McGoveran v. Amazon Web Servs.
| Decision Date | 29 March 2023 |
| Docket Number | 1:20-cv-01399-SB |
| Parties | CHRISTINE MCGOVERAN, JOSEPH VALENTINE, and AMELIA RODRIGUEZ, on behalf of themselves and all other persons similarly situated, known and unknown, Plaintiffs, v. AMAZON WEB SERVICES, INC. and PINDROP SECURITY, INC., Defendants. |
| Court | U.S. District Court — District of Delaware |
Alexander L. Braitberg, Joshua A. Katz, Andrew D. Schlichter Joel Rohlf, SCHLICHTER BOGARD & DENTON, LLP, St. Louis MO; Stephen B. Brauerman, Ronald P. Golden, III, BAYARD P.A., Wilmington, DE. Counsel for Plaintiff.
Jody Barillare, MORGAN LEWIS & BOCKIUS LLP, Wilmington, DE; Elizabeth Herrington, MORGAN LEWIS & BOCKIUS LLP, Chicago, IL; Raechel K. Kummer, MORGAN LEWIS & BOCKIUS LLP, Washington, DC. Counsel for Defendant Amazon Web Services, Inc.
Andrew Bloomer, KIRKLAND & ELLIS, Chicago, IL; Diana M. Torres, KIRKLAND & ELLIS, Los Angeles, CA; Jack B. Blumenfeld, Megan Elizabeth Dellinger, MORRIS, NICHOLS, ARSHT & TUNNELL LLP, Wilmington, DE. Counsel for Defendant Pindrop Security, Inc.
Legislation requires tradeoffs. Regulate an industry too strictly, and you could stifle innovation. Take a hands-off approach, and people might be harmed.
Illinois's law regulating the use of biometrics to identify customers reflects these tradeoffs. It limits collecting, retaining, and using consumer biometric data. But it exempts some industries from its rules.
Plaintiffs, all residents of Illinois, have sued defendants for violating Illinois law. Defendants now move to dismiss, arguing that the law does not apply to them and that plaintiffs' allegations fall short. Because they are mostly right, I grant their motions in part.
In 2008, Illinois enacted the Biometric Information Privacy Act. See 740 Ill. Comp. Stat. 14/1-14/25. Designed to address “[t]he use of biometrics” in “financial transactions and security screenings,” the Act “regulat[es] the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information” in Illinois. 14/5(a), (g). And it has teeth: “[a]ny person aggrieved by a violation” of the Act can sue for liquidated damages. Id. 14/20 (awarding $1,000 for negligent violations and $5,000 for intentional or reckless violations). Plaintiffs can also recover attorneys' fees and costs. Id.
The Act regulates the use of both “biometric identifiers” and “biometric information.” See 14/15. Rather than generally defining “biometric identifiers,” the Act simply lists the six things that count: “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 14/10. On the other hand, the Act defines “biometric information” generally: “any information ... based on an individual's biometric identifier used to identify an individual.” Id. The Act had to define and regulate biometric information, not just identifiers, to ensure that companies did not convert identifiers into numbers or some other format-thus creating information not on the Act's list of identifiers-and then use that information to identify people. Rivera v. Google Inc., 238 F.Supp.3d 1088, 1095, 1097 (N.D. Ill. 2017).
The parties sometimes use “biometric identifiers” and “biometric information” interchangeably. But as we will see, the distinction can make a difference. For clarity, I will use “biometric data,” a term that the Act does not use, when I refer to both.
At the motion-to-dismiss stage, I take all well pleaded allegations in plaintiffs' Amended Complaint as true. Ashcroft v. Iqbal, 556 U.S. 662, 679 (2009).
Plaintiffs all live in Illinois and are customers of John Hancock, a financial-services company that offers retirement products. Am. Compl., D.I. 47 ¶¶ 6-8, 98-101. At various times in 2019, they called John Hancock to discuss their retirement accounts. ¶¶ 98-101. John Hancock used Amazon Connect, a product offered by defendant Amazon Web Services, to receive and process those calls. ¶¶ 51, 98, 102.
Amazon Connect provides cloud-based call centers. ¶¶ 50-55. People dial phone numbers to reach companies like John Hancock, and Amazon servers receive those phone calls, process voice commands, and connect callers to live agents. ¶ ¶ 50-55, 121, 123. Amazon also offers voice authentication, an add-on service that confirms callers' identities using their voiceprints without requiring them to enter a PIN. ¶¶ 37-39, 64-69, 80, 103, 140.
Amazon authenticates callers by using defendant Pindrop's technology. ¶¶ 64-68, 102-05. Pindrop is a tech company offering “biometric voice products and services.” ¶¶ 57-63. Its technology can process live audio from callers, identify their unique voiceprints, and confirm whether they are who they claim to be. Id.; see also ¶ 77. Amazon uses Pindrop's technology as a software plugin. ¶ 69. People call in to an Amazon call center, Amazon routes the call audio to Pindrop's servers, and Pindrop extracts the callers' unique biometric data to authenticate them. ¶¶ 78-80. This all seamlessly happens in real time during the phone call. ¶¶ 67, 71, 73, 77.
At various points in the Complaint, plaintiffs allege both that Pindrop itself authenticates callers and that Amazon authenticates callers using biometric data that Pindrop has extracted and then sent to Amazon. Compare ¶¶ 59-61, 103, with ¶¶ 78, 80, 86, 88. And recently, Amazon developed its own technology to process voiceprints and authenticate callers without Pindrop. ¶ 69. In any event, Amazon and Pindrop both used their technology to authenticate plaintiffs when they called John Hancock. ¶¶ 98, 102-03.
Believing that defendants' use of their voiceprints violated the Act, plaintiffs filed this suit in Illinois state court as a class action. D.I. 34, at 4. Defendants then removed to federal court and had the case dismissed for lack of personal jurisdiction. Id. So plaintiffs refiled here in the District of Delaware, where both defendants are incorporated. D.I. 1 ¶¶ 10, 12. The Court then dismissed because the Act does not apply outside of Illinois, and plaintiffs had not alleged that defendants had acted in Illinois. D.I. 34, at 12.
Plaintiffs have now filed their First Amended Complaint, which makes several allegations about defendants' activities in Illinois. See, e.g., D.I. 47 ¶¶ 108-34. Their claims come in four counts, each corresponding to a subsection of the Act's overall duty section. ¶¶ 178-207 (citing 740 Ill. Comp. Stat. 14/15(a)-(d)). And they ask me to enjoin defendants from further violating the Act. D.I. 47, at 40 (citing 14/20(4)).
Both Pindrop and Amazon now move to dismiss on several grounds. I must decide if plaintiffs have alleged “sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Iqbal, 556 U.S. at 678 (internal quotation marks omitted).
Pindrop says that plaintiffs lack standing to bring some of their claims. Because standing is jurisdictional, I address this argument first. See N.J. Bankers Ass'n v. Att'y Gen. N.J., 49 F.4th 849, 855 (3d Cir. 2022). Pindrop is right: the Complaint fails to show that plaintiffs have standing to bring Count I, Count III, or a claim for injunctive relief.
To have standing, plaintiffs “must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant[s], and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016). To meet the first requirement, they must allege that they have suffered a “concrete-that is, real, and not abstract” injury that has a “close historical or common-law analogue” “traditionally recognized as providing a basis for a lawsuit in American courts.” TransUnion LLC v. Ramirez, 141 S.Ct. 2190, 2204 (2021) (internal quotation marks omitted). And to get injunctive relief, they must allege that their injury is “actual or imminent,” that is, “certainly impending.” Clapper v. Amnesty Intern. USA, 568 U.S. 398, 409 (2013) (internal quotation marks omitted).
1. Count I. Count I claims that Pindrop violated section 15(a) of the Act. D.I. 47 ¶¶ 178-184. That section requires companies that have biometric data to “develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information.” 14/15(a). The written policy must mandate destruction of the biometric data “when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual's last interaction with the [company], whichever occurs first.” Id. And companies “must comply” with their retention policies. Id.
The Seventh Circuit, which encompasses Illinois, has discussed Article III standing for section 15(a) claims. When plaintiffs allege only that a company has failed to develop a written policy, they fail to allege a concrete injury in fact. Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020), as amended, 2020 WL 6534581, at *1 (7th Cir. June 30, 2020). The statutory duty to develop and make available a written policy “is owed to the public generally, not to particular persons whose biometric information the entity collects.” Id. So failing to follow section 15(a)'s written-policy requirement does not injure individual plaintiffs in “a concrete and particularized” way. Id.
On the other hand, the Seventh Circuit has held that when plaintiffs allege that a company retained their biometric data for longer than section 15(...
To continue reading
Request your trial