Jurisdiction Can Be a Key Tool for BIPA Class Action Defense
Following the Illinois Supreme Court's seminal decision in Rosenbach v. Six Flags Entertainment Corp.[1] in early 2019, the Illinois Biometric Information Privacy Act has rapidly developed into a formidable class action battleground — with a tsunami of bet-the-company BIPA suits that has continued apace into 2021.
While filings have continued to flood the courts, at the same time a number of defendant-friendly opinions have been issued on a range of key BIPA issues and defenses. Several of those decisions have helped define the contours of the personal jurisdiction defense, which has quickly emerged as a key tool for defending BIPA claims.
When used properly, successful personal jurisdiction challenges can allow BIPA defendants to dispose of a wide range class actions at an early stage by demonstrating the absence of any connection between the defendant and Illinois or the conduct allegedly giving rise to the plaintiff's BIPA claims.
Overview of Personal Jurisdiction
For personal jurisdiction to exist, there must be either general or specific jurisdiction over the defendant. Absent special circumstances, a corporation is only subject to general personal jurisdiction in the state in which it is incorporated or has its principal place of business.
For specific jurisdiction to exist over a defendant, there must be an affiliation between the forum and the underlying controversy: principally, an activity or occurrence involving the defendant that takes place in the forum state and therefore subjects the defendant to the state's regulation.
Successful Personal Jurisdiction Challenges in BIPA Class Action Litigation
BIPA defendants have found significant success recently in challenging personal jurisdiction to extricate themselves from BIPA class actions at an early phase of litigation.
Salkauskaite v. Sephora
In the May 2020 case, Salkauskaite v. Sephora USA Inc.,[2] popular cosmetics retailer Sephora and ModiFace Inc. were sued in the U.S. District Court for the Northern District of Illinois for alleged BIPA violations stemming from the use of ModiFace's technology to collect biometric information about customers' facial geometry at kiosks in Sephora stores.
Shortly after suit was filed, ModiFace moved to dismiss for lack of personal jurisdiction. Because ModiFace was both incorporated and headquartered in Ontario, Canada, the court focused its analysis on whether the company was subject to specific personal jurisdiction in the Northern District of Illinois.
In support of its motion, ModiFace submitted the declaration of its CEO, which established that ModiFace never had property, employees or operations in Illinois; was not registered to do business in Illinois; did not target its marketing, sales or commercial activity toward Illinois; never met or developed a business relationship with Sephora in Illinois; and did not codevelop any biometric devices or provide any type of customized biometric device to Sephora.
The court found that the declaration demonstrated a lack of any connection between ModiFace and the forum state and, in doing so, effectively rebutted the plaintiff's principal argument that the company was subject to specific jurisdiction because it developed customized devices and technology for Sephora with the knowledge and intent that they would be deployed in Illinois.
In addition, the court also rejected the plaintiff's reliance on a 2016 article featuring ModiFace and the use of its technology at a Sephora store in Chicago as evidence of the company's minimum contacts with Illinois, noting that the article did not indicate that ModiFace purposefully directed its conduct at Illinois or purposefully availed itself of the benefits of doing business in the Prairie State.
Ultimately, in the absence of any evidence that ModiFace purposefully availed itself of the right to do business in Illinois, the court concluded that it lacked personal jurisdiction over the biometrics vendor, resulting in its dismissal from the action.
Gullen v. Facebook
A similar result was seen in Gullen v. Facebook Inc.,[3] which involved a lawsuit against Facebook for purported BIPA violations stemming from the company's use of facial biometrics to identify and tag users in photos uploaded to the social media platform.
According to Gullen's complaint, Facebook's contacts with Illinois were that it was registered to do business in the state, maintained a sales and advertising office in the state, and targeted its facial recognition technology to millions of users located in Illinois. Gullen argued that these contacts conferred specific personal jurisdiction over the social media titan. The court, however, disagreed.
The court reasoned that the first two contacts were insufficient to confer specific jurisdiction, as these contacts had no relationship to the suit — which arose from Facebook's alleged collection of biometric data from photos, and not from its sales, marketing or any other business activity in Illinois.
As to the third alleged contact, the court noted that Gullen had alleged that Facebook uses facial recognition on every user-uploaded photo, and not just on photos uploaded in or by residents of Illinois. At bottom, then, the court continued, this third contact merely amounted to the fact that Facebook operated an interactive website available to Illinois residents.
The court found that a connection of this nature also fell short of conferring specific jurisdiction, as the fact that Facebook's site was accessible to Illinois residents did not confer specific jurisdiction over Facebook where the company did not target Illinois residents with its biometrics activities .
Taken together, as a result of Gullen's failure to make a prima facie showing of specific jurisdiction, the court granted Facebook's motion to dismiss.
Bray v. Lathem Time Co.
Finally, Bray v. Lathem Time Co.[4] also involved a successful personal jurisdiction challenge asserted by a Georgia-based timekeeping system vendor.
The vendor in Bray was incorporated and headquartered outside Illinois; did not have any real estate, accounts, personal property, employees or physical presence in Illinois; did not target Illinois or purposely direct sales into the state through advertising/marketing or the use of sales or service representatives; and did not sell a timekeeping device to the plaintiff's employer in Illinois. Under these facts, the court held it lacked specific personal jurisdiction over the vendor defendant and dismissed the action in its entirety.
Like Gullen, the Bray court also rejected the plaintiff's argument that the vendor's operation of a website that could be accessed in Illinois was sufficient to establish jurisdiction, as the company had no additional physical presence in Illinois and did not intentionally target Illinois customers.
Practical Tips and Best Practices
Data Mapping and Inventory
Challenging personal jurisdiction is a particularly powerful tool that can be used at the pleading stage to procure an early dismissal from costly BIPA class action litigation. Importantly, however, in order to be in a position to leverage this defense in BIPA litigation, companies must be able to show that the plaintiffs' claims arise out of biometric-related activities involving the organization that took place exclusively beyond the borders of Illinois.
For this reason, it is critical that all companies that use biometric data in their business operations conduct thorough data mapping and inventory exercises — which entails mapping and inventorying every piece of biometric data collected, used, and/or sold by the company, as well as its data-processing practices.
Completing this exercise will allow companies to develop a comprehensive picture and understanding of where the entity's collection of biometric data takes place, as well as which parts of the organization it passes through, and where it is used and stored thereafter.
This data-flow diagram and data storage inventory can then be used to provide persuasive support for a personal jurisdiction challenge in the event the company's biometrics practices are challenged in BIPA or similar biometric privacy class action litigation.
Putting the Personal Jurisdiction Defense to Good Use
In the event a company is sued for purported violations of Illinois' biometric privacy statute, the organization and its biometric privacy counsel must ensure that a prompt evaluation is undertaken to determine whether personal jurisdiction can be used to facilitate a quick exit from the litigation through an early motion to dismiss.
In completing this analysis, both general and specific personal jurisdiction must be considered. Assuming suit is filed in Illinois, general personal jurisdiction can be defeated in the context of BIPA litigation where the entity is not at home in Illinois — i.e., where Illinois is not the defendant's state of incorporation or the location of its principal place of business.
Specific personal jurisdiction can be defeated where the entity can establish that the defendant's biometric-related activities that serve as the basis for the plaintiff's BIPA claims took place exclusively beyond the borders of the Prairie State.
Conclusion
Companies that collect, use and store biometric data can expect to continue to see a flurry of BIPA class actions to continue for the foreseeable future. With that said, as the above decisions show, personal jurisdiction challenges can play a powerful role in defeating a wide variety of class actions filed for purported violations of Illinois' biometric privacy law.
“Jurisdiction Can Be a Key Tool for BIPA Class Action Defense,” by David J. Oberly was published in Law360 on February 18, 2021.
[1] 129 N.E.3d 1197 (Ill. 2019).
[2] 2020 WL 2796122 (N.D. Ill. May 30, 2020).
[3] 2016 WL 245910 (N.D. Ill. Jan. 21, 2016).
[4] 2020 WL 1492742 (N.D. Ill. Mar. 27, 2020).