Opinion
Case No. 3:15-cv-03747-JD
05-14-2018
IN RE FACEBOOK BIOMETRIC INFORMATION PRIVACY LITIGATION THIS DOCUMENT RELATES TO: ALL ACTIONS
ORDER RE SUMMARY JUDGMENT MOTIONS
Re: Dkt. Nos. 257, 299, 307
Plaintiffs and defendant Facebook, Inc., have filed cross-motions for summary judgment on plaintiffs' claim that Facebook's Tag Suggestions program collects and stores biometric data in violation of the Illinois Biometric Information Privacy Act ("BIPA"), 740 Ill. Comp. Stat. 14/1 et seq. Dkt. Nos. 257, 299, 307. The Court's prior orders discuss the core elements of this litigation in substantial detail, and provide the context for the summary judgment motions. See In re Facebook Biometric Info. Privacy Litig., 185 F. Supp. 3d 1155 (N.D. Cal. 2016) (choice of law); Patel v. Facebook Inc., 290 F. Supp. 3d 948 (N.D. Cal. 2018) (Article III standing); In re Facebook Biometric Info. Privacy Litig., No. 3:15-CV-03747-JD, 2018 WL 1794295 (N.D. Cal. Apr. 16, 2018) (certifying Illinois user class).
The parties have filed over 100 pages of briefs for the cross-motions, accompanied by several hundred pages of documents and emails, deposition testimony, expert opinions and other exhibits. These voluminous submissions underscore the multitude of fact disputes that bar judgment as a matter of law for either side. That is particularly true for plaintiffs' motion, which effectively asks for entry of judgment in their favor on a record that they concede is often unsettled. Consequently, all of the summary judgment motions are denied, and the trial set for July 9, 2018, will go forward. This order addresses the parties' disagreements about Facebook's face scanning practices, which illustrate the factual disputes barring summary judgment, and certain legal arguments raised by Facebook, with the goal of clarifying them in advance of trial and the pretrial conference.
Before getting to those matters, the Court is concerned about a troubling theme in Facebook's briefs. Facebook says it knows "from this Court's class certification decision" and an Illinois state decision, Rosenbach v. Six Flags Entertainment Corporation, 2017 IL App (2d) 170317 (Ill. App. Ct. 2017), that plaintiffs "must prove something more than a violation of BIPA's notice-and-consent provisions" to prevail. Dkt. No. 349-2 at 3. This and similar comments suggest that Facebook is reverting to the faulty proposition that plaintiffs must show an "actual" injury beyond the invasion of the privacy rights afforded by BIPA. That is not what the Court has concluded. The Court expressly rejected that contention in considerable detail in the class certification order and the order finding Article III standing to sue. In re Facebook, 2018 WL 1794295 at *6-8; Patel, 290 F. Supp. 3d at 953-54. A class was certified for that exact reason. BIPA does not require additional proof of individualized "actual" harm, and so the question of whether Facebook is liable can be decided in "one stroke" for the class as a whole without a likelihood that individualized inquiries would overwhelm commonality and predominance. Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 350 (2011). To contend otherwise, or to argue that BIPA requires some individualized quantum of "actual" injury in addition to the privacy violation caused by the deprivation of the notice and consent requirements, is to misread and misrepresent the Court's orders.
LEGAL STANDARDS
"A party may move for summary judgment, identifying each claim or defense -- or the part of each claim or defense -- on which summary judgment is sought. The Court shall grant summary judgment if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law." Fed. R. Civ. P. 56(a). The Court may dispose of less than the entire case and just portions of a claim or defense. Smith v. State of California Dep't of Highway Patrol, 75 F. Supp. 3d 1173, 1179 (N.D. Cal. 2014).
Under Rule 56, a dispute is genuine "if the evidence is such that a reasonable jury could return a verdict" for either party. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986). A fact is material if it could affect the outcome of the suit under the governing law. Id. at 248-49. In determining whether a genuine dispute of material fact exists, the Court will view the evidence in the light most favorable to the non-moving party and draw "all justifiable inferences" in that party's favor. Id. at 255. A principal purpose of summary judgment "is to isolate and dispose of factually unsupported claims." Celotex Corp. v. Catrett, 477 U.S. 317, 323-24 (1986).
The moving party can initially establish the absence of a genuine issue of material fact, which it must do by "pointing out to the district court . . . that there is an absence of evidence to support the nonmoving party's case." Id. at 325. It is then the non-moving party's burden to go beyond the pleadings and identify specific facts that show a genuine issue for trial. Id. at 323-34. "A scintilla of evidence or evidence that is merely colorable or not significantly probative does not present a genuine issue of material fact." Addisu v. Fred Meyer, Inc., 198 F.3d 1130, 1134 (9th Cir. 2000). It is not the Court's task "to scour the record in search of a genuine issue of triable fact." Keenan v. Allan, 91 F.3d 1275, 1279 (9th Cir. 1996) (quotations omitted).
DISCUSSION
I. Scan of Face Geometry
The parties' disagreements about Facebook's face recognition and scanning practices are emblematic of the factual disputes that are rife in this case. BIPA requires private entities to provide notice and obtain consent when either "biometric identifiers or biometric information" are at issue. 740 Ill. Comp. Stat. Ann. 14/15. "Biometric identifiers" include "scan[s] of . . . face geometry" and "biometric information" includes "any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual." 740 Ill. Comp. Stat. Ann. 14/10. "Biometric identifiers do not include . . . photographs" and biometric information "does not include information derived from items or procedures excluded under the definition of biometric identifiers." Id.
Plaintiffs' case turns in large measure on whether Facebook collects and stores scans of face geometry. While the parties have no serious disagreement about the literal text of Facebook's source code, they offer strongly conflicting interpretations of how the software processes human faces. Plaintiffs say the technology necessarily collects scans of face geometry because it uses human facial regions to process, characterize, and ultimately recognize face images. Facebook disagrees and says the technology has no express dependency on human facial features at all. Rather, according to Facebook, the technology "learns for itself what distinguishes different faces and then improves itself based on its successes and failures, using unknown criteria that have yielded successful outputs in the past." Dkt. No. 298-24 at 5.
This is a quintessential dispute of fact for the jury to decide. On their part, plaintiffs have tendered evidence that Facebook's algorithm collects information about face geometry. For example, plaintiffs highlight a Facebook research paper captioned "DeepFace," which describes the processing system used for face recognition. Facebook agrees that the "DeepFace" paper is descriptive of its technology, and does not identify any specific differences between the approach outlined in the paper and its actual practices. See Dkt. No. 337 at 18.
"DeepFace" is a network architecture whose "success . . . is highly dependent on a very rapid 3D alignment step" that "fix[es] at the pixel level" "the location of each facial region." Dkt. No. 341-30 at FBBIPA_00001214. Alignment begins "by detecting 6 fiducial points . . . centered at the center of the eyes, tip of the nose, and mouth locations." Id. at FBBIPA_00001216. After alignment, a representation step "capture[s] correlations between features captured in distant parts of the face images, e.g., position and shape of eyes and position and shape of mouth." Id. at FBBIPA_00001217.
Plaintiffs proffer opinions by their expert, Dr. Atif Hashmi, who examined Facebook's source code and concluded that alignment "utilize[s] facial geometry to determine the location of facial landmarks including eyes, nose, mouth, chin, and others in unaligned face images." Dkt. No. 339-7 at 18. Locating those landmarks allows face images to be reconstructed in a fully frontal position. Id. According to Dr. Hashmi, representation then "progressively extract[s] complex features like . . . eyes, nose, chin, and mouth" in order to produce "a set of numerical values . . . that represent the facial landmarks or features present in the face image." Id. at 20-23.
In addition to these technical materials, plaintiffs tender internal Facebook emails indicating that Facebook understood it was collecting what is "normally referred to as biometric data." Dkt. No. 306-5; see also Dkt. No. 339-11.
Facebook counters with other evidence to contest the claim that its technology scans face geometry. It cites, for example, the opinions of its own expert, Dr. Matthew Turk, who says that Facebook's technology "analyze[s] all of the pixels in a face image, and not any particular human-notable facial features." Dkt. No. 298-1 at 3. "Through an iterative trial-and-error training process, Facebook's [current technology] . . . learned for itself what features of an image's pixel values are most useful for the purpose of characterizing and distinguishing images of human faces." Id. at 2. The technology, in Dr. Turk's view, "does not explicitly detect human-notable facial features" but instead "combines and weights different combinations of different aspects of the entire face image's pixel values. Indeed, the [technology] . . . would still calculate a 'face signature' if provided with an image of something other than a face." Id. at 40.
The parties unleash volleys of other competing evidence, but this summary is enough to show that a jury will need to resolve the genuine factual disputes surrounding facial scanning and the recognition technology. Facebook makes a stab at avoiding trial by suggesting that "scan" in "scan of face geometry" necessarily connotes an express measurement of human facial features -- for instance, "a measurement of the distance between a person's eyes, nose, and ears." Dkt. No. 299 at 20 (internal quotation omitted). But the argument is of no moment because it merely begs the question of what, in fact, happens in the operation of the technology. In addition, the word "scan" does not bear the definitional freight Facebook seeks to impose. BIPA does not specifically define it, and the ordinary meaning of "to scan" is to "examine" by "observation or checking," or "systematically . . . in order to obtain data especially for display or storage." MERRIAM-WEBSTER'S COLLEGIATE DICTIONARY at 1107-08 (11th ed. 2003). "Geometry" is also understood in everyday use to mean simply a "configuration," which in turn denotes a "relative arrangement of parts or elements." Id. at 524, 261. None of these definitions demands actual or express measurements of spatial quantities like distance, depth, or angles. In addition, the Illinois legislature's decision to use the word "scan" rather than "record" does not indicate that express measurements are required, and limiting scans of face geometry to techniques that literally measure distances, depths, and angles cannot be squared with the legislature's clear intent to regulate emergent biometric data collection technology in whatever specific form it takes. See In re Facebook, 185 F. Supp. 3d at 1171.
II. Dormant Commerce Clause
Moving to Facebook's more overtly legal contentions, Facebook says that subjecting it to BIPA would violate the dormant commerce clause because it processes facial recognition on servers outside the state of Illinois. Dkt. No. 257 at 13. Plaintiffs do not meaningfully dispute that the pertinent servers are not located in Illinois.
The dormant commerce clause typically applies when a state tries to regulate or control economic conduct wholly outside its borders with the goal of protecting local businesses from out-of-state competition. See Healy v. Beer Inst., Inc., 491 U.S. 324, 336-37 (1989). It is a "limitation upon the power of the States" intended to prohibit "discrimination against interstate commerce" and "state regulations that unduly burden interstate commerce." Sam Francis Found. v. Christies, Inc., 784 F.3d 1320, 1323 (9th Cir. 2015) (en banc) (quoting Great Atl. & Pac. Tea Co. v. Cottrell, 424 U.S. 366, 371 (1976) and Quill Corp. v. North Dakota, 504 U.S. 298, 312 (1992)).
Facebook's concerns are not well taken. As an initial matter, the application of BIPA to Illinois users does not have the impermissible "'practical effect' of regulating commerce occurring wholly outside" Illinois. Healy, 491 U.S. at 332. The Court rejected a similar argument about extraterritoriality under Illinois state law that Facebook raised at class certification, and the same basic reasoning applies to the dormant commerce clause challenge. This lawsuit is under an Illinois state statute on behalf of Illinois residents who used Facebook in Illinois. See In re Facebook, 2018 WL 1794295, at *8 (finding that the alleged BIPA violations took place "'primarily and substantially within' Illinois" under Avery v. State Farm Mutual Automobile Insurance Co., 216 Ill.2d 100, 187 (Ill. 2005)). For the reasons discussed in the Court's class certification order, Facebook's facial recognition program cannot be understood to have occurred wholly outside Illinois, and the same rather metaphysical arguments about where BIPA was violated fare no better when re-packaged under the dormant commerce clause. Facebook's reliance on our circuit's conclusions in Christies, Inc., is misplaced. The California state law challenged there purported to regulate sales of fine art conducted entirely outside the state. In contrast, this case is deeply rooted in BIPA's native soil of Illinois.
Facebook's cursory reference to the specter of inconsistent regulations is equally unavailing. Facebook says that the Commerce Clause "precludes Illinois from overriding the decisions of California and other states" to not regulate biometric information, Dkt. No. 257 at 15, but there is no risk of Illinois law overriding the laws of the other states. This suit involves Facebook's conduct with respect to Illinois users only, and even so, evidence in the record shows that Facebook can activate or deactivate features for users in specific states with apparent ease when it wants to do so. See Dkt. No. 339-11. Nothing indicates that liability under BIPA would force Facebook to change its practices with respect to residents of other states. Our circuit has declined dormant commerce clause challenges in similar circumstances. See, e.g., Rocky Mountain Farmers Union v. Corey, 730 F.3d 1070, 1101 (9th Cir. 2013).
III. The Photograph Exclusion
Facebook seeks to re-argue on summary judgment another legal contention it made at the start of this case, namely that BIPA regulates in-person or "live" scans of facial geometry only, and that information derived from photographs, whether analogue or digital, is categorically excluded from the statute. Dkt. No. 299 at 24. The Court has already considered and rejected that point, based on well-established principles of statutory interpretation. In re Facebook, 185 F. Supp. 3d at 1170-71. Three other federal courts have reached the same conclusion. Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1095 (N.D. Ill. 2017); Monroy v. Shutterfly, Inc., No. 16 C 10984, 2017 WL 4099846, at *3 (N.D. Ill. Sept. 15, 2017); Norberg v. Shutterfly, Inc., 152 F. Supp. 3d 1103, 1106 (N.D. Ill. 2015). Facebook did not comply with our district's rule for seeking reconsideration, see Civil L.R. 7-9, and in any event, it offers nothing in the way of new facts or law that would warrant reconsideration at this stage. If facts adduced at trial provide a good-faith basis for further discussion, either side may propose it. See In re Facebook, 185 F. Supp. 3d at 1172.
IV. Damages
The cross-motions touch upon two damages issues that will benefit from clarification now as the parties prepare for trial. The first is an offshoot of Facebook's photo exclusion theory. BIPA authorizes damages against a private entity that negligently, intentionally, or recklessly violates BIPA, and scales the amount of damages to the degree of culpability. 740 Ill. Comp. Stat. Ann. 14/20. Negligent violations are subject to statutory damages of $1,000, while intentional or reckless violations are $5,000. Id. Facebook appears to contend that it should not be liable for any damages at all, including at the negligence level, because it reasonably understood BIPA to exclude data harvested from photographs.
That is not a sound proposition. As an initial matter, Facebook's understanding of BIPA is in dispute. Plaintiffs have tendered materials indicating that Facebook knew the face signatures and face templates it created from user photographs involved "biometric data." See, e.g., Dkt. No. 306-5; Dkt. No. 339-11. Facebook offers competing evidence. That is not a record that permits judgment as a matter of law.
In addition, a good argument can be made that Facebook's position amounts to a very questionable mistake of law defense. It is a "'common maxim, familiar to all minds, that ignorance of the law will not excuse any person, either civilly or criminally.'" Jerman v. Carlisle, McNellie, Rini, Kramer & Ulrich LPA, 559 U.S. 573, 581 (2010) (citing Barlow v. United States, 7 Pet. 404, 411 (1833)). An "act may be 'intentional' for purposes of civil liability, even if the actor lacked actual knowledge that her conduct violated the law. . . . [E]ven in the criminal context, . . . reference to a 'knowing' or 'intentional' 'violation' or cognate terms has not necessarily implied a defense for legal errors." Id. at 582-85 (internal citation omitted) (citing cases). Facebook's position appears to conflate defenses for mistakes of fact with defenses for mistakes of law, contrary to our common law's "long tradition [of] . . . distinguishing errors of fact from errors of law." Id. at 608 (Scalia, J., concurring).
The doubts about Facebook's argument are magnified by the Supreme Court's holding that statutory violations are not necessarily excused by a mistake of law even when a statute includes an express "bona fide error" defense, as in the federal Fair Debt Collection Practices Act. Id. at 584. BIPA does not feature a similar "bona fide error" provision, and does not contemplate the possibility of the mistake defense Facebook urges, let alone the conclusion that it is necessarily insulated from all damages. There is no evidence that the Illinois legislature intended mistakes of law to bar damages for negligent violations. Facebook's cited cases are unhelpful because they discuss willful violations only. See, e.g., Landwer v. Scitex Am. Corp., 238 Ill. App. 3d 403, 409 (Ill. 1992); Safeco Ins. Co of Am. v. Burr, 551 U.S. 47, 56-57 (2007).
The Court will not rule out at this stage the possibility that a reasonable mistake of law might foreclose exposure at the $5,000 level of damages. See Jerman, 559 U.S. at 584 ("willful" is more typically understood in the civil context to excuse mistakes of law). That issue will require further briefing and discussion at the pretrial conference.
The second damages issue is whether plaintiffs must prove actual damages as a precondition for an award of statutory damages. BIPA states that a victim may recover "liquidated damages" at the $1,000 or $5,000 level, "or actual damages, whichever is greater." 740 Ill. Comp. Stat. Ann. 14/20(1)-(2). Facebook appears to read the "or greater" construction to mean that a plaintiff must establish at least some measure of actual damages before seeking statutory damages.
This damages theory echoes Facebook's faulty contention that BIPA requires actual damages of some sort to maintain a cause of action, and it fails for the reasons stated in prior orders. See Patel, 290 F. Supp. 3d at 953; In re Facebook, 2018 WL 1794295, at *7. It also misconstrues the plain language of BIPA. Section 20 expressly provides for two separate categories of damages that a plaintiff may recover. Consequently, proof of actual damages is not a prerequisite to recovery of statutory damages. Facebook's reliance on Doe v. Chao, 540 U.S. 614 (2004), is misplaced. As Doe states, the determination of damages available under a statute is an exercise of "straightforward textual analysis." Id. at 620. The statutory damages provision at issue in Doe is far too different from the language in BIPA to serve as a sound basis for analogy or guidance here. In addition, other courts have concluded after Doe that the mention of actual and liquidated damages in a statute does not necessarily require proof of actual damages as a threshold matter. See, e.g., Sterk v. Redbox Automated Retail, LLC, 672 F.3d 535, 538 (7th Cir. 2012) (Video Privacy Protection Act provision allowing for "actual damages but not less than liquidated damages in an amount of $2,500" authorizes liquidated damages without proof of actual damages); Pichler v. UNITE, 542 F.3d 380, 398 (3d Cir. 2008) (Driver's Privacy Protection Act provision for "actual damages, but not less than liquidated damages in the amount of $2,500" "creates a base amount below which the court may not go, whether the plaintiff is able to prove actual damages or not"); Kehoe v. Fidelity Fed. Bank & Trust, 421 F.3d 1209, 1216 (11th Cir. 2005) (same).
V. The Named Plaintiffs
Facebook says that it is entitled to judgment because the named plaintiffs cannot show that their photos were subjected to scanning. But that clearly is another disputed question of fact for the jury to resolve. Plaintiffs have identified more than enough evidence to allow a reasonable jury to conclude their biometric data was harvested. Among other facts, the record shows that plaintiffs were active Facebook users while the Tag Suggestions program was in place. The program was launched in the United States in 2011, and Facebook agrees that Pezen did not opt out of Tag Suggestions until 2014, Licata did not opt out of Tag Suggestions until 2017, and Patel has not opted out at all. Dkt. No. 284-2 at 14 n.12. The record also shows that each of the named plaintiffs uploaded a sizeable number of photographs and were tagged in other users' photos. See Dkt. No. 341 at 18; Dkt. No. 349-2 at 8. A jury could reasonably find from this and other evidence that the named plaintiffs' photographs were processed by Facebook's facial recognition technology.
CONCLUSION
The parties' motions for summary judgment, Dkt. Nos. 257, 299, 307, are denied.
IT IS SO ORDERED. Dated: May 14, 2018
/s/_________
JAMES DONATO
United States District Judge