17-303
      Vigil v. Take-Two Interactive Software, Inc.

                               UNITED STATES COURT OF APPEALS
                                   FOR THE SECOND CIRCUIT

                                              SUMMARY ORDER

RULINGS BY SUMMARY ORDER DO NOT HAVE PRECEDENTIAL EFFECT. CITATION TO A SUMMARY ORDER
FILED ON OR AFTER JANUARY 1, 2007, IS PERMITTED AND IS GOVERNED BY FEDERAL RULE OF APPELLATE
PROCEDURE 32.1 AND THIS COURT’S LOCAL RULE 32.1.1. WHEN CITING A SUMMARY ORDER IN A
DOCUMENT FILED WITH THIS COURT, A PARTY MUST CITE EITHER THE FEDERAL APPENDIX OR AN
ELECTRONIC DATABASE (WITH THE NOTATION “SUMMARY ORDER”). A PARTY CITING TO A SUMMARY
ORDER MUST SERVE A COPY OF IT ON ANY PARTY NOT REPRESENTED BY COUNSEL.

                     At a stated term of the United States Court of Appeals for the Second
      Circuit, held at the Thurgood Marshall United States Courthouse, 40 Foley Square, in the
      City of New York, on the 21st day of November, two thousand seventeen.

      PRESENT:
                          ROBERT A. KATZMANN,
                               Chief Judge,
                          RAYMOND J. LOHIER, JR.,
                          CHRISTOPHER F. DRONEY,
                               Circuit Judges.


      HADIT SANTANA,

                                    Plaintiff,

      VANESSA VIGIL, RICARDO VIGIL,

                                    Plaintiffs-Appellants,

                          v.                                        No. 17-303


      TAKE-TWO INTERACTIVE SOFTWARE, INC.,

                                    Defendant-Appellee.




                                                             1
For Plaintiffs-Appellants:                             FRANK HEDIN (John C. Carey, on the brief),
                                                       Carey, Rodriguez, Milian, Gonya, LLP,
                                                       Miami, FL.

For Defendant-Appellee:                                VICTOR JIH (Robert M. Schwartz, Nathaniel
                                                       Lipanovich, Molly Russell, Derek R. Flores,
                                                       on the brief), Irell & Manella LLP, Los
                                                       Angeles, CA.

          Appeal from a final judgment of the United States District Court for the Southern District

of New York (Koeltl, J.).

          UPON DUE CONSIDERATION, IT IS HEREBY ORDERED, ADJUDGED, AND

DECREED that the judgment of the district court is AFFIRMED IN PART and VACATED

IN PART, and the case is REMANDED with the instruction that the court shall amend its

judgment and enter dismissal without prejudice.

          Plaintiffs-Appellants Ricardo Vigil and Vanessa Vigil appeal from a final judgment

dismissing their second amended complaint (“SAC”) with prejudice, entered on January 30,

2017, by the United States District Court for the Southern District of New York (Koeltl, J.). We

assume the parties’ familiarity with the underlying facts, procedural history, and issues on

appeal.

          Defendant-Appellee Take-Two Interactive Software, Inc. is a publisher, developer, and

distributor of video games, including “NBA 2K15” and “NBA 2K16.” The NBA 2K15 and NBA

2K16 games contain a feature called “MyPlayer,” which allows gamers to create a personalized

basketball player that has a realistic 3-D rendition of the gamer’s face, also known as an

“avatar.” If a gamer chooses to play with the avatar in the games’ online, “multiplayer” mode,

then other players who participate in the same multiplayer match will see the rendition of the

gamer’s “face” during gameplay.




                                                  2
       To create a MyPlayer avatar, a gamer must first agree to the following terms and

conditions, which are presented on the viewer’s television screen or monitor:

       Your face scan will be visible to you and others you play with and may be
       recorded or screen captured during gameplay. By proceeding you agree and
       consent to such uses and other uses pursuant to the End User License Agreement.
       www.take2games.com/eula.

App. 23. Only after viewing this screen and pressing “continue” can a gamer access the

MyPlayer feature. 

mapping process uses cameras to capture a scan of the gamer’s facial geometry,

which is then used to disseminate a realistic rendition of the gamer’s face. Gamers must hold

their faces within 6 to 12 inches of the camera and slowly turn their heads 30 degrees to the left

and to the right during the scanning process. 

The process of scanning the face takes

about 15 minutes. 

purchased NBA 2K15 and his sister, Vanessa Vigil, played his copy of the

game.1 Both plaintiffs used the MyPlayer feature and followed the above-described procedure to

create their MyPlayer avatars. On October 19, 2015, plaintiffs brought claims against Take-Two

in the United States District Court for the Southern District of New York (Koeltl, J.) alleging

five violations of the Illinois Biometric Information Privacy Act, 740 Ill. Comp. Stat. 14/1 et seq.

(“BIPA”). The statute governs the collection, storage, and dissemination of individuals’

“biometric identifiers” and “biometric information” by private entities, and defines a “biometric

identifier” as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry,” and




1
 Although Ricardo and Vanessa Vigil bring class action claims based on their use of the
MyPlayer feature on both the NBA 2K15 and NBA 2K16 video games, App. 30, there is no
allegation that any of the named plaintiffs actually used the feature on the NBA 2K16 game.
                                                  3
“biometric information” as information based on “biometric identifiers.” 2 

Plaintiffs

allege that Take-Two: (1) collected their biometric data without their informed consent; (2)

disseminated their biometric data to others during game play without their informed consent; (3)

failed to inform them in writing of the specific purpose and length of term for which their

biometric data would be stored; (4) failed to make publicly available a retention schedule and

guidelines for permanently destroying plaintiffs’ biometric data; and (5) failed to store, transmit,

or protect from disclosure plaintiffs’ biometric data by using a reasonable standard of care or in a

manner that is at least as protective as the manner in which it stores, transmits, and protects other

confidential and sensitive information.

        Take-Two moved to dismiss plaintiffs’ claims for lack of Article III standing and for

failure to state a cause of action under the statute (i.e., lack of “statutory standing”).3 The district

court granted the motion on both grounds and dismissed the action with prejudice on January 30,

2017, and the clerk entered final judgment the same day. Plaintiffs timely appealed.

        We begin with Article III standing. The principles for evaluating whether plaintiffs have

constitutional standing for a procedural violation of law are set forth in our trio of decisions in

Strubel v. Comenity Bank, 

(2d Cir. 2016), Crupar-Weinmann v. Paris Baguette


2
 The parties refer to “biometric identifiers” and “biometric information” collectively as
“biometric data.” Although this term is not in the statute, we adopt it for the purposes of this
summary order for ease of reference.
3
  Although Take-Two framed its second argument for dismissal as based on “statutory standing”
grounds, the district court correctly observed “that what has been called ‘statutory standing’ in
fact is not a standing issue, but simply a question of whether the particular plaintiff ‘has a cause
of action under the statute,’” and therefore appropriately framed the issue as whether the
plaintiffs had a cause of action under the statute. See Vigil v. Take-Two Interactive Software,
Inc., 

, 507 n.5 (S.D.N.Y. 2017) (quoting Am. Psychiatric Ass’n v. Anthem
Health Plans, Inc., 

, 359 (2d Cir. 2016)). While we will continue to “avoid [the
statutory standing] appellation going forward,” see Am. Psychiatric 

, we
nonetheless use the term where necessary in this summary order when quoting previous
decisions by this Court.
                                                   4
Am., Inc., 

(2d Cir. 2017), and Katz v. Donna Karan Co., L.L.C., 

(2d

Cir. 2017). A plaintiff’s pleading must establish “first, that ‘Congress conferred the procedural

right to protect a plaintiff’s concrete interests’ as to the harm in question, and second, that ‘the

procedural violation presents a risk of real harm to that concrete interest.’” 

(quoting 

).

       “The first of these two issues – determining the scope and purpose of the procedural right

provided by the statute – is a question of law” that we review de novo. 

issue –

whether a bare procedural violation presents a material risk of harm to a concrete interest – “may

raise either a question of law or a question of fact, depending on the sources the parties rely on in

their pleadings.” 

here, a defendant makes a “facial challenge to standing, i.e., one

‘based solely on the allegations of the complaint or the complaint and exhibits attached to it,’”

we review the district court’s decision de novo.4 

v. HealthPort Techs., LLC,

, 56 (2d Cir. 2016)).

       The parties do not materially dispute the first issue of our inquiry. Plaintiffs concede that

BIPA is implicated only if their biometric data is collected or disseminated without their

authorization or if a procedural violation creates a material risk of such an outcome, Pls.’ Br. 25,

which is essentially the same as Take-Two’s position. Def.’s Br. 3-4, 15-16. We accordingly

assume without deciding that BIPA’s purpose is to prevent the unauthorized use, collection, or

disclosure of an individual’s biometric data.

       We further conclude, pursuant to the second step of our inquiry, that none of the alleged

procedural violations here raise a material risk of harm to this interest. Although plaintiffs allege


4
  Although these principles arose out of decisions involving alleged violations of federal laws,
the parties do not argue that our analysis should proceed any differently when a state law is at
issue. We accordingly assume for the purposes of this appeal that the foregoing Article III
standing analysis applies to alleged procedural violations of BIPA as well.
                                                   5
that Take-Two collected and disclosed their biometric data without their authorization, there is

no dispute that Take-Two informed them that the MyPlayer feature required a “face scan” that

would be visible to other players during online gameplay. App. 26. This terminology is sufficient

to meet BIPA’s mandates under the circumstances here. The statute requires that private entities

“inform[] the subject . . . in writing that a biometric identifier . . . is being collected or stored,”

740 Ill. Comp. Stat. Ann. 14/15(b)(1), and defines a “biometric identifier,” among other things,

as a “scan of . . . face geometry,” 

Thus, to the extent that Take-Two departed from

BIPA’s requirements, it only did so insofar as it omitted the term, “geometry.”

        No reasonable person, however, would believe that the MyPlayer feature was conducting

anything other than such a scan. Plaintiffs had to place their faces within 6 to 12 inches of the

camera, slowly turn their heads to the left and to the right, and do so for approximately 15

minutes. This degree of invasiveness far exceeded that of a simple photo, and plaintiffs do not

plausibly assert (beyond a mere conclusory allegation) that they would have withheld their

consent had Take-Two included the missing term.5 See 

(plaintiff failed

to allege a material risk of harm where she did not “assert that the allegedly flawed notice caused

her . . . behavior to be different from what it would have been”).

        Take-Two’s alleged violations of BIPA’s notice provisions similarly fail to raise a

material risk of harm. Plaintiffs allege that Take-Two did not inform them of the duration that it

would hold their biometric data, as BIPA requires. See 740 Ill. Comp. Stat. Ann. 14/15(a).

However, plaintiffs have not shown that this violation, if true, presents a material risk that their



5
  The second amended complaint (“SAC”) states that had Ricardo Vigil known “that Take-Two
would collect . . . his unique biometric identifiers and/or biometric information without his
informed written consent . . . , [he] would not have purchased the NBA 2k15 video game.” App.
29. While that may be true, the pleadings do not allege that Take-Two’s omission of the term
“geometry” actually led plaintiffs to unwittingly turn over their biometric identifiers.
                                                    6
biometric data will be misused or disclosed. Plaintiffs have not alleged that Take-Two has not or

will not destroy their biometric data within the period specified by the statute, and accordingly

have alleged only a bare procedural violation. Likewise, although Take-Two did not notify the

plaintiffs of its “retention schedule and guidelines for permanently destroying [their] biometric

[data],” 

not allege that Take-Two lacks such protocols, that its policies are

inadequate, or that Take-Two is unlikely to abide by its internal procedures. There is accordingly

no material risk that Take-Two’s procedural violations have resulted in plaintiffs’ biometric data

being used or disclosed without their consent. See Spokeo, Inc. v. Robins, 

, 1550

(2016) (observing that a credit reporting agency’s failure to notify a user of the agency’s

consumer information would not confer standing where “that information . . . [is] entirely

accurate”).

       Take-Two’s alleged violations of BIPA’s data security provisions raise a somewhat

thornier issue. BIPA requires entities to use the “reasonable standard of care within [their]

industry” to protect the biometric data in their possession and to store and transmit such data in a

manner that is as “protective” as that in which they handle “other confidential and sensitive

information.” 740 Ill. Comp. Stat. Ann. 14/15(e). Plaintiffs allege that Take-Two violated these

provisions by “transmit[ting] . . . unencrypted scans of face geometry via the open, commercial

Internet, and not a secure network such as a virtual private network,” and “stor[ing] [p]laintiffs’

face templates in a manner that associates their identity with their biometric data.” App. 27.

       Although Take-Two asserts that violations of such prophylactic measures confer standing

only where there has been a data breach, we do not need to make such a wide-sweeping




                                                  7
conclusion.6 Despite multiple opportunities to amend their pleadings, plaintiffs have failed to

allege that Take-Two’s alleged violations have raised a material risk that their biometric data will

be improperly accessed by third parties. They therefore have failed to show a “risk of real harm”

sufficient to confer an injury-in-fact. See 

.

       We lastly find unpersuasive plaintiffs’ attempt to manufacture an injury. Plaintiffs assert

that “a consumer deprived of BIPA’s procedural protections is likely to be deterred from using

. . . biometrics to authorize transactions in the future,” Pls.’ Br. 34-35, and that they similarly

have “refrained from participating in biometric transactions facilitated by, among other things,

scans of face geometry.” App. 30. Plaintiffs’ fear, without more, is insufficient to confer an

Article III injury-in-fact.7 While it is true that BIPA’s legislative findings identify consumers’

withdrawal from biometric-facilitated transactions as a problem, they clarify that this issue arises

only where a consumer’s biometric data has been “compromised,” i.e., collected or disclosed

without his or her authorization. 740 Ill. Comp. Stat. 14/5(c). Because plaintiffs have failed to

establish that Take-Two’s procedural violations have created a material risk that this will occur,

they cannot now leapfrog this obligation by imposing an injury upon themselves.

       Although we find for the foregoing reasons that the district court properly held that the

plaintiffs lack Article III standing, we nonetheless must remand with the instruction that the

court shall amend its judgment and enter dismissal without prejudice. A complaint dismissed for


6
 Although there is some ambiguity in the decision below, we do not interpret the district court as
having held that violations of BIPA’s data security provisions confer standing only where there
has been an actual data breach.
7
  We note that pursuant to the Supreme Court’s decision in Clapper v. Amnesty Int’l USA, 

, 414 n.5 (2013), a plaintiff may establish an Article III injury-in-fact where there is “a
‘substantial risk’ that the harm will occur, which may prompt plaintiffs to reasonably incur costs
to mitigate or avoid that harm.” 

Co. v. Geertson Seed Farms, 

, 153 (2010)). Because we find that plaintiffs have failed to establish a “substantial risk” of
harm, we do not reach whether plaintiffs incurred reasonable mitigation costs.
                                                   8
lack of Article III standing should be without prejudice because the court is without subject

matter jurisdiction. 

. To be sure, the district court has discretion to decide

“certain threshold bases for dismissal without deciding whether it has subject matter

jurisdiction,” and “under certain circumstances, questions of ‘statutory standing . . . may properly

be treated before Article III standing.’” In re Facebook, Inc. Initial Pub. Offering Derivative

Litig., 

, 155-56 (2d Cir. 2015) (quoting Ortiz v. Fibreboard Corp., 

,

831 (1999)). This, however, is not such a circumstance.

        Courts may adjudicate statutory standing prior to Article III issues only where deciding

statutory standing does not constitute a “definitive ruling on the merits.” Alliance For Envtl.

Renewal, Inc. v. Pyramid Crossgates Co., 

, 87 (2d Cir. 2006). Where “the parties’

standing arguments [are] based upon differing constructions of the governing statute,” however,

plaintiffs’ “‘standing to bring this action turns on the merits of the action itself.’” 

States Legal Found., Inc. v. Eastman Kodak Co., 

, 357 (2d Cir. 1993)). Since the

statutory standing arguments here are based on differing constructions of the term “aggrieved

party” as used in BIPA, the district court’s resolution of the issue was a judgment on the merits

that could not be properly addressed absent subject matter jurisdiction. The district court was

therefore without power to dismiss the complaint with prejudice for failure to state a cause of

action under the statute.

        We have considered all of plaintiffs’ contentions on appeal and have found in them no

basis for reversal. For the reasons stated herein, the judgment of the district court is AFFIRMED

IN PART insofar as it held that plaintiffs lack Article III standing, but is VACATED IN PART

insofar as it held that the plaintiffs lack a statutory cause of action as “aggrieved” parties. The




                                                   9
case is REMANDED with the instruction that the court shall amend its judgment and enter

dismissal without prejudice.

                                          FOR THE COURT:
                                          Catherine O’Hagan Wolfe, Clerk




                                             10