Opinion
22 CV 1284
02-26-2024
KRISTEN DEYERLER, et al., Plaintiffs v. HIREVUE, INC., Defendant
MEMORANDUM ORDER
JEREMY C. DANIEL, United States District Judge
Six Illinois residents filed this putative class action alleging that HireVue, Inc. (“HireVue”), a Utah-based software vendor, violated the Illinois Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/1, et seq., when its interactive software captured and collected their biometric information during virtual job interviews. HireVue now moves to dismiss the plaintiffs' first amended complaint under Federal Rules of Civil Procedure 12(b)(2) and 12(b)(6). (R. 48.) For the reasons set forth in this opinion, the motion is granted in part and denied in part.
The plaintiffs' full names are Kristen Deyerler, Max Ellithorpe, Bryen Zimmerman, Christopher Coats, Nicolas Galindo, and William Phemister. (See generally R. 17 (“FAC”).)
BACKGROUND
HireVue is a Delaware corporation based in Utah that develops and markets software to assess job applicants' performance during virtual interviews. (FAC ¶¶ 16, 19.) HireVue sells its software to employers-including companies headquartered in Illinois-who are looking to fill job openings. (Id. ¶ 20.) HireVue's software allows customers to record video interviews with potential candidates and analyze their performance with artificial intelligence. (Id. ¶ 19.) Each recorded interview yields “thousands of data points” that are used to assess candidates' cognitive ability, personality traits, emotional intelligence, and social aptitude. (Id. ¶ 21.)
The plaintiffs are six Illinois residents who allege that HireVue captured and collected their biometric identifiers when they used HireVue's platform to interview for positions in Illinois. (See generally id.) They filed this putative class action alleging that HireVue's actions violate subsections 15(a), (b), (c), and (d) of the BIPA. (See FAC.) HireVue now moves to dismiss the first amended complaint in its entirety under Federal Rules of Civil Procedure 12(b)(2) and 12(b)(6). (R. 48.)
LEGAL STANDARD
A motion to dismiss under Rule 12(b)(2) tests whether a federal court has personal jurisdiction over a defendant. Curry v. Revolution Labs., LLC, 949 F.3d 385, 392 (7th Cir. 2020). Although a plaintiff need not allege personal jurisdiction in their complaint, they bear the burden of establishing it once a defendant moves to dismiss under Rule 12(b)(2). Id. at 392. At the pleading stage, a plaintiff only needs to establish a prima facie case for personal jurisdiction to proceed. uBID, Inc. v. GoDaddy Grp., Inc., 623 F.3d 421, 423 (7th Cir. 2010). The plaintiff “is entitled to the resolution in its favor of all disputes concerning relevant facts presented in the record.” Purdue Rsch. Found. v. Sanofi-Synthelabo, S.A., 338 F.3d 773, 782 (7th Cir. 2003) (citation and quotation marks omitted). The Court may weigh declarations submitted by the parties in evaluating whether the plaintiff has established its prima facie case. Curry, 949 F.3d at 393.
A Rule 12(b)(6) motion to dismiss for failure to state a claim, “test[s] the sufficiency of the complaint, not the merits of the case.” Gociman v. Loyola Univ. of Chi., 41 F.4th 873, 885 (7th Cir. 2022). To survive a Rule 12(b)(6) motion, a complaint must “state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). The complaint must put the defendants on “fair notice of what the . . . claim is and the grounds upon which it rests.” Twombly, 550 U.S. at 555 (citation omitted).
ANALYSIS
I. HireVue' s Rule 12(b)(2) Motion
The Court first addresses HireVue's motion to dismiss for lack of personal jurisdiction. In a diversity action under Illinois law, personal jurisdiction is permitted to the extent allowed by due process. Bristol Meyers v. Super. Ct., 137 S.Ct. 1773, 1779 (2017); Rogers v. City of Hobart, 996 F.3d 812, 818 (7th Cir. 2021). Federal law recognizes both general and specific personal jurisdiction. General personal jurisdiction exists over a defendant who has “continuous and systematic” contacts with the forum state and is “essentially at home” there. Daimler AG v. Bauman, 571 U.S. 117, 119 (2014). By contrast, specific personal jurisdiction may be exercised only when (1) the defendant purposefully directs its activities at the forum state or conducts business in that state, and (2) the alleged injury “arise[s] out of or relate[s] to the defendant's contacts” with the forum. Tamburo v. Dworkin, 601 F.3d 693, 702 (7th Cir. 2010). In this case, the parties do not dispute that Illinois lacks general personal jurisdiction over HireVue; the relevant question is whether the Court may exercise specific personal jurisdiction over the company.
The Court has subject matter jurisdiction over this action under 28 U.S.C. § 1332(d), et seq.
In support of its Rule 12(b)(2) motion, HireVue submitted the unrebutted declarations of its former Senior Vice President of Product, Richard Simmons, and its Chief Financial Officer, Kevin Coombs. (See R. 57-1 (“Simmons Decl.”); R. 57-2 (“Coombs Decl.”).)
The Simmons declaration provides an overview of HireVue's software platform and its relationship to the plaintiffs' individual allegations. (See generally Simmons Decl.) Simmons states that HireVue provides its customers with an “out-of-the-box” interview platform, which employers can customize and configure to fit their needs. (Simmons Decl. ¶ 6.) Interview applicants' data are collected and analyzed with “HireVue Assessments,” an “optional add-on component” to HireVue's basic software package. (Simmons Decl. ¶¶ 9-16.) Simmons states that most of HireVue's customers do not use the HireVue Assessments technology and represents that only one of the plaintiffs-Max Ellithorpe-was interviewed using this technology. (Id. ¶¶ 16, 29) Simmons also states that HireVue Assessments was not developed in Illinois and no team in Illinois was involved in its creation. (Id. ¶ 18.)
The Coombs declaration provides an overview of HireVue's corporate operations and presence in Illinois. (See generally Coombs Decl.) Coombs states that HireVue has no meaningful corporate presence in Illinois and does not market its technology to individual residents of the state. (Coombs Decl. ¶¶ 4-5, 8.) He states that HireVue does not control over where its customers deploy its software. (Id. ¶ 9.) Coombs concedes, however, that HireVue employs eight individuals who reside in Illinois. (Id. ¶ 11.) He further states that HireVue is party to a service agreement with Blue Cross and Blue Shield of Illinois, one of the “operating divisions” of Health Care Service Corporation (“HCSC”), the company that Ellithorpe interviewed with. (Id. ¶¶ 13-16.) In its briefing, HireVue admits that HCSC is headquartered in Chicago, Illinois. (R. 49 at 12.)
Accepting the information in the declarations as true, the Court finds that the plaintiffs have met their burden of establishing a prima facie case for exercising specific personal jurisdiction. The plaintiffs have alleged-and HireVue does not dispute-that HireVue intentionally caused its biometric software to be marketed and sold to at least one company headquartered in Illinois and that this software was used to capture at least one of the plaintiff's biometric identifiers. (See generally FAC.) These facts are sufficient to establish that HireVue “purposefully availed itself of the Illinois market.” GoDaddy, 623 F.3d at 429. In the retail context, the Seventh Circuit has held that a single online sale of a tangible product to a customer in Illinois is sufficient to establish personal jurisdiction over a retailer. NBA Props., Inc. v. HANWJH, 46 F.4th 614, 624 (7th Cir. 2022), cert. denied, 143 S.Ct. 577 (2023). It follows that a sale of an interactive software product to a single customer in Illinois that is used by the customer to capture Illinois residents' biometric data may be sufficient to establish specific personal jurisdiction as well. See King v. PeopleNet Corp., 21 C 2774, 2021 WL 5006692, at *6 (N.D. Ill. Oct. 28, 2021) (finding that a third-party software vendor's contracts with Illinois-based companies who mandated that their staff use its biometric technology were sufficient to establish minimum contacts).
HireVue cites several cases for the proposition a third party's contacts with a forum state may not be imputed to an out-of-state technology vendor simply because the vendor and the third party contracted with each other. (See R. 49 at 13 (citing Salkauskaite v. Sephora USA, Inc., No. 18 C 8507, 2020 WL 2796122 (N.D. Ill. May 30, 2020); Bray v. Lathem Time Co., No. 19 C 3157, 2020 WL 1492742 (C.D. Ill. Mar. 27, 2020)); R. 50 (citing Redd v. Amazon Web Servs., Inc., 22 C 6779, 2023 WL 3505264, at *3 (N.D. Ill. May 17, 2023)).) HireVue argues that the plaintiffs similarly attempt to impute HCSC's contacts with Illinois to HireVue, even though it had no intention of targeting the forum state.
As the plaintiffs point out, however, the cases that HireVue cites are distinguishable because they involved allegations that the technology at issue was deployed in the forum state without the defendants' knowledge. (See R. 51 at 13.) Here, HireVue admits that it knowingly executed a service agreement with an Illinois headquartered company, and that company used HireVue's artificial intelligence software to interview one of the plaintiffs in Illinois. (Coombs Decl. ¶ 16; Simmons Decl. ¶ 29.) These allegations are sufficient to establish that HireVue “purposefully directed” activity at Illinois. Tamburo, 601 F.3d at 702; see also Redd, 2023 WL 3505264 at *3 (“It is possible for a defendant to establish the requisite contacts via a third party so long as the defendant itself targets the forum.”).
HireVue also suggests that, because Ellithorpe is the only plaintiff who was interviewed by an Illinois-based company, the other plaintiffs cannot establish personal jurisdiction. (R. 49 at 12 (“Because Ellithorpe is the sole Plaintiff who interacted with the relevant technology, he is the only one who could, in theory, establish personal jurisdiction.”).) While the personal jurisdiction analysis is “plaintiff-specific,” Arnold v. Goldstar Fin. Sys., Inc., No. 01 C 7694, 2002 WL 1941546, at *3 (N.D. Ill. Aug. 22, 2002) (Phillips Exeter Acad. v. Howard Phillips Fund, Inc., 196 F.3d 284, 289 (1st Cir.1999)), “a strict causal relationship between the defendant's in-state activity and the litigation” is not required. Ford Motor Co. v. Mont. Eighth Jud. Dist. Ct., 141 S.Ct. 1017, 1026 (2021). Instead, to establish personal jurisdiction for each of the plaintiffs' claims, the claims need only “arise out of or relate to the defendant's contacts with the forum.” Id. (emphasis added). Although “not just any relationship will suffice,” due process is satisfied when there is a sufficiently close nexus between “the defendant, the forum[s], and the litigation.” Dzananovic v. Bumble, Inc., 21 C 6925, 2023 WL 4405833, at *5 (N.D. Ill. July 7, 2023) (quoting NBA Props., 46 F.4th at 626 n.18).
Here, all six of the plaintiffs allege that they interviewed for positions in Illinois using a software that HireVue marketed and sold to at least one company headquartered in Illinois. (See generally FAC.) Moreover, they each allege that they were physically located in Illinois when they interacted with HireVue's online software platform. (See generally id.) These allegations are sufficient to establish adequate connections between HireVue and the forum state as to each of the plaintiffs' claims.
In sum, the Court concludes that the plaintiffs have met their burden of making “a threshold showing of minimum contacts” with Illinois. Curry, 949 F.3d at 402 (citation omitted). To rebut this prima facie showing, Hirevue must present compelling reasons why haling it into court here offends traditional notions of fair play and substantial justice. Id. HireVue has not pointed to any reason why litigating its claims in Illinois would be unreasonable or unfair. (See generally R. 49.) Accordingly, the Court concludes that it may exercise specific personal jurisdiction over HireVue and denies the defendant's Rule 12(b)(2) motion.
II. HireVue' s Rule 12(b)(6) Motion
The Court next turns to HireVue's Rule 12(b)(6) motion. Unlike a motion to dismiss for lack of personal jurisdiction, a Rule 12(b)(6) motion is limited in scope to the sufficiency of the allegations set forth in the complaint. Geinosky v. City of Chi., 675 F.3d 743, 745 n.1 (7th Cir. 2012). This means that while the Simmons and Coombs declarations were properly considered in the context of HireVue's Rule 12(b)(2) motion, they are inappropriate to consider in ruling on its Rule 12(b)(6) motion. Burlingham v. U.S. Dep't of Health & Hum. Servs., No. 22 C 1134, 2023 WL 6390798, at *4 (E.D. Wis. Sept. 30, 2023) (ignoring declaration submitted in support of Rule 12(b)(2) motion in deciding parallel Rule 12(b)(6) motion); JT's Frames, Inc. v. Casares, 16 C 2504, 2018 WL 835225, at *6 (N.D. Ill. Feb. 13, 2018) (same). The Court therefore ignores the factual contentions set forth in the Simmons and Coombs declarations and considers only the allegations in the first amended complaint in deciding HireVue's 12(b)(6) motion.
HireVue raises several arguments in support of dismissal under Rule 12(b)(6). First, it argues that the plaintiffs' allegations constitute an extraterritorial application of the BIPA. (R. 49 at 14-15.) Second, it argues that, under principles of statutory interpretation, the plaintiffs' claims fall outside of the scope of the statute, are foreclosed by other legislative enactments, or are subject to exemptions. (Id. at 15-24.) Finally, it argues that the allegations fail to state a claim. (Id. at 24-27.) The Court addresses each argument in turn. Because many of HireVue's arguments are fact-specific, the Court declines to decide their merits prior to summary judgment.
A. Extraterritoriality
First, HireVue argues that the plaintiffs' BIPA claims violate Illinois' extraterritoriality doctrine. (R. 49 at 14-15.) Under this doctrine, a statute that does not clearly contemplate extraterritorial effect cannot be applied unless “the circumstances that relate to the disputed transaction occur primarily and substantially in Illinois.” Avery v. State Farm Mut. Auto. Ins. Co., 835 N.E.2d 801, 854 (Ill. 2005). Courts have recognized that, in the context of BIPA claims, extraterritoriality “is a highly fact-based analysis that is generally inappropriate for the motion to dismiss stage.” Vance v. Int'l Bus. Mach. Corp., No. 20 C 577, 2020 WL 5530134, at *3 (N.D. Ill. Sept. 15, 2020) (collecting cases).
HireVue cites Neals v. PAR Technology Corporation, in which the district court dismissed the plaintiff's BIPA claims because she did not allege whether she was in Illinois when the defendant scanned her fingerprints. 419 F.Supp.3d 1088, 1091 (N.D. Ill. 2019). Here, by contrast, the plaintiffs allege that they accessed HireVue's interview platform while they were in Illinois through the use of a webcam. (See FAC ¶¶ 30, 35, 40, 45, 50, 57.) While HireVue disputes the veracity of these allegations and represents that any biometric data collected was stored outside of Illinois, at this stage the Court is bound to draw all factual inferences in the plaintiffs' favor. Vesuvius USA Corp. v. Am. Com. Lines LLC, 910 F.3d 331, 333 (7th Cir. 2018). The Court declines to rule on HireVue's extraterritoriality arguments until a record has been developed. Accordingly, the Court denies its Rule 12(b)(6) motion on this basis.
B. Statutory Interpretation Arguments
Next, HireVue raises several statutory interpretation arguments, arguing that the plaintiffs' claims are either not covered by the BIPA, are foreclosed by other legislation, or are subject to exemptions.
First, HireVue argues that the plaintiffs have failed to allege that their facial scans are “biometric identifiers” under the BIPA. This argument is undermined by the plain language of the BIPA, however, which defines “biometric identifiers” to include, among other things, “face geometry.” 740 ILCS 14/10. The first amended complaint alleges that HireVue used “facial expression and screening technology . . . to identify and assess candidates by collecting their facial geometry.” (FAC ¶ 22.) These allegations are all that is needed at the pleading stage. See Wilk v. Brainshark, Inc., 21 C 4794, 2022 WL 4482842, at *5 (N.D. Ill. Sept. 27, 2022) (denying motion to dismiss BIPA claims based on the statutory definition of “biometric identifiers” where plaintiff alleged that facial features in sales professionals' videos were analyzed and collected through facial-mapping technology).
Second, HireVue argues that the plaintiffs' BIPA claims are precluded by Illinois' Artificial Intelligence Video Interview Act (“AIVIA”), 820 ILCS 42/1 et seq. HireVue appeals to the principle that “where two statutes appear to be in conflict, the more specific controls over the more general.” State v. Mikusch, 562 N.E.2d 168, 173 (Ill. 1990). Because the AIVIA specifically regulates the use of artificial intelligence to analyze videos submitted by job applicants, HireVue argues that the plaintiffs may not bring claims under the BIPA related to HireVue's use of its online video platform.
The problem with HireVue's argument is that it assumes that the BIPA and the AIVIA impose conflicting-as opposed to concurrent-obligations. In interpreting statutes, the Court must presume that the Illinois legislature “acts rationally and with full knowledge of all previous enactments” and that “the legislature will not enact a law which completely contradicts a prior statute without an express repeal of it.” Mikusch, 562 N.E.2d at 170. As the plaintiffs point out, nothing in the AIVIA indicates that the legislature intended to repeal or preempt any portion of the BIPA when it enacted the statute, or that the legislature intended to limit the BIPA's private right of action. (R. 51 at 15-17.) Although HireVue points to the fact that the two statutes impose different consent, retention, and disclosure obligations, these apparent conflicts do not compel the conclusion that the statutes are entirely inconsistent with one another or that the AIVIA forecloses the plaintiffs' BIPA claims. See Mikusch, 562 N.E.2d at 173. Accordingly, the Court denies HireVue's motion to dismiss on this basis.
In yet another flourish of statutory interpretation, HireVue suggests that the BIPA's “financial institution” exemption bars the plaintiffs' claims. (R. 49 at 21-24.) Section 25(c) of the BIPA provides that the statute does not apply “in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act (‘GLBA').” 740 ILCS 14/25.
Courts in this district have commented that the financial institution exemption is akin to an affirmative defense, which cannot be considered in the context of a Rule 12(b)(6) motion unless the defendant's entitlement to the defense is apparent from the face of the complaint. See Davis v. Jumio Corp., No. 22 C 776, 2023 WL 2019048, at *2 (N.D. Ill. Feb. 14, 2023); Patterson v. Respondus, Inc., 593 F.Supp.3d 783, 819 n.18 (N.D. Ill. 2022)) (citing United States v. Lewis, 411 F.3d 838, 842 (7th Cir. 2005)).
The first amended complaint contains no allegations upon which the Court can infer that HireVue is a financial institution subject to the GBLA. To the contrary, HireVue's defense rests on the apparently novel and fact-specific assertion that HireVue's contracts with health insurance companies like HCSC entitle it to the financial institution exemption. (See R. 47 at 23 (“[T]he practical effect of applying the BIPA to HireVue would be to apply the BIPA to HCSC, which is precisely what § 25(c) forbids.”).) It would be premature to resolve such a fact-specific argument it at this stage. See Davis, 2023 WL 2019048, at *4 (holding that whether cryptocurrency exchange qualified as a financial institution for purposes of BIPA's financial institution exemption “presents a question of fact that cannot be determined based on the allegations of the [c]omplaint”). Accordingly, the Court declines to consider the merits of this argument and denies HireVue's motion to dismiss on this basis.
C. Failure to State a Claim
Finally, the Court arrives at the question of whether the plaintiffs' allegations are sufficient to state claims under the BIPA. The plaintiffs allege violations under subsections 15(a), (b), (c), and (d) of the BIPA. Because each of these subsections gives rise to a separate claim, see, e.g., Clark v. Microsoft Corp., No. 23 C 695, 2023 WL 5348760, at *4 (N.D. Ill. Aug. 21, 2023), the Court addresses each in turn.
First, HireVue argues that the plaintiffs have failed to state a claim under § 15(a) of the BIPA, which requires entities who are “in possession” of biometric information to “develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers.” 740 ILCS 14/15(a). Because the plaintiffs have alleged that HireVue “collect[ed], capture[d] and use[d]” their facial geometry and “did not make publicly available any biometric retention policy that disclosed how long it stored the biometrics it collected,” (FAC ¶¶ 5, 22, 25), their allegations are sufficient to state a claim under § 15(a). See Rogers v. CSX Intermodal Terminals, Inc., 409 F.Supp.3d 612, 618 (N.D. Ill. 2019) (holding that allegations that the defendant “failed to make publicly available any retention or destruction policies” despite collection of the plaintiff's biometric data were sufficient to state a claim under § 15(a)).
HireVue argues that the plaintiffs have not alleged that it was “in possession” of their biometric data. (R. 49 at 25.) The BIPA does not define this term, however. See 740 ILCS 14/10. Given the ordinary meaning of “in possession,” the first amended complaint plausibly alleges that HireVue violated § 15(a) by capturing and collecting the plaintiffs' biometric data. See People v. Grant, 52 N.E.3d 308, 313 (Ill. 2016) (“[The] most reliable indicator of [the legislature's] intent is the statutory language itself, given its plain and ordinary meaning”); see also Possession, Black's Law Dictionary (11th ed. 2019). Accordingly, the Court denies HireVue's motion to dismiss on this basis.
Similarly, HireVue argues that it is not subject to § 15(b) of BIPA which prohibits, among other things, “captur[ing] [and] collect[ing]” an individual's biometric information without their consent. 740 ILCS 14/15(b). HireVue argues that the plaintiffs cannot state a claim under this subsection because the company does not collect or store biometric data. (R. 49 at 25-26.) But the first amended complaint alleges the opposite: that HireVue actively gathered the plaintiffs' biometric data through its software platform. (See FAC ¶¶ 22, 29, 34, 39, 44, 49, 55, 73.) The Court is bound to accept these allegations as true and draw all inferences in the plaintiffs' favor. Vesuvius, 910 F.3d at 333. The Court denies HireVue's motion to dismiss on this basis as well.
Next, HireVue moves to dismiss the plaintiffs' claims under § 15(c), which prohibits a company from “sell[ing], leas[ing], trad[ing], or otherwise profit[ing]” from an individual's biometric data. 740 ILCS 14/15(c). In the context of § 15(c), the Seventh Circuit has held that pleading a “bare violation” of the statute is not enough; instead, plaintiffs must allege how the alleged conduct harmed them individually. Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1246-47 (7th Cir. 2021).
Here, the Court agrees with HireVue that the plaintiffs' allegations fail to state a claim. The plaintiffs allege that HireVue profited from their biometric information because its clients paid for use of its software. (FAC ¶ 26.) But the fact that HireVue profited from the sale of its software does not plausibly indicate that it sold, leased, traded, or otherwise profited from the plaintiffs' biometric data itself. Moreover, the allegations in the first amended complaint plead a “bare violation” of the statute without an explanation of how the plaintiffs have been harmed. Thornley, 984 F.3d at 1246-47. Because the first amended complaint does not allege that HireVue profited directly from the collection of biometric data or explain how the plaintiffs were individually harmed by this activity, the Court grants HireVue's motion to dismiss as to this claim.
Finally, HireVue argues that the plaintiffs' § 15(d) claim fails because the first amended complaint does not plausibly allege that HireVue “disclose[d], redisclose[d], or otherwise disseminate[d]” their data. 740 ILCS 14/15(d). But the first amended complaint alleges that HireVue's software “also results in the dissemination of biometrics to third parties, such as data storage vendors.” (FAC ¶ 5.) Whether or not this allegation is true, it must be accepted as such at this stage. Vesuvius, 910 F.3d at 333. And allegations that HireVue “disseminated [the plaintiffs'] biometric data to other firms that hosted the information in their data centers” are sufficient to state a claim under § 15(d). Figueroa v. Kronos Inc., 454 F.Supp.3d 772, 785 (N.D. Ill. 2020). The Court therefore denies HireVue's motion to dismiss on this basis.
CONCLUSION
For the reasons set forth in this memorandum opinion, the Court grants Defendant HireVue Inc.'s motion to dismiss in part and denies it in part. The Court denies HireVue's Rule 12(b)(2) motion to dismiss for lack of personal jurisdiction and finds that it may exercise specific personal jurisdiction over HireVue with respect to all pending claims. The Court also grants HireVue's Rule 12(b)(6) motion as to the plaintiffs' claims under § 15(c) of the BIPA. The motion is denied as to all other claims. HireVue will have 21 days to answer the complaint. It is so ordered.