Cheryl Doyle v. Louis Vuitton North America, Inc.

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK -------------------------------------- X : PAULA THERIOT and CHERYL DOYLE, : individually and on behalf of all : others similarly situated, : 22cv2944 (DLC) : Plaintiffs, : OPINION AND ORDER : -v- : : LOUIS VUITTON NORTH AMERICA, INC., : : Defendant. : : -------------------------------------- X APPEARANCES: For plaintiffs Paula Theriot and Cheryl Doyle, individually and on behalf of all others similarly situated: Adam J. Levitt Amy E. Keller Nada Djordjevic James A. Ulwick Sharon Cruz DiCello Levitt LLC Ten North Dearborn Street, 6th Floor Chicago, IL 60602 David A. Straite DiCello Levitt LLC 485 Lexington Avenue, 10th Floor New York, NY 10017 James J. Pizzirusso Hausfeld LLP 888 16th Street, NW, Suite 300 Washington, DC 20006 Steven M. Nathan Hausfeld LLP 33 Whitehall Street, 14th Floor New York, NY 10004 For defendant Louis Vuitton North America, Inc.: Robert E. Shapiro Barack, Ferrazzano, Kirschbaum, Perlman & Nagelberg, LLP 200 W. Madison, Suite 3900 Chicago, IL 60606 DENISE COTE, District Judge: Paula Theriot and Cheryl Doyle bring this case under the Illinois Biometric Information Privacy Act (“BIPA”) on behalf of themselves and others similarly situated. Defendant Louis Vuitton North America, Inc. (“LVNA”) has moved to dismiss the complaint in its entirety pursuant to Rules 12(b)(1) and 12(b)(6), Fed. R. Civ. P. For the following reasons, the motion is granted in part. Background The following facts are taken as true from the first amended complaint (“FAC”). LVNA is an international luxury brand that sells various products including eyewear. On its website, a consumer can see how a particular pair of glasses would look on their face using the website’s “Virtual Try-On” feature. When a user of the website clicks the “Try On” button of a particular pair of glasses, the website activates the Virtual Try-On tool. This feature automatically activates the customer’s computer or phone camera to show a live image of the customer “wearing” the selected glasses. In addition to the real-time option for “trying on” eyewear, customers may upload a photograph of their face. Through this photo-upload option, the Virtual Try-On tool again places the pair of glasses in the correct place on the user’s photograph. The Virtual Try-On tool operates through an application created by a company called FittingBox, which is not a party in this case. LVNA’s website incorporates FittingBox’s proprietary technology to collect and process a user’s facial geometry. A user’s facial geometry data is extracted, combined with data necessary to show the glasses on the user’s face, repackaged, and then sent back to the user’s device. Through use of this technology, LVNA collects detailed biometric data including complete facial scans of the users of the Virtual Try-On tool. LVNA does not inform its users that the Virtual Try-On tool will collect or store their facial geometry. LVNA also does not obtain the users’ consent to collect or store this data. Finally, LVNA does not have a publicly available written policy setting out a retention schedule and guidelines for destroying any biometric identifiers or information after the initial purpose for collecting them has ended. Plaintiff Cheryl Doyle accessed the LVNA website once between November and December of 2021 and “tried on” pairs of sunglasses using the real-time Virtual Try-On tool. Plaintiff Paula Theriot used the LVNA website four times between November and December of 2021 using both the real-time and picture-upload versions of the Virtual Try-On feature. The plaintiffs filed their complaint on April 8, 2022, asserting two causes of action for breach of §§ 15(a) and 15(b) of BIPA.1 They filed the FAC on July 8. On August 17, the case was reassigned to this Court. The defendant filed this motion to dismiss on August 22. The motion became fully submitted on September 23. Discussion Plaintiff brings claims under BIPA §§ 15(a) and 15(b). Section 15(a) provides: A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever occurs first. 1 Subject matter jurisdiction is premised on the Class Action Fairness Act, 28 U.S.C. § 1332 (d). The FAC alleges that at least some plaintiffs are diverse from the defendant, there are at least 100 putative class members, and the combined claims of the class members exceed $5,000,000, exclusive of costs and interest. 740 Ill. Comp. Stat. 14/15(a) (2008) (emphasis supplied). Section 15(b) provides: No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s biometric identifier or biometric information, unless it first: (1) informs the subject or the subject’s legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored; (2) informs the subject or the subject’s legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and (3) receives a written release executed by the subject of the biometric identifier or biometric information or the subject’s legally authorized representative. Id. § 15(b) (emphases supplied). As explained below, defendant’s motion to dismiss plaintiffs’ § 15(a) claim is granted. Its motion to dismiss the § 15(b) claim is denied. I. Section 15(a) Defendant challenges plaintiffs’ § 15(a) claim under Rule 12(b)(1), Fed. R. Civ. P., arguing that the plaintiffs lack Article III standing for the claim and therefore the Court lacks subject matter jurisdiction. When a challenge to subject matter jurisdiction is addressed to the complaint and premised on lack of Article III standing, “[t]he task of the district court is to determine whether the [p]leading alleges facts that affirmatively and plausibly suggest that the plaintiff has standing to sue.” Carter v. HealthPort Techs., LLC, 822 F.3d 47, 56 (2d Cir. 2016) (citation omitted). The irreducible minimum of Article III standing contains three elements. Dubuisson v. Stonebridge Life Ins. Co., 887 F.3d 567, 573 (2d Cir. 2018). The plaintiff must have “(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Melito v. Experian Mktg. Sols., Inc., 923 F.3d 85, 92 (2d Cir. 2019) (citation omitted). As the party invoking federal jurisdiction, the plaintiff bears the burden of establishing these elements “for each claim he seeks to press and for each form of relief that is sought.” Keepers, Inc. v. City of Milford, 807 F.3d 24, 42 (2d Cir. 2015) (citation omitted). Only the injury-in-fact prong of the standing inquiry is in dispute here. To be sufficient for Article III standing, an injury in fact must be “concrete” and “particularized.” Harty v. W. Point Realty, Inc., 28 F.4th 435, 442 (2d Cir. 2022). “Particularized injuries affect the plaintiff in a personal and individual way.” Id. (citation omitted). “Concrete injuries are physical, monetary, or cognizable intangible harms traditionally recognized as providing a basis for a lawsuit in American courts.” Id. at 442-43 (citation omitted). Two recent opinions from the Seventh Circuit are useful in analyzing the injury-in-fact prong of standing under §§ 15(a) and 15(b). In Bryant v. Compass Group USA, Inc., the Seventh Circuit held that “a failure to follow section 15(b) of the law leads to an invasion of personal rights that is both concrete and particularized.” 958 F.3d 617, 619 (7th Cir. 2020). In the same case, however, the court held that the plaintiff lacked standing to pursue her § 15(a) claim because she alleged only a claim under the provision of that section requiring development of a written policy, made available to the public, rather than the provision requiring compliance with that policy. See id. at 626. Since the duty to develop and disclose the policy is “owed to the public generally, not to particular persons whose biometric information the entity collects,” the court held that the plaintiff had not alleged a particularized injury sufficient for Article III standing. Id. By contrast, in Fox v. Dakkota Integrated Systems, LLC, the Court of Appeals held that the plaintiff did have standing to pursue a § 15(a) claim. 980 F.3d 1146 (7th Cir. 2020). Unlike in Bryant, the plaintiff in Fox did “not allege a mere failure to publicly disclose a data-retention policy.” Id. at 1154 . Instead, she accused the defendant “of violating the full range of its section 15(a) duties by failing to develop, publicly disclose, and comply with a data-retention schedule and guidelines.” Id. Specifically, plaintiff alleged that her employer required her and other employees to clock in and out of work by scanning their hands on a biometric timekeeping device. Id. at 1149 . She also alleged that the defendant retained her biometric information after she stopped working for the defendant. Id. at 1150 . The plaintiff’s allegations that the defendant unlawfully retained her biometric data were sufficient to allege an injury in fact for standing purposes. Id. at 115456. Here, the plaintiffs’ § 15(a) claim falls on the Bryant side of the framework. Plaintiffs’ § 15(a) claim is expressly based on the “failure to develop and make publicly available a written policy for retention and destruction of biometric identifiers,” rather than on the unlawful retention of data after the initial purpose for collecting the data had been satisfied. As the court held in Bryant, because the duty to develop and disclose a retention policy is owed to the public generally, plaintiffs have failed to allege a particularized harm sufficient for Article III standing. Plaintiffs attempt to recast their § 15(a) claim to analogize the case to Fox, but this attempt fails. Plaintiffs argue that the FAC alleges that plaintiffs suffered a particularized harm caused by LVNA’s failure not only to publish a retention policy, but also, “by implication,” to comply with such a policy. There are no allegations in the FAC, however, that LVNA unlawfully retained the plaintiffs’ data after the initial purpose for collection had ended. Here, the allegations in the FAC are directed to LVNA’s alleged failure to develop and publish data retention and destruction policies. Plaintiffs also point to two allegations in the FAC that they contend show injuries in fact for the § 15(a) claim. The first allegation states that the “failure to develop” the required policies put plaintiffs’ “biometric identifiers at risk of compromise or illicit use.” This injury, however, is expressly connected to the failure to develop the policies, not the failure to comply with them. There is, as explained above, no allegation in the FAC that LVNA unlawfully retained the biometric data after its initial purpose had been served. The second allegation states that plaintiffs’ injury includes “the unknowing loss of control of their most unique biometric identifiers, and violations of their privacy.” But any such harm is relevant to § 15(b)’s informed consent regime, not § 15(a)’s retention policy regime. See Bryant, 958 F.3d at 620, 626-27 (holding that the “loss of the right to control” biometric identifiers and information was an injury in fact for a § 15(b) claim, but that plaintiff still lacked standing for a § 15(a) claim). Accordingly, plaintiffs have not alleged an injury in fact sufficient to confer Article III standing for their § 15(a) claim, and the claim is dismissed. II. Section 15(b) Defendant moves to dismiss the plaintiffs’ § 15(b) claims under Rule 12(b)(6), Fed. R. Civ. P., arguing that the FAC fails to state a claim for relief. Defendant’s motion to dismiss plaintiffs’ § 15(b) claim is denied. To survive a motion to dismiss for failure to state a claim, the complaint “must plead enough facts to state a claim to relief that is plausible on its face.” Green v. Dep’t of Educ. of City of New York, 16 F.4th 1070 , 1076–77 (2d Cir. 2021) (citation omitted). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Charles v. Orange Cnty., 925 F.3d 73, 81 (2d Cir. 2019) (citation omitted). “In determining if a claim is sufficiently plausible to withstand dismissal,” a court “accept[s] all factual allegations as true” and “draw[s] all reasonable inferences in favor of the plaintiffs.” Melendez v. City of New York, 16 F.4th 992, 1010 (2d Cir. 2021) (citation omitted). A court “must dismiss a claim if a plaintiff pleads [herself] out of court by alleging facts which show that [she] has no claim.” Soto v. Disney Severance Pay Plan, 26 F.4th 114, 120 (2d Cir. 2022) (citation omitted). Under § 15(b), no private entity may collect a customer’s biometric identifier or biometric information unless it (1) provides written notice of the collection, the purpose of the collection, and the length of the term for the collection, and (2) receives a written release authorizing the collection. 740 Ill. Comp. Stat. 14/15(b) (2008). The statute defines “biometric identifier” as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” Id. § 10. Photographs are excluded from the definition of biometric identifier. Id. Courts have held, however, that facial scans derived from photographs can constitute biometric identifiers within the meaning of BIPA. See, e.g., Sosa v. Onfido, Inc., -- - F. Supp. 3d ---, 2022 WL 1211506 , at *9 (N.D. Ill. 2022) (collecting cases). BIPA does not define “collect,” but courts have held that collection requires more than mere possession. These courts also have held that for an entity to “collect” biometric data, it must take an “active step” towards that collection. See, e.g., Naughton v. Amazon.com, Inc., No. 20-cv6485, 2022 WL 19324 , at *3 (N.D. Ill. Jan. 3, 2022); Jacobs v. Hanwha Techwin Am., Inc., No. 21 C 866, 2021 WL 3172967 , at *2-3 (N.D. Ill. July 27, 2021); Namuwonge v. Kronos, Inc., 418 F. Supp. 3d 279 , 286 (N.D. Ill. Nov. 22, 2019). Here, plaintiffs allege that LVNA violated § 15(b) through its Virtual Try-On tool. The plaintiffs assert that LVNA encourages its website visitors to use the Virtual Try-On tool, through which it collects their facial geometry. The plaintiffs’ allegations are sufficient to survive a motion to dismiss. Defendant offers two arguments in support of its motion to dismiss the § 15(b) claim, but each fails. First, defendant argues that plaintiffs have pleaded themselves out of court by alleging that the Virtual Try-On tool is powered by FittingBox, who is not a party to this litigation. Specifically, defendant argues that the FAC proves that it is FittingBox, not LVNA, who “collects” biometric identifiers. Not so. To be sure, the FAC contains allegations suggesting that FittingBox created the relevant technology and may even have a role in extracting the facial scans from the users’ images. But this does not mean that it fails to allege that LVNA collects those scans. The FAC alleges that “LVNA collects detailed and sensitive biometric identifiers and information, including complete facial scans, of its users through the Virtual Try-On tool.” It also alleges that LVNA takes active steps to collect users’ facial scans using this technology, such as inviting users to take advantage of the Virtual Try-On tool. At bottom, the precise roles of LVNA and FittingBox and the precise kinds of data each receives are factual questions to be resolved later in the litigation. At this time, the plaintiffs’ allegations that LVNA collects facial scans of its users through the Virtual Try-On tool on its website must be credited. Second, defendant argues that plaintiffs cannot bring a claim under BIPA because the events giving rise to the litigation did not occur “primarily and substantially” in Illinois. Under Illinois law, “a statute is without extraterritorial effect unless a clear intent in this respect appears from the express provisions of the statute.” Avery v. State Farm Mut. Auto Ins. Co., 835 N.E.2d 801, 852 (Ill. 2005) (citation omitted).2 In the absence of such an intent, a plaintiff may maintain a cause of action under an Illinois 2 The plaintiff in Avery brought a claim under the Consumer Fraud and Deceptive Business Practices Act, 815 Ill. Comp. Stat. 505/2 (1998). Avery, 835 N.E.2d at 835 . Courts have applied the extraterritoriality rules articulated in Avery to other statutes, including BIPA. See, e.g., Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1100-01 (N.D. Ill. 2017). Neither party disagrees that the rule should apply here. statute only if the events giving rise to the action occurred “primarily and substantially” within Illinois. Id. at 853. Here, the plaintiffs allege that they are Illinois residents who used the Virtual Try-On tool while in Illinois. They allege that they did not receive the proper disclosures or provide the requisite consent for collection of their facial geometry when they accessed the LVNA website in Illinois. Additionally, there is no indication from the FAC that other events relevant to the action occurred primarily in another location. Thus, there is no basis, at this stage, to dismiss the claim on extraterritoriality grounds. See Rivera, 238 F. Supp. 3d at 1101-02 ; see also Patel v. Facebook, Inc., 932 F.3d 1264, 1276 (9th Cir. 2019) (“[I]t is reasonable to infer that the General Assembly contemplated BIPA’s application to individuals who are located in Illinois, even if some relevant activities occur outside the state.”). Conclusion The defendant’s August 22 motion to dismiss the § 15(a) claim is granted. The defendant’s motion to dismiss the § 15(b) claim is denied. Dated: New York, New York December 5, 2022 ENISE COTE United States District Judge