Mayhall v. Amazon Web Services Inc

[8] UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON 9 AT SEATTLE [10] 11 ANN MAYHALL, on behalf of her Minor CASE NO. 2:21-cv-01473-TL Child, D.M., individually and on behalf of 12 all others similarly situated, ORDER ADOPTING REPORT AND 13 Plaintiff, RECOMMENDATION v. [14] AMAZON WEB SERVICES, INC. and 15 AMAZON.COM, INC., 16 Defendants. [17] 18 This matter comes before the Court on the Report and Recommendation of United States 19 Magistrate Judge Michelle L. Peterson (“R&R”) (Dkt. No. 31) on Defendants Amazon Web 20 Services Inc. (“AWS”) and Amazon.com, Inc.’s Motion to Dismiss Complaint (Dkt. No. 18) and 21 Defendants’ objections to the R&R (Dkt. No. 32). The Court has reviewed the R&R, 22 Defendants’ objections, Plaintiff’s response to Defendants’ objections (Dkt. No. 33), and the 23 remaining record. The Court finds oral argument unnecessary (see LCR 7(b)(4)), ADOPTS the 24 Report and Recommendation, and OVERRULES the objections. 1 I. BACKGROUND 2 Plaintiff Ann Mayhall filed this case on behalf of her minor child, D.M. Dkt. No. 1 at 1. 3 At the core of this case is what involvement Defendants AWS and Amazon.com, Inc. have with 4 respect to the biometric data created by players of NBA 2K, a basketball video game published 5 by Take 2 Interactive Software, Inc. (“Take 2”) and its subsidiary 2K Games Inc. Dkt. No. 1 ¶¶ 6 9, 77–81. The Court assumes familiarity with the detailed facts as described in the R&R. Dkt. 7 No. 31 at 2–6. 8 In brief, the relevant facts for the purposes of this motion as alleged in Plaintiff’s 9 Complaint are as follows. Plaintiff alleges that Take 2 utilizes Amazon’s cloud-computing 10 services for, inter alia, computing storage, and to provide the infrastructure to deliver its games 11 to internet-connected gaming platforms.1 Id. ¶¶ 9–11, 83–85. Players of NBA 2K, such as 12 Plaintiff’s minor child, take and scan multiple photos of their faces on the Take 2 app and upload 13 those images to the AWS/Amazon cloud to make customized players resembling the user. Id. 14 ¶¶ 13, 93–103. When players log on to insert their faces onto a player in the game, AWS and/or 15 Amazon uses its computing power to collect facial features vectors from the face-scan data to 16 construct a 3D face geometry of the user (“Face Geometry”). Id. ¶¶ 106, 141–42. Once the Face 17 Geometry is created, AWS and/or Amazon transmits the Face Geometry to the players’ Gaming 18 Platforms. Id. ¶¶ 107, 144. The process of retrieving the Face Geometry as well as any associated 19 data is repeated each time a player uses their custom player. Id. ¶¶ 113, 117, 150. AWS and/or 20 Amazon also stores the data based on the Face Geometry used to identify individual players. Id, 21 ¶¶ 110, 145. [23] 1 Take 2 and/or 2K Games use AWS/Amazon cloud-computing to deliver its games to the following internetconnected gaming platforms: X-Box, PlayStation, Nintendo Switch, and the personal computers of users who play 24 the game on Steam (collectively, the “Gaming Platforms”). Id. ¶¶ 84–85. 1 Defendants moved to dismiss the Complaint under Federal Rule of Civil Procedure 2 12(b)(6). Dkt. No. 18. Judge Peterson recommended that the motion to dismiss be denied, for the 3 reasons spelled out in the R&R. Dkt. No. 31. Defendants objected (Dkt. No. 32), and Plaintiff 4 has responded to Defendants’ objection (Dkt. No. 33). 5 II. LEGAL STANDARD 6 A. District Court Review of a Report and Recommendation 7 A district court has jurisdiction to review a magistrate judge’s report and 8 recommendation on dispositive matters. See Fed. R. Civ. P. 72(b). The district court “shall make 9 a de novo determination of those portions of the report or specified proposed findings or 10 recommendations to which objection is made.” 28 U.S.C. § 636 (b)(1); see also Fed. R. Civ. P. 11 72(b)(3) ( “The district judge must determine de novo any part of the magistrate judge’s 12 disposition that has been properly objected to.”). “The district judge may accept, reject, or 13 modify the recommended disposition; receive further evidence; or return the matter to the 14 magistrate judge with instructions.” Fed. R. Civ. P. 72(b)(3); accord 28 U.S.C. § 636 (b)(1). A 15 party properly objects when the party files “specific written objections” to the report and 16 recommendation as required under Federal Rule of Civil Procedure 72(b)(2). Defendant filed 17 timely objections to the report and recommendation, and Plaintiff filed a timely response to the 18 objections. 19 B. Motions to Dismiss 20 A complaint must include “a short and plain statement of the claim showing that the 21 pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). In reviewing a Rule 12(b)(6) motion to 22 dismiss, the Court takes all well-pleaded factual allegations as true and considers whether the 23 complaint “state[s] a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662 , 24 678 (2009); accord Bell Atl. Corp. v. Twombly, 550 U.S. 544 , 555–56 (2007). The Court 1 “accept[s] as true all facts alleged in the complaint and construe[s] them in the 2 light most favorable to plaintiff[], the non-moving party.’” DaVinci Aircraft, Inc. v. United 3 States, 926 F.3d 1117, 1122 (9th Cir. 2019) (quoting Snyder & Assocs. Acquisitions LLC v. 4 United States, 859 F.3d 1152 , 1156–57 (9th Cir. 2017)). While “[t]hreadbare recitals of the 5 elements of a cause of action, supported by mere conclusory statements” are insufficient, a claim 6 has “facial plausibility when the plaintiff pleads factual content that allows the court to draw the 7 reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 8 672, 678. 9 III. DISCUSSION 10 A. Preliminary Matters 11 1. Exhibit C to Defendants’ Motion 12 The Court finds no error in the Magistrate Judge’s ruling with regard to Exhibit C. Dkt. 13 No. 31 at 10. The Court agrees that it should err on the side of caution and not consider the 14 exhibit in evaluating Defendants’ Motion to Dismiss, given the dispute as to the accuracy and 15 nature of the document. 16 2. Rule 8(a)(2) Pleading as to Amazon.com, Inc. 17 Federal Rule of Civil Procedure 8(a)(2) does not require that a complaint set forth a 18 “defendant’s precise role in the injurious conduct.” Silicon Knights, Inc. v. Crystal Dynamics, 19 Inc., 983 F. Supp. 1303, 1308 (N.D. Cal. 1997) (citation omitted). A complaint only needs to 20 “put [defendants] on notice as to the nature of the allegations against them and their relationship 21 to the actions at issue in the case.” Id. (quotation omitted). The Court also finds that Plaintiff’s 22 Complaint outlines the interrelatedness of AWS and Amazon.com in both their infrastructure 23 generally (see Dkt. No. 1 ¶¶ 59–64), and the provision of services to video game companies such 24 as Take 2 (id. ¶¶ 61–66). Therefore, the allegations in the Complaint suffice to put Amazon.com, 1 Inc. on notice of the claims against it. See Tivoli LLC v. Sankey, No. C14-1285, 2015 WL 2 12683801, at *3 (C.D. Cal. Feb. 3, 2015) (“Group pleading is not fatal to a complaint if the 3 complaint still gives defendants fair notice of the claims against them.”). 4 B. The BIPA Claims 5 Plaintiffs allege that Defendants violated Illinois’s Biometric Information Privacy Act 6 (“BIPA”), 740 Ill. Comp. Stat. 14/1 et seq. BIPA was enacted to help regulate “the collection, 7 use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and 8 information.” Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d 1197, 1203 (Ill. 2019). BIPA 9 “imposes numerous restrictions on how private entities collect, retain, disclose and destroy 10 biometric identifiers, including . . . scans of . . . face geometry. ” Id. at 1199 (quoting 740 Ill. 11 Comp. Stat. 14/20). 12 1. Section 15(a) 13 Pursuant to Section 15(a) of BIPA, a private entity 14 in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, 15 establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when 16 the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s 17 last interaction with the private entity, whichever occurs first. 18 740 Ill. Comp. Stat. 14/15(a). 19 a. Possession 20 BIPA does not define “possession.” See 740 Ill. Comp. Stat. 14/10. Defendants assert that 21 “the exercise of control is the touchstone of ‘possession’ under Section 15(a)” and object that the 22 R&R “disregards a long line of cases” holding as much. Dkt. No. 32 at 9. But the R&R leads off 23 with an Illinois Supreme Court case holding that possession “occurs when a person has or takes 24 control of the subject property . . . .” Dkt. No. 31 at 14 (quoting People v. Ward, 830 N.E.2d 556 , 1 560 (Ill. 2005)). Ward is the same case Defendants lead off with in their motion and cite in their 2 objection. Compare Dkt. No. 31 at 14 with Dkt. No. 18 at 12 and Dkt. No. 32 at 9. 3 In their introduction to their objection, Defendants try to portray themselves as simply 4 offering cloud storage services where biometric data is merely “present on their servers.” Dkt. 5 No. 32 at 6–7. Defendants then fault the Magistrate Judge for “credit[ing] Plaintiff’s vague 6 allegation that AWS took certain actions—creating the face geometry and storing it on their 7 servers . . .” (id. at 9 (quotations omitted)), though a court is supposed to accept as true the facts 8 alleged in a complaint and construe them in them in the light most favorable to the plaintiff. 9 DaVinci Aircraft, Inc., 926 F.3d at 1122 . And Defendants’ very next sentence then admits that 10 “when the Complaint is read as a whole, the only plausible interpretation is that Take-Two 11 uploaded the photos it collected from [Plaintiff’s child] to its AWS account, extracted face 12 geometry data from them using AWS computing power, and then stored the resulting face 13 geometry data in its AWS account.” Dkt. No. 32 at 10 (emphasis added). Therefore, Defendants 14 admit that the Complaint alleges that they did more than simply store biometric data on their 15 servers.2 The Complaint alleges that Defendants use their computing power not only to collect 16 facial features vectors from face-scan data for Take 2 but also to construct a 3D Face Geometry 17 of the user, which Defendants then transmit to the players’ Gaming Platforms. Dkt. No. 1 18 ¶¶ 106–07. These allegations more than suffice to infer Defendants had control over Plaintiff’s 19 biometric data—and, therefore, possessed the data under Section 15(a) of BIPA—for the 20 purposes of a motion to dismiss. See Wilk v. Brainshark, Inc., No. C21-4794, 2022 WL 4482842 , [22] 2 Defendants inappropriately raised this policy argument for the first time in their objection. United States v. Howell, 231 F. 3d 615 , 621–22 (9th Cir. 2000) (a district court need not consider arguments presented for the first time in [23] objections to a report and recommendation). However, the facts alleged in the Complaint make it unnecessary for the Court to consider the new policy argument regarding entities that merely provide cloud computing and storage 24 services to other entities. Dkt. No. 32 at 1–2, 10. 1 at *5 (N.D. Ill. Sept. 27, 2022) (denying Rule 12(b)(6) motion where allegations that defendant 2 used its technology to scan plaintiff’s facial geometry from videos, analyzed those scans, and 3 then developed reports for plaintiff’s employer were sufficient to establish possession under 4 BIPA). 5 b. Ripeness 6 Defendants also object to the R&R’s conclusion that Plaintiff’s Section 15(a) claim is 7 ripe because Plaintiff’s child continues to play the NBA 2K game with a personal avatar so the 8 “initial purpose” of collection remains ongoing. Again, at the motion to dismiss stage of a case, 9 the Court accepts the allegations in a complaint as true and construes them in the light most 10 favorable to Plaintiff. DaVinci Aircraft, Inc. 926 F.3d at 1122 . In doing so, the Court finds that 11 Plaintiff adequately alleges facts for the Court to draw the reasonable inference that the “initial 12 purpose” for collecting biometric data was satisfied once it was delivered to a player’s Gaming 13 Platform. See Dkt. No. 1 ¶¶ 104–115; Dkt. No. 33 at 9. 14 Further, the Court acknowledges that there is disagreement as to whether the “when” 15 clause in Section 15(a)3 describes what a written policy should cover or is a time trigger. The 16 R&R discusses both sets of cases. Dkt. No. 31 at 16–17. In their response to Defendants’ 17 objections (Dkt. No. 33 at 9), Plaintiffs point to Fluery v. Union Pacific Railroad Company, a 18 case decided after the issuance of an R&R where a court interpreted the “when” clause “to 19 explain what the policies must describe—not to create a time frame within which [those] policies 20 must be developed.” No. C20-390, 2022 WL 1803357 , at *4 (N.D. Ill. June 2, 2022). The Court [22] 3 “A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric [23] identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever 24 occurs first.” 740 Ill. Comp. Stat. 14/15(a) (emphasis added). 1 agrees with the rationale in Fleury and interprets Section 15(a) to require the development of 2 publicly available written policy regarding the retention and destruction of biometric identifiers 3 or biometric information, at a minimum, as soon as an entity possesses the information. Id. at *4 ; 4 see also Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146 , 1149 (7th Cir. 2020) (noting 5 Section 15(a) delineates three duties: “the duties to develop, publicly disclose, and comply with 6 data retention and destruction policies” (emphasis removed)); Rogers v. CSX Intermodal 7 Terminals, Inc., 409 F. Supp. 3d 612 , 617 (N.D. Ill. 2019) (noting the Illinois Supreme Court has 8 held that “the strategy adopted by the General Assembly was to head off . . . problems before 9 they occur by imposing safeguards to insure that individuals’ and customers’ privacy rights in 10 their biometric identifiers and biometric information are properly honored and protected to begin 11 with” (citation and quotations omitted)). Any other reading simply does not make sense. 12 First, reading the “when” clause as a time trigger would contradict the proactive approach 13 to biometric data collection and retention that the General Assembly sought when it enacted 14 BIPA. Id.; see also S.B. 2400, 95th Gen. Assemb. 1532–35 (Ill. 2007) (making clear that BIPA 15 requires affirmative action by covered entities to develop policy for retention and deletion of 16 biometric information); Nseumen v. Dal Glob. Servs. Inc., No. C21-2630, 2021 WL 4728707 , at 17 *2 (N.D. Ill. Oct. 11, 2021) (an entity may not wait three years to develop a policy because “a 18 claim regarding [defendant’s] failure to establish a retention and destruction policy involves a 19 current violation, not a potential future violation” (emphasis in original)). Second, reading the 20 “when” clause to be a time trigger would subject private entities in possession of biometric 21 identifiers or information to not only keep track of their obligation to develop a written policy on 22 a rolling basis for each individual affected but also seemingly could allow an entity to constantly 23 change its policy for each individual. Defendant AWS has more than one million enterprise 24 customers who utilize its cloud storage and computing services. Dkt. No. 23 at 6, 8. The Court 1 highly doubts that AWS (or any entity subject to BIPA) would actually want to potentially 2 develop more than one million different policies and keep track of when those policies needed to 3 be issued. 4 The Court agrees with the R&R’s determination that Plaintiff’s Section 15(a) claim is 5 ripe. 6 2. Section 15(b) 7 Section 15(b) requires a person’s informed consent and release before a private entity 8 collects, purchases, receives through trade, or otherwise obtains that person’s biometric 9 identified or biometric information. 740 Ill. Comp. Stat. 14/15(b). The parties disagree whether 10 an entity must take an “active step” to collect, capture or otherwise obtain biometric information 11 (see Dkt. No. 33 at 10), and the R&R held that an active step was required. Dkt. No. 31 at 20. 12 Defendants object as to whether the R&R correctly found that they had taken any active steps. 13 The same facts that establish that Defendants did not merely passively store information4 but 14 actively possessed it also adequately show that they took active steps to otherwise obtain 15 biometric data from Plaintiff’s child, for purposes of surviving a motion to dismiss. See supra 16 Section III.B.1.a; see also Dkt. No. 31 at 20–21. 17 3. Section 15(c) 18 Section 15(c) states that “[n]o private entity in possession of a biometric identifier or 19 biometric information may sell, lease, trade, or otherwise profit from a person's or a customer's 20 biometric identifier or biometric information.” 740 Ill. Comp. Stat. 14/15(c). Defendants object 21 to the R&R crediting Plaintiff’s allegations that “Defendants somehow ‘shared’ face geometry [22] 4 The Court finds inapposite Jones v. Microsoft Corp., No. C22-3437, 2023 WL 130495 (N.D. Ill. Jan. 9, 2023), [23] which Defendants submit as supplemental authority. Dkt. No. 45. In Jones, the district court found that the defendant (Microsoft) provided only one service (storage). Jones, 2023 WL 130495 , at *4 (“Microsoft provided 24 Paychex with one component (storage) that it used as part of its system for collecting and storing biometric data.”). 1 ‘with Take-Two for a fee in order to use Defendant’s cloud computing services.’” Dkt. No. 32 at 2 13 (citing Dkt. No. 31 at 24–25). Once again, courts are supposed to accept the allegations 3 pleaded in a complaint as true and construe them in the light most favorable to the non-moving 4 party. 5 In particular, the R&R referenced Plaintiff’s allegations that “Defendants: (1) retrieve the 6 photographs from Take-Two’s servers; (2) utilize the photographs and related data to create face 7 geometry—the biometric identifier at issue in the case—on their servers; and (3) that the face 8 geometry is then shared with Take-Two for a fee in order to use Defendants’ cloud computing 9 services.” Dkt. No. 31 at 24–25. The Complaint specifically alleges that Defendants “received 10 money from Take2/2K Games to create biometric identifiers of Plaintiff and the Class 11 Members.” Dkt. No. 1 at ¶¶ 187, 224. These facts are sufficient for the Court to reasonably infer 12 that Defendants possessed biometric data and otherwise profited from that information for 13 purposes of surviving a motion to dismiss. Whether discovery will yield additional or contrary 14 facts is unknown, but the Court takes into account the limited access plaintiffs often have to 15 crucial information that may be in the sole possession of the defendant. See Braden v. Wal-Mart 16 Stores, Inc., 588 F.3d 585, 598 (8th Cir. 2009) (recognizing that “while a [claimant] must offer 17 sufficient factual allegations to show that he or she is not merely engaged in a fishing 18 expedition . . . , we must also take account of their limited access to crucial information . . . . 19 which tend systemically to be in the sole possession of defendants”); see also Khoja v. Orexigen 20 Therapeutics, Inc., 899 F.3d 988 , 998–99 (9th Cir. 2018) (describing how the asymmetry of 21 access to litigation-related information can be unfair where defendants “possess materials to 22 which the plaintiffs do not yet have access”). [24] 1 4. Section 15(d) 2 Section 15(d) prohibits a private entity “in possession of a biometric identifier or 3 biometric information” to “disclose, redisclose, or otherwise disseminate a person’s . . . 4 biometric identifier or biometric information” unless a listed exception applies, such as when the 5 subject or legally authorized representative of the biometric identifier or information “consents to 6 the disclosure or redisclosure.” 740 Ill. Comp. Stat. 14/15(d). 7 Defendants object to the R&R finding that Section 15(d) claims do not necessarily 8 require third-party disclosure and claim that “[t]here is no mention of third parties in this case.” 9 Dkt. No. 32 at 13–14. However, this completely ignores that the R&R also found that “Plaintiff 10 has alleged that Defendants disseminated the biometric information to the user’s gaming 11 platform, which would share it with Take-Two and/or the gaming platform’s servers.” Dkt. No. 12 31 at 26. In particular, the Complaint alleges that: (1) “Take 2 and/or 2K Games use 13 AWS/Amazon cloud-computing for, inter alia, servers, computing, storage, and to provide the 14 infrastructure to deliver its games to internet-connected gaming platforms” (Dkt. No. 1 ¶ 84); and 15 (2) once Defendants have used their computing power to collect facial feature vectors to 16 construct the Face Geometry of a user, “[Defendants] transmit[] the Face Geometry via 17 CloudFront . . . and deliver[] it to the user’s Gaming Platform.” Id. ¶¶ 106–07. These facts allow 18 the Court to draw the reasonable inference that Defendants disseminated Plaintiff’s biometric 19 information to a third-party.5 Plaintiff’s allegations sufficiently suggest that Defendants 20 disseminated Plaintiff’s biometric data to a third-party, which is all that Plaintiff must do to [23] 5 Defendants’ reliance on Jones for its Section 15(d) argument is again inapposite as “Jones [did] not allege that Microsoft disseminated her biometric data to any third-party data centers or any tangible third parties whatsoever.” [24] 2023 WL 130495 , at *5. 1 proceed to discovery on this claim. See Johnson v. NCR Corp., No. C22-3061, 2023 WL 2 1779774, at *5 (N.D. Ill. Feb. 6, 2023). 3 Defendants also object that “the R&R incorrectly finds that the Complaint does not 4 indicate that [Plaintiff’s child] gave consent.” Dkt. No. 32 at 14. But the Complaint alleges that 5 “[Defendants] never informed nor received consent from Plaintiff or the Class Members to 6 disclose and /or redisclose their biometric identifiers and biometric information to third parties.” 7 Dkt. No. 1 ¶¶ 198, 235. In addition, as correctly noted in the R&R, Plaintiff’s child could not 8 consent, as a minor. Dkt. No. 31 at 27. Thus, at this stage, the Court concludes that Plaintiff has 9 sufficiently pleaded a Section 15(d) claim. 10 C. The Unjust Enrichment Claim 11 Defendants object to the R&R’s conclusion that Illinois, rather than Washington, law 12 applies. Dkt. No. 32 at 15. The Court agrees with and adopts the six-page, detailed analysis 13 provided in the R&R with respect to the five factors laid out in Sections 6 and 221 of the 14 Restatement (Second) of Law on Conflict of Laws. Dkt. No. 31 at 28–33. 15 Defendants further object that Plaintiff does not plausibly allege any benefit that they 16 received from Plaintiff’s child’s data and assert that the Complaint simply recites the elements of 17 the cause of action. Dkt. No. 32 at 16 (citing only to Paragraph 241 of the Complaint). However, 18 the unjust enrichment claim starts by incorporating by reference all of previous allegations set 19 forth in the Complaint. Dkt. No. 1 ¶ 240. As Defendants point out in their motion, under Illinois 20 law, “[w]here ‘an unjust enrichment claim rests on the same improper conduct alleged in another 21 claim, . . . unjust enrichment will stand or fall with the related claim’” (Dkt. No. 18 at 22 22 (quoting Cleary v. Philip Morris Inc., 656 F.3d 511, 516 (7th Cir. 2011))); Washington law leads 23 to the same result. As Plaintiff sufficiently alleged BIPA claims, the unjust enrichment claim 24 survives, linked with the BIPA claims at this juncture. 1 Finally, Defendants assert that Plaintiff did not plausibly allege detriment because Illinois 2 law requires an economic detriment. Dkt. No. 32 at 16. But Plaintiff accurately points to at least 3 three cases where Illinois courts allowed unjust enrichment claims to proceed where no 4 economic detriment was alleged. Dkt. No. 33 at 16 (citing cases). Accordingly, the Court rejects 5 Defendants’ objection on this ground. 6 IV. CONCLUSION 7 For the foregoing reasons, the Court hereby ORDERS that: 8 (1) The Report and Recommendation (Dkt. No. 31) is ADOPTED; 9 (2) Defendants Amazon Web Services and Amazon.com Inc’s objections (Dkt. No. 10 32) are OVERRULED; 11 (3) The Clerk is DIRECTED to send a copy of this Order to counsel and to Judge 12 Peterson. [13] 14 Dated this 31st day of March 2023. [15] A [16] Tana Lin United States District Judge