Opinion
C21-1473-TL-MLP
05-24-2022
ANN MAYHALL, on behalf of her Minor Child, D.M., individually and on behalf of all others similarly situated, Plaintiff, v. AMAZON WEB SERVICES INC., et al., Defendants.
REPORT AND RECOMMENDATION
MICHELLE L. PETERSON, UNITED STATES MAGISTRATE JUDGE.
I. INTRODUCTION
Before the Court is Defendants Amazon Web Services Inc. (“AWS”) and Amazon.com Inc.'s (collectively, “Defendants”) Motion to Dismiss for Failure to State a Claim (“Defendants' Motion”). (Defs.' Mot. (dkt. # 18).) Plaintiff Ann Mayhall filed this action, on behalf of her minor child D.M, alleging class-action claims for: (1) violations of Illinois's Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/15(a); and (2) unjust enrichment. (Compl. (dkt. # 1).) Plaintiff's claims generally arise from Defendants' provision of cloud services to Take-Two Interactive (“Take-Two”) and 2K Games for their NBA 2K video game series, which Plaintiff alleges allows Defendants to create, disseminate, and store biometric data. (Compl. at ¶¶ 8-21, 166-247.) Plaintiff filed a response (Pl.'s Resp. (dkt. # 20)), and Defendants filed a reply (Defs.' Reply (dkt. # 23)). The Court heard oral argument from the parties on May 4, 2022. (Dkt. # 30.)
Having considered the parties' submissions, oral argument, the balance of the record, and the governing law, the Court recommends that Defendants' Motion (dkt. # 18) be DENIED, as further explained below.
II. BACKGROUND
Take-Two, and its subsidiary 2K Games, annually publish NBA 2K, a basketball video game. (Compl. at ¶¶ 9, 77-81.) For online services related to the NBA 2K games, Take-Two utilizes Amazon's cloud-computing services. (Id. at ¶¶ 9-11, 83-85.) Plaintiff alleges that Defendants have shared facilities and infrastructure, such that AWS enters into contractual relationships with video game companies for its cloud services but employs Amazon.com facilities and infrastructure to provide the services. (Id. at ¶¶ 11, 59-63, 65-68.)
In this case, Plaintiff alleges that Take-Two utilizes Defendants' “Amazon CloudFront” service, a content storage and delivery network that speeds up content delivery by distributing and storing content at “Edge” and “Regional Edge Cache” data server locations. (Id. at ¶¶ 47-58, 107.) Plaintiff alleges that six of Defendants' “Edge” data server locations are located in Chicago, Illinois. (Id. at ¶ 51.) Plaintiff further alleges that if the content is not in an “Edge” data server location, CloudFront attempts to retrieve the content from either a “Regional Edge Cache” data server location or an “Origin Server” to deliver it to the “Edge” data server, and ultimately, to the end user. (Id. at ¶¶ 53-56.) Relevant to the instant matter, Plaintiff alleges that during this process, the content is stored in each “Edge” and “Regional Edge Cache” data server location from which it is delivered to reduce latency the next time the user requests the content. (Id. at ¶¶ 57-58, 73.)
In addition to publishing NBA 2K, Take-Two publishes a companion app (the “App”) for mobile devices that inter alia allows users to upload images of their face to make customized players resembling the user in the NBA 2K video game. (Compl. at ¶¶ 12-15, 86-89, 93.) To create a customized player in this fashion, the user is required to log into the App and take multiple pictures of their face. (Id. at ¶¶ 13, 93-96.) Plaintiff alleges that the photos collected by the App are then compressed and uploaded to a Take-Two server. (Id. at ¶¶ 14, 97, 104.) After the user uploads the photos through the App, the user is then required to log into their gaming platform and select an option when creating a customized player to “Check for Head Scan Data.” (Id. at ¶¶ 15, 97-100.) Once selected, Plaintiff alleges that the game makes a request to Defendants' servers to retrieve the face-scan photos from Take-Two's server. (Id. at ¶¶ 16, 105.) Plaintiff alleges that Defendants' servers are then utilized to collect facial feature vectors from the face-scan data and that those vectors are employed to construct a three-dimensional model of the user's face (the “face geometry”) using Defendants' computing power. (Id. at ¶¶ 16, 106.) While this process is ongoing, the game depicts a circle moving from 0% to 100% above the text: “Building your MyPLAYER's unique scanned head. This may take a few minutes.” (Id. at ¶ 100.)
Once the user's face geometry is created, Plaintiff alleges that Defendants transmit the face geometry via CloudFront through Defendants' “Edge” and “Regional Edge Cache” server locations to deliver it to the user's gaming platform and game session. (Compl. at ¶¶ 16, 107, 109.) Plaintiff alleges that the face geometry transmitted constitutes a “biometric identifier” per BIPA, that Defendants store this data at each data server location through which it is transmitted to the user, and that Defendants do not disclose how long the face geometry or associated data is stored on their server locations. (Id. at ¶¶ 17-18, 108, 110, 112.) Plaintiff further alleges that once the face geometry is created and used to make a customized player, the user must remain connected to the internet to play NBA 2K using the customized player. (Id. at ¶ 113.) Plaintiff alleges that the customized player is not stored locally on the gaming platform's hard drive, and thus, the process of delivering, storing, and transmitting the facial geometry through Defendants' server locations is repeated each time the user seeks to play with their customized player. (Id. at ¶¶ 113-117.) The face geometry creation, delivery, and storage process is depicted in Plaintiff's complaint as follows:
Figure 4: The Face Geometry Creation, Delivery & Storage process
(Image Omitted) (Compl. at ¶ 111.)
Pertinent to the instant action, in early 2021, D.M. created a customized player in the NBA 2K21 video game on his Xbox One. (Compl. at ¶¶ 135, 137.) To create the customized player, Plaintiff alleges that D.M. downloaded the App without parental knowledge or consent, took multiple pictures of his face, and uploaded them via the App. (Id. at ¶¶ 136-139.) D.M. then logged on to his Xbox One to create his customized player. (Id. at ¶ 140.) When D.M. clicked the button to create his customized player, Plaintiff alleges that his Xbox One made a request to Defendants' servers to retrieve D.M.'s photos from the Take-Two server to create a face geometry on Defendants' servers. (Id. at ¶¶ 141-142.)
Once D.M.'s face geometry was created, Plaintiff alleges that Defendants transmitted it via CloudFront through their “Edge” and “Regional Edge Cache” systems and delivered it to D.M.'s Xbox One at his home in Illinois. (Compl. at ¶ 144.) Plaintiff alleges that Defendants stored D.M.'s face geometry at each “Edge” and “Regional Edge Cache” data center location through which it passed. (Id. at ¶¶ 145, 147-48.) Plaintiff alleges that any requests related to D.M.'s face geometry were routed to or through the “Edge” data server location in Chicago, Illinois, and that his face geometry and biometric information were obtained, stored, and transmitted from that location. (Compl. at ¶¶ 151-52.) Finally, Plaintiff alleges that D.M. played NBA 2K21 using his customized player with his scanned face on multiple occasions throughout 2021, and that every time D.M. played NBA 2K21 with his customized player, Defendants obtained, delivered, and stored his face geometry and/or biometric information on their servers. (Id. at ¶¶ 149-150.)
Based on the above allegations, Plaintiff brings class-action claims pursuant to BIPA, Sections 15(a)-(d), and for unjust enrichment. (Compl. at ¶¶ 154-247.) In sum, Plaintiff alleges that Defendants' failure to develop, make publicly available, or comply with a written retention and destruction policy for biometric data is in violation of BIPA. (Id. at ¶¶ 171, 208.) Plaintiff claims that Defendants improperly sold, traded, or profited from Plaintiff and Class Members' biometric data and disseminated it without consent. (Id. at ¶¶ 186-90, 197-98, 223-27, 234-35.) Plaintiff alleges that Defendants did not provide advance notice to Plaintiff and Class Members of any collection, capturing, receiving, or obtaining of biometric data, nor did they receive written releases before doing so. (Id. at ¶¶ 178-81, 215-18.) Finally, Plaintiff alleges that Defendants were unjustly enriched by Plaintiff and Class Members' biometric information, depriving them of control over their biometric data, while exposing both them and their biometric information to a heightened risk of privacy and informational harms. (Id. at ¶¶ 241, 244-46.)
III. DISCUSSION
Defendants contend that Plaintiff's claims in this matter largely amount to a futile attempt to “force a square peg into a round hole,” because as a cloud services provider, Defendants did not possess, obtain, sell, lease, trade, disseminate, or otherwise interact with biometric data stored by Take-Two such that Defendants are subject to BIPA liability. (Defs.' Reply at 1.) To a degree, the Court understands Defendants' skepticism that they could be found liable for biometric data utilized by Take-Two simply because Defendants offer cloud storage services.
Nevertheless, Plaintiff's allegations at this early stage-as examined in the light of relevant case law and BIPA's plain language-demonstrate that Plaintiff has plausibly alleged that Defendants were in possession of and/or obtained D.M.'s biometric data, which they then utilized to create facial geometry, disseminated, and stored on their servers without Plaintiff's consent. In addition, the Court finds that Plaintiff has sufficiently stated a claim for unjust enrichment.
A. Rule 12(b)(6) Legal Standard
When considering a motion to dismiss under Rule 12(b)(6), the court construes the complaint in the light most favorable to the nonmoving party. Livid Holdings Ltd. v. Salomon Smith Barney, Inc., 416 F.3d 940, 946 (9th Cir. 2005). The Court must accept all well-pleaded facts as true and draw all reasonable inferences in favor of the plaintiff. Wyler Summit P'ship v. Turner Broad. Sys., Inc., 135 F.3d 658, 661 (9th Cir. 1998). However, the Court is not required “to accept as true allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” Sprewell v. Golden State Warriors, 266 F.3d 979, 988 (9th Cir. 2001).
“To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.'” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. at 677-78. “A pleading that offers ‘labels and conclusions' or ‘a formulaic recitation of the elements of a cause of action will not do.' . . . Nor does a complaint suffice if it tenders ‘naked assertion[s]' devoid of ‘further factual enhancement.'” Id. at 678 (quoting Twombly, 550 U.S. at 555, 557).
B. Defendants' Exhibits
First, Defendants' Motion attaches and relies on multiple exhibits that were not incorporated or otherwise referenced as part of Plaintiff's complaint. Specifically, Defendants have submitted copies of: (1) the AWS Customer Agreement (Defs.' Mot., Ex. A at 27-47); (2) the AWS “Data Privacy FAQ” (Defs.' Mot., Ex. B at 48-49); and (3) an Amazon white paper titled “Using AWS in the Context of Common Privacy and Data Protection Considerations” (“Exhibit C”) (Defs.' Mot., Ex. C at 50-73). Defendants argue that consideration of the exhibits is appropriate because: (1) Plaintiff's complaint cites information from AWS's website, and thus, incorporates Defendants' exhibits by reference; or (2) the exhibits are matters of public record that the Court may take judicial notice of. (Defs.' Mot. at 7 n.4.) Plaintiff argues that consideration of Defendants' exhibits is inappropriate because the evidence is outside of the complaint and Defendants fail to meet the requirements to show that different webpages than those cited by Plaintiff should be considered. (Pl.'s Resp. at 8 n.2.)
In deciding whether to dismiss a complaint for failing to state a claim, the Court is generally bound by the facts and allegations contained within the four corners of the complaint. See Shaver v. Operating Eng'rs Loc. 428 Pension Tr. Fund, 332 F.3d 1198, 1201 (9th Cir. 2003) (“Generally, on a 12(b)(6) motion, [the Court] should consider only the pleadings.”). However, the Court may consider “materials incorporated into the complaint by reference, and matters of judicial notice.” New Mexico State Inv. Council v. Ernst & Young LLP, 641 F.3d 1089, 1094 (9th Cir. 2011). “Incorporation by reference” doctrine allows for consideration of documents “whose contents are alleged in a complaint and whose authenticity no party questions, but which are not physically attached to the [plaintiff's] pleading.” Knievel v. ESPN, 393 F.3d 1068, 1076 (9th Cir. 2005) (internal quotations omitted). A court may also review materials on a motion to dismiss if they are the subject of judicial notice. Judicial notice may be taken of facts that are not subject to reasonable dispute because they are generally known or “capable of accurate and ready determination by resort to sources whose accuracy cannot be reasonably questioned.” U.S. v. Ritchie, 342 F.3d 903, 908-09 (9th Cir. 2003); Fed.R.Evid. 201(b).
Plaintiff's complaint cites in footnotes to four different webpages hosted by Amazon, none of which include or reference Defendants' submitted exhibits. (See Compl. at ¶¶ 49 n.4 (citing to “Amazon Cloudfront Key Features,” https://aws.amazon.com/cloudfront/features/ (last visited May 24, 2022)), 64 n.11 (citing to “What is Computer Vision?” https://aws.amazon.com/computer-vi si on/ (last visited May 24, 2022)), 67 n.13 (citing to “What is Cloud Computing?,” https://aws.amazon.com/what-is-cloud-computing/ (last visited May 24, 2022)), 68 n.14 (citing to “AWS for Games,” https://aws.amazon.com/gametech/ (last visited May 24, 2022).) Defendants fail to show that the webpages cited in Plaintiff's complaint incorporate Defendants' exhibits by reference or that Plaintiff's claims otherwise depend on Defendants' exhibits. See Knievel, 393 F.3d at 1076. Nor have Defendants demonstrated that a viewer accessing the webpages cited by Plaintiff “must also access the surrounding pages” including Defendants' exhibits. Id.
However, the Court may take judicial notice of matters that are either “generally known within the trial court's territorial jurisdiction” or “can be accurately and readily determined from sources whose accuracy cannot reasonably be questioned.” Fed.R.Evid. 201(b). The AWS Customer Agreement and AWS “Data Privacy FAQ” both appear on publicly available websites and the facts included are not subject to reasonable dispute. Therefore, both exhibits are proper subjects for judicial notice. See, e.g., Brown v. Google LLC, 525 F.Supp.3d 1049, 1061 (N.D. Cal. 2021) (taking judicial notice of Google's Terms of Service and a version of Google's Privacy Policy); In re Google Assistant Priv. Litig., 457 F.Supp.3d 797, 813-14 (N.D. Cal. 2020) (taking judicial notice of Google's Terms of Service, Privacy Policy, and a Google blog post); Matera v. Google, Inc., 2016 WL 5339806, at *7 (N.D. Cal. Sept. 23, 2016) (same).
The same cannot be said of Exhibit C. Plaintiff disputes that the Amazon white paper has binding effect or relevance to Plaintiff's claims, arguing that it notes it: (a) “is for informational purposes only”; (b) “represents current AWS product offerings and practices, which are subject to change without notice”; (c) “does not create any commitments or assurances from AWS”; and (d) “is not part of, nor does it modify, any agreement between AWS and its customers.” (Pl.'s Resp. at 8 n.3 (citing Defs.' Mot., Ex. C at 52).) Plaintiff additionally contends that nothing contained in Exhibit C states that AWS customers retain exclusive ownership or control over their content. (Id.)
As indicated by Plaintiff's opposition, the accuracy and nature of the Amazon white paper is not beyond reasonable dispute. “Because the effect of judicial notice is to deprive a party of an opportunity to use rebuttal evidence, cross-examination, and argument to attack contrary evidence, caution must be used in determining that a fact is beyond controversy under Rule 201(b).” Rivera v. Philip Morris, Inc., 395 F.3d 1142, 1151 (9th Cir. 2005) (internal citations omitted); see also F.T.C. v. Amazon.com, Inc., 71 F.Supp.3d 1158, 1161 (W.D. Wash. 2014). Erring on the side of such caution, Exhibit C will not be considered in evaluating Defendants' Motion.
C. Rule 8(a) and Group Pleading
Next, Defendants argue that Plaintiff improperly grouped AWS and Amazon.com, in violation of Rule 8(a)'s pleading standards, because Amazon.com did not contract to provide Take-Two cloud storage or any service. (Defs.' Mot. at 18-19.) Plaintiff counters that the claims are adequately alleged against AWS and Amazon.com because Defendants are generally integrated entities, which supports a plausible inference that each has possession and/or control over the biometric data due to their shared infrastructure. (Pl.'s Resp. at 23-24.)
Rule 8(a) of the Federal Rules of Civil Procedure provides that for a pleading to state a claim for relief, it must contain a short and plain statement of the grounds for the court's jurisdiction, a short and plain statement of the claim showing that the pleader is entitled to relief, and a demand for the relief sought. The statement of the claim must be sufficient to “give the defendant fair notice of what the plaintiff's claim is and the grounds upon which it rests.” Conley v. Gibson, 355 U.S. 41, 47 (1957).
A complaint which lumps together multiple defendants in one broad allegation generally fails to satisfy the notice requirement of Rule 8(a)(2). See Adobe Sys. Inc. v. Blue Source Grp., Inc., 125 F.Supp.3d 945, 964 (N.D. Cal. 2015). But “[g]roup pleading is not fatal to a complaint if the complaint still gives defendants fair notice of the claims against them.” Tivoli LLC v. Sankey, 2015 WL 12683801, at *3 (C.D. Cal. Feb. 3, 2015). Where defendants are alleged to be “related entities” who acted in concert “it is entirely possible that the allegations of wrongdoing are intended to include each and every entity defendant.” Id. at *4; see also Munning v. Gap, Inc., 2016 WL 6393550, at *3 (N.D. Cal. Oct. 28, 2016) (“[B]ecause the Defendants all share a parent-subsidiary relationship . . . and because all the Defendants are represented by the same counsel, frustration of notice of the claims to each defendant is unlikely.”).
Here, based on the factual allegations in Plaintiff's complaint, Plaintiff has adequately raised claims against AWS and Amazon.com. Plaintiff's complaint outlines the interrelatedness of AWS and Amazon.com based on the alleged joint ownership and hosting of servers and their shared infrastructure. (See Compl. at ¶¶ 59-64.) Specifically, Plaintiff alleges that: (1) the servers at the “AWS Edge Locations” and “AWS Regional Edge Caches” in this matter are hosted by Amazon.com; (2) Amazon.com owns, leases, operates and/or controls data centers used by AWS; and (3) that per Amazon.com's 2021 Form 10-K filing, Amazon.com acknowledges it “leverage[s] a shared infrastructure [with AWS] that supports both our internal technology requirements and external sales to AWS customers.” (See id. at ¶¶ 59-61.) Moreover, Plaintiff's complaint alleges that AWS enters into contractual relationships with video game companies, such as Take-Two (see id. at ¶¶ 65, 67-68), but employs Amazon.com's shared facilities and infrastructure to provide the services (see id. at ¶¶ 61-63, 66).
Additional discovery may uncover that AWS is the sole entity responsible in providing the services and server infrastructure to Take-Two at issue in this case. But at the present time, and as pleaded in Plaintiff's complaint, Plaintiff's claims against Amazon.com provide Amazon.com fair notice of Plaintiff's claims and therefore do not run afoul of Rule 8 pleading standards.
In addition, the Court notes that Defendants are both represented by the same counsel. Munning, 2016 WL 6393550 at *3 (“[B]ecause all the Defendants are represented by the same counsel, frustration of notice of the claims to each defendant is unlikely.”).
D. Biometric Identity Protection Act (“BIPA”)
BIPA was enacted in 2008 to help regulate “the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” Rosenbach v. Six Flags Entm't. Corp., 129 N.E.3d 1197, 1203 (Ill. 2019) (citing 740 ILCS 14/1 et seq.). BIPA “imposes numerous restrictions on how private entities collect, retain, disclose and destroy biometric identifiers . . . Under the Act, any person ‘aggrieved' by a violation of its provisions ‘shall have a right of action against an offending party' and ‘may recover for each violation.'” Id. at 1199 (quoting 740 ILCS 14/20). Under BIPA, “when a private entity fails to comply with one of Section 15's requirements, that violation constitutes an invasion, impairment, or denial of the statutory rights of any person or customer whose biometric identifier or biometric information is subject to the breach.” Id. at 1206.
“Biometric identifiers” covered by BIPA include retina or iris scans, fingerprints, voiceprints, and scans of hand or face geometry. 740 ILCS 14/10. “Biometric information” covered by BIPA includes “any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual.” Id.
For negligent violations of BIPA, a plaintiff may obtain “liquidated damages of $1,000 or actual damages, whichever is greater,” 740 ILCS 14/20(1), and for intentional or reckless violations of BIPA, a plaintiff may collect “liquidated damages of $5,000 or actual damages, whichever is greater,” 740 ILCS 14/20(2), for each violation. A plaintiff need not plead or prove additional consequences beyond the statutory violation. Rosenbach, 129 N.E.3d at 1206 (“The violation, in itself, is sufficient to support the individual's . . . statutory cause of action.”).
Defendants have moved to dismiss all of Plaintiff's BIPA claims in their instant motion. (See Defs.' Mot.) The Court addresses the arguments applicable to each claim in turn.
i. Section 15(a)
Section 15(a) of BIPA requires that:
A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual's last interaction with the private entity, whichever occurs first. Absent a valid warrant or subpoena issued by a court of competent jurisdiction, a private entity in possession of biometric identifiers or biometric information must comply with its established retention schedule and destruction guidelines.740 ILCS 14/15(a).
1. Possession
First, Defendants argue that Plaintiff fails to adequately allege Defendants were “in possession of” D.M.'s biometric information as required under Section 15(a) because Take-Two owned and controlled the data. (Defs.' Mot. at 6-7.) Therefore, Defendants contend that Plaintiff fails to allege any facts supporting a plausible inference that Defendants exercised dominion or control over D.M.'s biometric information. (Id. at 7.) Plaintiff counters that the complaint plausibly alleges that Defendants are in possession of biometric information because an entity that creates biometric identifiers, then disseminates and stores it, is necessarily in possession of such data. (Pl.'s Resp. at 5-6.) Plaintiff further argues that exclusive ownership or control of the data is not required under Section 15(a) but merely possession. (Id. at 6-7.)
BIPA does not define “possession.” See 740 ILCS 14/10. The Illinois Supreme Court has held possession “occurs when a person has or takes control of the subject property or holds the property at his or her disposal” People v. Ward, 830 N.E.2d 556, 560 (Ill. 2005). Courts have generally adopted this definition when analyzing BIPA claims. See e.g., Heard v. Becton, Dickinson & Co., 440 F.Supp.3d 960, 968 (N.D. Ill. 2020); Namuwonge v. Kronos, Inc., 418 F.Supp.3d 279, 283-84 (N.D. Ill. 2019); Rosenbach, 129 N.E.3d at 1205. As such, allegations demonstrating that the defendant in any way controlled, accessed, received, or exerted dominion over the biometric data are typically required to show possession. See Naughton v. Amazon.com, Inc., 2022 WL 19324, at *3 (N.D. Ill. Jan. 3, 2022) (“[Plaintiff] also specifically asserts that Amazon stores his biometric data in a database. This plainly satisfies the ‘possession' requirement at the pleadings stage.”); but see Jacobs v. Hanwha Techwin Am., Inc., 2021 WL 3172967, at *3 (N.D. Ill. July 27, 2021) (dismissing Section 15(a) claim where plaintiff failed to “provide any factual allegations that plausibly establish that defendant exercised control over plaintiff's data or otherwise held plaintiff's data at its disposal”).
Here, at this stage of the litigation, the Court must accept the facts as pleaded in Plaintiff's complaint as true. Plaintiff alleges that Defendants obtain the facial scan data from Take-Two's servers and convert the data into face geometry on Defendants' servers utilizing Defendants' cloud-computing power. (See Compl. at ¶¶ 16, 106, 111.) Plaintiff further alleges that once Defendants create the face geometry, they disseminate it across their server infrastructure and otherwise store it on each server as it is transmitted back to the user. (See id. at ¶¶ 107-117.) In short, Plaintiff alleges Defendants took certain actions-creating the face geometry and storing it on their servers-that would otherwise be impossible absent possession of the data. As a result, Plaintiff has plausibly alleged Defendants are in possession of D.M.'s biometric data. See Naughton, 2022 WL 19324 at *3.
Defendants point to the AWS Customer Agreement and “Data Privacy FAQ” as evincing their lack of control over D.M.'s biometric information. (Defs.' Reply at 3-4 (citing Defs.' Mot., Exs. A at 30 (“We will not access or use Your Content except as necessary to maintain or provide the Service Offerings, or as necessary to comply with the law or a binding order of a governmental body.”), B at 49 (“As a customer, you maintain full control of your content that you upload to the AWS services under your AWS account.”)).) To the contrary, these provisions instead indicate that Defendants maintain some form of possession of the data in their servers to access customer content when necessary to provide services or comply with the law. And despite Defendants' arguments that Take-Two owned the data containing D.M.'s biometric information, Defendants fail to demonstrate that BIPA's possession requirement requires exclusive access or control.
At a minimum, it is clear there are issues of fact as to what possession and/or control Defendants actually retain over data stored on their servers by their customers. But at this juncture, the Court finds that Plaintiff has adequately alleged that Defendants are in possession of Plaintiff's biometric data as contemplated under BIPA.
2. Ripeness
Pursuant to Section 15(a), the retention and destruction policy an entity establishes must provide for the destruction of biometric identifiers within three years of the individual's last interaction with the entity or when the initial purpose for collecting or obtaining such identifiers has been satisfied, whichever is earlier. 740 ILCS 14/15(a). Defendants argue that Plaintiff's Section 15(a) claims are unripe because neither of the statutory conditions requiring the destruction of D.M.'s biometric information have been met. (Defs.' Mot. at 8-9.) Defendants argue that it is undisputed that three years have not yet passed since D.M. last played NBA 2K21 and that the purpose of the collection of D.M.'s biometric information remains ongoing because D.M. continues to play the NBA 2K21 using his customized player. (Id. at 9.) Defendants additionally respond that because Plaintiff's allegations go beyond Defendants' alleged failure to develop a policy-and instead extend to Defendants' failure to destroy biometric data in the timeframe set by BIPA-such claims remain unripe. (Defs.' Reply at 4-5.)
Plaintiff counters that the Section 15(a) claim is ripe because allegations of Defendants' possession of biometric data without a written retention or destruction policy plausibly suggests that Defendants violated Section 15(a) by failing to develop a policy in the first instance. (Pl.'s Resp. at 10-11.) Plaintiff additionally contends that Plaintiff's Section 15(a) claim as to the required destruction of biometric information was triggered because the purpose for collecting D.M.'s biometric information was satisfied “when the data was delivered to D.M.” and that in any event, whether that purpose was in fact “satisfied” remains a factual question. (Id. at 12.)
Courts have generally held that Section 15(a) claims lack subject matter jurisdiction where brought earlier than the passing of three years since the individual's last interaction with the entity or where the purpose for collecting or obtaining the identifiers has been “satisfied.” See Horn v. Method Prods., PBC, 2022 WL 1090887, at *4 (N.D. Ill. Apr. 12, 2022) (“[Plaintiff's] claim related to [Defendant's] alleged failure to destroy his biometric information is not yet ripe for review because three years have not passed since his last interaction with [Defendant].”); Kislov v. Am. Airlines, Inc., 2021 WL 4711741, at *4 (finding where collection of biometrics did not occur more than three years prior to filing of the complaint, “[a]ny claim for unlawful retention of biometric data is likely not yet ripe”).
However, at least one court has found that ripeness challenges based on Section 15(a)'s statutory obligations as to when an entity must destroy biometric information “[do not] make much sense” because an alleged failure to establish a retention and destruction policy involves a current violation, and not a future one. Nseumen v. Dal Glob. Servs., Inc., 2021 WL 4728707, at *2 (N.D. Ill. Oct. 11, 2021). Specifically, the court in Nseumen held that:
[T]he fact that the [Section 15(a)] policy has to say something about destroying information no more than three years out doesn't suggest that the entity may wait those three years to establish its policy. The obligation under section 15(a) is, under the statutory language, a current obligation that applies to any entity collecting biometric data . . . Thus a claim regarding [defendant's] failure to establish a retention and destruction policy involves a current violation, not a potential future violation.Id.
Here, Plaintiff has alleged that Defendants did not employ a written retention or destruction policy (see Compl. at ¶¶ 19, 124, 171-72, 208-09), which Defendants do not dispute. Because Defendants did not develop a policy, and thus could not comply with such a policy in the first instance, Plaintiff's allegations that Defendants violated Section 15(a) by failing to develop or comply with a written policy is ripe for adjudication. See Nseumen, 2021 WL 4728707 at *2; see also Horn, 2022 WL 1090887 at *4 (finding plaintiff's Section 15(a) claim as to failure to develop and disclose a retention policy ripe based on defendant's alleged failure to “develop a written policy establishing a schedule and guidelines for the permanent destruction of biometric information”).
Furthermore, though it is clear three years have not since passed since D.M.'s last interaction with NBA 2K21, it is unclear at this early stage whether the “initial” purpose for collecting D.M.'s biometric information was “satisfied” for Plaintiff's Section 15(a) claim premised on Defendants' alleged failure to destroy biometric information. Relevant to this issue, Plaintiff has alleged that: (1) D.M. played NBA 2K using his customized player “on multiple occasion(s) throughout 2021”; and (2) every time D.M. played a game with his customized player, Defendants obtained, delivered, and stored his face geometry or biometric information. (Compl. at ¶¶ 149-50.) Plaintiff's complaint further alleges that the customized player with the face geometry is not stored locally on the video game console's hard drive, but rather the gaming platform's random-access memory during gameplay. (Id. at ¶ 114.) Once gameplay ends, Plaintiff alleges that the customized player and face geometry are stored on Defendants' servers, and therefore, the face geometry and/or other associated data must be re-delivered from Defendants each time the user wants to play NBA 2K using the previously customized player. (Id. at ¶¶ 115-17.)
Based on Plaintiff's allegations, there is, at a minimum, a factual question as to if the “initial” purpose was “satisfied” when the facial geometry was delivered to D.M. to create his customized player; or whether that purpose remains ongoing because D.M. continues to play NBA 2K21 using his customized player. Therefore, dismissal of Plaintiff's Section 15(a) claim premised on Defendants' alleged failure to destroy his biometric information on ripeness grounds would be premature at this time.
ii. Section 15(b)
Next, Defendants argue that Plaintiff fails to allege that Defendants took an “active step” to collect, capture, purchase, or otherwise obtain biometric data for Section 15(b) requirements to apply. (Defs.' Mot. at 9-11.) Defendants contend that the alleged collection of D.M.'s biometric information resulted from D.M's use of the App maintained and operated by Take-Two, not Defendants. (Id. at 11.) Plaintiff argues that Section 15(b) “do[es] not inherently require affirmative action,” but encompasses passive possession of biometric information. (Pl.'s' Resp. at 13-14.) Plaintiff alternatively argues that Defendants' creation of face geometry and/or dissemination and storage of it constitute any requisite affirmative actions. (Id. at 14-15.)
Section 15(b) provides that:
No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information, unless it first:
(1) informs the subject or the subject's legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored;
(2) informs the subject or the subject's legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and
(3) receives a written release executed by the subject of the biometric identifier or biometric information or the subject's legally authorized representative.740 ILCS 14/15(b). Unlike Sections 15(a), (c), (d), and (e) of BIPA-all of which apply to entities “in possession of” biometric data-Section 15(b) applies to entities that “collect, capture, purchase, receive through trade, or otherwise obtain” biometric data. See 740 ILCS 14/15(a)-(e).
In addition, the Court notes that Section 15(a) imposes different obligations than Section 15(b). Section 15(a) requires entities to develop and publish written policies regardless of whether they obtained biometric data before or after BIPA's effective date, while Section 15(b) imposes notice and consent obligations on entities that came into possession of such data after BIPA's effective date. See Figueroa, 454 F.Supp.3d at 784 (citing 740 ILCS 14/15(a) (covering “[a] private entity in possession of biometric identifiers or biometric information”) (emphasis added), with 740 ILCS 14/15(b) (“No private entity may collect, capture, purchase, ... or otherwise obtain a person's . . . biometric identifier or biometric information . . .” (emphasis added); see also 740 ILCS 14/99 (“This Act takes effect upon becoming law.”).)
“Otherwise obtain” is not defined by BIPA. See 740 ILCS 14/10. “Obtain” is defined as “[t]o come into the possession of,” or “to get, acquire, or secure.” Vance v. Amazon.com Inc. (“Vance I”), 525 F.Supp.3d 1301, 1312 (W.D. Wash. 2021) (citing Obtain, Oxford English Dictionary). “Otherwise” means “[i]n a different manner; in another way, or in other ways.” Id. (citing Black's Law Dictionary 1101 (6th ed. 1990); Oxford English Dictionary). Accordingly, this Court has found that “in context, [Section] 15(b) is triggered whenever a private entity acquires biometric data in the enumerated ways-collecting, capturing, purchasing, receiving through trade-or gets the biometric data in some other way.” Id.
Courts interpreting the meaning of “otherwise obtain” have held that possession alone is not enough to subject an entity to Section 15(b). See Heard, 440 F.Supp.3d at 966 (the argument that Section 15(b) requires more than mere possession “finds ample support in the case law”); see also Namuwonge, 418 F.Supp.3d at 286 (because “[t]he Illinois legislature used the term possession in certain sections of BIPA . . . but chose not to include possession in [Section] 15(b),” there “is a difference between possessing and collecting biometric information.”). Thus, courts analyzing Section 15(b) claims have found that a defendant entity must take active steps to collect, capture, or otherwise obtain the plaintiff's biometric information to sufficiently allege a Section 15(b) claim. See, e.g., Vance I, 525 F.Supp.3d at 1312-13 (finding plaintiff sufficiently alleged Amazon otherwise obtained biometric data by applying for and downloading a data set from IBM); Heard, 440 F.Supp.3d at 966 (“[F]or Section 15(b)'s requirements to apply, an entity must, at a minimum, take an active step to ‘collect, capture, purchase, receive through trade, or otherwise obtain' biometric data.”).
Here, Plaintiff has adequately alleged that Defendants otherwise obtained D.M.'s biometric data for a Section 15(b) claim. First, contrary to Defendants' argument, Plaintiff's allegations plead an “active step.” Plaintiff's complaint alleges that Defendants uploaded or otherwise stored the biometric data on their servers. (See Compl. at ¶¶ 84, 106.) Moreover, Plaintiff alleges Defendants constructed the facial geometry on their own servers through the use of Defendants' cloud computing services. (See id. at ¶¶ 107-111.) To do any of these things, Defendants “necessarily first had to ‘obtain' the data.” See Figueroa v. Kronos Inc., 454 F.Supp.3d 772, 784 (N.D. Ill. 2020).
Defendants' contention that Section 15(b) only applies if they themselves acquired the biometric data directly from D.M. also finds no support in the case law.Section 15(b) does not add any limitation to who or where the information is collected or obtained from, stating only that the protections are triggered when an entity collects biometric data, regardless of how that collection occurs. See Vance I, 525 F.Supp.3d at 1313 (citing 740 ILCS 14/15(b)). Like the situation in Vance I, “[i]n essence, Amazon wishes the court to read the limitation ‘directly from the person' into Section 15(b) where none exists.” Id.
It appears Defendants made nearly identical claims in Vance I. Compare Vance 1, 525 F.Supp.3d at 1313-14 (“Nor will the court adopt Amazon's proposal that [Section] 15(b) only applies when an entity acquires biometric data “'directly from any individual.'”) with Defs.' Mot. at 9-11. (“The alleged collection of D.M.'s biometric information resulted from D.M.'s use of the NBA2K App. Take-Two-not AWS or Amazon-maintained and operated the App, including with regard to collecting data . . . Because AWS and Amazon did not collect, capture, purchase, receive through trade, or otherwise obtain D.M.'s alleged biometrics-and the Complaint does not allege any of these things-Plaintiff's Section 15(b) claims fail as a matter of law.”).
Finally, Defendants' argument on whether BIPA remains applicable to third-party vendors remains unavailing. Defendants' cited cases concern situations where the plaintiffs failed to sufficiently plead the role of the third-party vendor, and therefore, warranted dismissal of the third party on those grounds. See Namuwonge, 418 F.Supp.3d at 286 (plaintiff alleged that only the employer, not the third-party vendor, obtained her fingerprints); Heard, 440 F.Supp.3d at 966-67 (dismissing Section 15(b) claim where plaintiff failed to provide facts detailing how third-party vendor actively collected his biometric data). Conversely, Plaintiff here has alleged that Defendants store the biometric data on their servers and that the biometric data is used by Defendants to construct facial geometry before being ultimately transmitting it to Take-Two. (See Compl. at ¶¶ 84, 106-111.) Plaintiff's Section 15(b) claim should not be dismissed.
Courts are split on whether third-party vendors who provide biometric technology, such as biometric operating systems, must comply with Section 15(b). See Vance I, 525 F.Supp.3d at 1313-14 (acknowledging split but concluding Amazon, as a third-party vendor, owed a Section 15(b) duty to plaintiffs because it took an active step to obtain biometric data); Figueroa, 454 F.Supp.3d at 779 (concluding third-party manufacturer of biometric time clocks owed Section 15(b) duty to their customers' employees).
iii. Section 15(c)
Defendants argue that Plaintiff's Section 15(c) claim fails because Plaintiff fails to allege facts demonstrating that AWS engaged in a direct sale of biometric data or that D.M.'s biometric data is integrated into Defendants' service such that Section 15(c) applies. (Defs.' Mot. at 12-13.) Defendants argues that they do not profit from D.M.'s biometric data because Take-Two creates the biometric data, and because Plaintiff fails to allege that Defendants received any money from Take-Two in exchange for transferring biometric data as opposed to payments for cloud computing services generally. (Id.)
Plaintiff responds that Defendants share and allow access to the biometric data and computing services to Take-Two for a fee, and that if payment stops, Take-Two's access stops. (Pl.'s Resp. at 15-16.) Plaintiff cites AWS's Customer Agreement, which provides Take-Two's “right to access or use” the data in Defendants' possession will be suspended if it breaches its payment obligation. (Pl.'s Resp. at 16 (citing Defs.' Mot., Ex. A at 32-33).) Thus, Plaintiff argues that Defendants violated Section 15(c) because they shared or gave access to biometric data, namely Defendants' created face geometry, in exchange for something of value. (Id.)
Section 15(c) prohibits any private entity “in possession of a biometric identifier or biometric information” from “sell[ing], leas[ing], trad[ing], or otherwise profit[ing] from a person's . . . biometric identifier or biometric information.” 740 ILCS 14/15(c). Section 15(c)'s first three verbs-“sell,” “lease,” and “trade”-all contemplate a transaction in which an item is given or shared in exchange for something of value. Vance v. Amazon.com (“Vance II”), 534 F.Supp.3d 1314, 1321-22 (W.D. Wash. 2021) (citations omitted). “In the context of the enumerated terms, ‘otherwise profit' encompasses commercial transactions-such as a sale, lease or trade-during which the biometric data is transferred or shared in return for some benefit.” Id. at 1322.
As a result, Section 15(c) applies to transactions with two components: “(1) access to biometric data is shared or given to another; and (2) in return for that access, the entity receives something of value.” Vance II, 534 F.Supp.3d at 1322. The first component is satisfied where the biometric data is the product of the transaction, such as in a direct sale, or where the biometric data is necessarily integrated into a product such that consumers gain access to the data by using the product or service. Id. The second component is satisfied where the “commercial dissemination of biometric data” is made “for some sort of gain, whether pecuniary or not.” Id.
In Vance II, plaintiffs alleged that Amazon's facial recognition technology, “Rekognition” allowed users to match new images of faces with known facial images based on visual geometry and that the services and its face-matching feature were incorporated into Amazon's products. 534 F.Supp.3d at 1324. Because the plaintiffs' allegations supported an inference that the biometric data was itself so incorporated into Amazon's product that, by marketing the product, Amazon was commercially disseminating the biometric data, this Court found that Amazon received some benefit from the biometric data through increased sales of its facial recognition technology. Id.
Similarly, in Flores v. Motorola Sols., Inc., plaintiffs alleged that the defendant used biometric data to develop a database that allowed customers to search for facial matches. 2021 WL 232627 at *3 (N.D. Ill. Jan. 8, 2021). Thus, using the product-“compar[ing] novel images to the database images to find facial matches”-necessarily allowed customers to gain access to the underlying biometric data. See id. In finding that “biometric data is a necessary element to Defendant's business model,” the court declined to find that the activity did not constitute “otherwise profiting from” biometric data. Id.
On this issue, Defendants' position is understandable. It appears Defendants are paid to provide cloud computing services regardless of the data involved, and unlike Vance II or Flores, there is not a direct benefit to Defendants' services due to the integration of biometric data as a necessary element of the service. Nevertheless, Plaintiff has clearly pleaded that access to D.M.'s biometric data was shared or disseminated to Take-Two, and that in return for that access, Defendants received something of value-namely payment from Take-Two. See Vance II, 534 F.Supp.3d at 1322. More specifically, Plaintiff plausibly alleges that Defendants: (1) retrieve the photographs from Take-Two's servers; (2) utilize the photographs and related data to create face geometry- the biometric identifier at issue in the case -on their servers; and (3) that the face geometry is then shared with Take-Two for a fee in order to use Defendants' cloud computing services. (See Compl. at ¶¶ 16, 83-84, 106, 111, 187-188, 224-225.)
As such, Plaintiff's allegations at this stage plausibly allege that Defendants' cloud computing services shared access to D.M.'s biometric data in exchange for monetary payment for their services. See Vance II, 534 F.Supp.3d at 1324 (“[B]ecause Plaintiffs' factual allegations allow for the reasonable inference that selling Amazon's products necessarily shares access to the underlying biometric data in exchange for some benefit to Amazon, the court concludes that Plaintiffs have sufficiently stated a claim under [Section] 15(c).”); see also Flores, 2021 WL 232627 at *3. Despite Defendants' position, it is also clear that Section 15(c)'s plain language does not require a direct sale of biometric data. See 740 ILCS 14/15(c); Vance II, 534 F.Supp.3d at 1322 (“Section 15(c) . . . [prohibits] a market in the transfer of biometric data, whether through a direct exchange-sale, lease or trade-or some other transaction where the product is comprised of biometric data.” (emphasis added)). Plaintiff's Section 15(c) claim should not be dismissed.
iv. Section 15(d)
Defendants argue that Plaintiff's Section 15(d) claim fails because Plaintiff fails to allege “commercial dissemination of biometric data for some sort of gain” to a third party. (Defs.' Mot. at 13-14.) Defendants additionally contend that D.M. consented to “disclosure” to himself of his data upon his request for that data. (Id. at 15.) Plaintiff argues that she has properly alleged Defendants disseminated D.M.'s biometric data every time they moved it to, and stored it in, a different server in a different location across the nation. (Pl.'s Resp. at 18.) Plaintiff argues that each time the biometric data passes through and is stored in a new location, it is disclosed or disseminated to other entities-that is at a minimum, to, through, or among AWS and Amazon.com. (Id. at 19.)
Section 15(d) disallows any private entity “in possession of a biometric identifier or biometric information” to “disclose, redisclose, or otherwise disseminate a person's . . . biometric identifier or biometric information” unless the subject of the biometric identifier or information “consents to the disclosure or redisclosure.” 740 ILCS 14/15(d). A plaintiff must only plead “specific, plausible dissemination” to proceed on a Section 15(d) claim. See Cothron v. White Castle System, Inc., 467 F.Supp.3d 604, 618 (N.D. Ill. 2020); Naughton, 2022 WL 19324 at *4 (finding plaintiff pleaded “plausible dissemination” by alleging Amazon collected his biometric information and disclosed that information to “other Amazon entities” and “third-party biometric device and software vendor(s)”).
Here, Plaintiff has pleaded plausible dissemination of biometric information. Plaintiff alleges Defendants disseminated D.M.'s biometric data when they moved it to, or stored it in, different server locations across Defendants' server infrastructure. (See Compl. at ¶¶ 55-56 (“The Origin Server, which may or may not be owned by AWS/Amazon, sends the content to the AWS Regional Edge Cache, which sends the content to the AWS Edge Location. CloudFront then delivers the content to the end-user from the Edge Location.”), 71-73 (alleging exchange of data between gaming platform, “Edge” and “Regional Edge Cache” data server locations, and Origin Server as needed). Furthermore, Plaintiff has alleged that Defendants disseminated the biometric information to the user's gaming platform, which would share it with Take-Two and/or the gaming platform's servers. (See id. at ¶¶ 105-111 (alleging Defendants transmit the constructed face geometry via CloudFront through Defendants' “Edge” and “Regional Edge Cache” date server locations to deliver it to user's gaming platform), 115-117 (”If the Face Geometry and associated data is not already stored in the Edge Location, the Edge Location either obtains the Face Geometry and associated data from the Regional Edge Cache location, or from the Origin Server, and the Edge Location forwards the Face Geometry and associated data to the user's Platform.”), 197, 234.)
While third-party disclosure may satisfy the requirements to state a Section 15(d) claim, Section 15(d) claims do not necessarily require third-party disclosure. See Roberson v. Maestro Consulting Servs. LLC, 507 F.Supp.3d 998, 1010 (S.D. Ill. 2020) (finding plaintiffs adequately alleged Section 15(d) claim where defendants “disclosed, redisclosed, or disseminated the biometric information of plaintiffs and the class members to, through, and/or among others, including but not limited to other [Defendants'] entities or persons associated with [Defendants].” (emphasis added)); Naughton, 2022 WL 19324 at *4. Here, Plaintiff has plausibly alleged dissemination by indicating Defendants are in possession of D.M.'s facial geometry and disclosed that data to “other Amazon entities,” which include Defendants based on their shared infrastructure, in addition to Take-Two.
Section 15(d) “prohibits private entities from disclosing an individual's biometric data without their consent.” Twin City Fire Ins. Co. v. Vonachen Servs., Inc., 2021 WL 4876943, at *8 (C.D. Ill. Oct. 19, 2021). Though Defendants contend that D.M. consented to any dissemination, there is no indication that D.M. gave consent from the face of the complaint. (See Compl. at ¶¶ 198, 235.) Moreover, BIPA likely requires the consent of D.M.'s “legally authorized representative” because D.M. is a minor. See 740 ILCS 14/15(d)(1).
Finally, Defendants' argument that they are not in possession of D.M.'s biometric data largely reasserts Defendants' position addressed in Section 15(a). As noted above, Plaintiff has plausibly alleged possession of D.M.'s biometric data, and in any event, there remain issues of fact as to what possession and/or control Defendants actually retain over data stored on their servers. Plaintiff's Section 15(d) claim should not be dismissed.
E. Choice of Law and Unjust Enrichment
A federal court sitting in diversity applies the choice-of-law rules of its forum state to determine which substantive law controls. Kohlrautz v. Oilmen Participation Corp., 441 F.3d 827, 833 (9th Cir. 2006). Washington employs a two-step approach. Kelley v. Microsoft Corp., 251 F.R.D. 544, 550 (W.D. Wash. 2008). First, the court must determine whether “an actual conflict between Washington and the other applicable state law exists.” Id. (citation omitted). Where there is an actual conflict, the court must then next determine which state has the “most significant relationship” to the action. Id.
In Vance I, this Court found that an actual conflict exists between Washington and Illinois law on a claim of unjust enrichment in the context of a BIPA lawsuit “over whether Plaintiffs must plead that they suffered an economic expense distinct from a privacy harm.” 525 F.Supp.3d at 1315. In that case, the Court found that applicable Washington and Illinois law would produce different outcomes because alleging a non-economic loss-such as a loss of privacy-is insufficient for an unjust enrichment claim under Washington law. Id. (citing Cousineau v. Microsoft Corp., 992 F.Supp.2d 1116, 1130 (W.D. Wash. 2012) (“Washington courts have not applied the doctrine of unjust enrichment outside the context of an ‘expense' stemming from some tangible economic loss to a plaintiff.”)). But under Illinois law, “the assertion that plaintiffs are ‘exposed to a heightened risk of privacy harm' and ‘have been deprived of their control over their biometric data' sufficiently states an unjust enrichment claim.” Id. (quoting Vance v. IBM Corp., 2020 WL 5530134, at *5 (N.D. Ill. Sept. 15, 2020)). Consequently, under the first step, the Court concurs with Vance I's conclusion that an actual conflict exists between Washington and Illinois law as to unjust enrichment.
In determining the “most significant relationship,” Washington courts employ a two-step analysis. FutureSelect Portfolio Mgmt., Inc. v. Tremont Grp. Holdings, Inc., 180 Wn.2d 954, 968 (2014). First, courts evaluate the parties' contacts with each jurisdiction that are relevant to the cause of action. Id. Second, courts consider the interests and public policies of the relevant jurisdictions. Id.
Choice of law for unjust enrichment claims is governed by Restatement (Second) of Law on Conflict of Laws Section 221 (Restitution). See Vance II, 534 F.Supp.3d at 1325 (citing Restatement (Second) of Law on Conflict of Laws § 221(1) cmt. a (Am. Law Inst. 1971) (“The rule of this Section applies to claims, which are based neither on contract nor on tort, to recover for unjust enrichment.”)). In determining which jurisdiction has the most significant relationship to the dispute under Section 221, the Court must consider the principles laid out in Section 6 of the Restatement:
(a) the needs of the interstate and international systems, (b) the relevant policies of the forum, (c) the relevant policies of other interested states and the relative interests of those states in the determination of the particular issue, (d) the protection of justified expectations, (e) the basic policies underlying the particular field of law, (f) certainty, predictability and uniformity of result, and (g) ease in the determination and application of the law to be applied.Vance II, 534 F.Supp.3d at 1325 (citing Restatement (Second) of Law on Conflict of Laws § 6(2) (Am. Law Inst. 1971)). In applying the Section 6 principles, courts are to consider the following contacts:
(a) the place where a relationship between the parties was centered, provided that the receipt of enrichment was substantially related to the relationship, (b) the place where the benefit or enrichment was received, (c) the place where the act conferring the benefit or enrichment was done, (d) the domicile, residence, nationality, place of incorporation and place of business of the parties, and (e) the place where a
physical thing, such as land or a chattel, which was substantially related to the enrichment, was situated at the time of the enrichment.Id. (citing Restatement (Second) of Law on Conflict of Laws § 221(2) (Am. Law Inst. 1971)).
In Vance II, this Court found that Illinois had the most significant relationship to the plaintiffs' unjust enrichment claim. Of note, the Vance II decision cited that the place where the act conferring the benefit occurred being Illinois, and the grouping of plaintiffs' domicile, residence, and Amazon's business in Illinois, as leaning most prominently toward application of Illinois law. 534 F.Supp.3d at 1326-27. Because Illinois had the most significant relationship per the contacts analysis in Restatement Section 221, and the general principles listed in Section 6, this Court found that the plaintiffs sufficiently pleaded an unjust enrichment claim under Illinois law. Id. at 1329.
Plaintiff responds that here, like Vance II, the contacts in this case weigh in favor of the application of Illinois law, and thus, a finding that Plaintiff has plausibly alleged an unjust enrichment claim. (Pl.'s Resp. at 20.) Specifically, Plaintiff notes that to the extent the relationship between D.M. and Defendants was centered in any location, it was Illinois, that it was Illinois where D.M.'s biometric data was stored and disseminated, and that Illinois is where any benefit was received. (Id.) Plaintiff additionally argues that “even if the contacts were balanced, Illinois has the greater interest in determining this particular issue.” (Id. at 22 (citing Vance II, 534 F.Supp.3d at 1328-29).)
Defendants counter that application of the “most significant relationship test” to determine choice of law results in an application of Washington, not Illinois law. (Defs.' Reply at 9.) Defendants cite that where the alleged benefit was received is the factor “of greatest importance” under a Section 221 analysis, and that here, any profit Defendants allegedly obtained would have been in Washington. (Id. at 10.) Defendants further argue that regardless of whether Washington or Illinois law is applied, Plaintiff fails to state an unjust enrichment claim because Plaintiff fails to allege that Defendants received a benefit. (Id.)
Here, based on the “most significant relationship” analysis, the application of Illinois law to Plaintiff's unjust enrichment claim is appropriate. Under the first factor, Illinois appears to be the place where the relationship between the parties was centered because that is where D.M. took the facial scans and uploaded them. However, as D.M. did not contract with Defendants, this factor is to be given little weight or viewed neutrally. See Vance II, 534 F.Supp.3d at 1326 (citing Veridian Credit Union v. Eddie Bauer, LLC, 295 F.Supp.3d 1140, 1154 (W.D. Wash. 2017) (finding first factor bears “little, if any, weight” when parties did not contract)).
The second factor, where the benefit was received, also receives little weight or weighs neutrally. Defendants argue that any profit they allegedly obtained from Plaintiff would have been realized in Washington because that is where Defendants are based. (Defs.' Reply at 10.) However, like in Vance II, the central benefit received by Defendants stemmed from D.M. providing images of his face to allow for the creation of the facial geometry, which occurred in Illinois (Compl. at ¶¶ 154-155). See 534 F.Supp.3d at 1326. And though Defendants are based in Washington, “Amazon's nation-wide reach . . . supports the inference that the place where the benefit was received may span many states.” See id. Because Amazon operates nationwide, and Washington remains tangential to the specific occurrence at issue in this action, the Court finds this factor weighs neutrally. See id. (citing Restatement § 221(2) cmt. d) (assigning factor “little or no weight” when place where benefit was received “bears little relation to the occurrence . . . or where this place cannot be identified”).
Under the third factor, the place where the act conferring the benefit occurred is to be given “[p]articular weight” if it differs from the place where the benefit was received or if the place where the benefit was received cannot be identified. Restatement (Second) of Law on Conflict of Laws § 221(2) cmt. d. Here, Plaintiff conferred any benefit to Defendants in Illinois because that is where he uploaded his facial scans. (See Compl. at ¶¶ 154-155.) “Although there are other acts in the chain of events leading to Amazon benefiting off of Plaintiffs' biometric data . . . the core of the benefit lies in Plaintiffs providing images of their faces.” See Vance II, 534 F.Supp.3d at 1326. In addition, this factor is assigned enhanced weight because of the neutrality of the place where the benefit was received under the second factor. Id.
Under the fourth factor, the domicile, residence, and place of business of the parties, weighs toward the application of Illinois law. Despite Defendants being headquartered in Washington (Compl. at ¶¶ 3-4), “[t]he fact that one of the parties is domiciled in a particular state is of little significance” alone. See Vance II, 534 F.Supp.3d at 1327 (citing Veridian, 295 F.Supp.3d at 1154; Restatement (Second) of Law on Conflict of Laws § 221(2) cmt. d (“The fact . . . that one of the parties is domiciled . . . in a given state will usually carry little weight of itself.”)). The importance of the domicile, residence, and place of business of the parties instead “depends largely upon the extent to which they are grouped with other contacts.” Restatement (Second) of Law on Conflict of Laws § 221(2) cmt. d. Here, the contacts in this matter are grouped in Illinois as that is where Plaintiff resides and where Defendants conducted the relevant business related to the enrichment at issue. See Vance II, 534 F.Supp.3d at 1327. Like Vance II, aside from Defendants' headquarters, the allegations in the instant matter largely do not concern Washington.
Finally, under the fifth factor, where the “physical thing which was substantially related to the enrichment was situated at the time of enrichment” weighs neutrally. The allegations in this matter center around non-tangible biometric data. See Vance II, 534 F.Supp.3d at 1326.
In whole, the Court finds that three of the factors weigh neutrally. Because the third and fourth factor largely tip toward the application of Illinois law, the Court finds that the parties' contacts per Restatement Section 221 in this case advise toward application of Illinois law to Plaintiff's unjust enrichment claim under the first step.
In considering the interests and public policies of the relevant jurisdictions, the Court finds that application of Illinois law over Washington law is also appropriate because “[a]pplication of [Illinois's] unjust enrichment law, which recognizes privacy harms, aligns with and strengthens Illinois's general regulatory scheme regarding privacy interests.” Vance II, 534 F.Supp.3d at 1328. Specifically, as noted in Vance II:
Illinois made clear through BIPA that it has substantial interest in protecting its residents' biometric data, even if the harm is inflicted by an out-of-state corporation . . . Indeed, Illinois's recognition of both the role of major national corporations as well as the unknown nature of the full ramifications of biometric technology underscores Illinois's great interest in protecting its citizenry against a multitude of harms stemming from a privacy violation, including if a corporation unjustly enriches itself off of Illinois residents' biometric data.Id. at 1327 (citing In re Facebook Biometric Info. Priv. Litig., 185 F.Supp.3d 1155, 1169-70 (N.D. Cal. 2016)). Furthermore, the Court finds that Washington's interest in the instant matter is relatively minimal due to the lack of any Washington connection to Plaintiff's allegations outside of Defendants' headquarters. BIPA's provision of a private cause of action further emphasizes Illinois's interest as Washington's biometric protection statute does not create a private cause of action. See RCW 19.375.030 (“This chapter may be enforced solely by the attorney general under the consumer protection act.”). Consequently, application of Washington law would cause Illinois to suffer greater impairment of its policies than if Illinois law is applied. See Vance II, 534 F.Supp.3d at 1328 (citing In re Facebook, 185 F.Supp.3d at 1170).
Under an application of Illinois law to the instant matter, because Plaintiff has alleged that Defendants profited off of Plaintiff and Class Members' biometric data, while exposing Plaintiff and Class Members to a heightened risk of privacy harm and depriving them of control of their biometric data (see Compl. at ¶ 241), Plaintiff has sufficiently alleged an unjust enrichment claim. See Vance II, 534 F.Supp.3d at 1328 (quoting IBM Corp., 2020 WL 5530134 at *5). Accordingly, Plaintiff's unjust enrichment claim should not be dismissed.
Defendants additionally argue that: (1) that the unjust enrichment claim must be dismissed because Plaintiff's BIPA claims should be dismissed; and (2) unjust enrichment is not available to Plaintiff as a claim because Plaintiff has a statutory remedy. (Defs.' Mot. at 16.) But as explained above, the Court finds Plaintiff's BIPA claims survive. Furthermore, Plaintiff may plead an unjust enrichment claim in the alternative. See Vance II, 534 F.Supp.3d at 1328 n.7 (citing Fed.R.Civ.P. 8(e)(2); Quadion Corp. v. Mache, 738 F.Supp.270, 278 (N.D. Ill. 1990)).
IV. CONCLUSION
For the forgoing reasons, the Court recommends that Defendants' Motion (dkt. # 18) be DENIED. A proposed Order accompanies this Report and Recommendation.
Objections to this Report and Recommendation, if any, should be filed with the Clerk and served upon all parties to this suit within fourteen (14) days of the date on which this Report and Recommendation is signed. Failure to file objections within the specified time may affect your right to appeal. Objections should be noted for consideration on the District Judge's motions calendar for the third Friday after they are filed. Responses to objections may be filed within fourteen (14) days after service of objections. If no timely objections are filed, the matter will be ready for consideration by the District Judge on June 10, 2022.
The Clerk is directed to send copies of this Order to the parties and to the Honorable Tana Lin.