A New York federal judge partially sided with Louis Vuitton North America (“Louis Vuitton”) in a proposed class action lawsuit accusing the luxury giant of collecting consumers’ biometric data for a virtual eyewear try-on tool “without first obtaining their consent or informing them” about the data collection. Deciding a motion to dismiss that Louis Vuitton filed in response to the amended complaint that Paula Theriot and Cheryl Doyle filed this summer, Judge Denise Cote of the Southern District of New York agreed to toss out one of the plaintiffs’ Illinois Biometric Information Privacy Act (“BIPA”)-centric claims, while keeping the other in place.
Setting the stage in her December 5 order, Judge Cote asserted that Louis Vuitton sought to escape the plaintiffs’ case on the basis that they lack Article III standing for their BIPA section 15(a) claim and therefore, the court lacks subject matter jurisdiction. Louis Vuitton also argued that the plaintiffs’ fail to state a claim for relief in connection with their BIPA section 15(b) claim, and thus, their complaint should be dismissed in its entirety.
BIPA Standing
Turning first to BIPA section 15(a), which requires that companies “develop a written policy [that is] made available to the public [and] establish a retention schedule … for permanently destroying biometric identifiers,” Judge Cote stated that only the injury-in-fact prong of the standing inquiry is in dispute. In finding that the plaintiffs fail to allege the necessary “particularized harm,” the judge said that two recent opinions from the Seventh Circuit are useful.
Primarily, in Bryant v. Compass Group USA, the 7th Cir. held that “a failure to follow section 15(b) of the law” – which prohibits companies from collecting biometric data without informing subjects in writing that the data is being collected and the purpose of the data collection, and receiving a written release from subjects to do so – “leads to an invasion of personal rights that is both concrete and particularized.” In that case, though, Judge Cote contended that “the court held that the plaintiff lacked standing to pursue her 15(a) claim because she only alleged a claim under the provision of that section requiring development of a written policy, made available to the public, rather than the provision requiring compliance with that policy.”
(The latter refers to the need for companies to “permanently destroy biometric identifiers when the initial purpose for collecting or obtaining such identifiers … has been satisfied or within 3 years of the individual’s last interaction with the [company], whichever occurs first.”)
“Since the duty to develop and disclose the policy is ‘owed to the public generally [and] not to particular persons whose biometric information the entity collects,’” the 7th Cir. held that the plaintiff in that case failed to allege a particularized injury sufficient for Article III standing, per Judge Cote. The same is true here, according to the court, because the plaintiffs’ 15(a) claim is “expressly based on” Louis Vuitton’s alleged “‘failure to develop and make publicly available a written policy for retention and destruction of biometric identifiers’” and not on its unlawful retention of the biometric data.
Judge Cote pointed to a second relevant case from the 7th Cir., Fox v. Dakkota Integrated Systems, in which the Court of Appeals held that the plaintiff had standing for her 15(a) claim, as she accused Dakkota of violating “the full range of its section 15(a) duties by failing to develop, publicly disclose, and comply with a data-retention schedule and guidelines.”
While the plaintiffs here have “attempt[ed] to recast their 15(a) claim to analogize the case to Fox, but this attempt fails,” according to the court, as “there are no allegations in the amended complaint that Louis Vuitton unlawfully retained the plaintiffs’ data after the initial purpose for collection had ended.” Instead, the plaintiffs’ allegations here are directed to Louis Vuitton’s “alleged failure to develop and publish data retention and destruction policies.” Accordingly, the court found that the plaintiffs have not alleged an injury in fact sufficient to confer Article III standing for their 15(a) claim and dismissed the claim.
As for the plaintiffs’ section 15(b) claim, Louis Vuitton looked to get that tossed out, as well, arguing that they fail to state a claim for relief. Siding with the plaintiffs, the court determined that they sufficiently pled that Louis Vuitton ran afoul of the law by “encourag[ing] its website visitors to use the Virtual Try-On tool, through which it collects their facial geometry.” While Louis Vuitton argued that the plaintiffs’ complaint “proves that it is FittingBox,” the company that “powers” the Louis Vuitton virtual try-on tool, and thus, “not Louis Vuitton, who ‘collects’ biometric identifiers,” the court stated that “the precise roles of Louis Vuitton and FittingBox, and the precise kinds of data each receives are factual questions to be resolved later in the litigation.”
The court was similarly unpersuaded by Louis Vuitton’s argument that the plaintiffs cannot bring a claim under BIPA because “the events giving rise to the litigation did not occur ‘primarily and substantially’ in Illinois,” stating that the plaintiffs allege that they are Illinois residents who used the virtual try-on tool while in Illinois.”
THE BIGGER PICTURE: An increasing number of brands and retailers have introduced virtual try-on tools that use biometric technology to recreate the fitting room experience or makeup testing in an e-commerce scenario. “As the popularity of these tools grow, so does the legal risk from the growing number of biometric data privacy lawsuits,” according to Steptoe & Johnson LLP’s Stephanie Sheridan, Meegan Brooks and Surya Kundu. Other brands are similarly facing off against such lawsuits, with Estée Lauder Companies, Bobbi Brown Professional Cosmetics, Smashbox Beauty, and Too Faced Cosmetics being accused of violating Illinois’ biometric data law by way of their virtual try-on tools. “Despite consumer concerns regarding facial-scanning technology, and BIPA’s clear mandate,” Plaintiffs Celia Castelaz, Brittanie Nalley, Northa Johnson, and Lori Carter allege that Estée Lauder Companies and co. have – and continue to – run afoul of BIPA.
The case is Theriot v. Louis Vuitton North America, Inc., 1:22-cv-02944 (SDNY).
Share
