Class action lawsuits accusing companies of violating the Illinois Biometric Information Privacy Act (“BIPA”) have more than doubled following a February 2023 ruling by the Illinois Supreme Court, which found, based on a plain reading of the statute, a separate claim accrues each time a person’s biometric identifier is scanned in violation of the statute.
While there is no sign that BIPA class action lawsuits will slow, a recent federal district court decision in Clark v. Microsoft Corporation may serve as a favorable data point for entities defending against these suits. There, the United States District Court for the Eastern District of Illinois partially dismissed a putative class action against Microsoft Corporation for alleged violations of Sections 15(a) through (d) of BIPA. The alleged violations arose from training software, developed by a company called Brainshark, that apparently leveraged facial geometry scans to provide feedback to salespeople on their “elevator pitches.”
According to the complaint, the software purportedly interfaced with two Microsoft products: Azure cloud services (“Azure”) – a cloud computing platform – and Azure Cognitive Services applications (“ACS”) – a programming platform used by developers to integrate artificial intelligence-based capabilities into various products and services. In ruling on Microsoft’s motion to dismiss, the Court dismissed plaintiffs’ claims under all sections of BIPA except Section 15(a).
The Court’s Decision
With respect to Section 15(a) – which requires companies that possess biometric data to develop and publish written data retention policies – the Court held that “possession” was sufficiently pleaded because Microsoft’s Products and Services Data Protection Addendum (“DPA”), a publicly available document of which the court took judicial notice, suggested that Microsoft stored certain biometric information and “exercised some degree of control” over that information. The basis for this conclusion was a single statement in the DPA that Microsoft “control[s] access to Customer Data and Professional Services Data (including any Personal Data therein),” and an allegation in the complaint that Brainshark is hosted on Azure’s servers.
Regarding Section 15(b) – which requires companies that “collect, capture, purchase, receive through trade, or otherwise obtain” individuals’ biometric information to receive these individuals’ written consent – the Court concluded that liability under this section requires an active step to obtain individuals’ biometric information. Because the complaint made clear that “Microsoft provides technology to Brainshark and that Brainshark allegedly uses that technology to collect” plaintiffs’ biometric information, the Court found that Microsoft had not engaged in the requisite active step.
With respect to Section 15(c) – which prohibits companies from profiting off individuals’ biometric information – the Court held that plaintiffs had not established Article III standing because they had not specifically alleged how they were harmed individually. The court listed examples of allegations a plaintiff could make to establish injury-in-fact, including that, by selling individuals’ data, a collector had deprived the subjects of the opportunity to profit from the data. Plaintiffs’ allegation, the Court concluded, fell short of these examples because it did not explain how Microsoft’s alleged use of the data to improve its Azure products, which are then licensed to other entities, had done any harm to plaintiffs.
Finally, with regard to Section 15(d) – which limits the disclosure and dissemination of biometric information – the Court found that the plaintiffs had not adequately pleaded an allegation that Microsoft, by providing its technology to Brainshark, had “disclosed, redisclosed or otherwise disseminated” their biometric information.
***
The Court’s Microsoft decision may be encouraging news to entities defending against the recent onslaught of BIPA suits. It may not be encouraging enough, however, to convince these entities to litigate rather than settle the claims outright. Indeed, it appears that the BIPA litigation landscape is far from stable as courts are still grappling with issues of statutory construction and standing.