In re Facebook Biometric Information Privacy Litigation

Filing 372

ORDER re Summary Judgment Motions ( 257 , 299 , 307 ). Signed by Judge James Donato on 5/14/2018. (jdlc3S, COURT STAFF) (Filed on 5/14/2018)

Download PDF
1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 IN RE FACEBOOK BIOMETRIC INFORMATION PRIVACY LITIGATION 8 9 THIS DOCUMENT RELATES TO: ALL ACTIONS 10 Case No. 3:15-cv-03747-JD ORDER RE SUMMARY JUDGMENT MOTIONS Re: Dkt. Nos. 257, 299, 307 United States District Court Northern District of California 11 12 13 Plaintiffs and defendant Facebook, Inc., have filed cross-motions for summary judgment 14 on plaintiffs’ claim that Facebook’s Tag Suggestions program collects and stores biometric data in 15 violation of the Illinois Biometric Information Privacy Act (“BIPA”), 740 Ill. Comp. Stat. 14/1 et 16 seq. Dkt. Nos. 257, 299, 307. The Court’s prior orders discuss the core elements of this litigation 17 in substantial detail, and provide the context for the summary judgment motions. See In re 18 Facebook Biometric Info. Privacy Litig., 185 F. Supp. 3d 1155 (N.D. Cal. 2016) (choice of law); 19 Patel v. Facebook Inc., 290 F. Supp. 3d 948 (N.D. Cal. 2018) (Article III standing); In re 20 Facebook Biometric Info. Privacy Litig., No. 3:15-CV-03747-JD, 2018 WL 1794295 (N.D. Cal. 21 Apr. 16, 2018) (certifying Illinois user class). 22 The parties have filed over 100 pages of briefs for the cross-motions, accompanied by 23 several hundred pages of documents and emails, deposition testimony, expert opinions and other 24 exhibits. These voluminous submissions underscore the multitude of fact disputes that bar 25 judgment as a matter of law for either side. That is particularly true for plaintiffs’ motion, which 26 effectively asks for entry of judgment in their favor on a record that they concede is often 27 unsettled. Consequently, all of the summary judgment motions are denied, and the trial set for 28 July 9, 2018, will go forward. This order addresses the parties’ disagreements about Facebook’s 1 face scanning practices, which illustrate the factual disputes barring summary judgment, and 2 certain legal arguments raised by Facebook, with the goal of clarifying them in advance of trial 3 and the pretrial conference. 4 Before getting to those matters, the Court is concerned about a troubling theme in 5 Facebook’s briefs. Facebook says it knows “from this Court’s class certification decision” and an 6 Illinois state decision, Rosenbach v. Six Flags Entertainment Corporation, 2017 IL App (2d) 7 170317 (Ill. App. Ct. 2017), that plaintiffs “must prove something more than a violation of BIPA’s 8 notice-and-consent provisions” to prevail. Dkt. No. 349-2 at 3. This and similar comments 9 suggest that Facebook is reverting to the faulty proposition that plaintiffs must show an “actual” injury beyond the invasion of the privacy rights afforded by BIPA. That is not what the Court has 11 United States District Court Northern District of California 10 concluded. The Court expressly rejected that contention in considerable detail in the class 12 certification order and the order finding Article III standing to sue. In re Facebook, 2018 WL 13 1794295 at *6-8; Patel, 290 F. Supp. 3d at 953-54. A class was certified for that exact reason. 14 BIPA does not require additional proof of individualized “actual” harm, and so the question of 15 whether Facebook is liable can be decided in “one stroke” for the class as a whole without a 16 likelihood that individualized inquiries would overwhelm commonality and predominance. Wal- 17 Mart Stores, Inc. v. Dukes, 564 U.S. 338, 350 (2011). To contend otherwise, or to argue that 18 BIPA requires some individualized quantum of “actual” injury in addition to the privacy violation 19 caused by the deprivation of the notice and consent requirements, is to misread and misrepresent 20 the Court’s orders. 21 22 LEGAL STANDARDS “A party may move for summary judgment, identifying each claim or defense -- or the part 23 of each claim or defense -- on which summary judgment is sought. The Court shall grant 24 summary judgment if the movant shows that there is no genuine dispute as to any material fact and 25 the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). The Court may 26 dispose of less than the entire case and just portions of a claim or defense. Smith v. State of 27 California Dep’t of Highway Patrol, 75 F. Supp. 3d 1173, 1179 (N.D. Cal. 2014). 28 2 1 Under Rule 56, a dispute is genuine “if the evidence is such that a reasonable jury could 2 return a verdict” for either party. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986). A 3 fact is material if it could affect the outcome of the suit under the governing law. Id. at 248-49. In 4 determining whether a genuine dispute of material fact exists, the Court will view the evidence in 5 the light most favorable to the non-moving party and draw “all justifiable inferences” in that 6 party’s favor. Id. at 255. A principal purpose of summary judgment “is to isolate and dispose of 7 factually unsupported claims.” Celotex Corp. v. Catrett, 477 U.S. 317, 323-24 (1986). 8 The moving party can initially establish the absence of a genuine issue of material fact, which it must do by “pointing out to the district court . . . that there is an absence of evidence to 10 support the nonmoving party’s case.” Id. at 325. It is then the non-moving party’s burden to go 11 United States District Court Northern District of California 9 beyond the pleadings and identify specific facts that show a genuine issue for trial. Id. at 323-34. 12 “A scintilla of evidence or evidence that is merely colorable or not significantly probative does not 13 present a genuine issue of material fact.” Addisu v. Fred Meyer, Inc., 198 F.3d 1130, 1134 (9th 14 Cir. 2000). It is not the Court’s task “to scour the record in search of a genuine issue of triable 15 fact.” Keenan v. Allan, 91 F.3d 1275, 1279 (9th Cir. 1996) (quotations omitted). DISCUSSION 16 17 I. Scan of Face Geometry 18 The parties’ disagreements about Facebook’s face recognition and scanning practices are 19 emblematic of the factual disputes that are rife in this case. BIPA requires private entities to 20 provide notice and obtain consent when either “biometric identifiers or biometric information” are 21 at issue. 740 Ill. Comp. Stat. Ann. 14/15. “Biometric identifiers” include “scan[s] of . . . face 22 geometry” and “biometric information” includes “any information, regardless of how it is 23 captured, converted, stored, or shared, based on an individual’s biometric identifier used to 24 identify an individual.” 740 Ill. Comp. Stat. Ann. 14/10. “Biometric identifiers do not include . . . 25 photographs” and biometric information “does not include information derived from items or 26 procedures excluded under the definition of biometric identifiers.” Id. 27 28 Plaintiffs’ case turns in large measure on whether Facebook collects and stores scans of face geometry. While the parties have no serious disagreement about the literal text of Facebook’s 3 1 source code, they offer strongly conflicting interpretations of how the software processes human 2 faces. Plaintiffs say the technology necessarily collects scans of face geometry because it uses 3 human facial regions to process, characterize, and ultimately recognize face images. Facebook 4 disagrees and says the technology has no express dependency on human facial features at all. 5 Rather, according to Facebook, the technology “learns for itself what distinguishes different faces 6 and then improves itself based on its successes and failures, using unknown criteria that have 7 yielded successful outputs in the past.” Dkt. No. 298-24 at 5. 8 9 This is a quintessential dispute of fact for the jury to decide. On their part, plaintiffs have tendered evidence that Facebook’s algorithm collects information about face geometry. For example, plaintiffs highlight a Facebook research paper captioned “DeepFace,” which describes 11 United States District Court Northern District of California 10 the processing system used for face recognition. Facebook agrees that the “DeepFace” paper is 12 descriptive of its technology, and does not identify any specific differences between the approach 13 outlined in the paper and its actual practices. See Dkt. No. 337 at 18. 14 “DeepFace” is a network architecture whose “success . . . is highly dependent on a very 15 rapid 3D alignment step” that “fix[es] at the pixel level” “the location of each facial region.” Dkt. 16 No. 341-30 at FBBIPA_00001214. Alignment begins “by detecting 6 fiducial points . . . centered 17 at the center of the eyes, tip of the nose, and mouth locations.” Id. at FBBIPA_00001216. After 18 alignment, a representation step “capture[s] correlations between features captured in distant parts 19 of the face images, e.g., position and shape of eyes and position and shape of mouth.” Id. at 20 FBBIPA_00001217. 21 Plaintiffs proffer opinions by their expert, Dr. Atif Hashmi, who examined Facebook’s 22 source code and concluded that alignment “utilize[s] facial geometry to determine the location of 23 facial landmarks including eyes, nose, mouth, chin, and others in unaligned face images.” Dkt. 24 No. 339-7 at 18. Locating those landmarks allows face images to be reconstructed in a fully 25 frontal position. Id. According to Dr. Hashmi, representation then “progressively extract[s] 26 complex features like . . . eyes, nose, chin, and mouth” in order to produce “a set of numerical 27 values . . . that represent the facial landmarks or features present in the face image.” Id. at 20-23. 28 4 1 In addition to these technical materials, plaintiffs tender internal Facebook emails 2 indicating that Facebook understood it was collecting what is “normally referred to as biometric 3 data.” Dkt. No. 306-5; see also Dkt. No. 339-11. 4 Facebook counters with other evidence to contest the claim that its technology scans face 5 geometry. It cites, for example, the opinions of its own expert, Dr. Matthew Turk, who says that 6 Facebook’s technology “analyze[s] all of the pixels in a face image, and not any particular human- 7 notable facial features.” Dkt. No. 298-1 at 3. “Through an iterative trial-and-error training 8 process, Facebook’s [current technology] . . . learned for itself what features of an image’s pixel 9 values are most useful for the purpose of characterizing and distinguishing images of human faces.” Id. at 2. The technology, in Dr. Turk’s view, “does not explicitly detect human-notable 11 United States District Court Northern District of California 10 facial features” but instead “combines and weights different combinations of different aspects of 12 the entire face image’s pixel values. Indeed, the [technology] . . . would still calculate a ‘face 13 signature’ if provided with an image of something other than a face.” Id. at 40. 14 The parties unleash volleys of other competing evidence, but this summary is enough to 15 show that a jury will need to resolve the genuine factual disputes surrounding facial scanning and 16 the recognition technology. Facebook makes a stab at avoiding trial by suggesting that “scan” in 17 “scan of face geometry” necessarily connotes an express measurement of human facial features -- 18 for instance, “a measurement of the distance between a person’s eyes, nose, and ears.” Dkt. No. 19 299 at 20 (internal quotation omitted). But the argument is of no moment because it merely begs 20 the question of what, in fact, happens in the operation of the technology. In addition, the word 21 “scan” does not bear the definitional freight Facebook seeks to impose. BIPA does not 22 specifically define it, and the ordinary meaning of “to scan” is to “examine” by “observation or 23 checking,” or “systematically . . . in order to obtain data especially for display or storage.” 24 MERRIAM-WEBSTER’S COLLEGIATE DICTIONARY at 1107-08 (11th ed. 2003). “Geometry” is also 25 understood in everyday use to mean simply a “configuration,” which in turn denotes a “relative 26 arrangement of parts or elements.” Id. at 524, 261. None of these definitions demands actual or 27 express measurements of spatial quantities like distance, depth, or angles. In addition, the Illinois 28 legislature’s decision to use the word “scan” rather than “record” does not indicate that express 5 1 measurements are required, and limiting scans of face geometry to techniques that literally 2 measure distances, depths, and angles cannot be squared with the legislature’s clear intent to 3 regulate emergent biometric data collection technology in whatever specific form it takes. See In 4 re Facebook, 185 F. Supp. 3d at 1171. 5 II. Dormant Commerce Clause 6 Moving to Facebook’s more overtly legal contentions, Facebook says that subjecting it to 7 BIPA would violate the dormant commerce clause because it processes facial recognition on 8 servers outside the state of Illinois. Dkt. No. 257 at 13. Plaintiffs do not meaningfully dispute that 9 the pertinent servers are not located in Illinois. 10 The dormant commerce clause typically applies when a state tries to regulate or control United States District Court Northern District of California 11 economic conduct wholly outside its borders with the goal of protecting local businesses from out- 12 of-state competition. See Healy v. Beer Inst., Inc., 491 U.S. 324, 336-37 (1989). It is a “limitation 13 upon the power of the States” intended to prohibit “discrimination against interstate commerce” 14 and “state regulations that unduly burden interstate commerce.” Sam Francis Found. v. Christies, 15 Inc., 784 F.3d 1320, 1323 (9th Cir. 2015) (en banc) (quoting Great Atl. & Pac. Tea Co. v. Cottrell, 16 424 U.S. 366, 371 (1976) and Quill Corp. v. North Dakota, 504 U.S. 298, 312 (1992)). 17 Facebook’s concerns are not well taken. As an initial matter, the application of BIPA to 18 Illinois users does not have the impermissible “‘practical effect’ of regulating commerce occurring 19 wholly outside” Illinois. Healy, 491 U.S. at 332. The Court rejected a similar argument about 20 extraterritoriality under Illinois state law that Facebook raised at class certification, and the same 21 basic reasoning applies to the dormant commerce clause challenge. This lawsuit is under an 22 Illinois state statute on behalf of Illinois residents who used Facebook in Illinois. See In re 23 Facebook, 2018 WL 1794295, at *8 (finding that the alleged BIPA violations took place 24 “‘primarily and substantially within’ Illinois” under Avery v. State Farm Mutual Automobile 25 Insurance Co., 216 Ill.2d 100, 187 (Ill. 2005)). For the reasons discussed in the Court’s class 26 certification order, Facebook’s facial recognition program cannot be understood to have occurred 27 wholly outside Illinois, and the same rather metaphysical arguments about where BIPA was 28 violated fare no better when re-packaged under the dormant commerce clause. Facebook’s 6 1 reliance on our circuit’s conclusions in Christies, Inc., is misplaced. The California state law 2 challenged there purported to regulate sales of fine art conducted entirely outside the state. In 3 contrast, this case is deeply rooted in BIPA’s native soil of Illinois. 4 Facebook’s cursory reference to the specter of inconsistent regulations is equally 5 unavailing. Facebook says that the Commerce Clause “precludes Illinois from overriding the 6 decisions of California and other states” to not regulate biometric information, Dkt. No. 257 at 15, 7 but there is no risk of Illinois law overriding the laws of the other states. This suit involves 8 Facebook’s conduct with respect to Illinois users only, and even so, evidence in the record shows 9 that Facebook can activate or deactivate features for users in specific states with apparent ease when it wants to do so. See Dkt. No. 339-11. Nothing indicates that liability under BIPA would 11 United States District Court Northern District of California 10 force Facebook to change its practices with respect to residents of other states. Our circuit has 12 declined dormant commerce clause challenges in similar circumstances. See, e.g., Rocky 13 Mountain Farmers Union v. Corey, 730 F.3d 1070, 1101 (9th Cir. 2013). 14 III. The Photograph Exclusion 15 Facebook seeks to re-argue on summary judgment another legal contention it made at the 16 start of this case, namely that BIPA regulates in-person or “live” scans of facial geometry only, 17 and that information derived from photographs, whether analogue or digital, is categorically 18 excluded from the statute. Dkt. No. 299 at 24. The Court has already considered and rejected that 19 point, based on well-established principles of statutory interpretation. In re Facebook, 185 F. 20 Supp. 3d at 1170-71. Three other federal courts have reached the same conclusion. Rivera v. 21 Google Inc., 238 F. Supp. 3d 1088, 1095 (N.D. Ill. 2017); Monroy v. Shutterfly, Inc., No. 16 C 22 10984, 2017 WL 4099846, at *3 (N.D. Ill. Sept. 15, 2017); Norberg v. Shutterfly, Inc., 152 F. 23 Supp. 3d 1103, 1106 (N.D. Ill. 2015). Facebook did not comply with our district’s rule for 24 seeking reconsideration, see Civil L.R. 7-9, and in any event, it offers nothing in the way of new 25 facts or law that would warrant reconsideration at this stage. If facts adduced at trial provide a 26 good-faith basis for further discussion, either side may propose it. See In re Facebook, 185 F. 27 Supp. 3d at 1172. 28 7 1 IV. Damages 2 The cross-motions touch upon two damages issues that will benefit from clarification now 3 as the parties prepare for trial. The first is an offshoot of Facebook’s photo exclusion theory. 4 BIPA authorizes damages against a private entity that negligently, intentionally, or recklessly 5 violates BIPA, and scales the amount of damages to the degree of culpability. 740 Ill. Comp. Stat. 6 Ann. 14/20. Negligent violations are subject to statutory damages of $1,000, while intentional or 7 reckless violations are $5,000. Id. Facebook appears to contend that it should not be liable for 8 any damages at all, including at the negligence level, because it reasonably understood BIPA to 9 exclude data harvested from photographs. 10 That is not a sound proposition. As an initial matter, Facebook’s understanding of BIPA is United States District Court Northern District of California 11 in dispute. Plaintiffs have tendered materials indicating that Facebook knew the face signatures 12 and face templates it created from user photographs involved “biometric data.” See, e.g., Dkt. No. 13 306-5; Dkt. No. 339-11. Facebook offers competing evidence. That is not a record that permits 14 judgment as a matter of law. 15 In addition, a good argument can be made that Facebook’s position amounts to a very 16 questionable mistake of law defense. It is a “‘common maxim, familiar to all minds, that 17 ignorance of the law will not excuse any person, either civilly or criminally.’” Jerman v. Carlisle, 18 McNellie, Rini, Kramer & Ulrich LPA, 559 U.S. 573, 581 (2010) (citing Barlow v. United States, 19 7 Pet. 404, 411 (1833)). An “act may be ‘intentional’ for purposes of civil liability, even if the 20 actor lacked actual knowledge that her conduct violated the law. . . . [E]ven in the criminal 21 context, . . . reference to a ‘knowing’ or ‘intentional’ ‘violation’ or cognate terms has not 22 necessarily implied a defense for legal errors.” Id. at 582-85 (internal citation omitted) (citing 23 cases). Facebook’s position appears to conflate defenses for mistakes of fact with defenses for 24 mistakes of law, contrary to our common law’s “long tradition [of] . . . distinguishing errors of fact 25 from errors of law.” Id. at 608 (Scalia, J., concurring). 26 The doubts about Facebook’s argument are magnified by the Supreme Court’s holding that 27 statutory violations are not necessarily excused by a mistake of law even when a statute includes 28 an express “bona fide error” defense, as in the federal Fair Debt Collection Practices Act. Id. at 8 1 584. BIPA does not feature a similar “bona fide error” provision, and does not contemplate the 2 possibility of the mistake defense Facebook urges, let alone the conclusion that it is necessarily 3 insulated from all damages. There is no evidence that the Illinois legislature intended mistakes of 4 law to bar damages for negligent violations. Facebook’s cited cases are unhelpful because they 5 discuss willful violations only. See, e.g., Landwer v. Scitex Am. Corp., 238 Ill. App. 3d 403, 409 6 (Ill. 1992); Safeco Ins. Co of Am. v. Burr, 551 U.S. 47, 56-57 (2007). 7 The Court will not rule out at this stage the possibility that a reasonable mistake of law 8 might foreclose exposure at the $5,000 level of damages. See Jerman, 559 U.S. at 584 (“willful” 9 is more typically understood in the civil context to excuse mistakes of law). That issue will 10 United States District Court Northern District of California 11 require further briefing and discussion at the pretrial conference. The second damages issue is whether plaintiffs must prove actual damages as a 12 precondition for an award of statutory damages. BIPA states that a victim may recover “liquidated 13 damages” at the $1,000 or $5,000 level, “or actual damages, whichever is greater.” 740 Ill. Comp. 14 Stat. Ann. 14/20(1)-(2). Facebook appears to read the “or greater” construction to mean that a 15 plaintiff must establish at least some measure of actual damages before seeking statutory damages. 16 This damages theory echoes Facebook’s faulty contention that BIPA requires actual 17 damages of some sort to maintain a cause of action, and it fails for the reasons stated in prior 18 orders. See Patel, 290 F. Supp. 3d at 953; In re Facebook, 2018 WL 1794295, at *7. It also 19 misconstrues the plain language of BIPA. Section 20 expressly provides for two separate 20 categories of damages that a plaintiff may recover. Consequently, proof of actual damages is not a 21 prerequisite to recovery of statutory damages. Facebook’s reliance on Doe v. Chao, 540 U.S. 614 22 (2004), is misplaced. As Doe states, the determination of damages available under a statute is an 23 exercise of “straightforward textual analysis.” Id. at 620. The statutory damages provision at 24 issue in Doe is far too different from the language in BIPA to serve as a sound basis for analogy or 25 guidance here. In addition, other courts have concluded after Doe that the mention of actual and 26 liquidated damages in a statute does not necessarily require proof of actual damages as a threshold 27 matter. See, e.g., Sterk v. Redbox Automated Retail, LLC, 672 F.3d 535, 538 (7th Cir. 2012) 28 (Video Privacy Protection Act provision allowing for “actual damages but not less than liquidated 9 1 damages in an amount of $2,500” authorizes liquidated damages without proof of actual 2 damages); Pichler v. UNITE, 542 F.3d 380, 398 (3d Cir. 2008) (Driver’s Privacy Protection Act 3 provision for “actual damages, but not less than liquidated damages in the amount of $2,500” 4 “creates a base amount below which the court may not go, whether the plaintiff is able to prove 5 actual damages or not”); Kehoe v. Fidelity Fed. Bank & Trust, 421 F.3d 1209, 1216 (11th Cir. 6 2005) (same). 7 V. The Named Plaintiffs 8 Facebook says that it is entitled to judgment because the named plaintiffs cannot show that their photos were subjected to scanning. But that clearly is another disputed question of fact for 10 the jury to resolve. Plaintiffs have identified more than enough evidence to allow a reasonable 11 United States District Court Northern District of California 9 jury to conclude their biometric data was harvested. Among other facts, the record shows that 12 plaintiffs were active Facebook users while the Tag Suggestions program was in place. The 13 program was launched in the United States in 2011, and Facebook agrees that Pezen did not opt 14 out of Tag Suggestions until 2014, Licata did not opt out of Tag Suggestions until 2017, and Patel 15 has not opted out at all. Dkt. No. 284-2 at 14 n.12. The record also shows that each of the named 16 plaintiffs uploaded a sizeable number of photographs and were tagged in other users’ photos. See 17 Dkt. No. 341 at 18; Dkt. No. 349-2 at 8. A jury could reasonably find from this and other 18 evidence that the named plaintiffs’ photographs were processed by Facebook’s facial recognition 19 technology. CONCLUSION 20 21 The parties’ motions for summary judgment, Dkt. Nos. 257, 299, 307, are denied. 22 IT IS SO ORDERED. 23 Dated: May 14, 2018 24 25 JAMES DONATO United States District Judge 26 27 28 10

Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.

Why Is My Information Online?