In re Facebook Biometric Information Privacy Litigation

Filing 333

ORDER RE CLASS CERTIFICATION (Dkt. No. #255 ). Signed by Judge James Donato on 4/16/2018. (jdlc3S, COURT STAFF) (Filed on 4/16/2018)

Download PDF
1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 IN RE FACEBOOK BIOMETRIC INFORMATION PRIVACY LITIGATION 8 9 Case No. 3:15-cv-03747-JD ORDER RE CLASS CERTIFICATION THIS DOCUMENT RELATES TO: ALL ACTIONS Re: Dkt. No. 255 10 United States District Court Northern District of California 11 12 13 In this privacy action against defendant Facebook, Inc. (“Facebook”), named plaintiffs 14 Nimesh Patel, Adam Pezen, and Carlo Licata move for class certification. Dkt. No. 255. 15 Plaintiffs’ claims are sufficiently cohesive to allow for a fair and efficient resolution on a class 16 basis. Consequently, the case will proceed with a class consisting of Facebook users located in 17 Illinois for whom Facebook created and stored a face template after June 7, 2011. BACKGROUND 18 19 The material facts of this case are reported in a number of prior orders. See, e.g., Patel v. 20 Facebook Inc., __ F. Supp. 3d. __, No. 3:15-cv-03747-JD, 2018 WL 1050154, at *1 (N.D. Cal. 21 Feb. 26, 2018) [“Spokeo order”]. Briefly summarized, plaintiffs are Facebook users who 22 challenge its “Tag Suggestions” program, which scans for and identifies people in uploaded 23 photographs to promote user tagging. Plaintiffs allege that Facebook collects and stores their 24 biometric data without prior notice or consent in violation of their privacy rights and Sections 25 15(a) and 15(b) of the Illinois Biometric Information Privacy Act, 740 Ill. Comp. Stat. 14/1 et seq. 26 (“BIPA”). Dkt. No. 40. 27 28 The salient facts for class certification are undisputed. Facebook launched Tag Suggestions on June 7, 2011. Dkt. No. 255 at 2. In broad strokes, Tag Suggestions is powered by 1 a four-step facial recognition process. Initially, the software tries to detect faces (the “detection” 2 step) and standardizes any detected faces for qualities like orientation and size (the “alignment 3 step”). Dkt. No. 256-8 ¶¶ 13-17. For each face that is detected and aligned, Facebook computes a 4 “face signature,” which is a “string of numbers that represents a particular image of a face” (the 5 “representation” step). Id. ¶ 18. Face signatures are then run through a stored database of user 6 “face templates” to look for matches (the “classification” step). Id. ¶¶ 21-23. A face template is 7 “a string of numbers that represents a boundary” between the face signatures of a given Facebook 8 user and the face signatures of others, and is calculated based on that user’s photographs. Id. If a 9 computed face signature falls within the boundary described by a user’s face template, Facebook suggests tagging the user. See Dkt. No. 284-20 at 37. Facebook represents, with no challenge 11 United States District Court Northern District of California 10 from plaintiffs, that face signatures are not stored. Dkt. No. 256-8 ¶ 20. Only face templates are 12 kept by Facebook. 13 Facebook’s facial recognition technology is reliable but not foolproof. Facebook estimates 14 that 90% of faces appearing in photographs are successfully detected, and of those detected faces, 15 85% are successfully aligned. Dkt. No. 284-9 ¶¶ 5-6. That means approximately 76% of faces 16 appearing in photographs reach the representation step and have face signatures computed. 17 Facebook states that in 2014, it was able to match around 67% of detected faces with users, which 18 somewhat understates current matches because the rate has risen as the technology has matured. 19 Id. ¶¶ 8-9. 20 Plaintiffs seek certification under Federal Rule of Civil Procedure 23(b)(3) and propose a 21 class of all “Facebook users living in Illinois whose face appeared in a photo uploaded to 22 Facebook from Illinois between June 7, 2011, and the final disposition of this action.” Dkt. No. 23 255 at 5. Plaintiffs also propose an alternative class of all “people living in Illinois for whom 24 Facebook has a stored ‘face template’ that was created between June 7, 2011, and final disposition 25 of this action.” Id. 26 27 28 LEGAL STANDARDS As the parties seeking certification, plaintiffs bear the burden of showing that the requirements of Federal Rule of Civil Procedure 23 are met. Mazza v. Am. Honda Motor Co., 666 2 1 F.3d 581, 588 (9th Cir. 2012). The proposed class action must satisfy all four requirements of 2 Rule 23(a), and at least one of the sub-sections of Rule 23(b). Comcast Corp. v. Behrend, 569 3 U.S. 27, 33 (2013); Zinser v. Accufix Research Inst., Inc., 253 F.3d 1180, 1186 (9th Cir. 2001), 4 amended by 273 F.3d 1266 (9th Cir. 2001). 5 Rule 23(a) imposes four prerequisites. The class must be “so numerous that joinder of all 6 members is impracticable” (numerosity). There must be “questions of law or fact common to the 7 class” (commonality). The claims or defenses of the named plaintiffs must be “typical of the 8 claims or defenses of the class” (typicality). And the named parties must show that they “will 9 fairly and adequately protect the interests of the class” (adequacy). Fed. R. Civ. P. 23(a)(1)-(4). 10 To obtain a Rule 23(b)(3) class, plaintiffs must also must show that “questions of law or United States District Court Northern District of California 11 fact common to class members predominate over any questions affecting only individual 12 members” (predominance) and that a class action is “superior to other available methods for fairly 13 and efficiently adjudicating the controversy” (superiority). Fed. R. Civ. P. 23(b)(3). 14 The Court’s “class-certification analysis must be rigorous and may entail some overlap 15 with the merits of the plaintiff’s underlying claim.” Amgen Inc. v. Connecticut Ret. Plans & Trust 16 Funds, 568 U.S. 455, 465-66 (2013) (internal quotations and citations omitted). “That is so 17 because the class determination generally involves considerations that are enmeshed in the factual 18 and legal issues comprising the plaintiff’s cause of action.” Comcast, 569 U.S. at 33-34 (internal 19 quotations and citations omitted). These principles apply to the Rule 23(a) and 23(b) analysis 20 alike. Id. at 34. 21 The rigorous analysis, however, has its limits. “Rule 23 grants courts no license to engage 22 in free-ranging merits inquiries at the certification stage. Merits questions may be considered to 23 the extent -- but only to the extent -- that they are relevant to determining whether the Rule 23 24 prerequisites for class certification are satisfied.” Amgen, 586 U.S. at 466. The class certification 25 procedure is decidedly not an alternative form of summary judgment or an occasion to hold a 26 mini-trial on the merits. Alcantar v. Hobart Service, 800 F.3d 1047, 1053 (9th Cir. 2015). The 27 goal under Rule 23 is “to select the metho[d] best suited to adjudication of the controversy fairly 28 and efficiently.” Amgen, 568 U.S. at 460 (internal quotations omitted) (modification in original). 3 1 That means deciding whether efficiency and the interests of justice are best served by having the 2 named plaintiffs go forward to the merits as individuals or on behalf of a class as “an exception to 3 the usual rule that litigation is conducted by and on behalf of the individual named parties only.” 4 Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 348 (2011) (quoting Califano v. Yamasaki, 442 5 U.S. 682, 700-701 (1979)). See generally Brickman v. Fitbit, Inc., No. 3:15-CV-02077-JD, 2017 6 WL 5569827, at *2-3 (N.D. Cal. Nov. 20, 2017). 7 8 The decision of whether to certify a class is entrusted to the sound discretion of the district court. Zinser, 253 F.3d at 1186. DISCUSSION 9 I. 11 United States District Court Northern District of California 10 The Initial Proposed Class Plaintiffs initially propose a class consisting of all Illinois Facebook users appearing in a 12 photograph uploaded to Facebook. This broad definition is not viable because it poses 13 insurmountable problems with superiority and manageability, commonality, predominance, and is 14 not “reasonably co-extensive with Plaintiffs’ chosen theory of liability.” Torres v. Mercer 15 Canyons Inc., 835 F.3d 1125, 1136-37 (9th Cir. 2016). 16 Simply appearing in an uploaded photograph does not necessarily mean that a face 17 signature or template was collected or stored, or that any biometric data was harvested. As 18 plaintiffs acknowledge, Facebook “locates certain landmarks on the face and uses that data to 19 create a three-dimensional map of the face” only after the initial steps of detection and alignment 20 are successfully completed. Dkt. No. 255 at 3. Unique physical characteristics are not involved in 21 the detection step, which is about locating all faces rather than a specific face. The detection and 22 alignment steps fail for approximately 24% of faces appearing in photographs. See Dkt. No. 284- 23 9 ¶¶ 5-6. The uncertainty generated by this match failure rate is compounded by evidence in the 24 record, which plaintiffs do not contest, that Facebook cannot reliably determine whether a face 25 signature was ever computed from a particular photograph, id. ¶¶ 11-12, and that face signatures 26 are not stored, Dkt. No. 256-8 ¶ 20. The record also shows that at times during the proposed class 27 period, the software did not consistently compute face signatures from a given photograph. See 28 Dkt. No. 284-9 ¶ 12. 4 1 These uncontested facts establish that uploading a photo did not necessarily result in the 2 collection of biometric data. Consequently, a class defined by uploaded photographs is too 3 amorphous and potentially over-inclusive to be certified. See Torres, 835 F.3d at 1139; Lozano v. 4 AT & T Wireless Servs., Inc., 504 F.3d 718, 730 (9th Cir. 2007). Plaintiffs suggest that a vigorous 5 claims process can fix these problems, but that only pushes them down the road to a later stage. 6 Facebook will have no greater ability to resolve these uncertainties at the verification stage than at 7 this definitional one. Plaintiffs’ citations to claims procedure cases are inapposite for this reason. 8 See, e.g., In re Cmty. Bank of N. Virginia Mortg. Lending Practices Litig., 795 F.3d 380, 397 (3d 9 Cir. 2015) (defendant already possessed all relevant records and identification method was reliable 10 United States District Court Northern District of California 11 and repeatable). Plaintiffs also suggest that they can obtain certification on the theory that users with 12 multiple photos posted on Facebook are likely to have had at least one processed in the 13 representation or classification steps, where biometric data is collected. Dkt. No. 292 at 7. That 14 too is inherently imprecise, and plaintiffs do not offer any statistical or other methods that might 15 translate this presumed likelihood into a reasonably certain class definition. 16 II. The Certified Class 17 Plaintiffs’ alternative proposal is tied to face templates, and with a minor modification it 18 provides a sound basis for certification. A class comprised of Facebook users located in Illinois 19 for whom Facebook created and stored a face template after June 7, 2011, satisfies Rule 23’s 20 requirements and neutralizes most of Facebook’s objections, which go mainly to problems caused 21 by the use of face signatures to define the class. This definition modestly refines plaintiffs’ 22 alternative class proposal, and will be used for the remaining Rule 23 analysis. See Armstrong v. 23 Davis, 275 F.3d 849, 871 n.28 (9th Cir. 2001) (“district court may redefine the class”) (citing Penk 24 v. Oregon State Bd. of Higher Educ., 816 F.2d 458, 467 (9th Cir. 1987)), abrogated on other 25 grounds by Johnson v. California, 543 U.S. 499 (2005). 26 A. Numerosity, Adequacy, and Typicality 27 The numerosity, adequacy, and typicality requirements in Rule 23(a) are readily satisfied 28 for a template-based class of Illinois users. Plaintiffs reasonably estimate that millions of Illinois 5 1 residents are Facebook users, many of whom have been tagged in enough photographs to have 2 face templates. Dkt. No. 255 at 6. Plaintiffs’ arguments are uncontested by Facebook, and 3 numerosity is established. 4 Adequacy is also not an issue. Neither named plaintiffs nor their counsel have an apparent conflict of interest with other class members, and the hard-fought proceedings in this case amply 6 establish that they will “prosecute the action vigorously on behalf of the class.” Hanlon v. 7 Chrysler Corp., 150 F.3d 1011, 1020 (9th Cir. 1998). Facebook says adequacy cannot be found 8 because the named plaintiffs “know almost nothing” about their case or claims, but that goes too 9 far. Dkt. No. 285 at 24. The deposition testimony by the named plaintiffs shows a perfectly 10 adequate understanding of the case, and it clearly manifests their concerns about Facebook’s 11 United States District Court Northern District of California 5 treatment of personal biometric data. See, e.g., Dkt. Nos. 255-5; 255-6; 284-23; 284-24; 284-25. 12 This is not a situation where the named plaintiffs “are startlingly unfamiliar with the case.” 13 Dufour v. Be LLC, 291 F.R.D. 413, 419 (N.D. Cal. 2013) (internal quotations omitted). In any 14 event, objections to adequacy based on a named representative’s alleged ignorance are disfavored. 15 See Surowitz v. Hilton Hotels Corp., 383 U.S. 363, 370-74 (1966). Even if the named plaintiffs 16 have relied heavily on the advice of attorneys and others, it is hardly a badge of inadequacy to 17 seek help from those with relevant expertise, particularly in a complex case like this one. Baffa v. 18 Donaldson, Lufkin & Jenrette Sec. Corp., 222 F.3d 52, 62 (2d Cir. 2000). 19 There is no serious doubt that typicality is satisfied, too. Named plaintiffs are Illinois 20 Facebook users with face templates suing under Illinois law on behalf of fellow users in Illinois. 21 That is enough to “assure that the interest of the named representative aligns with the interests of 22 the class.” Hanon v. Dataproducts Corp., 976 F.2d 497, 508 (9th Cir. 1992). Typicality may be a 23 bar to certification if other members would suffer because the named plaintiffs would be 24 “preoccupied with defenses unique to” them. Just Film, Inc. v. Buono, 847 F.3d 1108, 1116 (9th 25 Cir. 2017) (quoting Hanon, 976 F.2d at 508). That is not the situation here. Facebook has not 26 shown that named plaintiffs would be preoccupied with unique defenses, or are in any way 27 atypical with respect to the overall class. 28 6 1 B. Commonality and Predominance 2 The main thrust of Facebook’s non-technical objections to certification go to the somewhat 3 overlapping factors of commonality under Rule 23(a)(2) and predominance under Rule 23(b)(3). 4 These inquiries go to the heart of whether adjudication of the claims on a class basis would be fair, 5 efficient and superior to individual prosecution. 6 The commonality requirement is satisfied when “there are questions of law or fact 7 common to the class.” Fed. R. Civ. P. 23(a)(2). “Because any competently crafted class 8 complaint literally raises common questions,” the Court’s task is to look for a common contention 9 “capable of classwide resolution -- which means that determination of its truth or falsity will resolve an issue that is central to the validity of each one of the claims in one stroke.” Alcantar, 11 United States District Court Northern District of California 10 800 F.3d at 1052 (internal quotations and citations omitted). What matters is the “capacity of a 12 classwide proceeding to generate common answers apt to drive the resolution of the litigation.” 13 Wal-Mart, 564 U.S. at 350 (internal quotations omitted) (emphasis in original). 14 Rule 23(a)(2) does not demand total uniformity across a class. “All questions of fact and 15 law need not be common to satisfy the rule. The existence of shared legal issues with divergent 16 factual predicates is sufficient, as is a common core of salient facts coupled with disparate legal 17 remedies within the class.” Hanlon, 150 F.3d at 1019. Rule 23(a)(2) imposes a “‘rigorous’ 18 commonality standard.” Levya v. Medline Indus. Inc., 716 F.3d 510, 512 (9th Cir. 2013). 19 Rule 23(b)(3) requires that common questions of law or fact predominate over individual 20 ones. The predominance inquiry asks whether “common questions present a significant aspect of 21 the case and [if] they can be resolved for all members of the class in a single adjudication.” 22 Hanlon, 150 F.3d at 1022 (internal quotations omitted); see also Tyson Foods v. Bouaphakeo, __ 23 U.S. __, 136 S.Ct. 1036, 1045 (2016). Each element of a claim need not be susceptible to 24 classwide proof, Amgen, 568 U.S. at 468-69, and the “important questions apt to drive the 25 resolution of the litigation are given more weight in the predominance analysis over individualized 26 questions which are of considerably less significance to the claims of the class.” Torres, 835 F.3d 27 at 1134. Rule 23(b)(3) permits certification when “one or more of the central issues in the action 28 are common to the class and can be said to predominate, . . . even though other important matters 7 1 will have to be tried separately, such as damages or some affirmative defenses peculiar to some 2 individual class members.” Tyson, 136 S. Ct. at 1045 (internal quotations omitted). 3 As the Court has discussed in other decisions, the line separating the commonality inquiry under Rule 23(a)(2) and the predominance assessment under Rule 23(b)(3) can be elusive. See 5 Ochoa v. McDonald’s Corp., Case No. 14-cv-02098 JD, 2016 WL 3648550, at *5-6 (N.D. Cal. 6 July 7, 2016). Wal-Mart emphasized the commonality inquiry, but the Supreme Court has also 7 advised that “[i]f anything, Rule 23(b)(3)’s predominance criterion is even more demanding than 8 Rule 23(a).” Comcast, 569 U.S. at 34. Whatever the precise demarcation might be between the 9 two inquiries, it is clear that commonality alone will not fulfill Rule 23(b)(3), and that the main 10 concern under subsection (b)(3) “is the balance between individual and common issues.” In re 11 United States District Court Northern District of California 4 Hyundai and Kia Fuel Economy Litigation, 881 F.3d 679, 691 (9th Cir. 2018) (internal quotations 12 omitted); see also Tyson, 136 S.Ct. at 1045 (purpose of the Rule 23(b)(3) inquiry is to determine 13 whether the proposed class is “sufficiently cohesive to warrant adjudication by representation”) 14 (quoting Amchem Products, Inc. v. Windsor, 521 U.S. 591, 623 (1997)). As a practical matter, 15 commonality and predominance can be assessed in tandem, with a careful eye toward ensuring 16 that the specific requirements of each are fully satisfied. See, e.g., Just Film, 847 F.3d at 1120-21. 17 As an initial matter, there is no doubt that a template-based class poses common legal and 18 factual questions, namely: did Facebook’s facial recognition technology harvest biometric 19 identifiers as contemplated under BIPA, and if so, did Facebook give users prior notice of these 20 practices and obtain their consent? Facebook agrees that these questions reach the entire class, 21 Dkt. No. 285 at 9, but challenges whether common answers will predominate. Specifically, 22 Facebook contends that three issues can be resolved only by individualized evidence of: 23 (1) whether a class member is “aggrieved” as that word is used in BIPA, which grants a private 24 right of action only to “persons aggrieved” under it; (2) whether a class member’s claims fall 25 within BIPA’s territorial scope; and (3) whether a class member was depicted in photographs 26 derived from “paper photos . . . converted to digital form before upload.” Id. 27 28 Facebook puts greatest emphasis on its argument about the meaning of “aggrieved.” It relies almost exclusively on Rosenbach v. Six Flags Entertainment Corporation, 2017 IL App (2d) 8 1 170317 (Ill. App. Ct. 2017), a currently unpublished opinion by an intermediate court of appeals in 2 Illinois. The BIPA claim in Rosenbach arose out of the practice by the defendant amusement 3 parks of fingerprinting season pass holders so that thumb scans could speed up entry into the park. 4 The parks collected a minor’s thumbprint when he purchased a pass, and his mother subsequently 5 objected under BIPA that the parks had not provided prior notice or obtained consent. She sued 6 on those grounds. The trial court initially denied defendants’ motion to dismiss but certified 7 questions about the meaning of “aggrieved” to the appellate court. Rosenbach is the intermediate 8 court’s response to the certified questions. As a threshold matter, Rosenbach does not bear the heavy weight Facebook seeks to place 10 on it. Facebook heatedly insists that Rosenbach interpreted “aggrieved” to require injury or harm 11 United States District Court Northern District of California 9 “beyond the alleged statutory violation.” Dkt. No. 285 at 1 (emphasis in original). But the 12 opinion is far less pertinent or definitive than Facebook contends, and a fair reading suggests that 13 the Rosenbach court would have reached the opposite conclusion had the allegations in this case 14 been before it. Rosenbach states on several occasions that the plaintiff in that case -- the mother of 15 the minor fingerprinted by the amusement park defendants -- did not allege that she or her son 16 “suffered any actual injury.” See, e.g., Rosenbach, 2017 IL App (2d) 170317, ¶ 10 (“Plaintiff 17 alleged not that she or Alexander suffered any actual injury, but that, had she known of 18 defendants’ conduct, ‘she never would have purchased a season pass for her son.’”). Instead, “the 19 only injury alleged” by the plaintiff was “a violation of the notice and consent requirements of 20 section 15(b) of the Act,” and her argument was that “a mere technical violation of the Act is 21 sufficient to render a party ‘aggrieved.’” Id. ¶ 18. Critically, the Rosenbach court expressly 22 observed that “Plaintiff did not allege in her complaint any harm or injury to a privacy right,” id. 23 ¶ 20 n.1, and underscored that the “injury or adverse effect need not be pecuniary” to qualify a 24 person as “aggrieved” under BIPA. Id. ¶ 28. Facebook glosses over these essential parts of 25 Rosenbach to say it demands some undefined “actual” harm beyond injury to a privacy right, but 26 the better reading is Rosenbach would find that injury to a privacy right is enough to make a 27 person aggrieved under BIPA. As the Court has already found, there is no question that plaintiffs 28 9 1 here have sufficiently alleged that intangible injury. See, e.g., Dkt. No. 40 ¶ 17 (Facebook 2 “continues to violate millions of Illinois residents’ legal privacy rights”); id. ¶ 31. 3 This is enough to overcome Facebook’s objections based on its interpretation of 4 Rosenbach. To the extent Rosenbach might be read differently, the Court would part company 5 with it. To be sure, principles of comity and federalism counsel that federal courts should not 6 lightly disregard state court interpretations of state law. But as an intermediate court opinion, 7 Rosenbach is a non-binding data point for ascertaining Illinois law, and if “other persuasive data” 8 convinces the Court that the Illinois Supreme Court would decide otherwise, the Court need not 9 follow it. Am. Tower Corp. v. City of San Diego, 763 F.3d 1035, 1047 (9th Cir. 2014); Klein v. 10 United States District Court Northern District of California 11 United States, 537 F.3d 1027, 1032 (9th Cir. 2008). A considerable amount of “persuasive data” would indeed call into serious doubt an 12 intermediate court decision holding that BIPA requires “actual” injury beyond an invasion of 13 privacy. First and foremost is the plain language of BIPA itself. As the Illinois Supreme Court 14 has held, the “cardinal rule in interpreting a statute is to give effect to the intent of the legislature.” 15 People v. Fort, 88 N.E.3d 718, 723 (Ill. 2017) (internal citation omitted). The legislature’s intent 16 is best determined from the language of the statute itself, which should be read as a whole to 17 determine “its nature, its object and the consequences that would result from construing it one way 18 or the other.” Id. at 723-724 (internal quotations omitted); see also FDA v. Brown & Williamson 19 Tobacco Corp., 529 U.S. 120, 132-33 (2000) (“fundamental canon of statutory construction” to 20 define words in reference to “context” and “overall statutory scheme”) (quoting Davis v. Michigan 21 Dept. of Treasury, 489 U.S. 803, 809 (1989)). 22 These well-established canons of interpretation are crucial here, because a plain of reading 23 of BIPA “leave[s] little question that the Illinois legislature codified a right of privacy in personal 24 biometric information” rooted in “a long tradition of claims actionable in privacy law” and 25 extending to control over one’s data, independent of disclosure or misuse risks. Patel, 2018 WL 26 1050154, at *4. This intent cannot be squared with a construction of “aggrieved” that requires 27 some other “actual” injury, whatever that might be, particularly when deprivation of BIPA’s 28 notice and consent requirements amounts to the “precise harm the Illinois legislature sought to 10 1 prevent.” Id. Such a holding would be all the more questionable because the Illinois legislature 2 clearly knows how to condition a cause of action on actual injury simply by saying so in the 3 statute. See, e.g., 815 Ill. Comp. Stat. Ann. 505/10a (Illinois Consumer Fraud and Deceptive 4 Business Practices Act) (private right of action limited to person who suffers “actual” damage). 5 The legislature did not choose to say so in BIPA, and that choice must be given weight. 6 This statutory analysis would be enough on its own to turn away Facebook’s characterization of Rosenbach. See Am. Tower, 763 F.3d at 1047 (text of statute alone is 8 persuasive data). Express precedent from the Illinois Supreme Court is another point of 9 persuasive data against it. The Illinois high court has determined that “aggrieved” parties under an 10 Illinois statute are those with a “direct, immediate and substantial interest rather than a speculative, 11 United States District Court Northern District of California 7 theoretical, inconsequential or remote interest.” Am. Sur. Co. v. Jones, 384 Ill. 222, 230 (Ill. 12 1943). The Illinois Supreme Court made this determination in the context of an insurance statute, 13 but did not cabin its holding to that statute or the facts before it. Jones stands for the proposition 14 that, under Illinois law, an individual is “aggrieved” when “a legal right is invaded by the act 15 complained of.” Id. at 229-230 (quoting Glos v. People, 259 Ill. 332, 340 (Ill. 1913)). 16 Tellingly, Rosenbach omits any discussion of Jones, and Facebook also does not address it 17 in its papers. That is a concern because Jones is good law in Illinois and is actively cited today by 18 other federal courts and Illinois state courts, significantly in the BIPA context. See, e.g., Vigil v. 19 Take-Two Interactive Software, Inc., 235 F. Supp. 3d 499, 520 (S.D.N.Y. 2017) (citing Jones in 20 interpreting BIPA). A convincing construction of “aggrieved” in BIPA would need to account for 21 Jones, and not rely entirely, for example, on decisions from courts outside Illinois. See, e.g., 22 Rosenbach, 2017 IL App (2d) 170317, ¶ 22 (citing Wisconsin decision). 23 An analysis of Jones is particularly important because a good argument can be made that 24 Facebook’s reading of Rosenbach is not consistent with it. Jones holds that a party is aggrieved 25 by an act that directly or immediately affects her legal interest. In contrast, Facebook portrays 26 Rosenbach as saying that the word “aggrieved” requires a plaintiff to affirmatively plead some 27 additional “actual injury” as an element of her claim, whatever that undefined extra harm might 28 11 1 be. Dkt. No. 285 at 10. This is a significantly more limited construction of “aggrieved” than 2 afforded by Jones, and the grounds on which it can be harmonized with Jones are not at all clear. 3 It is also worth noting that the facts in Rosenbach place it several steps away from this 4 case. In Rosenbach, the plaintiff’s son provided his thumbprint for scanning by the defendant. 5 Rosenbach, 2017 IL App (2d) 170317, ¶ 7. As the Spokeo order discussed, an express request for 6 a fingerprint scan is a far cry from the situation here, where plaintiffs plausibly argue that simply 7 using Facebook or reading Facebook’s user policy did not put them on notice that Facebook was 8 collecting their biometric data. See Patel, 2018 WL 1050154, at *5 (distinguishing fingerprinting 9 cases). Indeed, an Illinois trial court has applied Rosenbach to dismiss a BIPA case precisely because the plaintiff expressly allowed defendants to take a fingerprint scan and so could not plead 11 United States District Court Northern District of California 10 an invasion of privacy. Rottner v. Palm Beach Tan, Inc., et al., No. 15 CH 16695 (Ill. Cir. Ct. 12 Mar. 2, 2018) (available at Dkt. No. 315-1). Consequently, if Rosenbach were to be read as Facebook urges, persuasive data convinces 13 14 the Court it would not be a good prediction of how the Illinois Supreme Court would interpret 15 “aggrieved” under BIPA. It follows that Facebook has not demonstrated on the basis of 16 Rosenbach that a predominance of individual inquiries would defeat class certification. Facebook’s other commonality and predominance objections also pose no certification bar. 17 18 Facebook raises an “extraterritoriality” contention based on the assertion that its servers are not 19 located within Illinois. The parties agree that BIPA does not have extraterritorial reach because no 20 “clear intent in this respect appears from the express provisions of the statute,” Avery v. State 21 Farm Mut. Auto. Ins. Co., 216 Ill.2d 100, 185 (Ill. 2005), but disagree how that applies here.1 There is no genuine dispute that this case is deeply rooted in Illinois. The named plaintiffs 22 23 are located in Illinois along with all of the proposed class members, and the claims are based on 24 the application of Illinois law to use of Facebook mainly in Illinois. As the Court found in a prior 25 order, the case is properly governed by Illinois law pursuant to California choice of law principles, 26 In re Facebook Biometric Info. Privacy Litig., 185 F. Supp. 3d 1155, 1169 (N.D. Cal. 2016), and 27 1 28 Facebook raises a similar argument in its motion for summary judgment. The Court considers it here with respect to certification only. 12 1 Facebook does not contest the application of Illinois law in opposing class certification. None of 2 the class members are non-residents suing under Illinois law, which is the paradigmatic situation 3 for the presumption against the extraterritorial application of local law. See, e.g., Avery, 216 Ill.2d 4 at 187. Facebook has not tendered any evidence to indicate that the circumstances relating to the 5 challenged conduct did not occur “primarily and substantially within” Illinois. Id. Class members 6 do not need to show more in order to sue under BIPA, particularly in light of BIPA’s express 7 concerns about data collection by “[m]ajor national corporations,” 740 Ill. Comp. Stat. Ann. 8 14/5(b). See Morrison v. Nat’l Australia Bank Ltd., 561 U.S. 247, 267 (2010) (territoriality 9 inquiry looks to the “objects of the statute’s solicitude”). 10 Contrary to Facebook’s suggestion, the geographic location of its data servers is not a United States District Court Northern District of California 11 dispositive factor. Server location may be one factor in the territoriality inquiry, but it is not the 12 exclusive one. As Avery cautions, “focusing solely on [only one circumstance] . . . can create 13 questionable results” where “the bulk of the circumstances . . . occur within Illinois.” Avery, 216 14 Ill.2d at 186; see also Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1102 (N.D. Ill. 2017) (in BIPA 15 face scan context, even if “the scanning takes place outside of Illinois, that would not necessarily 16 be dispositive”). Avery’s warning is particularly apt here because the functionality and reach of 17 modern online services like Facebook’s cannot be compartmentalized into neat geographic boxes. 18 Making the geographic coordinates of a server the most important circumstance in fixing the 19 location of an Internet company’s conduct would yield the questionable results Avery counsels 20 against. Among other problematic outcomes, it would effectively gut the ability of states without 21 server sites to apply their consumer protection laws to residents for online activity that occurred 22 substantially within their borders. See Rocky Mountain Farmers Union v. Corey, 730 F.3d 1070, 23 1104 (9th Cir. 2013) (state cannot “impose its own regulatory standards on another jurisdiction” 24 but “may regulate with reference to local harms”). Correlatively, a single-minded focus on server 25 location would also potentially nationalize the consumer protection laws of states that host servers, 26 which in this case includes California. Both outcomes are fraught with unintended and 27 undesirable consequences. 28 13 1 Facebook also suggests that the claims of some class members may only be peripherally 2 related to Illinois. It says for example that some class members might have just moved to Illinois 3 with face templates created elsewhere. Dkt. No. 285 at 18. Maybe so, but Facebook does not 4 offer anything other than its own conjecture on this point, and mere “speculation” about class 5 variability “does not meet [defendant’s] burden of demonstrating that individual . . . issues 6 predominate.” Gutierrez v. Wells Fargo Bank, NA, 704 F.3d 712, 729 (9th Cir. 2012). As a final contention, Facebook says that predominance cannot be found because 8 individualized inquiries may be necessary to determine which users’ face templates were derived 9 from scans of paper photographs. This too is unavailing. Assuming for discussion purposes only 10 that a class member’s claim could turn on whether an uploaded photograph was taken by a digital 11 United States District Court Northern District of California 7 versus film camera, Facebook simply asserts with no accompanying evidence that “[m]any photos 12 uploaded to Facebook fit that description.” Dkt. No. 285 at 19. Conclusory allegations with no 13 support in the record will not defeat commonality and predominance. Brickman, 2017 WL 14 5569827, at *5. 15 C. Superiority 16 The closing consideration for certification is whether any fairness or practical case 17 management reasons count against it. “Rule 23(b)(3) requires that a class action be ‘superior to 18 other available methods for fairly and efficiently adjudicating the controversy,’ and it specifically 19 mandates that courts consider ‘the likely difficulties in managing a class action.’” Briseno v. 20 ConAgra Foods, Inc., 844 F.3d 1121, 1127-28 (9th Cir. 2017). 21 A class action is clearly superior to individual proceedings here. While not trivial, BIPA’s 22 statutory damages are not enough to incentivize individual plaintiffs given the high costs of 23 pursuing discovery on Facebook’s software and code base and Facebook’s willingness to litigate 24 the case. Just Film, 847 F.3d at 1123. The class will be manageable because members can be 25 identified in a straightforward way. Facebook has collected a wealth of data on its users, including 26 self-reported residency and IP addresses. See Dkt. No. 255 at 7. Facebook does not argue that 27 determining the location of Facebook users with face templates would be unduly difficult or 28 subject to significant uncertainty. 14 1 Facebook seems to believe that a class action is not superior because statutory damages 2 could amount to billions of dollars. Dkt. No. 285 at 20. To be sure, class certification may be 3 inappropriate where it would result in damages inconsistent with legislative intent. Bateman v. 4 Am. Multi-Cinema, Inc., 623 F.3d 708, 722-23 (9th Cir. 2010); Kline v. Coldwell, Banker & Co., 5 508 F.2d 226, 235 (9th Cir. 1974). But the Illinois legislature knows how to speak clearly when it 6 wants to foreclose class actions. See, e.g., 35 Ill. Comp. Stat. 200/23-15(a) (“no complaint shall 7 be filed as a class action”). Facebook suggests that BIPA’s limitation of relief to “aggrieved” 8 persons bespeaks a reluctance to impose hefty penalties on non-compliant companies, but it offers 9 no evidence or cogent explanation in support of that claim, and to the extent it relies on Rosenbach, the argument is rejected for the previously stated reasons. In addition, substantial 11 United States District Court Northern District of California 10 damages are not a reason to decline class certification because it is within the Court’s discretion to 12 reduce a liquidated damages award to comport with due process at a later stage of the proceedings. 13 See, e.g., Six (6) Mexican Workers v. Arizona Citrus Growers, 904 F.2d 1301, 1309 (9th Cir. 14 1990). 15 CONCLUSION 16 The Court certifies a class of Facebook users located in Illinois for whom Facebook 17 18 19 created and stored a face template after June 7, 2011. IT IS SO ORDERED. Dated: April 16, 2018 20 21 JAMES DONATO United States District Judge 22 23 24 25 26 27 28 15

Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.

Why Is My Information Online?