Background
Users of Samsung smartphones and tablets brought a putative class action alleging that the devices’ preinstalled Gallery application violated the Illinois Biometric Information Privacy Act. According to the complaint, the application automatically scans photographs for faces, creates numerical templates based on facial geometry, and groups photographs depicting the same person.
The plaintiffs alleged that Samsung possessed, collected, captured, or otherwise obtained their biometric data without maintaining the retention-and-destruction policy or providing the notices and obtaining the written releases required by BIPA Sections 15(a) and 15(b). The district court dismissed the second amended complaint with prejudice for failure to state a claim, and the plaintiffs appealed.
The Court’s Holding
The Seventh Circuit affirmed. Relying on the ordinary meanings of BIPA’s terms and Illinois decisions interpreting them, the court held that “possession,” “collect,” “capture,” and “obtain” all require the defendant to have or acquire some degree of control over the biometric data. The complaint did not plausibly allege that Samsung controlled the facial-geometry data or templates generated and stored on users’ devices.
The court distinguished control over the Gallery software from control over data produced through that software. The plaintiffs did not plausibly allege that Samsung could access, modify, or use the facial data, that the data were stored anywhere other than the users’ devices, or that facial templates were uploaded with photographs backed up to Samsung’s cloud servers. Samsung’s privacy policy stating that it “may collect” biometrics likewise did not establish that Samsung actually collected the data at issue. The court assumed without deciding that the facial-geometry data and templates qualified as biometric identifiers or biometric information under BIPA.
Key Takeaways
- BIPA Sections 15(a) and 15(b) require a private entity to possess or acquire some degree of control over the biometric data at issue.
- Providing hardware and software that generate biometric data locally does not, without more, plausibly allege that the manufacturer possesses, collects, captures, or obtains that data.
- Speculation that facial templates might accompany photographs uploaded to cloud storage, or a general policy saying the company may collect biometrics, was insufficient to survive dismissal.
Why It Matters
The decision draws a significant line for BIPA claims involving consumer devices: control over facial-recognition software is not necessarily control over the biometric information the software creates. Plaintiffs challenging on-device processing must plead facts supporting a reasonable inference that the manufacturer itself accessed, received, stored, used, or otherwise controlled the resulting biometric data.
The ruling does not decide whether Samsung’s facial templates are covered biometric data. Instead, it resolves the case at the antecedent control requirement and confirms dismissal with prejudice where repeated amendments failed to plausibly connect locally stored data to the manufacturer.