The Privacy Class Action Review - 2023 - Report - Page 33
not allege any “biometric data” collected, captured, or possessed by Ring can be used
to identify her. The court denied the defendant’s motion to dismiss. The defendant
argued that, based on the class of bystanders with no contractual relationship to Ring,
the alleged face templates were not biometrics because a mere scan of hand or face
geometry – absent identifying information such as a name, address, or phone number
tying that geometry to a person – does not implicate the risks the Illinois Legislature
sought to mitigate. The court rejected this argument. It opined that on a motion to
dismiss, the court cannot determine whether the defendant had the capacity to identify
the plaintiff, nor can it assess the nature of the defendant’s patent applications for the
relevant technology. Id. at *7-8. Accordingly, the court denied the defendant’s motion to
dismiss.
F.
BIPA Rulings Outside Of Illinois
The plaintiffs’ class action bar also has initiated class actions under the BIPA outside of
Illinois. In 2022, those claims met with little success.
For example, in Thakkar, et al. v. ProctorU, Inc., 2022 U.S. Dist. LEXIS 211499 (N.D.
Ala. Nov. 22, 2022), the plaintiffs, a group of students, filed a class action alleging that
the defendant’s online testing platform for virtually proctoring exams violated the BIPA
by not taking reasonable steps to secure the safety of facial scan data and failing to
provide a retention policy for the data. The defendant filed a motion to dismiss, arguing
that the choice-of-law provision in its terms of service required that all claims must be
governed by the state of Alabama and therefore the state law claims could not survive.
The court granted the motion. The court reasoned that the by the plain language of the
contract, the plaintiffs’ claims related to and arose out of the defendant’s services
because its privacy policy was expressly incorporated in the terms of service. The court
concluded that because of the nature of the plaintiffs’ allegations and the language of
the parties' contract, the choice-of-law provision was enforceable and covered the BIPA
claims. For these reasons, the court granted the defendant’s motion to dismiss.
Likewise, in Vance, et al. v. Microsoft Corp., 2022 U.S. Dist. LEXIS 189250 (W.D.
Wash. Oct. 17, 2022), the plaintiffs filed a class action alleging that the defendant
violated the BIPA by using a data set compiled by IBM containing geometric scans of
their faces without their permission. The defendant filed a motion for summary
judgment, and the court granted the motion. The defendant asserted that the BIPA did
not apply outside of Illinois because there was no specific provision stating that it
expressly applied to out of state users. The defendant further argued that the actions
relevant to the claims at issue actually occurred in Washington and New York, such that
the alleged unlawful conduct was not subject to the BIPA. The plaintiffs contended that
because they were Illinois residents and their photos were thus uploaded to the internet
in Illinois, their injuries occurred in Illinois and were thereby subject to the BIPA
regulations. The court found that there was insufficient evidence to conclude that the
alleged unlawful conduct was connected to Illinois. The court determined that in order to
survive summary judgment, the plaintiffs must show a genuine issue of material fact
regarding whether the circumstances underlying their BIPA claims "occurred primarily
32
© Duane Morris LLP 2023
Duane Morris Privacy Class Action Review – 2023
