The Privacy Class Action Review - 2023 - Report - Page 28
consent prior to their upload of facial geometry to the defendant’s database. The plaintiff
further asserted that the defendant failed to inform her and others on how it planned to
retain and manage the data, did not have a publicly available policy detailing its data
collection and management, and did not have any written policy regarding the data
collection.
The defendant argued that: (i) the plaintiff's claims failed pursuant to Illinois'
Extraterritorial Doctrine; (ii) the plaintiff’s complaint failed to allege that the defendant
violated §§ 15(a) or (b) of the BIPA; (iii) the plaintiff failed to allege the requisite state of
mind for monetary damages; and (iv) that the BIPA violates the First Amendment
because it constitutes an unconstitutional restraint on commercial speech. Id. at *4. The
defendant contended that the plaintiff’s allegations that the plaintiff lived in and used the
database in Illinois could not suffice to plausibly suggest that the defendant’s conduct
occurred primarily or substantially within Illinois. Id. at *5.
The court explained that a bright-line rule for determining whether the alleged conduct
occurred in Illinois is not typically applied, but rather a consideration of the “totality of
circumstances.” Id. at *6. The court concluded that at this early stage of the litigation,
the plaintiff’s allegations were sufficient to plausibly suggest the conduct occurred
“primarily and substantially” in Illinois, as plaintiff asserted that the defendant contracted
with Illinois entities, including the plaintiff's employer, to provide its services to clients
operating within Illinois, and provided those Illinois entities with analyses of its geometric
scans, thereby taking specific actions toward the plaintiff directed at Illinois.
Further, the defendant argued that the complaint failed to allege a § 15(b) violation
because it only collected videos, not biometric information, and that a “video of a face"
did not clearly fall within the definition of "biometric identifier" because the definition
does not include "videos" or define "scan of face geometry.” Id. at *10. The court
rejected this argument. It reasoned that under a plain reading of the text, the BIPA
explicitly defines "biometric identifier" to include a "scan of hand and face geometry.” Id.
The defendant also asserted that the plaintiff's claim based on § 15(a) should be
dismissed because the plaintiff only alleged that the defendant captured or collected her
biometric data, not that it possessed it. The court disagreed. It opined that the plaintiff
sufficiently alleged that the defendant obtained access to the plaintiff's uploaded video
containing her biometric data; used its technology to scan the plaintiff's facial geometry
from those videos and analyzed those scans; and then developed reports for the
plaintiff's employer. Id. at *14.
Finally, the defendant contended that the BIPA violates the First Amendment because
its use of facial geometry scans constituted commercial speech and the BIPA
constituted a content-based restriction of the commercial speech. Id. at *16. The court
explained that Seventh Circuit precedent held that the First Amendment does not give
anyone a constitutional right to information and there exists numerous constitutionallypermissible laws that limit public access to sensitive information. Id. at *19. The court
ruled that since §§ 15(a) and (b) only restrict how an entity may obtain data in the first
27
© Duane Morris LLP 2023
Duane Morris Privacy Class Action Review – 2023
