 29