{"id":1671,"date":"2024-07-28T20:58:10","date_gmt":"2024-07-29T00:58:10","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/classactiondefense\/?p=1671"},"modified":"2024-07-29T09:05:23","modified_gmt":"2024-07-29T13:05:23","slug":"illinois-federal-court-dismisses-class-action-privacy-claims-involving-use-of-samsungs-gallery-app","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/classactiondefense\/2024\/07\/28\/illinois-federal-court-dismisses-class-action-privacy-claims-involving-use-of-samsungs-gallery-app\/","title":{"rendered":"Illinois Federal Court Dismisses Class Action Privacy Claims Involving Use Of Samsung\u2019s \u201cGallery\u201d App"},"content":{"rendered":"

\"\"<\/a>By Tyler Zmick, Justin Donoho, and Gerald L. Maatman, Jr.<\/b><\/p>\n

Duane Morris Takeaways:\u00a0 <\/i><\/b>In G.T., et al. v. Samsung Electronics America, Inc., et al., No. 21-CV-4976, 2024 WL 3520026 (N.D. Ill. July 24, 2024), Judge Lindsay C. Jenkins of the U.S. District Court for the Northern District of Illinois dismissed<\/a> claims brought under the Illinois Biometric Information Privacy Act (\u201cBIPA\u201d).\u00a0 In doing so, Judge Jenkins acknowledged limitations on the types of conduct (and types of data) that can subject a company to liability under the statute.\u00a0 The decision is welcome news for businesses that design, sell, or license technology yet do not control or store any \u201cbiometric\u201d data that may be generated when customers use the technology.\u00a0 The case also reflects the common sense notion that a data point does not qualify as a \u201cbiometric identifier\u201d under the BIPA if it cannot be used to identify a specific person.\u00a0 G.T. v. Samsung is required reading for corporate counsel facing privacy class action litigation.<\/i><\/p>\n

Background<\/b><\/p>\n

Plaintiffs \u2014 a group of Illinois residents who used Samsung smartphones and tablets \u2014 alleged that their respective devices came pre-installed with a \u201cGallery application\u201d (the \u201cApp\u201d) that can be used to organize users\u2019 photos.\u00a0 According to Plaintiffs, whenever an image is created on a Samsung device, the App automatically: (1) scans the image to search for faces using Samsung\u2019s \u201cproprietary facial recognition technology\u201d; and (2) if it detects a face, the App analyzes the face\u2019s \u201cunique facial geometry\u201d to create a \u201cface template\u201d (i.e.<\/i>, \u201ca unique digital representation of the face\u201d).\u00a0 Id.<\/i> at *2.\u00a0 The App then organizes photos based on images with similar face templates, resulting in \u201cpictures with a certain individual\u2019s face [being] \u2018stacked\u2019 together on the App.\u201d\u00a0 Id.<\/i><\/p>\n

Based on their use of the devices, Plaintiffs alleged that Samsung violated \u00a7\u00a7 15(a) and 15(b) of the BIPA by: (1) failing to develop a written policy made available to the public establishing a retention policy and guidelines for destroying biometric data, and (2) collecting Plaintiffs\u2019 biometric data without providing them with the requisite notice and obtaining their written consent.<\/p>\n

Samsung moved to dismiss on two grounds, arguing that: (1) Plaintiffs did not allege that Samsung \u201cpossessed\u201d or \u201ccollected\u201d their biometric data because they did not claim the data ever left their devices; and (2) Plaintiffs failed to allege that data generated by the App qualifies as \u201cbiometric identifiers\u201d or \u201cbiometric information\u201d under the BIPA, because Samsung cannot use the data to identify Plaintiffs or others appearing in uploaded photos.<\/p>\n

The Court\u2019s Decision<\/b><\/p>\n

The Court granted Samsung\u2019s motion to dismiss on both grounds.<\/p>\n

\u201cPossession\u201d And \u201cCollection\u201d Of Biometric Data<\/u><\/p>\n

Regarding Samsung\u2019s first argument, the Court began by explaining what it means for an entity to be \u201cin possession of\u201d biometric data under \u00a7 15(a) and to \u201ccollect\u201d biometric data under \u00a7 15(b).\u00a0 The Court observed that \u201cpossession\u201d occurs when an entity exercises control over data or holds it at its disposal.\u00a0 Regarding \u201ccollection,\u201d the Court noted that the term \u201ccollect,\u201d and the other verbs used in \u00a7 15(b) (\u201ccapture, purchase, receive through trade, or otherwise obtain\u201d), all refer to an entity taking an \u201cactive step\u201d to gain control of biometric data.<\/p>\n

The Court proceeded to consider Plaintiffs\u2019 contention that Samsung was \u201cin possession of\u201d their biometrics because Samsung controls the proprietary software used to operate the App.\u00a0 The Court sided with Samsung, however, concluding that Plaintiffs failed to allege \u201cpossession\u201d (and thus failed to state a \u00a7 15(a) claim) because they did not allege that Samsung can access the data<\/i><\/b> (as opposed to the technology<\/i><\/b> Samsung employs).\u00a0 Id.<\/i> at *9 (\u201cSamsung controls the App and its technology, but it does not follow that this control gives Samsung dominion over the Biometrics generated from the App, and plaintiffs have not alleged Samsung receives (or can receive) such data.\u201d).<\/p>\n

As for \u00a7 15(b), <\/i><\/b>the Court rejected Plaintiffs\u2019 argument that Samsung took an \u201cactive step\u201d to \u201ccollect\u201d their biometrics by designing the App to \u201cautomatically harvest[] biometric data from every photo stored on the Device.\u201d\u00a0 Id.<\/i> at *11.\u00a0 The Court determined that Plaintiffs\u2019 argument failed for the same reason their \u00a7 15(a) \u201cpossession\u201d argument failed.\u00a0 Id.<\/i> at *11-12 (\u201cPlaintiffs\u2019 argument again conflates technology with Biometrics. . . . Plaintiffs do not argue that Samsung possesses the Data or took any active steps to collect it.\u00a0 Rather, the active step according to Plaintiffs is the creation of the technology.\u201d).<\/p>\n

\u201cBiometric Identifiers\u201d And \u201cBiometric Information\u201d<\/u><\/p>\n

The Court next turned to Samsung\u2019s second argument for dismissal \u2013 namely, that Plaintiffs failed to allege that data generated by the App is \u201cbiometric\u201d under the BIPA because Samsung could not use it to identify Plaintiffs (or others appearing in uploaded photos).<\/p>\n

In opposing this argument, Plaintiffs asserted that: (1) the \u201cApp scans facial geometry, which is an explicitly enumerated biometric identifier\u201d; and (2) the \u201cmathematical representations of face templates\u201d stored through the App constitute \u201cbiometric information\u201d (i.e.<\/i>, information \u201cbased on\u201d scans of Plaintiffs\u2019 \u201cfacial geometry\u201d).\u00a0 Id.<\/i> at *13.<\/p>\n

The Court ruled that \u201cSamsung has the better argument,\u201d holding that Plaintiffs\u2019 claims failed because Plaintiffs did not allege that Samsung can use data generated through the App to identify specific people.\u00a0 Id.<\/i> at *15.\u00a0 The Court acknowledged that cases are split \u201con whether a plaintiff must allege a biometric identifier can identify a particular individual, or if it is sufficient to allege the defendant merely scanned, for example, the plaintiff\u2019s face or retina.\u201d\u00a0 Id.<\/i> at *13.\u00a0 After employing relevant principles of statutory interpretation, the Court sided with the cases in the former category and opined that \u201cthe plain meaning of \u2018identifier,\u2019 combined with the BIPA\u2019s purpose, demonstrates that only those scans that can identify an individual qualify.\u201d\u00a0 Id.<\/i> at *15.<\/p>\n

Turning to the facts alleged in the Complaint, the Court concluded that Plaintiffs failed to state claims under the BIPA because the data generated by the App does not amount to \u201cbiometric identifiers\u201d or \u201cbiometric information\u201d simply because the data can be used to identify and group the unique faces of unnamed people.\u00a0 In other words, biometric information must be capable of recognizing an individual\u2019s identity \u2013 \u201cnot simply an individual\u2019s feature.\u201d\u00a0 Id.<\/i> at *17; see also id.<\/i> at *18 (noting that Plaintiffs claimed only that the App groups unidentified faces together, and that it is the device user<\/i><\/b> who can add names or other identifying information to the faces).<\/p>\n

Implications Of The Decision <\/b><\/p>\n

G.T. v. Samsung<\/i>\u00a0is one of several recent decisions grappling with key questions surrounding the BIPA, including questions as to: (1) when an entity engages in conduct that rises to the level of \u201cpossession\u201d or \u201ccollection\u201d of biometrics; and (2) what data points qualify (and do not<\/i><\/b> qualify) as \u201cbiometric identifiers\u201d and \u201cbiometric information\u201d such that they are subject to regulation under the statute.<\/p>\n

Regarding the first question, the Samsung<\/i> case reflects the developing majority position among courts \u2013 i.e.<\/i>, a company is not \u201cin possession of,\u201d and has not \u201ccollected,\u201d data that it does not actually receive or access, even if it created and controlled the technology that generated the allegedly biometric data.<\/p>\n

As for the second question, the Court\u2019s decision in Samsung<\/i> complements the Ninth Circuit\u2019s recent decision in Zellmer v. Meta Platforms, Inc.<\/i>, where it held that a \u201cbiometric identifier\u201d must be capable of identifying a specific person.\u00a0 See<\/i> Zellmer v. Meta Platforms, Inc.<\/i>, 104 F.4th 1117, 1124 (9th Cir. 2024) (\u201cReading the statute as a whole, it makes sense to impose a similar requirement on \u2018biometric identifier,\u2019 particularly because the ability to identify did not need to be spelled out in that term \u2014 it was readily apparent from the use of \u2018identifier.\u2019\u201d).\u00a0 Courts have not uniformly endorsed this reading, however, and parties will likely continue litigating the issue unless and until the Illinois Supreme Court provides the final word on what counts as a \u201cbiometric identifier\u201d and \u201cbiometric information.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"

By Tyler Zmick, Justin Donoho, and Gerald L. Maatman, Jr. Duane Morris Takeaways:\u00a0 In G.T., et al. v. Samsung Electronics America, Inc., et al., No. 21-CV-4976, 2024 WL 3520026 (N.D. Ill. July 24, 2024), Judge Lindsay C. Jenkins of the U.S. District Court for the Northern District of Illinois dismissed claims brought under the Illinois … <\/p>\n

Continue reading “Illinois Federal Court Dismisses Class Action Privacy Claims Involving Use Of Samsung\u2019s \u201cGallery\u201d App”<\/span><\/a><\/p>\n","protected":false},"author":578,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[59],"tags":[],"ppma_author":[12,122,7],"class_list":["post-1671","post","type-post","status-publish","format-standard","hentry","category-privacy-class-actions"],"authors":[{"term_id":12,"user_id":578,"is_guest":0,"slug":"tzzmick","display_name":"Tyler Z. Zmick","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/zmicktyler-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":122,"user_id":686,"is_guest":0,"slug":"jrdonoho","display_name":"Justin Donoho","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2025\/02\/donohojustin-1-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":7,"user_id":575,"is_guest":0,"slug":"gmaatman","display_name":"Gerald L. Maatman, Jr.","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/maatmangerald-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""}],"_links":{"self":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/1671","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/users\/578"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/comments?post=1671"}],"version-history":[{"count":0,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/1671\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/media?parent=1671"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/categories?post=1671"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/tags?post=1671"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/ppma_author?post=1671"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}