In re Facebook Biometric Information Privacy Litigation

Filing 372

ORDER re Summary Judgment Motions ( #257 , #299 , #307 ). Signed by Judge James Donato on 5/14/2018. (jdlc3S, COURT STAFF) (Filed on 5/14/2018)

1
2
3
4

UNITED STATES DISTRICT COURT

5

NORTHERN DISTRICT OF CALIFORNIA

6
7

IN RE FACEBOOK BIOMETRIC
INFORMATION PRIVACY LITIGATION

8
9

THIS DOCUMENT RELATES TO:
ALL ACTIONS

10

Case No. 3:15-cv-03747-JD
ORDER RE SUMMARY JUDGMENT
MOTIONS
Re: Dkt. Nos. 257, 299, 307

United States District Court
Northern District of California

11
12
13

Plaintiffs and defendant Facebook, Inc., have filed cross-motions for summary judgment

14

on plaintiffs’ claim that Facebook’s Tag Suggestions program collects and stores biometric data in

15

violation of the Illinois Biometric Information Privacy Act (“BIPA”), 740 Ill. Comp. Stat. 14/1 et

16

seq. Dkt. Nos. 257, 299, 307. The Court’s prior orders discuss the core elements of this litigation

17

in substantial detail, and provide the context for the summary judgment motions. See In re

18

Facebook Biometric Info. Privacy Litig., 185 F. Supp. 3d 1155 (N.D. Cal. 2016) (choice of law);

19

Patel v. Facebook Inc., 290 F. Supp. 3d 948 (N.D. Cal. 2018) (Article III standing); In re

20

Facebook Biometric Info. Privacy Litig., No. 3:15-CV-03747-JD, 2018 WL 1794295 (N.D. Cal.

21

Apr. 16, 2018) (certifying Illinois user class).

22

The parties have filed over 100 pages of briefs for the cross-motions, accompanied by

23

several hundred pages of documents and emails, deposition testimony, expert opinions and other

24

exhibits. These voluminous submissions underscore the multitude of fact disputes that bar

25

judgment as a matter of law for either side. That is particularly true for plaintiffs’ motion, which

26

effectively asks for entry of judgment in their favor on a record that they concede is often

27

unsettled. Consequently, all of the summary judgment motions are denied, and the trial set for

28

July 9, 2018, will go forward. This order addresses the parties’ disagreements about Facebook’s

1

face scanning practices, which illustrate the factual disputes barring summary judgment, and

2

certain legal arguments raised by Facebook, with the goal of clarifying them in advance of trial

3

and the pretrial conference.

4

Before getting to those matters, the Court is concerned about a troubling theme in

5

Facebook’s briefs. Facebook says it knows “from this Court’s class certification decision” and an

6

Illinois state decision, Rosenbach v. Six Flags Entertainment Corporation, 2017 IL App (2d)

7

170317 (Ill. App. Ct. 2017), that plaintiffs “must prove something more than a violation of BIPA’s

8

notice-and-consent provisions” to prevail. Dkt. No. 349-2 at 3. This and similar comments

9

suggest that Facebook is reverting to the faulty proposition that plaintiffs must show an “actual”
injury beyond the invasion of the privacy rights afforded by BIPA. That is not what the Court has

11
United States District Court
Northern District of California

10

concluded. The Court expressly rejected that contention in considerable detail in the class

12

certification order and the order finding Article III standing to sue. In re Facebook, 2018 WL

13

1794295 at *6-8; Patel, 290 F. Supp. 3d at 953-54. A class was certified for that exact reason.

14

BIPA does not require additional proof of individualized “actual” harm, and so the question of

15

whether Facebook is liable can be decided in “one stroke” for the class as a whole without a

16

likelihood that individualized inquiries would overwhelm commonality and predominance. Wal-

17

Mart Stores, Inc. v. Dukes, 564 U.S. 338, 350 (2011). To contend otherwise, or to argue that

18

BIPA requires some individualized quantum of “actual” injury in addition to the privacy violation

19

caused by the deprivation of the notice and consent requirements, is to misread and misrepresent

20

the Court’s orders.

21
22

LEGAL STANDARDS
“A party may move for summary judgment, identifying each claim or defense -- or the part

23

of each claim or defense -- on which summary judgment is sought. The Court shall grant

24

summary judgment if the movant shows that there is no genuine dispute as to any material fact and

25

the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). The Court may

26

dispose of less than the entire case and just portions of a claim or defense. Smith v. State of

27

California Dep’t of Highway Patrol, 75 F. Supp. 3d 1173, 1179 (N.D. Cal. 2014).

28
2

1

Under Rule 56, a dispute is genuine “if the evidence is such that a reasonable jury could

2

return a verdict” for either party. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986). A

3

fact is material if it could affect the outcome of the suit under the governing law. Id. at 248-49. In

4

determining whether a genuine dispute of material fact exists, the Court will view the evidence in

5

the light most favorable to the non-moving party and draw “all justifiable inferences” in that

6

party’s favor. Id. at 255. A principal purpose of summary judgment “is to isolate and dispose of

7

factually unsupported claims.” Celotex Corp. v. Catrett, 477 U.S. 317, 323-24 (1986).

8

The moving party can initially establish the absence of a genuine issue of material fact,
which it must do by “pointing out to the district court . . . that there is an absence of evidence to

10

support the nonmoving party’s case.” Id. at 325. It is then the non-moving party’s burden to go

11
United States District Court
Northern District of California

9

beyond the pleadings and identify specific facts that show a genuine issue for trial. Id. at 323-34.

12

“A scintilla of evidence or evidence that is merely colorable or not significantly probative does not

13

present a genuine issue of material fact.” Addisu v. Fred Meyer, Inc., 198 F.3d 1130, 1134 (9th

14

Cir. 2000). It is not the Court’s task “to scour the record in search of a genuine issue of triable

15

fact.” Keenan v. Allan, 91 F.3d 1275, 1279 (9th Cir. 1996) (quotations omitted).
DISCUSSION

16
17

I.

Scan of Face Geometry

18

The parties’ disagreements about Facebook’s face recognition and scanning practices are

19

emblematic of the factual disputes that are rife in this case. BIPA requires private entities to

20

provide notice and obtain consent when either “biometric identifiers or biometric information” are

21

at issue. 740 Ill. Comp. Stat. Ann. 14/15. “Biometric identifiers” include “scan[s] of . . . face

22

geometry” and “biometric information” includes “any information, regardless of how it is

23

captured, converted, stored, or shared, based on an individual’s biometric identifier used to

24

identify an individual.” 740 Ill. Comp. Stat. Ann. 14/10. “Biometric identifiers do not include . . .

25

photographs” and biometric information “does not include information derived from items or

26

procedures excluded under the definition of biometric identifiers.” Id.

27
28

Plaintiffs’ case turns in large measure on whether Facebook collects and stores scans of
face geometry. While the parties have no serious disagreement about the literal text of Facebook’s
3

1

source code, they offer strongly conflicting interpretations of how the software processes human

2

faces. Plaintiffs say the technology necessarily collects scans of face geometry because it uses

3

human facial regions to process, characterize, and ultimately recognize face images. Facebook

4

disagrees and says the technology has no express dependency on human facial features at all.

5

Rather, according to Facebook, the technology “learns for itself what distinguishes different faces

6

and then improves itself based on its successes and failures, using unknown criteria that have

7

yielded successful outputs in the past.” Dkt. No. 298-24 at 5.

8
9

This is a quintessential dispute of fact for the jury to decide. On their part, plaintiffs have
tendered evidence that Facebook’s algorithm collects information about face geometry. For
example, plaintiffs highlight a Facebook research paper captioned “DeepFace,” which describes

11
United States District Court
Northern District of California

10

the processing system used for face recognition. Facebook agrees that the “DeepFace” paper is

12

descriptive of its technology, and does not identify any specific differences between the approach

13

outlined in the paper and its actual practices. See Dkt. No. 337 at 18.

14

“DeepFace” is a network architecture whose “success . . . is highly dependent on a very

15

rapid 3D alignment step” that “fix[es] at the pixel level” “the location of each facial region.” Dkt.

16

No. 341-30 at FBBIPA_00001214. Alignment begins “by detecting 6 fiducial points . . . centered

17

at the center of the eyes, tip of the nose, and mouth locations.” Id. at FBBIPA_00001216. After

18

alignment, a representation step “capture[s] correlations between features captured in distant parts

19

of the face images, e.g., position and shape of eyes and position and shape of mouth.” Id. at

20

FBBIPA_00001217.

21

Plaintiffs proffer opinions by their expert, Dr. Atif Hashmi, who examined Facebook’s

22

source code and concluded that alignment “utilize[s] facial geometry to determine the location of

23

facial landmarks including eyes, nose, mouth, chin, and others in unaligned face images.” Dkt.

24

No. 339-7 at 18. Locating those landmarks allows face images to be reconstructed in a fully

25

frontal position. Id. According to Dr. Hashmi, representation then “progressively extract[s]

26

complex features like . . . eyes, nose, chin, and mouth” in order to produce “a set of numerical

27

values . . . that represent the facial landmarks or features present in the face image.” Id. at 20-23.

28
4

1

In addition to these technical materials, plaintiffs tender internal Facebook emails

2

indicating that Facebook understood it was collecting what is “normally referred to as biometric

3

data.” Dkt. No. 306-5; see also Dkt. No. 339-11.

4

Facebook counters with other evidence to contest the claim that its technology scans face

5

geometry. It cites, for example, the opinions of its own expert, Dr. Matthew Turk, who says that

6

Facebook’s technology “analyze[s] all of the pixels in a face image, and not any particular human-

7

notable facial features.” Dkt. No. 298-1 at 3. “Through an iterative trial-and-error training

8

process, Facebook’s [current technology] . . . learned for itself what features of an image’s pixel

9

values are most useful for the purpose of characterizing and distinguishing images of human
faces.” Id. at 2. The technology, in Dr. Turk’s view, “does not explicitly detect human-notable

11
United States District Court
Northern District of California

10

facial features” but instead “combines and weights different combinations of different aspects of

12

the entire face image’s pixel values. Indeed, the [technology] . . . would still calculate a ‘face

13

signature’ if provided with an image of something other than a face.” Id. at 40.

14

The parties unleash volleys of other competing evidence, but this summary is enough to

15

show that a jury will need to resolve the genuine factual disputes surrounding facial scanning and

16

the recognition technology. Facebook makes a stab at avoiding trial by suggesting that “scan” in

17

“scan of face geometry” necessarily connotes an express measurement of human facial features --

18

for instance, “a measurement of the distance between a person’s eyes, nose, and ears.” Dkt. No.

19

299 at 20 (internal quotation omitted). But the argument is of no moment because it merely begs

20

the question of what, in fact, happens in the operation of the technology. In addition, the word

21

“scan” does not bear the definitional freight Facebook seeks to impose. BIPA does not

22

specifically define it, and the ordinary meaning of “to scan” is to “examine” by “observation or

23

checking,” or “systematically . . . in order to obtain data especially for display or storage.”

24

MERRIAM-WEBSTER’S COLLEGIATE DICTIONARY at 1107-08 (11th ed. 2003). “Geometry” is also

25

understood in everyday use to mean simply a “configuration,” which in turn denotes a “relative

26

arrangement of parts or elements.” Id. at 524, 261. None of these definitions demands actual or

27

express measurements of spatial quantities like distance, depth, or angles. In addition, the Illinois

28

legislature’s decision to use the word “scan” rather than “record” does not indicate that express
5

1

measurements are required, and limiting scans of face geometry to techniques that literally

2

measure distances, depths, and angles cannot be squared with the legislature’s clear intent to

3

regulate emergent biometric data collection technology in whatever specific form it takes. See In

4

re Facebook, 185 F. Supp. 3d at 1171.

5

II.

Dormant Commerce Clause

6

Moving to Facebook’s more overtly legal contentions, Facebook says that subjecting it to

7

BIPA would violate the dormant commerce clause because it processes facial recognition on

8

servers outside the state of Illinois. Dkt. No. 257 at 13. Plaintiffs do not meaningfully dispute that

9

the pertinent servers are not located in Illinois.

10

The dormant commerce clause typically applies when a state tries to regulate or control

United States District Court
Northern District of California

11

economic conduct wholly outside its borders with the goal of protecting local businesses from out-

12

of-state competition. See Healy v. Beer Inst., Inc., 491 U.S. 324, 336-37 (1989). It is a “limitation

13

upon the power of the States” intended to prohibit “discrimination against interstate commerce”

14

and “state regulations that unduly burden interstate commerce.” Sam Francis Found. v. Christies,

15

Inc., 784 F.3d 1320, 1323 (9th Cir. 2015) (en banc) (quoting Great Atl. & Pac. Tea Co. v. Cottrell,

16

424 U.S. 366, 371 (1976) and Quill Corp. v. North Dakota, 504 U.S. 298, 312 (1992)).

17

Facebook’s concerns are not well taken. As an initial matter, the application of BIPA to

18

Illinois users does not have the impermissible “‘practical effect’ of regulating commerce occurring

19

wholly outside” Illinois. Healy, 491 U.S. at 332. The Court rejected a similar argument about

20

extraterritoriality under Illinois state law that Facebook raised at class certification, and the same

21

basic reasoning applies to the dormant commerce clause challenge. This lawsuit is under an

22

Illinois state statute on behalf of Illinois residents who used Facebook in Illinois. See In re

23

Facebook, 2018 WL 1794295, at *8 (finding that the alleged BIPA violations took place

24

“‘primarily and substantially within’ Illinois” under Avery v. State Farm Mutual Automobile

25

Insurance Co., 216 Ill.2d 100, 187 (Ill. 2005)). For the reasons discussed in the Court’s class

26

certification order, Facebook’s facial recognition program cannot be understood to have occurred

27

wholly outside Illinois, and the same rather metaphysical arguments about where BIPA was

28

violated fare no better when re-packaged under the dormant commerce clause. Facebook’s
6

1

reliance on our circuit’s conclusions in Christies, Inc., is misplaced. The California state law

2

challenged there purported to regulate sales of fine art conducted entirely outside the state. In

3

contrast, this case is deeply rooted in BIPA’s native soil of Illinois.

4

Facebook’s cursory reference to the specter of inconsistent regulations is equally

5

unavailing. Facebook says that the Commerce Clause “precludes Illinois from overriding the

6

decisions of California and other states” to not regulate biometric information, Dkt. No. 257 at 15,

7

but there is no risk of Illinois law overriding the laws of the other states. This suit involves

8

Facebook’s conduct with respect to Illinois users only, and even so, evidence in the record shows

9

that Facebook can activate or deactivate features for users in specific states with apparent ease
when it wants to do so. See Dkt. No. 339-11. Nothing indicates that liability under BIPA would

11
United States District Court
Northern District of California

10

force Facebook to change its practices with respect to residents of other states. Our circuit has

12

declined dormant commerce clause challenges in similar circumstances. See, e.g., Rocky

13

Mountain Farmers Union v. Corey, 730 F.3d 1070, 1101 (9th Cir. 2013).

14

III.

The Photograph Exclusion

15

Facebook seeks to re-argue on summary judgment another legal contention it made at the

16

start of this case, namely that BIPA regulates in-person or “live” scans of facial geometry only,

17

and that information derived from photographs, whether analogue or digital, is categorically

18

excluded from the statute. Dkt. No. 299 at 24. The Court has already considered and rejected that

19

point, based on well-established principles of statutory interpretation. In re Facebook, 185 F.

20

Supp. 3d at 1170-71. Three other federal courts have reached the same conclusion. Rivera v.

21

Google Inc., 238 F. Supp. 3d 1088, 1095 (N.D. Ill. 2017); Monroy v. Shutterfly, Inc., No. 16 C

22

10984, 2017 WL 4099846, at *3 (N.D. Ill. Sept. 15, 2017); Norberg v. Shutterfly, Inc., 152 F.

23

Supp. 3d 1103, 1106 (N.D. Ill. 2015). Facebook did not comply with our district’s rule for

24

seeking reconsideration, see Civil L.R. 7-9, and in any event, it offers nothing in the way of new

25

facts or law that would warrant reconsideration at this stage. If facts adduced at trial provide a

26

good-faith basis for further discussion, either side may propose it. See In re Facebook, 185 F.

27

Supp. 3d at 1172.

28
7

1

IV.

Damages

2

The cross-motions touch upon two damages issues that will benefit from clarification now

3

as the parties prepare for trial. The first is an offshoot of Facebook’s photo exclusion theory.

4

BIPA authorizes damages against a private entity that negligently, intentionally, or recklessly

5

violates BIPA, and scales the amount of damages to the degree of culpability. 740 Ill. Comp. Stat.

6

Ann. 14/20. Negligent violations are subject to statutory damages of $1,000, while intentional or

7

reckless violations are $5,000. Id. Facebook appears to contend that it should not be liable for

8

any damages at all, including at the negligence level, because it reasonably understood BIPA to

9

exclude data harvested from photographs.

10

That is not a sound proposition. As an initial matter, Facebook’s understanding of BIPA is

United States District Court
Northern District of California

11

in dispute. Plaintiffs have tendered materials indicating that Facebook knew the face signatures

12

and face templates it created from user photographs involved “biometric data.” See, e.g., Dkt. No.

13

306-5; Dkt. No. 339-11. Facebook offers competing evidence. That is not a record that permits

14

judgment as a matter of law.

15

In addition, a good argument can be made that Facebook’s position amounts to a very

16

questionable mistake of law defense. It is a “‘common maxim, familiar to all minds, that

17

ignorance of the law will not excuse any person, either civilly or criminally.’” Jerman v. Carlisle,

18

McNellie, Rini, Kramer & Ulrich LPA, 559 U.S. 573, 581 (2010) (citing Barlow v. United States,

19

7 Pet. 404, 411 (1833)). An “act may be ‘intentional’ for purposes of civil liability, even if the

20

actor lacked actual knowledge that her conduct violated the law. . . . [E]ven in the criminal

21

context, . . . reference to a ‘knowing’ or ‘intentional’ ‘violation’ or cognate terms has not

22

necessarily implied a defense for legal errors.” Id. at 582-85 (internal citation omitted) (citing

23

cases). Facebook’s position appears to conflate defenses for mistakes of fact with defenses for

24

mistakes of law, contrary to our common law’s “long tradition [of] . . . distinguishing errors of fact

25

from errors of law.” Id. at 608 (Scalia, J., concurring).

26

The doubts about Facebook’s argument are magnified by the Supreme Court’s holding that

27

statutory violations are not necessarily excused by a mistake of law even when a statute includes

28

an express “bona fide error” defense, as in the federal Fair Debt Collection Practices Act. Id. at
8

1

584. BIPA does not feature a similar “bona fide error” provision, and does not contemplate the

2

possibility of the mistake defense Facebook urges, let alone the conclusion that it is necessarily

3

insulated from all damages. There is no evidence that the Illinois legislature intended mistakes of

4

law to bar damages for negligent violations. Facebook’s cited cases are unhelpful because they

5

discuss willful violations only. See, e.g., Landwer v. Scitex Am. Corp., 238 Ill. App. 3d 403, 409

6

(Ill. 1992); Safeco Ins. Co of Am. v. Burr, 551 U.S. 47, 56-57 (2007).

7

The Court will not rule out at this stage the possibility that a reasonable mistake of law

8

might foreclose exposure at the $5,000 level of damages. See Jerman, 559 U.S. at 584 (“willful”

9

is more typically understood in the civil context to excuse mistakes of law). That issue will

10

United States District Court
Northern District of California

11

require further briefing and discussion at the pretrial conference.
The second damages issue is whether plaintiffs must prove actual damages as a

12

precondition for an award of statutory damages. BIPA states that a victim may recover “liquidated

13

damages” at the $1,000 or $5,000 level, “or actual damages, whichever is greater.” 740 Ill. Comp.

14

Stat. Ann. 14/20(1)-(2). Facebook appears to read the “or greater” construction to mean that a

15

plaintiff must establish at least some measure of actual damages before seeking statutory damages.

16

This damages theory echoes Facebook’s faulty contention that BIPA requires actual

17

damages of some sort to maintain a cause of action, and it fails for the reasons stated in prior

18

orders. See Patel, 290 F. Supp. 3d at 953; In re Facebook, 2018 WL 1794295, at *7. It also

19

misconstrues the plain language of BIPA. Section 20 expressly provides for two separate

20

categories of damages that a plaintiff may recover. Consequently, proof of actual damages is not a

21

prerequisite to recovery of statutory damages. Facebook’s reliance on Doe v. Chao, 540 U.S. 614

22

(2004), is misplaced. As Doe states, the determination of damages available under a statute is an

23

exercise of “straightforward textual analysis.” Id. at 620. The statutory damages provision at

24

issue in Doe is far too different from the language in BIPA to serve as a sound basis for analogy or

25

guidance here. In addition, other courts have concluded after Doe that the mention of actual and

26

liquidated damages in a statute does not necessarily require proof of actual damages as a threshold

27

matter. See, e.g., Sterk v. Redbox Automated Retail, LLC, 672 F.3d 535, 538 (7th Cir. 2012)

28

(Video Privacy Protection Act provision allowing for “actual damages but not less than liquidated
9

1

damages in an amount of $2,500” authorizes liquidated damages without proof of actual

2

damages); Pichler v. UNITE, 542 F.3d 380, 398 (3d Cir. 2008) (Driver’s Privacy Protection Act

3

provision for “actual damages, but not less than liquidated damages in the amount of $2,500”

4

“creates a base amount below which the court may not go, whether the plaintiff is able to prove

5

actual damages or not”); Kehoe v. Fidelity Fed. Bank & Trust, 421 F.3d 1209, 1216 (11th Cir.

6

2005) (same).

7

V.

The Named Plaintiffs

8

Facebook says that it is entitled to judgment because the named plaintiffs cannot show that
their photos were subjected to scanning. But that clearly is another disputed question of fact for

10

the jury to resolve. Plaintiffs have identified more than enough evidence to allow a reasonable

11
United States District Court
Northern District of California

9

jury to conclude their biometric data was harvested. Among other facts, the record shows that

12

plaintiffs were active Facebook users while the Tag Suggestions program was in place. The

13

program was launched in the United States in 2011, and Facebook agrees that Pezen did not opt

14

out of Tag Suggestions until 2014, Licata did not opt out of Tag Suggestions until 2017, and Patel

15

has not opted out at all. Dkt. No. 284-2 at 14 n.12. The record also shows that each of the named

16

plaintiffs uploaded a sizeable number of photographs and were tagged in other users’ photos. See

17

Dkt. No. 341 at 18; Dkt. No. 349-2 at 8. A jury could reasonably find from this and other

18

evidence that the named plaintiffs’ photographs were processed by Facebook’s facial recognition

19

technology.
CONCLUSION

20
21

The parties’ motions for summary judgment, Dkt. Nos. 257, 299, 307, are denied.

22

IT IS SO ORDERED.

23

Dated: May 14, 2018

24
25
JAMES DONATO
United States District Judge

26
27
28
10