Zellmer v. Facebook, Inc.

Filing 87

ORDER RE SUMMARY JUDGMENT AND STATUS CONFERENCE. Signed by Judge James Donato on 3/31/2022. (jdlc3, COURT STAFF) (Filed on 3/31/2022)

Case 3:18-cv-01880-JD Document 87 Filed 03/31/22 Page 1 of 8

1

UNITED STATES DISTRICT COURT

2

NORTHERN DISTRICT OF CALIFORNIA

3
CLAYTON P. ZELLMER, on behalf of
himself and all others similarly situated,

4
5

Plaintiff,

6

v.

Case No. 3:18-cv-01880-JD
ORDER RE SUMMARY JUDGMENT
AND STATUS CONFERENCE
Re: Dkt. No. 67

7

FACEBOOK, INC.,

8

Defendant.

9
10

Plaintiff Clayton Zellmer sued defendant Facebook, Inc. (Facebook) on one claim under

United States District Court
Northern District of California

11

the Illinois Biometrics Information Privacy Act (BIPA). Dkt. No. 1. To a substantial degree, this

12

case overlaps with the facts and law of In re Facebook Biometric Information Privacy Litigation,

13

No. 15-cv-3747-JD (In re Facebook), which this Court presided over for several years, and which

14

concluded in a $650 million settlement in favor of Illinois Facebook users. The main difference is

15

that Zellmer “does not have, and has never had, a Facebook account,” and “has never used

16

Facebook’s services,” and sued on behalf of a putative class of Illinois non-users. Dkt. No. 1 ¶¶

17

28, 42. In effect, Zellmer filed a BIPA claim on behalf of just about everyone in Illinois not

18

covered by the settlement with users in In re Facebook.
Facebook asks for summary judgment on the BIPA claim. Dkt. No. 66-4.1 The parties’

19
20

familiarity with the record is assumed, and summary judgment is granted and denied in part.

21

BACKGROUND

22

The Court has substantial familiarity with Facebook, its face recognition technology, and

23

BIPA, from In re Facebook, and filed several detailed decisions that inform the discussion here.

24

See In re Facebook Biometric Info. Privacy Litig., 185 F. Supp. 3d 1155 (N.D. Cal. 2016)

25

(motions to dismiss and for summary judgment); In re Facebook Biometric Info. Privacy Litig.,

26
27
28

1

Facebook filed a motion to seal, Dkt. No. 66, with its motion for summary judgment, Dkt. No.
67. The Court refers to Dkt. No. 66-4, the unredacted motion for summary judgment, and to
Zellmer’s unredacted opposition, Dkt. No. 70-19, and Facebook’s unredacted reply, Dkt. No. 7927. An order on the motions to seal will be filed separately.

Case 3:18-cv-01880-JD Document 87 Filed 03/31/22 Page 2 of 8

1

326 F.R.D. 353 (N.D. Cal. 2018) aff’d sub nom, Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir.

2

2019) (class certification); Patel v. Facebook Inc., 290 F. Supp. 3d 948 (N.D. Cal. 2018) (motion

3

to dismiss); In re Facebook Biometric Info. Privacy Litig., No. 15-cv-3747-JD, 2018 WL 2197546

4

(N.D. Cal. May 14, 2018) (summary judgment); In re Facebook Biometric Inf. Privacy Litig., 522

5

F. Supp. 3d 617 (N.D. Cal. 2020) (final settlement approval and attorney’s fees award), aff’d, No.

6

21-15553, 2022 WL 822923 (9th Cir. 2022) (unpublished) (attorney’s fees).

7

Zellmer challenges the same “tagging” functionality that was in issue in In re Facebook.

8

See Dkt. No. 1 ¶ 6. This functionality entailed the scanning of faces in photographs uploaded on

9

Facebook for association with other scanned faces to automatically tag users, their friends, and
other recognized individuals. See Patel, 290 F. Supp. 3d at 951; In re Facebook, 185 F. Supp. 3d

11

United States District Court
Northern District of California

10

at 1158-59. Zellmer’s case also shares similarities to Gullen v. Facebook, Inc., No. 16-cv-937-JD,

12

which involved Facebook’s face recognition technology as applied to certain non-users of the

13

platform. Zellmer appears to have had some involvement in Gullen, albeit not as a named party.

14

See Gullen ECF counsel list. Gullen was dismissed with prejudice for reasons not germane here.

15

Gullen v. Facebook, Inc., No. 16-cv-937-JD, 2018 WL 1609337 (N.D. Cal. Apr. 3, 2018) aff’d,

16

772 F. App’x 481 (9th Cir. 2019) (unpublished).

17

Zellmer focuses on the same written consent and posted policy provisions of BIPA that

18

were at issue in In re Facebook. The Court discussed these and other provisions of BIPA in detail

19

in In re Facebook, and will not repeat all of that here. In pertinent summary, Illinois enacted

20

BIPA in 2008 on the basis of a legislative finding, among others, that “[a]n overwhelming

21

majority of members of the public are weary of the use of biometrics when such information is

22

tied to finances and other personal information.” 740 Ill. Comp. Stat. 14/5; see also Patel, 290 F.

23

Supp. 3d at 953-54 (analyzing BIPA); In re Facebook, 185 F. Supp. 3d at 1169 (same). The

24

statute sought to remedy this through greater regulation of the collection, use, safeguarding,

25

retention, and destruction of biometrics. As BIPA requires:

26
27
28

(a) A private entity in possession of biometric identifiers or biometric
information must develop a written policy, made available to the
public, establishing a retention schedule and guidelines for
permanently destroying biometric identifiers and biometric
information when the initial purpose for collecting or obtaining such
2

Case 3:18-cv-01880-JD Document 87 Filed 03/31/22 Page 3 of 8

identifiers or information has been satisfied or within 3 years of the
individual’s last interaction with the private entity, whichever occurs
first. Absent a valid warrant or subpoena issued by a court of
competent jurisdiction, a private entity in possession of biometric
identifiers or biometric information must comply with its established
retention schedule and destruction guidelines.

1
2
3
4

(b) No private entity may collect, capture, purchase, receive through
trade, or otherwise obtain a person’s or a customer’s biometric
identifier or biometric information, unless it first:
(1) Informs the subject or the subject’s legally authorized
representative in writing that a biometric identifier or biometric
information is being collected or stored;
(2) Informs the subject or the subject’s legally authorized
representative in writing of the specific purpose and length of term
for which a biometric identifier or biometric information is being
collected, stored, and used; and
(3) Receives a written release executed by the subject of the biometric
identifier or biometric information or the subject’s legally
authorized representative.

5
6
7
8
9
10
11

United States District Court
Northern District of California

740 Ill. Comp. Stat. 14/15. BIPA authorizes claims for damages or injunctive relief. 740
12
Ill. Comp. Stat. 14/20. Zellmer alleges violations of Section 15(a) and Section 15(b) of BIPA.
13
Dkt. No. 1 at ¶¶ 47-55.
14
Since Zellmer filed the complaint in this case, Facebook has abandoned the tagging
15
functionality pursuant to the settlement agreement in In re Facebook and other related reasons.
16
See In re Facebook, 522 F. Supp. 3d at 617; Torsten Kracht, Lisa Sotto, & Bennett Sooy,
17
Facebook Pivots from Facial Recognition System Following Biometric Privacy Suit, REUTERS
18
(Jan. 26, 2022), https://www.reuters.com/legal/legalindustry/facebook-pivots-facial-recognition19
system-following-biometric-privacy-suit-2022-01-26.
20
DISCUSSION
21
22

I.

LEGAL STANDARDS
A party “may move for summary judgment, identifying each claim or defense -- or the part

23
of each claim or defense -- on which summary judgment is sought. The court shall grant summary
24
judgment if the movant shows that there is no genuine dispute as to any material fact and the
25
26

movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). “The Court may dispose
of less than the entire case and even just portions of a claim or defense.” CZ Servs., Inc. v.

27
Express Scripts Holding Co., No. 3:18-CV-04217-JD, 2020 WL 4368212, at *2 (N.D. Cal. July
28
3

Case 3:18-cv-01880-JD Document 87 Filed 03/31/22 Page 4 of 8

1

30, 2020) (citing Smith v. Cal. Dep’t of Highway Patrol, 75 F. Supp. 3d 1173, 1179 (N.D. Cal.

2

2014)). A dispute is genuine “if the evidence is such that a reasonable jury could return a verdict

3

for the nonmoving party.” Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986).

4

A fact is material if it could affect the outcome of the suit under the governing law. Id. To

5

determine whether a genuine dispute as to any material fact exists, the Court views the evidence in

6

the light most favorable to the nonmoving party, and “all justifiable inferences are to be drawn” in

7

that party’s favor. Id. at 255. The moving party may initially establish the absence of a genuine

8

issue of material fact by “pointing out to the district court that there is an absence of evidence to

9

support the nonmoving party’s case.” Celotex Corp. v. Catrett, 477 U.S. 317, 325 (1986). It is
then the nonmoving party’s burden to go beyond the pleadings and identify specific facts that

11

United States District Court
Northern District of California

10

show a genuine issue for trial. Id. at 323-24. “A scintilla of evidence or evidence that is merely

12

colorable or not significantly probative does not present a genuine issue of material fact.” Addisu

13

v. Fred Meyer, Inc., 198 F.3d 1130, 1134 (9th Cir. 2000).
In resolving a summary judgment motion, it is not the Court’s task “to scour the record in

14
15

search of a genuine issue of triable fact.” Keenan v. Allan, 91 F.3d 1275, 1279 (9th Cir. 1996)

16

(quotations omitted). Rather, it is entitled to rely on the nonmoving party to “identify with

17

reasonable particularity the evidence that precludes summary judgment.” Id.; see also Fed. R.

18

Civ. P. 56(c)(3) (“The court need consider only the cited materials, but it may consider other

19

materials in the record.”).

20

II.

21

THE SECTION 15(B) CLAIM
Summary judgment is granted in Facebook’s favor on the portion of Zellmer’s BIPA claim

22

relating to notice and consent under Section 15(b). The reason is straightforward: it would be

23

patently unreasonable to construe BIPA to mean that Facebook was required to provide notice to,

24

and obtain consent from, non-users who were for all practical purposes total strangers to

25

Facebook, and with whom Facebook had no relationship whatsoever. Facebook and Zellmer

26

devoted substantial effort to debating technical questions of whether Facebook’s face scans are

27

“biometric identifiers” or “biometric information” within the meaning of BIPA, and whether

28

Facebook “collects” or “possesses” the face scans. See Dkt. No. 66-4 at 11-18; Dkt. No. 70-19 at
4

Case 3:18-cv-01880-JD Document 87 Filed 03/31/22 Page 5 of 8

1

10-17. But even assuming for present purposes that Zellmer has the better argument on these

2

disputes, which is by no means clear in the record, his claim is premised on an untenable

3

construction of Section 15(b).
In interpreting a statute, Illinois follows the well-established “cardinal rule” that courts

4
5

must “ascertain and give effect to the intent of the legislature.” In re Hernandez, 161 N.E.3d 135,

6

140 (Ill. 2020).2 “The best indicator of that intent is the language used in the statute itself,” and

7

that “language must be given its plain and ordinary meaning.” Id. (citing Bayer v. Panduit Corp.,

8

63 N.E.3d 890, 895 (Ill. 2016)). “In construing a statute, a court must not focus exclusively on a

9

single sentence or phrase but must view the statute as a whole, construing words and phrases in
light of other relevant statutory provisions and not in isolation.” Sigcho-Lopez v. Illinois State Bd.

11

United States District Court
Northern District of California

10

of Elections. --- N.E.3d ---, 2022 WL 869783 at *5 (Ill. 2022) (citation omitted). A court may also

12

“consider the reason for the law, the problems sought to be remedied, the purposes to be achieved,

13

and the consequences of construing the statute one way or another.” Id. (citation omitted).
Illinois also follows the construction principle that “a court presumes that the legislature

14
15

did not intend absurd, inconvenient, or unjust results.” Id.; see also Solon v. Midwest Medical

16

Records Ass’n, Inc., 925 N.E. 2d 1113, 1118 (Ill. 2010) (same). A court should “avoid an

17

interpretation producing an absurd or unreasonable result.” Sablik v. County of DeKalb, 163

18

N.E.3d 181, 187 (Ill. Ct. App. 2019). The Illinois Supreme Court has specifically stated with

19

respect to BIPA that “[c]ompliance should not be difficult” and any expense a business might

20

incur to comply should be minimal. Rosenbach v. Six Flags Ent’t Corp., 129 N.E.3d 1197, 1207

21

(Ill. 2019).
These standards make fairly short work of Zellmer’s Section 15(b) claim. To start, the

22
23

Illinois legislature clearly contemplated that BIPA would apply in situations where a business had

24

at least some measure of knowing contact with and awareness of the people subject to biometric

25

data collection. The legislative findings emphasize that BIPA is intended to apply to interactions

26
27
28

2

Facebook used Illinois law for its statutory construction arguments, Dkt. No. 66-4 at 18, and
Zellmer did not object. The Court will use Illinois law without deciding choice of law. All of the
statutory canons discussed here are widely accepted in federal and state case law.
5

Case 3:18-cv-01880-JD Document 87 Filed 03/31/22 Page 6 of 8

1

between businesses and their customers, such as “at grocery stores, gas stations, and school

2

cafeterias.” 740 Ill. Comp. Stat. 14/1(b). These examples, along with references to “financial

3

transactions” and other business practices, 740 Ill. Comp. Stat. 14/1(d), convey the legislature’s

4

intent that BIPA applies where there is at least a minimum level of known contact between a

5

person and an entity that might be collecting biometric information. It also bears mention that the

6

Illinois legislature did not intend to ban the use of biometrics altogether, but to regulate it. 740 Ill.

7

Comp. Stat. 14/1(g).

8
9

In light of these and other provisions in BIPA, the Court had no trouble concluding in In re
Facebook that Facebook should have complied with the notice and consent requirements of
Section 15(b) for its known users. See, e.g., In re Facebook, 326 F.R.D. at 545. The settlement in

11

United States District Court
Northern District of California

10

that case achieved a vastly higher claims rate than is typical in consumer cases precisely because

12

of Facebook’s relationship with its users. See In re Facebook, 522 F. Supp. 3d at 622 (outreach to

13

class members was maximized by “Facebook’s direct access to users”).

14

The situation here could not be more different. Zellmer and the putative class are by

15

definition entirely unknown to Facebook. Zellmer made no meaningful effort to explain how or

16

why BIPA might reasonably be interpreted to apply in this circumstance. This omission was all

17

the more glaring because Facebook highlighted portions of hearings in similar cases where the

18

Court expressed substantial doubt that the Illinois legislature had contemplated such a

19

counterintuitive result. See Dkt. No. 67-7 at 10:6-11:20; Dkt. No. 67-8 at 31:21-34:15.

20

To construe BIPA as Zellmer urges would lead to obvious and insoluble problems. Under

21

Zellmer’s interpretation of Section 15(b), Facebook in effect would need to identify every non-

22

user in Illinois on a regular basis, and figure out a way to communicate with them to provide

23

notice and obtain consent. Given the readily apparent impossibility of carrying such a burden, the

24

Court expressly asked Zellmer’s counsel for guidance on what, if anything, Facebook could

25

reasonably and realistically do vis-a-vis non-users who are unknown to it. See, e.g., Dkt. No. 84 at

26

5:5-17; Dkt. No. 67-7 at 9:8-18; Dkt. No. 67-8 at 31:21-34:14. The proposals offered in response

27

were highly problematic. Counsel suggested that Facebook might “deputize” its users in Illinois

28

as “legally authorized representatives” of non-users to affirm that non-users have consented to the
6

Case 3:18-cv-01880-JD Document 87 Filed 03/31/22 Page 7 of 8

1

facial scanning program when photos are uploaded. Dkt. No. 70-19 at 18-19. How this might

2

work as a practical matter is entirely unclear, as are the contours of the agency relationship

3

required for “legally authorized representatives” under BIPA. Zellmer also suggested that

4

Facebook could have revised its terms of service to apply facial scanning only when users had

5

written permission from every person in a photo. Id. at 19-20. This too is not consonant with the

6

plain language of BIPA, and immediately raises an insurmountable practical problem for the

7

myriad of photos taken in restaurants, vacation destinations, school graduations, and countless

8

other settings where unknown people will appear in a picture. There is no realistic way for the

9

person posting the photo to obtain consent from every stranger whose face happened to be caught
on camera. It may be, as Zellmer suggests, that Amazon and Shutterfly have such policies, but

11

United States District Court
Northern District of California

10

that does not mean those policies satisfy BIPA, or are otherwise legally sound. Simply pointing to

12

other policies also does not provide an answer to the problems the Court has identified.
Overall, Zellmer’s notice and consent claim entails an unreasonable reading of Section

13
14

15(b) that would put Facebook in an impossible position. It is not consonant with the Illinois

15

legislature’s intent or the Illinois Supreme Court’s determination that BIPA should not impose

16

extraordinary burdens on businesses. Summary judgment on the Section 15(b) portion of

17

Zellmer’s BIPA claim is granted in favor of Facebook. The Court emphasizes that this conclusion

18

is made on the basis of the specific record before it, and may not apply in other circumstances.

19

III.

THE SECTION 15(A) CLAIM

20

The Section 15(a) claim goes to whether Facebook had a “written policy, made available to

21

the public” that established data retention policies and related practices for biometric identifiers or

22

information. 740 Ill. Comp. Stat. 14/15(a). Facebook did not state that it had such a policy.

23

Instead, it requested summary judgment on the basis of a number of highly factual arguments

24

about whether it possessed such identifiers or information at all. See Dkt. No. 66-4 at 11-18.

25

Zellmer contests Facebook’s evidence, and much of the parties’ arguments are volleys and

26

returns about the record. For example, Facebook says that it deleted face signatures if it

27

determined that there was no match to an existing face templates. See Dkt. No. 66-12 at ¶ 16.

28

Zellmer says that was not always the case, and that biometric identifiers were stored by Facebook
7

Case 3:18-cv-01880-JD Document 87 Filed 03/31/22 Page 8 of 8

1

for later use. See Dkt. No. 70-19 at 5-6. Zellmer says that all of the steps of Facebook’s facial

2

recognition technology and the resulting data constituted scans of face geometry. Dkt. No. 70-19

3

at 2; Dkt. No. 70-8 at ¶¶ 44-45. Facebook says that is not true. Dkt. No. 66-4 at 5; Dkt. No. 66-12

4

at ¶¶ 2-7. The parties dispute whether face signatures could identify non-users. A Facebook

5

engineer states that face signatures were useless for identifying unknown faces because they can

6

only be used with Facebook’s existing face templates. Dkt. No. 66-12 at ¶ 12. Zellmer says the

7

evidence demonstrates otherwise. See Dkt. No. 70-14.

8
9
10

These are quintessential disputes of material facts that will require a trial to resolve. See
Facebook, 2018 WL 2197546, at *2-*3. Consequently, summary judgment is denied on the
Section 15(a) portion of Zellmer’s BIPA claim.
CONCLUSION

United States District Court
Northern District of California

11
12

The Court previously stayed and administratively closed the case pending further order.

13

The case will be re-opened and a status conference is set for May 26, 2022, at 10:00 a.m. in

14

Courtroom 11, San Francisco. The parties are directed to file a joint case management statement

15

by May 19, 2022. At the conference, the parties should be prepared to discuss whether the lack of

16

a public policy as contemplated by Section 15(a) is a single violation that warrants a single

17

liquidated damages or actual damages award, or some other remedy.

18
19

IT IS SO ORDERED.
Dated: March 31, 2022

20
21
JAMES DONATO
United States District Judge

22
23
24
25
26
27
28
8