illinois – Attorney Evan Brown

February 15, 2022 Privacy

Biometric privacy statute does not violate First Amendment

biometric privacy First Amendment — Biometric identifiers extracted from a photo are not public in the same way the photo itself is

Plaintiffs filed a class action lawsuit against a facial recognition technology company and related individual defendants, asserting violations of the Illinois Biometric Information Privacy Act (“BIPA”). Plaintiffs alleged that defendants covertly scraped over three billion photographs of faces from the internet and then used artificial intelligence algorithms to scan the face geometry of each individual depicted to harvest the individuals’ unique biometric identifiers and corresponding biometric information. One of the defendants then created a searchable database containing this biometric information and data that enabled users of its proprietary platform to identify unknown individuals by uploading a photograph to the database. Accordingly, plaintiffs alleged that defendants collected, captured, or otherwise obtained their biometric data without notice and consent, and thereafter, sold or otherwise profited from their biometric information, all in violation of BIPA.

Unconstitutional restriction on public information?

Defendants moved to dismiss the BIPA claim on a number of grounds, including an argument that BIPA violated defendants’ First Amendment rights. More specifically, defendants maintained that the capture and analysis of faceprints from public images was protected speech, and thus, BIPA was unconstitutional because it inhibited the ability to collect and analyze public information. Plaintiffs, however, asserted that the capturing of faceprints and the action of extracting private biometric identifiers from the faceprints was unprotected conduct. The court sided with plaintiffs and rejected defendants’ argument.

The court held that defendants’ argument oversimplified plaintiffs’ allegations. Although defendants captured public photographs from the internet, they then harvested an individual’s unique biometric identifiers and information – which are not public information – without the individual’s consent. Put differently, plaintiffs asserted that the defendants’ business model was not based on the collection of public photographs from the internet, some source code, and republishing information via a search engine, but the additional conduct of harvesting nonpublic, personal biometric data. And, as plaintiffs further alleged, unlike fingerprints, facial biometrics are readily observable and present a grave and immediate danger to privacy, individual autonomy, and liberty.

An intermediate approach to biometric privacy

Accordingly, the court looked at defendants’ conduct as involving both speech and nonspeech elements. Looking to the test set out in the Supreme Court case of United States v. O’Brien, 391 U.S. 367 (1968), the court evaluated how when “elements are combined in the same course of conduct, a sufficiently important governmental interest in regulating the nonspeech element can justify incidental limitations on First Amendment freedoms.” The court applied the intermediate scrutiny standard set out in O’Brien, namely, a regulation does not violate the First Amendment if (1) it is within the power of the government to enact, (2) furthers an important government interest, (3) the governmental interest is unrelated to the suppression of free expression, and (4) any incidental restriction on speech is no greater than is necessary to further the government interest.

The first element was easy to dispense with because the parties did not argue that the Illinois General Assembly lacked the power to enact BIPA. On the second element, the court found that the General Assembly enacted BIPA to protect Illinois residents’ highly sensitive biometric information from unauthorized collection and disclosure. Regarding the third element, the court noted that BIPA, including its exceptions, does not restrict a particular viewpoint, nor does it target public discussion of an entire topic. And on the fourth O’Brien element, the court found BIPA to be narrowly tailored by legitimately protecting Illinois residents’ highly sensitive biometric information and data, yet allowing residents to share their biometric information through its consent provision. And BIPA is not overly-broad, in the court’s view, because it does not prohibit a substantial amount of protected speech.

In re Clearview AI, Inc., Consumer Privacy Litigation, 2022 WL 444135 (N.D. Illinois, February 14, 2022)

October 17, 2012 Privacy

Fear of crime exception made recording phone call okay under eavesdropping statute

Carroll v. Merrill Lynch, No. 12-1076 (7th Cir. October 16, 2012)

Late in the evening on Thanksgiving Day 2005, plaintiff called her co-worker at home and started yelling profanities. The co-worker’s wife picked up another phone on the line and, becoming alarmed at the threatening nature of the conversation, began recording the call.

rotary phone

Plaintiff sued under the Illinois eavesdropping statute, 720 ILCS 5/14. Defendants moved for summary judgment, arguing that the recording was covered under the “fear of crime” exception to the statute. The lower court granted the motion for summary judgment and plaintiff sought review with the Seventh Circuit. On appeal, the court affirmed the award of summary judgment.

The Illinois eavesdropping statute prohibits recording a conversation unless all parties consent to the recording. But that general rule is subject to a bunch of exceptions, such as recordings made:

under reasonable suspicion that another party to the conversation is committing, is about to commit, or has committed a criminal offense against the person or a member of his or her immediate household, and there is reason to believe that evidence of the criminal offense may be obtained by the recording

In this case, the court held that the wife had both a subjective and objective belief that the plaintiff would, at minimum, vandalize their home. Since plaintiff introduced no evidence to create a genuine issue of material fact on the question of the wife’s asserted fear of a crime being committed, summary judgment had been properly granted.

Photo courtesy Vincent Van Der Pas under this Creative Commons license.

April 7, 2011 Computer Crime, Privacy

Court says law firm did not eavesdrop on employee phone calls

Bowden v. Kirkland & Ellis, 2011 WL 1211555 (7th Cir. April 1, 2011)

Two former employees of a law firm sued the firm for violation of the Electronic Communications Privacy Act, 18 USC 2510 et seq. and for violation of the Illinois Eavesdropping Act, 720 ILCS 5/14-2. The district court granted summary judgment in favor of the law firm. The former employees sought review with the Seventh Circuit. On appeal, the court affirmed the grant of summary judgment.

The court held that the former employees’ evidence of eavesdropping raised no more than a “theoretical possibility” of a violation. Even one of the strongest experts in the case triple hedged his testimony, saying the records “could indicate the potential that interception may have occurred.” So the grant of summary judgment was proper.

The plaintiffs had also raised an electronic discovery issue, namely a claim that the law firm spoliated evidence by destroying a server that contained phone records relevant to the case. The court rejected that argument, finding no credible evidence that the destruction was undertaken in bad faith.

March 19, 2011 Fraud/Misrepresentation

Court rules against woman accused of fraudulent misrepresentation for creating fake internet boyfriend

Bonhomme v. St. James, — N.E.2d —, (Ill.App. 2 Dist March 10, 2011.)

Perhaps the most famous legal case about someone creating a false persona online and using that to dupe someone is the sad case of Megan Meier, which resulted in the (unsuccessful) prosecution of Lori Drew. The facts of that case were hard to believe — a woman created the identity of a teenage boy from scratch by setting up a bogus MySpace profile, then engaged in sustained communications with young Megan, leading her to believe the two of them had a real relationship. After the “boy” broke that relationship off, Megan committed suicide.

Here’s a case that has not seen quite as much tragedy, but the extent and the nature of the alleged deception is just as incredible, if not more so, than that undertaken by Lori Drew.

The appellate court of Illinois has held that a woman who was allegedly the victim of an elaborate ruse, perpetrated in large part over the internet, can move forward with her fraudulent misrepresentation claim against the woman who created the fake persona of a “man” who became her “boyfriend”. The story should satisfy your daily requirement of schadenfreude.

Plaintiff first got to know defendant Janna St. James back in 2005 in an online forum for fans of the HBO show Deadwood. A couple months after they first began talking online, defendant set up another username on the Deadwood site, posing as a man named “Jesse”. Plaintiff and this “Jesse” (which was actually defendant) struck up an online romance which apparently got pretty intense.

To add detail to the ploy, defendant invented no less than 20 fictitious identities — all of whom were purportedly in “Jesse’s” social or family circle — which she used to communicate with plaintiff.

The interactions which took place, both online and through other media and forms of communication (e.g., phone calls using a voice disguiser) were extensive. “Jesse” and plaintiff planned to meet up in person once, but “Jesse” cancelled. Plaintiff sent $10,000 worth of gifts to “Jesse” and to the other avatars of defendant. It even went so far as “Jesse” and plaintiff planning to move to live with one another in Colorado. But before that could happen, defendant pulled the plug on “Jesse” — he “died” of liver cancer.

Some time after that, defendant (as herself) flew from Illinois to California to visit plaintiff. During this trip, some of plaintiff’s real friends discovered the complex facade. Plaintiff sued.

The trial court dismissed plaintiff’s fraudulent misrepresentation claim. Plaintiff sought appellate review. On appeal, the court reversed, sending the case for fraudulent misrepresentation back to the trial court.

The court said some interesting things about whether the facts that plaintiff alleged supported her claim for fraudulent misrepresentation. A plaintiff suing for fraudulent misrepresentation under Illinois law must show: (1) a false statement of material fact; (2) knowledge or belief of the falsity by the party making it; (3) intention to induce the plaintiff to act; (4) action by the plaintiff in justifiable reliance on the truth of the statement; and (5) damage to the plaintiff resulting from that reliance.

Defendant made a strange kind of circular argument as to the first element — falsity of a material fact. She asserted that plaintiff’s claim was based more on the fiction that defendant pursued rather than specific representations. And the concepts of “falsity” and “material fact,” defendant argued, should not apply in the context of fiction, which does not purport to represent actuality. So defendant essentially argued that so long as she knew the masquerade was fiction, there could be no misrepresentation. The court recognized how invalid this argument was. The logic would shift the element of reliance on the truth of the statement from the injured party to the utterer.

Though the appellate court ruled in favor of plaintiff, the judges disagreed on the question of whether plaintiff was justified in relying on the truth of what defendant (as “Jesse,” as the other created characters, and herself) had told plaintiff. One judge dissented, observing that “[t]he reality of the Internet age is that an online individual may not always be — and indeed frequently is not — who or what he or she purports to be.” The dissenting judge thought it simply was not justifiable for plaintiff to spend $10,000 on people she had not met, and to plan on moving in with a man sight-unseen. (In so many words, the judge seemed to be saying that plaintiff was too gullible to have the benefit of this legal claim.)

The majority opinion, on the other hand, found the question of justifiable reliance to be more properly determined by the finder of fact in the trial court. For the motion to dismiss stage, plaintiff had alleged sufficient facts as to justifiable reliance.

(Congratulations to my friend Daliah Saper for her good lawyering in this case on behalf of plaintiff.)

October 6, 2010 Personal Jurisdiction

Deliberate exploitation of market subjects GoDaddy to personal jurisdiction in Illinois

uBid v. GoDaddy, — F.3d —, 2010 WL 3768075 (7th Cir. September 29, 2010)

uBid sued GoDaddy in federal court in Illinois, alleging cybersquatting. uBid claimed that GoDaddy — an Arizona-based company — intended to profit in bad faith by registering on behalf of its customers certain domain names that were similar to uBid’s trademarks. uBid alleged that GoDaddy would set up parked pages at those domains, displaying sponsored links to sites run by uBid’s competitors.

The district court dismissed the case, finding that the court lacked personal jurisdiction over GoDaddy. uBid sought review with the Seventh Circuit. On appeal, the court reversed, holding that the exercise of personal jurisdiction over GoDaddy would not violate due process.

Contact with the forum state

The court held that GoDaddy’s activities in Illinois were not continuous or systematic enough for the exercise of general jurisdiction. But applying the standards set forth in Keeton v. Hustler, the court found that GoDaddy’s efforts to exploit the Illinois marketplace were done so thoroughly, deliberately and successfully that it would not be unfair for GoDaddy to appear in court in Illinois.

After all, in part through its ads at Wrigley Field, the United Center and Joliet Speedway, not to mention the numerous Super Bowl ads seen in Illinois, GoDaddy had acquired hundreds of thousands of customers in the state.

Relatedness of claims

In finding that GoDaddy’s contacts with Illinois were sufficiently related to the claims in the case, the court similarly looked to the extent and nature of GoDaddy’s advertising and marketing. The court couched the relatedness in terms of a quid pro quo:

[O]ut-of-state residents may avail themselves of the benefits and protections of doing business in a forum state, but they do so in exchange for submitting to jurisdiction in that state for claims arising from or relating to those activities.

In this case, GoDaddy’s connection with Illinois and uBid’s claims made the relatedness quid pro quo “balanced and reasonable.” GoDaddy’s contacts with Illinois alleged in the complaint and the alleged wrongs committed were so “intimately related” that GoDaddy should not have been surprised to find itself sued in Illinois.

Fair play and substantial justice

Finally, the court examined the question of whether the exercise of personal jurisdiction would comport with traditional notions of fair play and substantial justice. Again, the court’s finding relied on the thoroughness with which GoDaddy had exploited the Illinois marketplace.

Race car image courtesy Flickr user Jr 88 Rules under this Creative Commons license.

June 17, 2010 Anonymity, Electronic Discovery, Privacy

Illinois court sets standard for unmasking anonymous commenters

Maxon v. Ottawa Pub. Co., — N.E.2d —, 2010 WL 2245065 (Ill.App. 3 Dist. June 1, 2010)

The rules of civil procedure in Illinois permit an aggrieved party to file a petition with the court asking for an order requiring unknown potential defendants to be identified. This is called a Rule 224 petition.

A couple from Ottawa, Illinois got their feelings hurt over some anonymous comments left in response to content published by the local newspaper on its website. Wanting to sue for defamation, the couple filed a Rule 224 petition. The newspaper opposed the petition. (For something similar, see Enterline v. Pocono Medical Center.)

The trial court denied the petition, applying the standards articulated in Dendrite v. Doe and Doe v. Cahill, finding that the petitioners had not presented a strong enough case for defamation to justify the unmasking of the anonymous commenters. Those cases require, among other things, that a party seeking to identify an anonymous speaker make efforts to notify the anonymous party, and present enough evidence to establish a prima facie case of defamation (Dendrite) or survive a hypothetical motion for summary judgment (Cahill).

The aggrieved couple sought review with the Appellate Court of Illinois. Reviewing the decision to deny the Rule 224 petition de novo, the court reversed and remanded, ordering the identification of the anonymous speakers to be made.

In reaching its decision, the court rejected the newspaper’s (and amicis’) arguments that the trial court should apply the rigorous standards of Dendrite and Cahill. That’s not to say, however, that the court left anonymous speakers at great risk of having their First Amendment rights trampled upon.

The court held that the mechanics of Rule 224 adequately protect the potential First Amendment rights of anonymous internet speakers. Here’s why, according to the court:

The petition must be verified – the threat of the pain of perjury should keep out half-hearted claims.
The petition must state the reason discovery is necessary.
The discovery is limited only to learning the identity of the potential defendant.
Most importantly, before the discovery will be permitted, the court must hold a hearing and determine the petition sufficiently states a cause of action.

In this fourth step, the court is to apply the standard it would apply in a Section 2-615 motion. Such a motion is, essentially, the Illinois version of a motion to dismiss for failure to state a claim. That is no insignificant test, because unlike federal court and other state jurisdictions, Illinois requires fact pleading. That means the petition needs to include a significant amount of specific information to survive the motion to dismiss.

A troubling aspect of the ruling is the omission from the test of a requirement that the party seeking discovery attempt to notify the anonymous target of the inquisition. The appellate court held that a trial court may, in its discretion, impose such a requirement.

But it would be nice to know that the real party whose First Amendment interests are at stake (the anonymous speaker) is guaranteed a fair opportunity to argue from his or her perspective. After all, it’s that party with the real incentive to do so. Let’s hope the trial courts exercise that discretion wisely (and that they know in the first place that they have that discretion).

Photo courtesy Flickr user TheTruthAbout… under this Creative Commons license.