A federal judge won’t let online ID verifier Jumio end a class action accusing the company of violating a state biometrics law in the way it scans users' faces when delivering its online identity verification service.
In January 2022, attorneys with the firm of Edelson PC, of Chicago, filed suit in Cook County Circuit Court against Jumio, headquartered in Palo Alto, California, alleging the company continued to violate the Illinois Biometric Information Privacy Act, despite signing a $7 million settlement in mid-2020 to end similar claims under the same law.
Cook County resident Cory Davis alleged he used Jumio to verify his identity when he signed up for cryptocurrency trading app, Binance, which is not a party to the complaint. Davis said Binance users uploaded photos of their drivers’ licenses, and then selfie photos, and said Jumio scanned those images to create and store facial geometry templates for future login attempts. The alleged BIPA violations are failure to secure written consent from users and to provide required notice of data use, retention, sharing and destruction.
Jumio removed the complaint to federal court and moved to dismiss, a motion U.S. District Judge Andrea Wood rejected in an opinion filed Feb. 14.
In arguing for dismissal, Jumio said BIPA doesn’t apply to financial institutions that are regulated under Title V of the 1999 Gramm-Leech-Bliley Act. It also argued the complaint failed to allege the relevant conduct took place in Illinois.
Wood noted the first argument relies not on Jumio itself, but on the fact its technology as applicable to this lawsuit was deployed for Binance, and therefore a BIPA lawsuit is inappropriate. Davis countered that strategy by arguing Jumio’s position constituted an affirmative defense, which means Jumio has a burden to establish its position and the complaint need not address the issue in order to survive dismissal.
The parties disputed whether Binance qualifies as a financial institution in this context, and Wood agreed Davis’ complaint doesn’t have enough information for her to make such a determination. Even if she did reach that conclusion, Wood wrote, “it would not necessarily follow that Davis’ complaint against Jumio is barred.”
Although Jumio argued the General Assembly intended for the exemption to apply broadly, even indirectly, Wood said it’s “difficult to see” how making Jumio comply with BIPA would affect Binance’s operations, even if Jumio had to tailor its own technology to suit the law. Again she noted the dispute is suitable for a more developed litigation phase.
“Without further information regarding how the Binance app functions and how Jumio’s identity verification software is integrated into the Binance app, the court cannot determine the extent to which requiring Jumio to comply with BIPA would necessitate changes to how Binance does business, such that BIPA might be considered as applying ‘in any manner’ to Binance,” Wood wrote. “That is a determination more appropriately made with the benefit of discovery at the summary judgment stage of the proceedings.”
Regarding whether the allegations significantly involve Illinois-based conduct, Wood noted Davis’ response to Jumio’s motion to dismiss added the claim he registered with Binance and submitted his photos through the Jumio technology while in Illinois, where he also resides. Because the claim alleges Binance “conducts business transactions in Illinois,” Wood wrote, a motion to dismiss is premature, though she acknowledged the issue could prove decisive should Jumio move for summary judgment.
Attorneys J. Eli Wade-Scott and Schuyler Ufkes, of the Edelson firm, represent Davis.
In 2020, lawyers with the Chicago firm of McGuire Law P.C., walked away with more than $2.8 million in fees from a $7 million settlement deal with Jumio, ending a 2019 Cook county lawsuit. Davis’ complaint relies in part on allegations the settlement didn’t spur Jumio to change its policies to be compliant with BIPA, a law originally enacted in 2008.