Clark v. Microsoft Corp.

688 F.Supp.3d 743

Cody CLARK, on behalf of himself and all others similarly situated, Plaintiff, v. MICROSOFT CORPORATION, Defendant.

No. 23 C 695

United States District Court, N.D. Illinois, Eastern Division

Signed August 21, 2023

Carl V. Malmstrom, Wolf Haldenstein Adler Freeman & Herz LLC, Chicago, IL, Philip Fraietta, Bursor & Fisher P.A., New York, NY, for Plaintiff.

David Charles Layden, Savannah E. Berger, Precious S. Jacobs-Perry, Jenner & Block LLP, Chicago, IL, for Defendant.

Memorandum Opinion and Order

Elaine E. Bucklo, United States District Judge

Plaintiff Cody Clark brings this putative class action against Microsoft Corporation ("Microsoft"), alleging violations of sections 15(a)-(d) of the Illinois Biometric Information Privacy Act ("BIPA"), 740 Ill. Comp. Stat. 14/1 et seq. Microsoft now moves under Federal Rule of Civil Procedure 12(b)(6) to dismiss each of Clark's claims. I have subject-matter jurisdiction pursuant to the Class Action Fairness Act, 28 U.S.C. § 1332(d). For the following reasons, the motion is granted in part and denied in part.

I.

According to the complaint, while Clark worked as a salesperson for CONMED, he used "video-based coaching" software provided by Brainshark, Inc. ("Brainshark"). Compl., ECF 1-1 ¶¶ 8, 45. That software allows a salesperson to record a video of himself and upload it to Brainshark's platform, which then automatically generates feedback about his "elevator pitch." Id. ¶ 9. To provide this feedback, Brainshark's software analyzes facial expressions using facial geometry scans from the uploaded video. Id. ¶¶ 9-10.¹

Brainshark's software allegedly "interfaces with and/or integrates" two Microsoft products: its Azure cloud services ("Azure") and Azure Cognitive Services applications ("ACS"). Id. ¶ 8. "Public cloud[s]" like Azure "allow[ ] users to, inter alia, build and deploy applications; store data; deliver software on demand; and analyze data using machine learning and artificial intelligence." Id. ¶ 7. ACS "help[s] developers build cognitive solutions (that can see, hear, speak, and analyze) into their applications." Id.

In addition to the allegations in the complaint, Microsoft requests that I take judicial notice of its Products and Services Data Protection Addendum ("DPA"), ECF 16-1, which it says applies to Azure and ACS. Clark does not oppose consideration of this document, and in fact uses it in some of his arguments. Because the document is publicly available, it is a "matter of public record," and I will take judicial notice of it for purposes of this motion to dismiss. See U.S. ex rel. Suarez v. AbbVie, Inc., 503 F. Supp. 3d 711, 721-22 (N.D. Ill. 2020) (citing Cause of Action v. Chi. Transit Auth., 815 F.3d 267, 277 n.13 (7th Cir. 2016)).

II.

"To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to 'state a claim to relief that is plausible on its face.' " Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007)). "A claim is facially plausible 'when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.' " Law Offs. of David Freydin, P.C. v. Chamara, 24 F.4th 1122, 1128 (7th Cir. 2022) (quoting Iqbal, 556 U.S. at 678, 129 S.Ct. 1937). I accept well-pleaded facts as true and draw all reasonable inferences in plaintiff's favor, but I am "not bound to accept legal conclusions as true." Burger v. County of Macon, 942 F.3d 372, 374 (7th Cir. 2019) (citations omitted).

A.

Section 15(b) regulates entities that "collect, capture, purchase, receive through trade, or otherwise obtain" biometric data.² 740 Ill. Comp. Stat. 14/15(b). Microsoft maintains that Clark's section 15(b) claim should be dismissed because he failed to plausibly allege that Microsoft took an "active step" to obtain his biometric data. In response, Clark focuses only on whether Microsoft "receive[d] through trade" or "otherwise obtain[ed]" the data, and argues that section 15(b) does not require an active step and that, in any event, he has plausibly alleged one.

I agree with Microsoft and the weight of authority in this district that section 15(b) liability requires an active step in obtaining biometrics. See, e.g., Jones v. Microsoft Corp., No. 22-cv-3437, 649 F.Supp.3d 679, 683-84 (N.D. Ill. Jan. 9, 2023) (applying "active step" requirement to section 15(b) claim); Patterson v. Respondus, Inc., 593 F. Supp. 3d 783, 824 (N.D. Ill. 2022) (same); King v. PeopleNet Corp., No. 21 CV 2774, 2021 WL 5006692, at *8 (N.D. Ill. Oct. 28, 2021) (same); Jacobs v. Hanwha Techwin Am., Inc., No. 21 C 866, 2021 WL 3172967, at *2 (N.D. Ill. July 21, 2021) (same). The Illinois legislature premised BIPA sections 15(a), (c), (d), and (e) on "possession" of biometrics, but chose not to use that term in section 15(b). That choice matters. See Chi. Teachers Union, Local No. 1 v. Bd. of Educ. of the City of Chi., 357 Ill.Dec. 520, 963 N.E.2d 918, 925 (Ill. 2012) ("When the legislature includes particular language in one section of a statute but omits it in another section of the same statute, courts presume that the legislature acted intentionally and purposely in the inclusion or exclusion, and that the legislature intended different meanings and results." (citations omitted)).

The term "otherwise obtain" is also best construed as requiring something beyond passive possession or receipt. The parties put forth dueling dictionary definitions of the word "obtain"--Microsoft's preferred definition makes the verb active, while Clark's makes it passive. See Obtain, Black's Law Dictionary (11th ed. 2019) ("[t]o bring into one's own possession; to procure, esp. through effort"); Vance v. Microsoft Corp., 525 F. Supp. 3d 1287, 1297 (W.D. Wash. 2021) (" '[t]o come into the possession of,' or 'to get, acquire, or secure' " (quoting Obtain, Oxford English Dictionary, https://www.oed.com/dictionary/obtain_v (last visited August 21, 2023))). But because "otherwise obtain" comes at the end of a list of active verbs,³ the more active definition is the better one here. See Pooh-Bah Enters., Inc. v. County of Cook, 232 Ill.2d 463, 328 Ill.Dec. 892, 905 N.E.2d 781, 799 (2009) ("[W]hen a statutory clause specifically describes several classes of persons or things and then includes 'other persons or things,' the word 'other' is interpreted to mean 'other such like.' " (citation omitted)).⁴

Clark cautions that applying an active step requirement to section 15(b) is tantamount to "rewrit[ing] [BIPA] to create new elements or limitations not included by the legislature," in contravention of Illinois Supreme Court caselaw. Cothron v. White Castle Sys., Inc., 466 Ill.Dec. 85, 216 N.E.3d 918, 927-28 (Ill. Feb. 17, 2023). Indeed, according to Clark, the federal courts that had previously observed such a requirement can no longer be considered good law after Cothron. But Cothron merely reiterated rules of statutory construction that have been around for many years, and certainly since BIPA has been enacted. While true that section 15(b) nowhere says the words "active step," the statutory construction offered above shows that, "[u]nder a commonsense reading," "the private entity must undertake some effort to collect or obtain biometric identifiers or information." Jones, 649 F.Supp.3d at 683-84; see id. ("[T]his concept simply describes the unifying characteristic among the verbs in the statute.").

The complaint does not sufficiently allege that Microsoft took an active step in obtaining Clark's biometric data. There are repeated allegations that, for Brainshark to conduct its analysis of sales employees, it "(1) collects, captures, and/or otherwise obtains; (2) stores; and/or (3) makes use of such individuals' biometric identifiers (namely, scans of facial geometry) and biometric information." Compl. ¶¶ 10, 40; see also id. ¶ 46 (similar). From there, Clark alleges that because "Brainshark's software interfaces with and/or integrates Azure and/or ACS, Defendant Microsoft also (1) collects, captures, and/or otherwise obtains; (2) stores; and/or (3) makes use of such individuals' biometric identifiers and biometric information." Id. ¶¶ 11, 41; see also id. ¶¶ 13, 43, 47 (similar). That alone is a conclusory jump, and the complaint does not elsewhere allege facts sufficient to draw the inference that Microsoft actively obtained Clark's biometrics. Indeed, the complaint makes clear that Microsoft provides technology to Brainshark and that Brainshark allegedly uses that technology to collect Clark's biometrics. See, e.g., id. ¶ 7 (alleging that Azure is "a public cloud" that "allow[s] users to" perform various tasks (emphasis added)); id. ¶ 29 (describing ACS as "cloud-based artificial intelligence (AI) services that help developers build cognitive intelligence into applications" and "easily add cognitive features into their applications with cognitive solutions that can see, hear, speak, and analyze" (emphasis added) (footnote and internal quotation marks omitted)); see also id. ¶¶ 28, 30-32.

Rivera v. Amazon Web Services offers a helpful contrast. No. 2:22-cv-00269, 2023 WL 4761481 (W.D. Wash. July 26, 2023). There, the court found sufficient for section 15(b) purposes the plaintiff's allegations that the defendant could "access" and "extract" biometric data uploaded by an intermediary, and that it was "involve[d] in the data collection process . . . beyond simply providing the technology to" another entity. Id. at *5; see also Mayhall ex rel. D.M. v. Amazon Web Servs., Inc., No. 2:21-cv-01473-TL, 2023 WL 2728292, at *1, *3 (W.D. Wash. Mar. 31, 2023) (finding active step where defendant "use[d] its computing power . . . to collect facial features vectors from face-scan data," "construct[ed] a 3D face geometry of the user," and "transmit[ted] the [f]ace [g]eometry to [video game] pl...