A commonly asked question after being named as a defendant in data privacy litigation is “well, do we have any available defenses to have the complaint dismissed?”  A recent ruling out of Illinois provides some clarity on what a court may consider on a motion to dismiss for lack of personal jurisdiction for claims under the Illinois’ Biometric Information Privacy Act (“BIPA”).  In Stein v. Clarifai, Inc., No. 20 C 1937, 2021 U.S. Dist. LEXIS 49516 (N.D. Ill. Mar. 16, 2021), Plaintiff filed a putative class action against Clarifai, a technology company specializing in artificial intelligence, alleging it violated BIPA (among other statutes), by harvesting facial data from OkCupid without obtaining consent from users or making the necessary disclosure.  The lawsuit was filed shortly after New York Times published an article that stated Clarifai built the database it uses to develop and train its algorithm from OkCupid profile pictures.

Clarifai moved to dismiss Plaintiff’s claims on grounds that:

(1) The complaint lacks allegations sufficient to assert personal jurisdiction over it under Rule 12(b)(2);

(2) If personal jurisdiction does exist, BIPA does not have extraterritorial application;

(3) Applying BIPA to Clarifai violates the Dormant Commerce Clause, and

(4) Plaintiff’s claim for unjust enrichment claim is duplicative of Plaintiff’s BIPA claims.

The Court only addressed (1), Clarifai’s personal jurisdiction argument.

In support of its argument for lack of personal jurisdiction, Clarifai asserted it had never developed a business relationship with OkCupid and had no knowledge of where OkCupid users are located.  Clarifai also asserted it is not registered to do business in Illinois, has no offices or employees in Illinois, has never had property, employees or operations in Illinois, and does not maintain a place of business in Illinois.  And (more importantly), it does not target its website to residents in Illinois, and “does not target its marketing, sales, or commercial activity towards Illinois, nor does it specifically develop or train facial recognition or artificial technology in Illinois.”

As you may know, personal jurisdiction comes in two forms: general and specific. Plaintiff did not contend that the Court had general jurisdiction over Clarifai, so the Court limited its analysis to just the specific jurisdiction.  Specific jurisdiction, in the Court’s words, exists “when the defendant purposefully directs its activities at the forum state and the alleged injury arises out of those activities.”

Since May 2018, Clarifai had sold fifty-eight demographic models to two customers located in Illinois.  These sales brought in approximately seven cents in revenue. The miniscule number of transactions at issue, garnering seven cents in revenue, without additional evidence to show Clarifai targeted residents of Illinois, did not suffice to subject Clarifai to the personal jurisdiction of the Northern District of Illinois.  The Court went on to say “[t]o hold otherwise would mean that a plaintiff could bring suit in literally any state where the defendant shipped at least one item.”

Although Illinois remains the leader in the biometric privacy arena, other states are jumping on the bandwagon—meaning that similar issues are anticipated to reoccur in data privacy litigations.  Stay tuned.  CPW will be there.