Vance v. Microsoft Corporation

1 2 3 4 5 6 7 UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON 8 AT SEATTLE 9 10 STEVEN VANCE, et al., CASE NO. C20-1082JLR 11 Plaintiffs, ORDER ON MICROSOFT’S v. MOTION FOR SUMMARY 12 JUDGMENT MICROSOFT CORPORATION, 13 Defendant. 14 15 I. INTRODUCTION 16 Before the court is Defendant Microsoft Corporation’s (“Microsoft”) renewed 17 motion for summary judgment. (Mot. (Dkt. # 127); Reply (Dkt. # 138).) Plaintiffs 18 Steven Vance and Tim Janecyk (collectively, “Plaintiffs”) oppose Microsoft’s motion. 19 (Resp. (Dkt. # 1351).) The court has considered the motion, all materials submitted in 20 1 Plaintiffs originally filed their response under seal because it relied on and cited 21 documents that Microsoft had marked confidential; they also filed a redacted version of their response. (Mot. to Seal (Dkt. # 134); Redacted Resp. (Dkt. # 132).) Because Microsoft did not 22 oppose unsealing the response and the documents, the court denied Plaintiffs’ motion to seal and 1 support of and in opposition to the motion, and the governing law. Being fully advised,2 2 the court GRANTS Microsoft’s motion for summary judgment. 3 II. BACKGROUND 4 The court sets forth the factual and procedural background of this case below. 5 A. Factual Background 6 1. The Diversity in Faces (“DIF”) Dataset 7 Plaintiffs are longtime Illinois residents who, beginning in 2008, uploaded digital 8 photographs, including photos of themselves, to Flickr, a photo-sharing website. (See 9 Compl. (Dkt. # 1) ¶¶ 6-7, 28, 66-67, 75; Vance Dep.3 at 9:15-10:9; Janecyk Dep.4 at 10 39:7-40:1.) In 2014, Yahoo!, Flickr’s then-parent company, publicly released a dataset of 11 about 100 million photographs that had been uploaded to Flickr’s website between 2004 12 13 directed the clerk to remove the seal on Plaintiffs’ responsive brief and the confidential documents. (Mot. to Seal Resp. (Dkt. # 136); 7/11/22 Order (Dkt. # 137).) Accordingly, the 14 court cites the unredacted version of Plaintiffs’ response in this order. 2 Both parties request oral argument on the motion (see Mot. at 1; Resp. at 1). The court, 15 however, concludes that oral argument would not be helpful to its disposition of the motion. See Local Rules W.D. Wash. LCR 7(b)(4). 16 3 Both parties have submitted excerpts from Mr. Vance’s deposition. (See Berger Decl. 17 (Dkt. # 86) ¶ 2, Ex. 1; 7/1/22 Lange Decl. (Dkt. # 132-1) ¶ 2, Ex. 1.) For ease of reference, the court cites directly to the page and line number of the deposition. 18 The court notes that Plaintiffs did not highlight the portions of the deposition transcripts that they referred to in their pleadings as required by Local Civil Rule 10(e)(10). See Local 19 Rules W.D. Wash. LCR 10(e)(10) (“All exhibits [submitted in support of or in opposition to a motion] must be marked to designate testimony or evidence referred to in the parties’ filings.”). 20 The court directs Plaintiffs’ counsel to review the local rules regarding marking exhibits before making any further filings. 21 4 Both parties have submitted excerpts from Mr. Janecyk’s deposition. (See Berger Decl. ¶ 3, Ex. 2; 7/1/22 Lange Decl. ¶ 3, Ex. 2.) For ease of reference, the court cites directly to the 22 page and line number of the deposition. 1 and 2014 (the “YFCC-100M Dataset”). (See Merler Decl. (Dkt. # 85) ¶ 3, Ex. A 2 (“Diversity in Faces”) at 2.) The YFCC-100M Dataset included photos uploaded by both 3 Plaintiffs. (See Vance Dep. at 179:22-23; Janecyk Dep. at 95:22-24.) 4 Before 2018, “there was an industry-wide problem with many facial recognition 5 systems’ ability to accurately characterize individuals who were not male and did not 6 have light colored skin tones.” (Merler Decl. ¶ 4.) As a result, “the facial recognition 7 systems and algorithms associated with those facial recognition systems were trained in 8 such a way that the systems were able to accurately characterize a white, light skinned 9 male subject, but the technology suffered from inaccuracies when it had to characterize a 10 non-male or a person with darker skin tones.” (Id.) Seeking to “advance the study of 11 fairness and accuracy in face recognition technology,” researchers working for 12 International Business Machines Corporation (“IBM”)5 used one million of the photos in 13 the YFCC-100M Dataset to develop the Diversity in Faces (“DiF”) Dataset at issue in 14 this case. (Id. ¶ 5; Diversity in Faces at 2, 7.) The researchers implemented ten “facial 15 coding schemes” to measure aspects of the facial features of the individuals pictured in 16 the photos, such as “craniofacial distances, areas and ratios, facial symmetry and contrast, 17 skin color, age and gender predictions, subjective annotations, and pose and resolution.” 18 (Diversity in Faces at 9.) A statistical analysis of these coding schemes “provided insight 19 into how various dimensions . . . provide indications of dataset diversity.” (Merler 20 5 All of the researchers involved in creating the DiF Dataset were based in and worked 21 out of IBM’s office in Yorktown Heights, New York; and the work was performed on and stored on IBM Research computer servers in Poughkeepsie, New York. (Id. ¶ 8.) None of the work 22 involved computers or systems located in Illinois. (Id.) 1 Decl. ¶ 6.) The coding schemes implemented by the IBM researchers were intended to 2 enable other researchers to develop techniques to estimate diversity in their own datasets, 3 with the goal of mitigating dataset bias, and were “never intended to identify any 4 particular individual.” (Id. ¶ 7.) Rather, the coding schemes were “purely descriptive 5 and designed to provide a mechanism to evaluate diversity in the dataset.” (Id.) 6 IBM provided the DiF Dataset free of charge to researchers who filled out a 7 questionnaire and submitted it to IBM via email. (Id. ¶¶ 4, 9.) The questionnaire 8 required the researcher to verify 9 (i) that he/she would only use the DiF Dataset for research purposes, and (ii) that he/she had read and agreed to the DiF Dataset terms of use, which 10 made clear that the DiF Dataset could only be used for non-commercial, research purposes and prohibited using the DiF Dataset to identify any 11 individuals in images associated with URLs in the DiF Dataset. 12 (Id. ¶ 9; see also id. ¶ 11, Ex. H (DiF Dataset terms of use).) After verifying that a 13 request was for a “legitimate research purpose,” IBM researcher Dr. Michele Merler sent 14 the DiF Dataset to the requesting researcher “via an email that included a link to a 15 temporary Box folder that contained the DiF Dataset.” (Merler Decl. ¶ 10.) 16 2. Plaintiffs’ Photos in the DiF Dataset 17 The DiF Dataset includes at least 61 of the nearly 19,000 public photos that Mr. 18 Vance uploaded to Flickr. (Vance Dep. at 179:22-23, 210:19-24.) Mr. Vance appears in 19 some of the photos in the DiF Dataset; other photos depict people whose state of 20 residence was unknown to Mr. Vance and at least one depicts individuals who themselves 21 were unknown to Mr. Vance. (Id. at 132:4-14; 154:5-16.) 22 1 The DiF Dataset includes 24 of the 1,669 public photos that Mr. Janecyk uploaded 2 to Flickr. (Janecyk Dep. at 74:21-24, 95:22-96:1.) Mr. Janecyk appears in at least one of 3 the photos. (Id. at 99:21-100:6.) Because Mr. Janecyk photographed people on the 4 streets of Chicago, however, he does not know the names or places of residence of the 5 individuals depicted in most of his photos. (Id. at 45:16-46:19, 98:8-100:13, 6 167:11-168:15, 228:19-21.) 7 3. Microsoft’s Downloads of the DiF Dataset 8 Two individuals affiliated with Microsoft downloaded the DiF Dataset in February 9 2019: contractor Benjamin Skrainka and Microsoft Research intern Samira Samadi. 10 (Skrainka Decl. (Dkt. # 87) ¶ 5; Samadi Decl. (Dkt. # 88) ¶¶ 5-6.) The court describes 11 their interactions with the DiF Dataset below. 12 a. Benjamin Skrainka 13 Between September 7, 2018, and August 1, 2019, Mr. Skrainka worked as an 14 independent contractor for Neal Analytics, LLC, a Washington-based consulting firm, 15 through which he contracted as a vendor to Microsoft. (Skrainka Decl. ¶ 2; Skrainka 16 Dep.6 at 91:7-24, 111:8-23.) During this period, Mr. Skrainka provided support for a 17 project, Azure Intelligent Storage (“AIS”), for Microsoft. (Skrainka Decl. ¶ 3.) His work 18 related to defining a benchmark protocol for evaluating a third-party facial recognition 19 technology that Microsoft was considering acquiring. (Id.; Kasap Decl. (Dkt. # 91) 20 6 Both parties have submitted excerpts from Benjamin Skrainka’s deposition. (See 21 5/19/22 Wiese Decl. (Dkt. # 129) ¶ 2, Ex. 1; 7/1/22 Lange Decl. ¶ 12, Ex. 11; 7/29/22 Wiese Decl. (Dkt. # 139) ¶ 2, Ex. 9.) For ease of reference, the court cites directly to the page and line 22 number of the deposition. 1 ¶¶ 2-3.) Mustafa Kasap, a Principal Program Manager, was Mr. Skrainka’s manager and 2 technical advisor for this project. (Skrainka Decl. ¶ 4; Kasap Decl. ¶ 2; Skrainka Dep. at 3 121:11-15.) As part of his project, Mr. Skrainka “determined what the parameters and/or 4 methodology should be for comparing different face recognition technologies available in 5 the market,” including the technology that Microsoft considered acquiring, and developed 6 code to implement these benchmarks. (Skrainka Decl. ¶ 3; Kasap Decl. ¶ 4.) He 7 researched datasets containing photographs that might be suitable for making these 8 comparisons. (Skrainka Decl. ¶ 4.) 9 On or about February 1, 2019, Mr. Skrainka requested a copy of the DiF Dataset 10 from IBM. (Skrainka Decl. ¶ 4.) After Mr. Skrainka filled out IBM’s questionnaire, 11 IBM granted him access to the DiF Dataset through an online link. (Skrainka Decl. ¶ 5.) 12 He downloaded the DiF Dataset sometime in early February 2019 while in Washington. 13 (Id.) Mr. Skrainka evaluated the suitability of the photographs linked in the DiF Dataset 14 for his project by manually inspecting some of the images and used some of the metadata 15 in the DiF Dataset to “shrink or expand images to a consistent size” and to “extract the 16 relevant faces” before running Microsoft’s facial recognition software on them. 17 (Id. ¶¶ 6-7; Skrainka Dep. at 229:18-230:21, 231:13-18, 233:15-235:6.) He was not 18 interested in the coding schemes or facial annotations included in the DiF Dataset. 19 (Skrainka Dep. at 227:21-229:23.) He determined that the images were not suitable for 20 his benchmarking research because they “did not look like a conventional head-on 21 photograph used on a driver’s license or passport” and were of generally low quality. 22 (Skrainka Decl. ¶ 7; see also Skrainka Dep. at 233:7-235:6 (explaining reasons the 1 images were not suitable).) Consequently, he did not further pursue using the DiF 2 Dataset. (Skrainka Decl. ¶ 7.) 3 Mr. Skrainka was unaware that the DiF Dataset included any photographs or data 4 related to Illinois residents. (Id. ¶ 12.) He did not share the DiF Dataset with anyone at 5 Microsoft and is unaware of any other Microsoft group using the DiF Dataset, although 6 he acknowledges that others could have accessed the dataset while it was stored in the 7 cloud without his knowing. (Id.; Skrainka Dep. at 362:14-363:24; see also Kasap Decl. 8 ¶ 7 (stating he, too, was unaware of any other Microsoft group using the DiF Dataset).) 9 Mr. Skrainka does not recall where, “if at all,” he saved his copy of the DiF 10 Dataset. (Skrainka Decl. ¶ 8.) During his project, however, Microsoft instructed him to 11 use a virtual machine7 for his work, and he recalled that “any facial-recognition-related 12 work that [he] performed . . . was loaded only onto virtual machines and cloud storage in 13 Azure.” (Id.; Skrainka Dep. at 188:12-23.) When an Azure user creates a virtual 14 machine or sets up “blob” storage, he or she is prompted to select an Azure Region that 15 determines the geography of the data centers where the data will be stored; each Azure 16 Region includes “availability zones” that map to specific datacenters within the selected 17 region. (Kuttiyan Decl. (Dkt. # 128) ¶ 3.) Mr. Skrainka believes that he used a “West 18 Coast availability zone” for the work that he performed and that he was “almost surely” 19 using West Coast data centers “because they’re faster.” (Skrainka Dep. at 147:2-20, 20 21 7 “A virtual machine emulates the characteristics of a stand-alone physical computer. It shares physical resources, such as servers, with other virtual machines, and each virtual machine 22 is isolated by software.” (Id.) 1 154:10-20.) He acknowledged, however, that he might have saved data in other 2 availability zones, including the East Coast availability zone, and that he was unaware of 3 whether the data was backed up or migrated to other availability zones. (Skrainka Dep. 4 at 148:15-17, 151:19-24, 185:15-20; see also 7/1/22 Lange Decl. ¶ 19, Ex. 18 (“Kuttiyan 5 Dep.”) at 62:17-63:4, 63:24-65:2 (acknowledging that data may be backed up to data 6 centers in other availability zones).) When his project ended, Mr. Skrainka 7 decommissioned all virtual machines that he used in the project, including any data stored 8 on those virtual machines or in the cloud. (Skrainka Decl. ¶ 8.) 9 Microsoft has been unable to confirm if and where on its systems Mr. Skrainka 10 stored his copy of the DiF Dataset. (Mot. at 7; see Brunke Decl. (Dkt. # 92) ¶¶ 5-6.) In 11 its July 15, 2021 supplemental answers to Plaintiffs’ interrogatories, it stated that if Mr. 12 Skrainka’s copy of the DiF dataset had been stored on Microsoft servers in the cloud, the 13 file would have been “chunked (i.e., divided into non-overlapping packets of data bits)” 14 and encrypted, and the encrypted chunks would have been stored in data centers, likely in 15 San Antonio, Texas and Chicago, Illinois. (Lange Decl. ¶ 20, Ex. 19 at 9-10 16 (supplemental answer to ROG No. 8).) In its second supplemental answers served after 17 Mr. Skrainka’s deposition, however, Microsoft “amend[ed] and correct[ed]” its 18 supplemental answer to state that data stored on virtual machines and “blob” storage in 19 the “West US” availability zone in February 2019 would have been stored in servers 20 located in Washington or California, rather than in Illinois. (Id. at 10-11 (second 21 supplemental answer to ROG No. 8); see Kuttiyan Decl. ¶ 4, Ex. A.) 22 1 b. Samira Samadi 2 Between January 22, 2019, and May 3, 2019, while she was a graduate student at 3 Georgia Institute of Technology in Atlanta, Georgia, Ms. Samadi completed a student 4 internship at Microsoft Research in New York City, New York. (Samadi Decl. ¶ 2.) The 5 “focus of [her] internship was a research project involving the study of how humans 6 interact with, use, and make decisions with facial recognition systems.” (Id. ¶ 3.) She 7 “wanted to design a controlled human-subject experiment where participants were shown 8 examples of images of faces and asked to judge the similarities of the faces in the images 9 given the similarity score generated by an automatic facial recognition system.” (Id.) 10 Her goal was “to measure how the humans’ judgments of face similarities are affected by 11 perceived race, skin tone, and gender of the faces they are shown.” (Id.) Her research 12 was not focused on identifying people through facial recognition systems and did not 13 involve measuring facial geometry or features. (Id. ¶ 4.) Ms. Samadi’s research was 14 supervised by Microsoft Senior Principal Researcher Jenn Wortman Vaughan, who was 15 also based in New York. (Vaughan Decl. (Dkt. # 89) ¶¶ 1, 3.) 16 To run her experiment, Ms. Samadi needed “multiple photographs of the same 17 individual, all of which needed to be directly facing the camera or slightly angled.” 18 (Samadi Decl. ¶ 4.) On or about February 20, 2019, she asked IBM for access to the DiF 19 Dataset using her Georgia Institute of Technology credentials. (Id. ¶ 5, Ex. A (email 20 requesting access); see also Vaughan Decl. ¶ 7, Ex. B (email thread discussing Ms. 21 Samadi’s request for the DiF Dataset).) IBM directed Ms. Samadi to fill out its 22 questionnaire, and after she did so, granted her access to the DiF Dataset through an 1 online link. (Samadi Decl. ¶ 6.) She downloaded the dataset on or about February 25, 2 2019, while working at Microsoft Research in New York. (Id.) 3 After she downloaded the DiF Dataset, Ms. Samadi “briefly reviewed” some of 4 the photographs linked in that dataset. (Id. ¶ 7; see also Samadi Dep.8 at 20:5-7 (stating 5 she reviewed the DiF Dataset for about half an hour).) She determined that the photos 6 were not suitable for her project because there were not multiple photos of the same 7 individual facing the camera. (Samadi Decl. ¶ 7.) She did not further review the images 8 in the DiF Dataset. (Id.; see also id., Ex. C (email to Dr. Vaughan, stating that after 9 “looking closely” at the “IBM data,” she found that it did not have multiple images for 10 one person and that the images have “many different backgrounds”).) She did not use the 11 DiF Dataset in her project and the DiF Dataset did not play any role in the development 12 of the paper that she wrote with Dr. Vaughan about the results of her research. (Id. ¶ 11, 13 Ex. E (research paper); Vaughan Decl. ¶¶ 7-8.) 14 Ms. Samadi was “not aware of or interested in any facial annotations” in the DiF 15 Dataset, did not review any such data, and did not share the link to download the DiF 16 Dataset with anyone else. (Samadi Decl. ¶ 8.) She did not know that the DiF Dataset 17 included photographs or data relating to Illinois residents. (Id. ¶ 9.) Neither Ms. Samadi 18 nor Dr. Vaughn are aware of any other projects at Microsoft Research that used the DiF 19 20 21 8 Both parties have submitted excerpts from Samira Samadi’s deposition. (See 5/19/22 Wiese Decl. (Dkt. # 129) ¶ 3, Ex. 2; 7/1/22 Lange Decl. ¶ 22, Ex. 21.) For ease of reference, the 22 court cites directly to the page and line number of the deposition. 1 Dataset, nor are they aware of the DiF Dataset being used by any other group at 2 Microsoft. (Id. ¶ 12; Vaughan Decl. ¶ 11.) 3 Ms. Samadi believes, but is not certain, that she downloaded the DiF Dataset to 4 her Microsoft Research laptop. (Samadi Decl. ¶ 6; Samadi Dep. at 38:20-39:6.) Under 5 Microsoft’s Data Retention and Disposal Standard, data saved on Ms. Samadi’s 6 Microsoft Research laptop was deleted within 180 days of the end of her internship. 7 (Swann Decl. (Dkt. # 90) ¶ 9.) It is possible, however, that Ms. Samadi may have saved 8 the DiF Dataset to her OneDrive account9 or that her laptop was automatically uploading 9 information to OneDrive. (See Chirico Decl. (Dkt. # 93) ¶ 2, Ex. A10 (“3/11/19 Samadi 10 Email”) (email from Ms. Samadi to Mr. Chirico, in which she states that she works with 11 and must download “big data sets” and that her OneDrive account was full); Samadi Dep. 12 at 65:6-20, 57:1-19; Lange Decl. ¶ 20, Ex. 19 at 9 (supplemental answer to ROG No. 8) 13 (stating that Microsoft’s investigation “has not established how Ms. Samadi initially 14 downloaded or stored the IBM DiF Dataset”).) If Ms. Samadi’s copy of the DiF dataset 15 was saved to Ms. Samadi’s OneDrive account, the file would have been “chunked (i.e., 16 divided into non-overlapping packets of data bits) and encrypted, and the encrypted 17 chunks would have been stored in [Microsoft’s] data centers, likely in San Antonio, 18 Texas and Chicago, Illinois.” (Lange Decl. ¶ 20, Ex. 19 at 10-11 (second supplemental 19 answer to ROG No. 8).) 20 9 OneDrive is Microsoft’s cloud file hosting and storage service. (Swann Decl. ¶ 4.) It 21 allows Microsoft personnel to store their files and data in the cloud. (Id.) 22 10 Plaintiffs also provided this email thread as an exhibit. (See Lange Decl. ¶ 25, Ex. 24.) 1 In March 2019, Ms. Samadi reached out to Jeff Chirico, who provided information 2 technology support for Microsoft Research in New York, to ask where she should store 3 data related to her research project. (3/11/19 Samadi Email; Samadi Dep. at 50:24-51:12; 4 Chirico Decl. ¶¶ 1-2.) Mr. Chirico instructed her to save her data on a “hidden share” on 5 a Microsoft Research server located in New York. (3/11/19 Samadi Email; Chirico Decl. 6 ¶¶ 2-3.) This server is not backed up to any other server, and access to the server is 7 restricted to Microsoft Research. (Chirico Decl. ¶ 3.) Microsoft later found a copy of the 8 DiF Dataset and other data from Ms. Samadi’s internship on the Microsoft Research 9 server in New York. (Lange Decl. ¶ 20, Ex. 19 at 8 (answer to ROG No. 8).) 10 B. Relevant Procedural Background 11 Plaintiffs filed their proposed class complaint in this action on July 14, 2020. 12 (Compl.) They brought claims against Microsoft for violations of two provisions of 13 Illinois’s Biometric Information Privacy Act, 740 ILCS § 14/1, et seq. (“BIPA”), unjust 14 enrichment, and injunctive relief. (Id. ¶¶ 93-122.) With respect to the BIPA violations, 15 Plaintiffs alleged that Microsoft (1) violated BIPA § 15(b) by collecting and obtaining 16 their biometric data without providing required information or obtaining written releases, 17 and (2) violated BIPA § 15(c) by unlawfully profiting from Plaintiffs’ biometric data. 18 (Id. ¶¶ 93-106.) 19 On September 14, 2020, Microsoft moved to dismiss Plaintiffs’ claims. (MTD 20 (Dkt. # 25).) On March 15, 2021, the court granted in part and denied in part Microsoft’s 21 motion to dismiss. (3/15/21 Order (Dkt. # 43).) The court (1) granted Microsoft’s 22 motion to dismiss Plaintiffs’ injunctive relief claim on the ground that injunctive relief is 1 not a standalone cause of action; (2) denied Microsoft’s motion to dismiss Plaintiffs’ 2 BIPA § 15(b) claim, concluding that Plaintiffs had sufficiently alleged the elements of the 3 claim; and (3) deferred ruling on Microsoft’s motion to dismiss Plaintiffs’ BIPA § 15(c) 4 and unjust enrichment claims pending the receipt of supplemental briefing. (See 5 generally id.) On April 14, 2021, after reviewing the parties’ supplemental briefing and 6 hearing oral argument, the court dismissed Plaintiffs’ BIPA § 15(c) claim with leave to 7 amend and denied Microsoft’s motion to dismiss Plaintiffs’ unjust enrichment claim. 8 (See 4/13/21 Min. Entry (Dkt. # 46); 4/14/21 Order (Dkt. # 47).) Despite being granted 9 leave to do so, Plaintiffs did not amend their BIPA § 15(c) claim. (See generally Dkt.) 10 Microsoft filed its original motion for summary judgment on December 10, 2021. 11 (1st MSJ (Dkt. # 84).) On February 8, 2022, the court granted in part Plaintiffs’ motion 12 for additional discovery pursuant to Federal Rule of Civil Procedure 56(d) and struck 13 Microsoft’s original motion for summary judgment without prejudice. (2/8/22 Order 14 (Dkt. # 118); see also Pls. 56(d) Mot. (Dkt. # 107).) 15 On May 19, 2022, Microsoft filed the instant renewed motion for summary 16 judgment. (See Mot.) Subsequently, the parties agreed to a stipulated briefing schedule 17 to allow Plaintiffs to obtain additional discovery. (5/27/22 Stip. (Dkt. # 130).) Thus, this 18 motion became ripe for decision on July 29, 2022. (Id.) 19 III. ANALYSIS 20 Microsoft argues that summary judgment on Plaintiffs’ claims is warranted 21 because (1) BIPA cannot apply extraterritorially to its conduct outside of Illinois as a 22 matter of Illinois law; (2) applying BIPA to Microsoft’s conduct would violate the 1 dormant Commerce Clause of the United States Constitution; (3) even if BIPA could 2 apply to Microsoft’s out-of-state conduct, Plaintiffs cannot prove the elements of their 3 BIPA § 15(b) claim; and (4) Plaintiffs cannot prove the elements of their unjust 4 enrichment claim. (See generally Mot.) Below, the court sets forth the standard for 5 evaluating motions for summary judgment before considering Microsoft’s motion. 6 A. Summary Judgment Standard 7 Under Rule 56 of the Federal Rules of Civil Procedure, either “party may move 8 for summary judgment, identifying each claim or defense—or the part of each claim or 9 defense—on which summary judgment is sought.” Fed. R. Civ. P. 56. Summary 10 judgment is appropriate if the evidence, when viewed in the light most favorable to the 11 non-moving party, demonstrates “that there is no genuine dispute as to any material fact 12 and the movant is entitled to judgment as a matter of law.” Id.; see Celotex Corp. v. 13 Catrett, 477 U.S. 317, 322 (1986). A dispute is “genuine” if “the evidence is such that a 14 reasonable jury could return a verdict for the nonmoving party.” Anderson v. Liberty 15 Lobby, Inc., 477 U.S. 242, 248 (1986). A fact is “material” if it “might affect the 16 outcome of the suit under the governing law.” Id. 17 The moving party bears the initial burden of showing that there is no genuine 18 dispute of material fact and that it is entitled to prevail as a matter of law. Celotex, 477 19 U.S. at 323. If the moving party does not bear the ultimate burden of persuasion at trial, 20 it nevertheless “has both the initial burden of production and the ultimate burden of 21 persuasion on a motion for summary judgment.” Nissan Fire & Marine Ins. Co. v. Fritz 22 Companies, Inc., 210 F.3d 1099, 1102 (9th Cir. 2000). “In order to carry its burden of 1 production, the moving party must either produce evidence negating an essential element 2 of the nonmoving party’s claim or defense or show that the nonmoving party does not 3 have enough evidence of an essential element to carry its ultimate burden of persuasion at 4 trial.” Id. If the moving party meets its burden of production, the burden then shifts to 5 the nonmoving party to identify specific facts from which a factfinder could reasonably 6 find in the nonmoving party’s favor. Celotex, 477 U.S. at 324; Anderson, 477 U.S. at 7 250. 8 The court is “required to view the facts and draw reasonable inferences in the light 9 most favorable to the [nonmoving] party.” Scott v. Harris, 550 U.S. 372, 378 (2007). 10 The court may not weigh evidence or make credibility determinations in analyzing a 11 motion for summary judgment because these are “jury functions, not those of a judge.” 12 Anderson, 477 U.S. at 249-50. Nevertheless, the nonmoving party “must do more than 13 simply show that there is some metaphysical doubt as to the material facts . . . . Where 14 the record taken as a whole could not lead a rational trier of fact to find for the 15 nonmoving party, there is no genuine issue for trial.” Scott, 550 U.S. at 380 (quoting 16 Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 586-87 (1986) (internal 17 quotation marks omitted)). 18 B. Extraterritoriality Doctrine 19 Under Illinois law, a “statute is without extraterritorial effect unless a clear intent 20 in this respect appears from the express provisions of the statute.” Avery v. State Farm 21 Mut. Ins. Co., 835 N.E.2d 801, 852 (Ill. 2005) (quoting Dur-Ite Co. v. Indus. Comm’n, 68 22 N.E.2d 717 (Ill. 1946) (internal quotation marks omitted)). Because BIPA does not 1 contain such an express provision, it does not apply extraterritorially to conduct outside 2 of Illinois. Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1100 (N.D. Ill. 2017); (see 3 3/15/21 Order at 6). Thus, to survive summary judgment, Plaintiffs must show a genuine 4 issue of material fact regarding whether the circumstances underlying their BIPA claims 5 “occurred primarily and substantially in Illinois.” Avery, 835 N.E.2d at 854; (see also 6 3/15/21 Order at 6). 7 Microsoft asserts that Illinois’s extraterritoriality doctrine bars Plaintiffs’ BIPA 8 claims because none of its conduct relating to those claims took place in Illinois. (Mot. at 9 11-15.) Rather, its relevant conduct—downloading, reviewing, and evaluating the DiF 10 Dataset—took place in Washington and New York. (Id. at 13-15.) Thus, according to 11 Microsoft, Plaintiffs cannot prove that its conduct “occurred primarily and substantially 12 in Illinois.” (Id. at 10-11 (citing Avery, 835 N.E.2d at 854).) Plaintiffs, for their part, 13 counter that the extraterritoriality doctrine does not apply because Microsoft’s relevant 14 conduct occurred in Illinois. (Resp. at 10-16.) The court agrees with Microsoft that the 15 extraterritoriality doctrine bars Plaintiffs’ BIPA claims as a matter of law. 16 Plaintiffs have not met their burden at summary judgment to establish a genuine 17 issue of material fact regarding whether Microsoft’s relevant conduct “occurred primarily 18 and substantially in Illinois.” Avery, 835 N.E.2d at 854. First, Plaintiffs rely on the 19 court’s order denying Microsoft’s motion to dismiss, in which the court identified the 20 allegations in Plaintiffs’ complaint that precluded dismissal on extraterritoriality grounds. 21 (Resp. at 13-14 (quoting 3/15/21 Order at 8).) At summary judgment, however, Plaintiffs 22 can no longer rest on their allegations. Instead, they must identify evidence sufficient to 1 establish a genuine issue of material fact regarding whether the circumstances giving rise 2 to their claims occurred “primarily and substantially in Illinois.” Avery, 835 N.E.2d at 3 854. As discussed below, they have not met this burden. 4 Second, Plaintiffs contend that the extraterritoriality doctrine does not bar their 5 claims because (1) Plaintiffs resided in Illinois; (2) Plaintiffs’ photos from which their 6 biometric data was collected were taken in Illinois and uploaded to the Internet in Illinois; 7 and (3) Plaintiffs’ injuries occurred in Illinois. (Resp. at 14-15.) They also contend that 8 “both Mr. Skrainka and Ms. Samadi likely downloaded the [DiF D]ataset to a datacenter 9 in Illinois.” (Id. at 11-12.) At most, however, they point to the possibility that Microsoft 10 may have stored “chunked” and encrypted copies of the DiF Dataset on a cloud server 11 located in Illinois. (Id.; Lange Decl. ¶ 20, Ex. 19 at 9-11.) But as Microsoft points out, 12 even if Plaintiffs could prove that Microsoft stored the DiF Dataset in a datacenter in 13 Illinois, the relevant section of BIPA regulates only the acquisition of data, rather than the 14 encrypted storage of data after it is acquired. (Mot. at 13); 740 ILCS § 14/15(b) (stating 15 that “[n]o private entity may collect, capture, purchase, receive through trade, or 16 otherwise obtain a person’s or a customer’s biometric identifier or biometric 17 information”). Plaintiffs have not identified any other relevant conduct by Microsoft that 18 took place either primarily or substantially in Illinois. (See generally id.) 19 The cases Plaintiffs cite in support of their argument that claims “relating to 20 photos taken and uploaded to the internet in Illinois” necessarily survive the 21 extraterritoriality doctrine are all distinguishable from the present case. (See Resp. at 22 14-16.) In In re Facebook Biometric Info. Privacy Litig., 326 F.R.D. 535, 547 (N.D. Cal. 1 2018), for example, the plaintiff Illinois residents uploaded their photos to Facebook’s 2 social media service in Illinois. Facebook then scanned the photos, identified the 3 individuals in those photos, and suggested names of individuals to tag in those photos. 4 Id. Thus, Facebook reached into Illinois by providing its service to the plaintiffs, and the 5 plaintiffs’ direct interactions with Facebook gave rise to the alleged BIPA violations. See 6 id. (noting that Facebook had not “tendered any evidence” that the circumstances relating 7 to its conduct did not occur “primarily and substantially within” Illinois); id. at 549 8 (granting the plaintiffs’ motion for class certification). 9 Plaintiffs’ remaining citations are to decisions denying motions to dismiss. (See 10 Resp. at 14-15.) In In re Clearview AI, Inc. Consumer Privacy Litig., 585 F. Supp. 3d 11 1111, 1118, 1121 (N.D. Ill. 2022), clarified on denial of reconsideration by 2022 WL 12 2915627 (N.D. Ill. July 25, 2022), the court observed, in denying the defendants’ motion 13 to dismiss on extraterritoriality grounds, that the plaintiffs had alleged that the defendants 14 “trespassed on the Illinois subclass members’ private domains in Illinois,” “contracted 15 with hundreds of Illinois entities, both public and private,” and “used artificial 16 intelligence algorithms to scan the face geometry of each individual depicted to harvest 17 the individuals’ unique biometric identifiers.” Rivera v. Google, Inc., 238 F. Supp. 3d 18 1088, 1091 (N.D. Ill. 2017), involved a challenge to Google’s alleged practice of 19 automatically uploading photos taken by Illinois residents on Google Droid devices in 20 Illinois to its Google Photos service; immediately scanning the photos to create 21 “templates” that mapped the Illinois plaintiffs’ “distinct facial measurements”; and then 22 using those templates to “find and group together other photos of” the Illinois plaintiffs. 1 Similarly, in Monroy v. Shutterfly, Inc., No. 16 C 10984, 2017 WL 4099846, at *1 (N.D. 2 Ill. Sept. 15, 2017), the Illinois plaintiff alleged that when he uploaded a photo to 3 Shutterfly’s website, Shutterfly’s facial recognition software scanned the image, located 4 the faces in the image, and extracted a template for each face that could be used to 5 identify the persons in the photo. In all of these cases, the plaintiffs alleged that the 6 defendant itself reached into Illinois to collect their photographs, scan the photographs, 7 and/or generate facial measurements or templates for use in facial recognition systems 8 without the plaintiffs’ consent. 9 Here, in contrast, there is no dispute that other entities—rather than Microsoft— 10 were responsible for the collection of the photographs, the scanning of the photographs, 11 and the generation of facial measurements or templates. (See Mot. at 3-4 (describing the 12 conduct of Flickr, Yahoo, and IBM in collecting photos, creating datasets, and generating 13 facial measurements); Resp. at 3-10 (describing Microsoft’s conduct in downloading and 14 evaluating the DiF dataset); see generally id. (making no argument disputing Microsoft’s 15 description of Flickr, Yahoo, and IBM’s conduct).) Furthermore, Plaintiffs identify no 16 evidence that either Mr. Skrainka or Ms. Samadi had any relevant connection to Illinois 17 (aside from the possibility that Microsoft saved their data in a data center in Illinois), let 18 alone downloaded, reviewed, or evaluated the DiF Dataset in Illinois. (See generally 19 Resp.) As a result, this case is closer in nature to McGoveran v. Amazon Web Services, 20 Inc., C.A. No. 20-13399-LPS, 2021 WL 4502089, at *4 (D. Del. Sept. 30, 2021), in 21 which the court noted that the plaintiffs’ allegations about the case’s connections to 22 Illinois were “nothing more than repeated statements (phrased three different ways) about 1 Plaintiffs’ residency” and granted the defendant’s motion to dismiss under the 2 extraterritoriality doctrine. 3 The court concludes that, even if Microsoft’s systems “chunked,” encrypted, and 4 stored the DiF Dataset on a server in Illinois, any connection between Microsoft’s 5 conduct and Illinois is too attenuated and de minimis for a reasonable juror to find that the 6 circumstances underlying Microsoft’s alleged BIPA violation “occurred primarily and 7 substantially in Illinois.” Avery, 835 N.E.2d at 854; see also McGoveran, 2021 WL 8 4502089, at *4-6. Therefore, the court GRANTS Microsoft’s motion for summary 9 judgment on Plaintiffs’ BIPA claim.11 10 B. Unjust Enrichment 11 To prevail on a claim for unjust enrichment under Illinois law,12 a plaintiff must 12 prove (1) that the defendant has unjustly retained a benefit to the plaintiff’s detriment and 13 (2) that the defendant’s retention of the benefit “violates the fundamental principles of 14 justice, equity, and good conscience.” HPI Health Care Servs., Inc. v. Mt. Vernon Hosp., 15 Inc., 545 N.E.2d 672, 679 (Ill. 1989). Plaintiffs alleged that Microsoft “obtained a 16 monetary benefit from Plaintiffs . . . to their detriment . . . by profiting off of 17 18 19 11 Because the court grants Microsoft’s motion for summary judgment on 20 extraterritoriality grounds, it need not address Microsoft’s argument that the extraterritorial application of BIPA in this case would violate the Dormant Commerce Clause or Microsoft’s specific arguments relating to BIPA § 15(b). 21 12 The court previously determined that Illinois law governed Plaintiffs’ unjust 22 enrichment claim. (4/14/21 Order at 20-21.) 1 Plaintiffs’ . . . biometric identifiers and information” without providing “full 2 compensation for the benefit received from Plaintiffs.” (Compl. ¶¶ 108, 111.) 3 Microsoft asserts that it is entitled to summary judgment on Plaintiffs’ unjust 4 enrichment claim because it “did not use the DiF Dataset at all” and therefore “could not 5 possibly have obtained any ‘monetary benefit’ or ‘profit’ from Plaintiffs’ biometric 6 identifiers or information.” (Mot. at 23-24.) Rather, according to Microsoft, Mr. 7 Skrainka and Ms. Samadi “each reviewed some linked photos briefly, but neither they 8 nor anyone else at Microsoft used the DiF Dataset for any purpose—much less used the 9 annotations that Plaintiffs claim are biometrics.” (Mot. at 24.) Plaintiffs counter that 10 summary judgment is precluded because there is a material question of fact as to whether 11 Microsoft profited from its use of the DiF Dataset. (Resp. at 24.) Specifically, they 12 contend that Mr. Skrainka13 downloaded the DiF Dataset to evaluate a facial recognition 13 product that Microsoft was considering purchasing and that there is a question of fact as 14 to whether Mr. Skrainka in fact used the DiF Dataset or some other dataset to accomplish 15 that work. (Id. (citing Skrainka Dep. at 356:4-22, 340:19-341:3).) In reply, Microsoft 16 asserts that it is undisputed that Mr. Skrainka never used the facial annotations in the DiF 17 Dataset—rather, his evaluation used only the Flickr URLs for the photos, a sample of 18 photos, and spatial coordinates locating faces within a photo, none of which constitute 19 biometric identifiers or information. (Reply at 12 (citing 740 ILCS § 14/10 (“‘Biometric 20 21 13 Plaintiffs make no argument that Ms. Samadi’s conduct forms the basis of any unjust enrichment claim. (See Resp. at 24.) 22 1 identifier’ means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face 2 geometry. Biometric identifiers do not include . . . photographs . . . .”).) 3 Viewing the evidence in the light most favorable to Plaintiffs, the court concludes 4 Plaintiffs have not met their burden to identify specific facts from which a jury could 5 reasonably find that Microsoft unjustly retained a benefit to Plaintiffs’ detriment. To the 6 contrary, the court agrees with Microsoft that Plaintiffs have presented no evidence that 7 would establish a genuine issue of fact regarding whether Microsoft used Plaintiffs’ 8 biometric information or identifiers to its benefit, much less that Microsoft obtained some 9 sort of monetary benefit from their biometric information. Accordingly, the court 10 GRANTS Microsoft’s motion for summary judgment on Plaintiffs’ unjust enrichment 11 claim.14 12 IV. CONCLUSION 13 For the foregoing reasons, the court GRANTS Microsoft’s motion for summary 14 judgment (Dkt. # 127). 15 Dated this 17th day of October, 2022. 16 A 17 18 JAMES L. ROBART United States District Judge 19 20 14 For the same reasons, the court concludes that the result would be the same if 21 Washington law applied to Plaintiffs’ unjust enrichment claim. See Cousineau v. Microsoft, 992 F. Supp. 2d 1116, 1129 (W.D. Wash. 2012) (setting forth the elements of an unjust enrichment 22 claim under Washington law).