United States District Court, N.D. Illinois, Eastern Division
ALEJANDRO MONROY, on behalf of himself and all others similarly situated, Plaintiffs,
SHUTTERFLY, INC., Defendant.
MEMORANDUM OPINION AND ORDER
B. GOTTSCHALL, UNITED STATES DISTRICT JUDGE.
Monroy (“Monroy”) brings this putative class
action alleging that defendant Shutterfly, Inc.
(“Shutterfly”) violated Illinois' Biometric
Information Privacy Act (BIPA), 740 Ill. Comp. Stat. 14/1
et seq. Shutterfly has moved to dismiss the
complaint on several grounds. For the reasons discussed
below, the motion is denied.
is the operator of websites that allow users to upload,
organize, and share digital photographs. When a user uploads
a photo, Shutterfly's facial recognition software scans
the image, locates each of the faces in the image, and
extracts a highly detailed “map” or
“template” for each face based on its unique
points and contours. According to the complaint, a person can
be uniquely identified by his face geometry in the same way
that he can be identified by his fingerprints. Compl. ¶
complaint further alleges that Shutterfly stores these maps
of face geometry in a massive database, and that whenever a
new image is uploaded onto Shutterfly's site, the faces
in the image are compared against those in the database. If a
face's geometry matches that of an individual already in
its database, Shutterfly suggests that the user
“tag” the image with the individual's name.
Id. ¶ 23. If no match is found, Shutterfly
prompts the user to enter a name. Id.
alleges that in September 2014, an unnamed Shutterfly user
residing in Chicago uploaded a photograph of Monroy onto a
Shutterfly site. According to the complaint,
“Shutterfly automatically located Plaintiff's face,
analyzed the geometric data relating to the unique contours
of his face and the distances between his eyes, nose and
ears, and used that data to extract and collect
Plaintiff's scan of face geometry.” Id.
¶¶ 29-30. Monroy further says that Shutterfly
prompted the uploader to tag the face with a name, and that
the user entered “Alex Monroy.” The complaint
also states that Shutterfly then stored Monroy's
biometric data in its database, and that based on the scan,
it extracted and stored additional information regarding his
gender, age, race, and geographical location. Id.
¶ 32. Monroy does not use Shutterfly and never consented
to Shutterfly's extraction and storage of data
representing his face geometry. Id. ¶¶
to Monroy, Shutterfly's collection and storage of this
data violates BIPA. Passed in 2008, BIPA was the first law in
the nation to address the collection and storage of biometric
data. The legislative findings that precede the
statute's substantive provisions observe that the
“use of biometrics is growing in the business and
security screening sectors and appears to promise streamlined
financial transactions and security screenings.” 740
Ill. Comp. Stat. 14/5(a). However, the legislature also notes
that the “overwhelming majority of members of the
public are weary of the use of biometrics when such
information is tied to finances and other personal
information.” Id. § 14/5(d). This is
because, unlike social security numbers and other personal
information, biometrics “are biologically unique to the
individual … [so that] once compromised, the
individual has no recourse, [and] is at heightened risk for
identity theft.” Id. § 14/5(c).
other things, BIPA requires private entities in possession of
biometric data to develop publicly available written policies
containing guidelines for permanently destroying the data
within a specific time period. Id. § 14/15(a).
In addition, BIPA prohibits private entities from collecting,
capturing, or otherwise obtaining an individual's
biometric data without first informing him or her in writing,
and disclosing the specific purpose and length of time for
which the data is being collected and stored. Id.
§ 14/15(b)(1)-(2). Entities are prohibited from
collecting and storing a person's biometric data unless
he or she first executes a written release. Id.
brings this suit on behalf of himself and a putative class
consisting of “[a]ll individuals who are not users of
Shutterfly and who had their biometric identifier, including
scan of face geometry, collected, captured, received, or
otherwise obtained by Shutterfly from a photograph uploaded
to Shutterfly's website from within the state of
Illinois.” Compl. ¶ 36. Shutterfly moves to
dismiss under Federal Rule of Civil Procedure 12(b)(6).
considering a Rule 12(b)(6) motion to dismiss, the Court
accepts as true all well-pleaded facts in the complaint and
draws all reasonable inferences from those facts in the
plaintiff's favor.” United States Sec. &
Exch. Comm'n v. Ustian, 229 F.Supp.3d 739, 760 (N.D.
Ill. 2017) (citing AnchorBank, FSB v. Hofer, 649
F.3d 610, 614 (7th Cir. 2011)). Shutterfly claims that
Monroy's complaint must be dismissed because: (1)
BIPA's statutory text makes clear that it does not apply
to scans of face geometry obtained from photographs; (2)
Monroy's suit requires an impermissible extraterritorial
application of the statute; and (3) BIPA requires a plaintiff
to allege actual damages, and Monroy has failed to do so. The
court considers these arguments seriatim.
BIPA's Application to Scans from Photographs
first contends that BIPA's statutory text demonstrates
that the act does not apply to biometric data obtained from
photographs. Its argument is based on the statute's
definitions of the terms “biometric identifier”
and “biometric information, ” which are as
“Biometric identifier” means a retina or iris
scan, fingerprint, voiceprint, or scan of hand or face
geometry. Biometric identifiers do not include writing
samples, written signatures, photographs, human biological
samples used for valid scientific testing or screening,
demographic data, tattoo descriptions, or physical
descriptions such as height, weight, hair color, or eye
color. Biometric identifiers do not include donated organs,
tissues, or parts as defined in the Illinois Anatomical Gift
Act or blood or serum stored on behalf of recipients or
potential recipients of living or cadaveric transplants and
obtained or stored by a federally designated organ
procurement agency. Biometric identifiers do not include
biological materials regulated under the Genetic Information
Privacy Act. Biometric identifiers do not include information
captured from a patient in a health care setting or
information collected, used, or stored for health care
treatment, payment, or operations under the federal Health
Insurance Portability and Accountability Act of 1996.
Biometric identifiers do not include an X-ray, roentgen
process, computed tomography, MRI, PET scan, mammography, or
other image or film of the human anatomy used to diagnose,
prognose, or treat an illness or other medical condition or
to further validate scientific testing or screening.
“Biometric information” means any information,
regardless of how it is captured, converted, stored, or
shared, based on an individual's biometric identifier
used to identify an individual. Biometric information does
not include information derived from items or procedures
excluded under the definition of biometric identifiers.
740 Ill. Comp. Stat. 14/10.
clear that the data extracted from Monroy's photograph
cannot constitute “biometric information” within
the meaning of the statute: photographs are expressly
excluded from the definition of “biometric identifier,
” and the definition of “biometric
information” expressly excludes “information