Plaintiff Gets Her Own Lawsuit Dismissed on Spokeo Grounds in Seventh Circuit

In Thornley v. Clearview AI, Inc., No. 20-3249 (7th Cir. Jan. 14, 2021), a plaintiff fighting removal of her Illinois class action from state court persuades the Seventh Circuit that the federal courts lacked subject-matter jurisdiction over her claim.

“Illinois’s Biometric Information Privacy Act, familiarly known as BIPA, provides robust protections for the biometric information of Illinois residents. See 740 ILCS 14/1 et seq. It does so by regulating the collection, retention, disclosure, and destruction of biometric identifiers or information—for example, retinal scans, fingerprints, or facial geometry.”

Thornley and others, on behalf of a proposed class, sued Clearview for invasion of their BIPA rights. “Clearview uses a proprietary algorithm to ‘scrape’ pictures from social media sites such as Facebook, Twitter, Instagram, LinkedIn, and Venmo. The materials that it uses are all publicly available. The scraping process is not designed, however, simply to store photographs. Instead, Clearview’s software harvests from each scraped photograph the biometric facial scan and associated metadata (for instance, time and place stamps), and that information is put onto its database. The database, which is stored on servers in New York and New Jersey, at this point contains literally billions of entries.”

Thornley filed her BIPA action in the Circuit Court of Cook County, and Clearview removed it to federal court under the Class Action Fairness Act (CAFA), 28 U.S.C. § 1441. Thornley voluntarily dismissed her action without prejudice under Fed. R. Civ. P. 41(a)(1), then refiled “a new, significantly narrowed, action against Clearview” under BIPA, alleging only a violation of BIPA § 15(c), 740 ILCS 14/15(c). The class was defined as people “who suffered no injury from Defendant’s violation of Section 15(c) of BIPA other than statutory aggrievement” Clearview again removed to federal court, and the district court remanded based on lack of Article III standing due to the absence of injury-in-fact.

The Seventh Circuit affirms. Reversing the ordinary order of things, it was the plaintiff – not the defendant – who wanted dismissal on standing grounds. Thornley argued that she alleged only a “bare procedural violation, divorced from any concrete harm” Spokeo, Inc. v. Robbins, 136 S. Ct. 1540, 1549 (2016). Section 15(c) provides that “[n]o private entity in possession of a biometric identifier or biometric information may sell, lease, trade, or otherwise profit from a person’s or a customer’s biometric identifier or biometric information.” The complaint conceded that “suffered any injury as a result of the violations of Section 15(c) of BIPA other than the statutory aggrievement ….”

The burden was thus on the defendant to establish grounds for federal jurisdiction. “On appeal, Clearview urges us to equate a person’s potential injury from the sale (or lease, etc.) of her data with the injury from retention of that data … or the injury … from the collection of that data and the failure to obtain written consent.” While recognizing that plaintiff could have alleged such injuries, the complaint deliberately avoided stating such claims. “[W]e are left with a general rule that prohibits the operation of a market in biometric identifiers and information,” which by itself did not present a concrete injury.

“One final question remains: may the plaintiffs, by seeking to represent a class that includes only persons who suffered no injury from the alleged violation of section 15(c), prevent the district court from taking a broader view of the case?” The panel holds it was not plausible on this complaint. “We have no reason to believe that the district court, acting on its own initiative, would certify a different and broader class; to that extent, the rule that the plaintiff controls her own case applies …. We know of nothing that would prevent a putative class representative from taking a conservative approach to class definition.”

Judge Hamilton, concurring, adds that “our decision has been determined by the choices that these plaintiffs have made to narrow both their claims and the scope of their proposed class …. In fact, the misuse of a person’s biometric information presents an especially dangerous modern version of these traditional injuries. A victim of identity theft can obtain a new email address or even Social Security number, but ‘biometric identifiers … are immutable, and once compromised, are compromised forever.’” The concurrence also observes that “several of our recent opinions take Spokeo too far. Those opinions do not give sufficient weight to Spokeo’s endorsement of standing where Congress has chosen to provide procedural and informational rights to reduce the risk of more substantive harm for consumers and others, and has created private rights of action to enforce them.”