Sherman v. Brandt Industries USA LTD

IN THE UNITED STATES DISTRICT COURT CENTRAL DISTRICT OF ILLINOIS PEORIA DIVISION JOSEPH SHERMAN, individually and ) on behalf of himself and all others ) similarly situated, ) ) Plaintiff, ) ) v. ) Case No. 20-cv-1185 ) BRANDT INDUSTRIES USA LTD., ) ) Defendant. ) ORDER AND OPINION Pending before the Court is Defendant Brandt Industries USA, Ltd.’s Motion to Dismiss. Plaintiff has responded and this motion is ripe for review. For the reasons stated below, this motion is denied. BACKGROUND On May 18, 2020, Plaintiff filed his First Amended Complaint which alleges that Defendant violated two provisions of the Illinois Biometric Information Privacy Act. Plaintiff purports to bring this claim on behalf of himself and other similarly situated class members. Defendant filed a motion to dismiss on July 23, 2020 and Plaintiff filed a response. Plaintiff also filed a motion to stay the case pending a decision from an Illinois Appellate Court on the issue of whether biometric violations are preempted by the Illinois Works Compensation Act. The Court granted the stay, which was then lifted on October 7, 2020 after the Illinois Appellate Court decided the issue. Accordingly, Defendant’s Motion to Dismiss is now ripe for review. In 2008, Illinois enacted the Biometric Information Policy Act (“BIPA”). 740 ILCS 14/1 et seq. Part of Illinois’s reason for enacting this law is that “[b]iometrics are unlike other unique identifiers that are used to access finances or other sensitive information.” 740 ILCS 14/15(c). “For example, social security numbers, when compromised, can be changed. Biometrics, however, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric- facilitated transactions.” Id. Under BIPA, private entities may not obtain or possess an individual’s biometrics unless it informs that person in writing that biometric identifiers or information will be collected or stored. See 740 ILCS 14/15(b). BIPA further requires that the business inform people in writing of the specific purpose and length of term for which the biometric information is being collected and stored. Id. Moreover, entities collecting biometrics must publicly publish written retention schedules and guidelines for permanently destroying biometrics collected. 740 ILCS 14/15(a). Those guidelines must include destroying the biometric data within three years of the business’s last interaction with the individual or when the information is no longer needed for the purpose for which it was collected, whichever occurs first. Id. Further, the entity must store, transmit, and protect an individual’s biometric information using the same standard of care in the industry and in a manner at least as protective as the means used to protect other confidential and sensitive information. See 740 ILCS 14/15(c). Finally, the entity is expressly prohibited from selling, leasing, trading or otherwise profiting from an individual’s biometrics. See 740 ILCS 15/15(c). Plaintiff is a former employee of Defendant. Defendant used a fingerprint scanner to collect Plaintiff’s fingerprint and store it in an electronic database. Plaintiff would then “clock in” using his fingerprint, which would be matched against his stored fingerprints. Plaintiff argues that Defendant failed to provide notice, obtain informed consent, and publish data retention policies, as required by the statute. Plaintiff has left Defendant’s employ and suggests that Defendant might keep his fingerprints indefinitely. Plaintiff argues that Defendant’s failures deprived him the opportunity to consider the risks associated with Defendant’s collection and storage policy and otherwise violate BIPA. Accordingly, Plaintiff brings two claims against Defendant: Count I: Violation of 740 ILCS15/15 for failure to institute, maintain, and adhere to a publicly available retention schedule and Count II: Violation of 740 ILCS 14/15(b) for failure to obtain informed written consent before collecting biometric information. LEGAL STANDARD To survive a motion to dismiss, a complaint must contain sufficient factual matter, which when accepted as true, states a claim for relief that is plausible on its face. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Plausibility means alleging factual content that allows a court to reasonably infer that the defendant is liable for the alleged misconduct. Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 547 (2007). A plaintiff’s claim must “give enough details about the subject matter of the case to present a story that holds together” to be plausible. Swanson v. Citibank, N.A., 614 F.3d 400, 404 (7th Cir. 2010). A court must draw all inferences in favor of the non-moving party. Bontkowski v. First Nat’l Bank of Cicero, 998 F.2d 459, 461 (7th Cir. 1993). When evaluating a motion to dismiss, courts must accept as true all factual allegations in the complaint. Ashcroft, 556 U.S. at 678 . However, the court need not accept as true the complaint’s legal conclusions; “[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Id. (citing Bell Atlantic Corp., 550 U.S. at 555 ). Conclusory allegations are “not entitled to be assumed true.” Id. DISCUSSION A. Plaintiff has standing to pursue a claim under 740 ILCS § 14/15(a). Defendant argues that Plaintiff does not have standing to bring a claim under Section 15(a) of BIPA because Plaintiff did not suffer a concrete injury. Section 15(a) requires that private entities that collect biometric information develop a written policy establishing a retention schedule and guidelines for permanently destroying the information and make that policy available to the public. 740 ILCS § 14/15(a). The statute specifies that the information must be permanently destroyed once the initial purpose for collecting the data has been satisfied or within 3 years of the individual’s last interaction with the private entity. Id. This section further requires that the private entity comply with its established retention and destruction guidelines, unless a court issues a valid warrant or subpoena. Plaintiff alleges that Defendant failed to develop a policy for permanently destroying biometric data and suggests that Defendant may keep Plaintiff’s biometric information indefinitely. (Doc. 4 at 11). Defendant argues Plaintiff’s claims amounts to “[b]are procedural violations, divorced from any concrete harm.” (Doc. 10 at 7). Defendant asserts that to advance a claim: (1) Plaintiff must have suffered an actual or imminent, concrete and particularized injury-in-fact; (2) there must be a causal connection between Plaintiff’s injury and the conduct complained of; and (3) there must be a likelihood that this injury will be redressed by a favorable decision. Bryant v. Compass Group USA, Inc., 958 F.3d 617, 620 (7th Cir. 2020) (citing Lujan v. Defs of Wildlife, 504 U.S. 555 , 560–61 (1992)). Defendant argues that Plaintiff failed to meet the first criteria that he suffered a concrete injury due to Defendant’s failure to comply with BIPA. Both tangible and intangible injuries can be concrete. Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1549 (2016). And, a “legislature may ‘elevate to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law.’” Bryant, 958 F.3d at 621 (quoting Spokeo, 136 S. Ct. at 1548– 49). However, “a bare procedural violation, divorced from any concrete harm,” does not “satisfy the injury-in-fact requirement of Article III.” Id. (quoting Spokeo, 136 S. Ct. at 1548–49). “Instead, the plaintiff must show that the statutory violation presented an ‘appreciable risk of harm’ to the underlying concrete interest that [the legislature] sought to protect by enacting the statute.” Groshek v. Time Warner Cable, Inc., 865 F.3d 884, 887 (7th Cir. 2017) (quoting Meyers v. Nicolet Rest. of De Pere, LLC, 843 F.3d 724, 727 (7th Cir. 2016)). i. The Seventh Circuit has acknowledged a privacy interest in biometric data. In Bryant v. Compass, the Seventh Circuit addressed standing issues related to BIPA. There, the plaintiff alleged “only a claim under the provision of [section 15(a)] requiring development of a ‘written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information,’ not under the provision requiring compliance with the established retention schedule and destruction guidelines.” Bryant, 958 F.3d at 626 . The Seventh Circuit observed that the duty to disclose under section 15(a) is “owed to the public generally, not to particular persons whose biometric information the entity collects.” Id. Accordingly, the Seventh Circuit held that the plaintiff did not allege a particularized harm and lacked standing under that section to bring a claim. The Seventh Circuit was careful to specify that the plaintiff did not invoke the portion of the provision “requiring compliance with the established retention schedule and destruction guidelines” and its decision regarding the publication guideline did not necessarily apply to the destruction provision. Id. Moreover, the Seventh Circuit did find that the plaintiff had standing to bring a claim under 15(b) because the defendant “inflicted the concrete injury BIPA intended to protect against, i.e. a consumer’s loss of the power and ability to make informed decisions about the collection, storage, and use of her biometric information.” Id. at 627 . Unlike the plaintiff in Bryant, Plaintiff here did not limit his claim under 15(a) to a failure to develop a written policy, but also claims that Defendant failed to comply with the destruction guidelines. In Bryant, regarding the duty to obtain informed consent, the Seventh Circuit had “no trouble concluding that Bryant was asserting a violation of her own rights—her fingerprints, her private information.” Bryant, 958 F.3d 617 . The Seventh Circuit further held that failure to obtain informed consent “was no bare procedural violation; it was an invasion of her private domain, much like an act of trespass would be.” Id. Similarly, Plaintiff alleges that Defendant here is violating Plaintiff’s personal privacy rights by continuing to hold his fingerprint information past the statutorily prescribed deadline. Refusing to destroy biometric data that was obtained without lawful consent is a similar trespass to collecting it without the appropriate consent. Plaintiff sufficiently alleges that Defendant inflicted the concrete injury that this provision of BIPA was intended to prevent, which it the loss of control of biometric data and the increased risk of data breach due to Defendant keeping the information indefinitely. Defendant provides a recent district court decision that determined that the plaintiff lacked standing to pursue a destruction claim under 15(a). (Doc. 13-1). In Figueroa, the district court found that the plaintiff lacked standing under the destruction guideline of 15(a) by relying on a Seventh Circuit case that addressed standing related to a different data retention statute. Figueroa v. Kronos Inc., No. 19 C 1306, 2020 WL 4273995 (N.D. Ill. July 24, 2020) (citing Gubala v. Time Warner Cable, Inc., 846 F.3d 909 (7th Cir. 2017). However, this Court believes that reliance is misplaced. In Gubala, the plaintiff alleged that the cable company kept his personal information for years after he had cancelled his cable subscription, but the court determined that was no concrete injury for the purpose of standing. Gubala, 846 F.3d 909 . There, the plaintiff had provided the cable company with his date of birth, home address, home and work telephone numbers, social security number, and credit card information. Id. at 910 . The cable company maintained this information more than eight years after that plaintiff had cancelled his subscription even though there was a law requiring that it destroy personally identifiable information if the information is no longer necessary for the purpose for which it was collected. Id. (citing 47 U.S.C. § 551 (e)). The plaintiff’s “only allegation [wa]s that the retention of the information, on its own, ha[d] somehow violated a privacy right or entailed a financial loss.” Id. The Seventh Circuit acknowledged there was a risk of harm, but that plaintiff had not alleged that the cable company lost any of his information, used the information inappropriately, or was at risk of doing so. Id. The Seventh Circuit, however, has acknowledged that there is a difference between biometric data, which is personal and cannot be changed, and information like addresses, telephone numbers, and even social security numbers. The Seventh Circuit described the failure to obtain consent to collect biometric data as “an invasion of [plaintiff’s] private domain.” Bryant, 958 at 624. In contrast, in Gubala, the Seventh Circuit was dismissive of the plaintiff’s argument “that the retention of the information, on its own, has somehow violated a privacy right or entailed a financial loss.” Gubala, 846 F.3d at 910 . Accordingly, the Seventh Circuit has acknowledged that an unapproved collection of biometric information invades a private domain but has been dismissive of the idea that retaining information such as addresses, or even social security numbers beyond the statutorily prescribed period violates a privacy right. BIPA was passed due to the highly sensitive nature of biometric data and the possibility of irreparable harm if the data is breached. A company that retains biometric information past the time it is statutorily permitted to do so invades plaintiff’s private domain in a way that retaining other personal information does not. The fact that the harm of breached or shared information would be irreparable highlights why this retention invades Plaintiff’s privacy. ii. The Ninth Circuit agrees that violations of 15(a) confer standing. While the Seventh Circuit has not had the opportunity to directly address the Defendant’s claims regarding standing under the destruction guidelines of 15(a), the Ninth Circuit has held that plaintiffs have standing to pursue claims under 15(a)’s destruction duty. The Ninth Circuit reviewed a class-action brought against Facebook for breach of Illinois’s BIPA laws. In explaining why standing was appropriate, the Ninth Circuit explored the background of personal privacy interest and observed that the Supreme Court has acknowledged that technological advances “provide ‘access to a category of information otherwise unknowable.’” Patel v. Facebook, Inc., 932 F.3d 1264, 1273 (9th Cir. 2019) (quoting Carpenter v. U.S., 138 S. Ct. 2206, 2218 (2018)). The Ninth Circuit continued that this information made knowable by technological advances will “implicate privacy concerns’ in a manner as different from traditional intrusions as ‘ride on horseback’ is different from a ‘flight to the moon.’” Id. (quoting Riley v. California, 573 U.S. 373 , 393 (2014)). The court further found that an invasion of an individual’s biometric privacy rights has a close relationship to the basis for privacy lawsuits in American or English courts. Id. (citing Spokeo I, 136 S. Cr. At 1546). The Ninth Circuit asserted the improper collection and retention of biometric data implicates an “individual’s control of information concerning his or her person.” Id. (quoting U.S. Dep’t of Justice v. Reporters Comm. for Freedom of Press, 489 U.S. 749, 764 (1989)). The Ninth Circuit also reviewed the Illinois Supreme Court’s decision on BIPA, observing that the Illinois Supreme Court concluded that “[t]he strategy adopted by the General Assembly through enactment of [BIPA]” was to protect individuals’ “biometric privacy” by (1) “imposing safeguards to insure that individuals’ and customers’ privacy rights in their biometric identifiers and biometric information are properly honored and protected to begin with, before they are or can be compromised,” and (2) “by subjecting private entities who fail to follow the statute’s requirements to substantial potential liability.” Id. (brackets in original) (quoting Rosenbach v. Six Flags Entm’t Corp., 129 N.E.3d 1197, 1206 (Ill. 2019). The Illinois Supreme Court concluded that individuals are not required to sustain a “compensable injury beyond violation of their statutory rights before they may seek recourse ” because a violation of any section of BIPA “constitutes an invasion, impairment, or denial of the statutory rights of any person or customer whose biometric identifier or biometric information is subject to the breach.” Id. (quoting Rosenbach, 129 N.E. 3d at 1206 ).1 This Court is persuaded that the Ninth Circuit precedent is in line with the Seventh Circuit’s treatment of biometric data. Violating plaintiffs’ rights to control their biometric data is different than retaining addresses, phone numbers, and social security numbers. Both the privacy invasion and potential harm are much more serious and under these circumstances, the Court agrees with Plaintiff that 15(a) confers standing. B. Defendant’s argument that Plaintiff cannot state a claim under 740 ILCS § 14/15(a) for failing to adhere to a destruction policy because Defendant did not have a destruction guideline is without merit. At bottom, 740 ILCS § 14/15(a) requires that businesses destroy biometric data when the purposes for which the data was collected is fulfilled or within three years of the last interaction 1While the Court acknowledges that states are not bound by Article III’s standing requirement, the state court’s interpretation of state law can still be helpful in assisting federal courts in determining whether Article III’s standing requirements have been met. See Protect Our Parks, Inc. v. Chicago Park Dist., 971 F.3d 722 , 731 (7th Cir. 2020) (“Article III does not apply to the states, so ‘state courts are not bound by the limitations of a case or controversy or other federal rules of justiciability.’”) (citation omitted). with the individual whose information it collected, whichever occurs first. This statute, however, says this in a round about way. It requires that businesses have a policy for retaining and destroying biometric data. That policy must include destroying information when it is no longer needed for the purpose for which it was collected or within three years of the last interaction with the individual whose information it collected, whichever is first. The business must then comply with the guideline it created. Defendant attempts to argue that because Plaintiff claims that Defendant does not have a data retention guideline, it cannot then claim that Defendant did not comply with that guideline. The Court need look no further than the statute to find that it requires that the company must destroy information when the purpose for which the data was collected is fulfilled or within three years of the last interaction with the individual whose information it collected, whichever occurs first. That Defendant further violated the statute by failing to develop a written policy does not shield it from the requirement that it destroy information within a prescribed period of time. C. The Complaint adequately alleges a right to seek liquidated damages. Defendant argues that Plaintiff failed to allege the type of negligent or reckless behavior necessary to recover liquidated damages in Counts I and II. However, BIPA confers a private right of action on “[a]ny person aggrieved by a violation” of the statute. 740 ILCS 14/20. As Rosenbach makes clear, the plaintiff need not allege anything “beyond violation of his or her rights under the Act, in order to qualify as an ‘aggrieved’ person and be entitled to seek liquidated damages and injunctive relief[.]” 129 N.E.3d at 1207 (emphasis added); id.at 1206 (“The violation, in itself, is sufficient to support the individual’s or customer’s cause of action). Moreover, “[a] motion to dismiss under Rule 12(b)(6) doesn’t permit piecemeal dismissals of parts of claims; the question at this stage is simply whether the complaint includes factual allegations that state a plausible claim for relief.” BBL, Inc. v. City of Angola, 809 F.3d 317, 325 (7th Cir. 2015); see also, Cothron v. White Castle Sys., Inc., No. 19 CV 00382, 2020 WL 3250706 , at *5 (N.D. Ill. June 16, 2020) (finding that the plaintiff stated a claim under BIPA “even absent specific allegations about [the defendant’s mental state”); Figueroa v. Kronos, 454 F. Supp. 3d 772 , 787 (N.D. Ill. Apr. 13, 2020)(“BIPA provides that recklessness offers a basis for greater liquidated damages, not for a separate claim” and noting that 12(b)(6) motions do not permit piecemeal dismissals of parts of a claim)). In any event, Plaintiff has alleged sufficient facts to demonstrate negligence or recklessness in violating the statute. The Court agrees that an allegation that an entity made no effort to comply with BIPA for years “is enough, at the pleading stage, to make a claim of negligence or recklessness plausible.” Rogers v. BNSF Ry. Co., No. 19 C 3083, 2019 WL 5635180 , at *5 (N.D. Ill. Oct. 31, 2019); Lenoir v. Little Caesar Enterprises, Inc., No. 19-CV1575, 2020 WL 4569695 , at *4 (N.D. Ill. Aug. 7, 2020) (defendant’s alleged failure to comply with BIPA years after its enactment demonstrated negligence, at least at the pleadings stage). Accordingly, Defendant’s argument fails on this point as well. D. The Illinois Workers’ Compensation Act does not Preempt Plaintiff’s BIPA Claim. Defendant further argues that Plaintiff’s claims are preempted by the Illinois Workers’ Compensation Act because the claim arose in connection with his employment. The Workers’ Compensation Act “is designed to provide financial protection to workers for accidental injuries arising out of and in the course of employment.” Meerbrey v. Marshall Field & Co., 564 N.E.2d 1222, 1225 (Ill. 1990). It generally provides the “exclusive remedy” for injuries employees suffer at work. Id.; see also Baylay v. Etihad Airways P.J.S.C., 881 F.3d 1032 , 1038–39 (7th Cir. 2018) (explaining that the Workers’ Compensation Act “abrogates employer liability for all common law negligence claims and provides the exclusive means by which an employee can recover against an employer for a work-related injury in Illinois” (internal quotation marks and citations omitted)). Indeed, one provision of the Workers’ Compensation Act provides that “no common law or statutory right to recover damages from the employer . . . for injury or death sustained by any employee while engaged in the line of his duty . . . other than the compensation herein provided, is available to any employee who is covered by” the Workers’ Compensation Act. 820 ILCS 305/5(a). Another provides that the compensation provided under the Workers’ Compensation Act “shall be the measure of the responsibility of any employer” covered by the Act for accidental injuries employees sustain at work. Id. at 305/11. But in four circumstances, the Workers’ Compensation Act does not provide the exclusive remedy for an employee's injuries. See Collier v. Wagner Castings Co., 408 N.E.2d 198, 202 (Ill. 1980). A plaintiff may sue her employer if her injury: “(1) was not accidental, (2) did not arise from . . . her employment, (3) was not received during the course of employment[,] or (4) was noncompensable under the [Workers’ Compensation Act].” Id. An Illinois Appellate Court recently answered a certified question regarding whether the Workers’ Compensation Act applies to employees seeking liquidated damages under BIPA. The Illinois court concluded that “the exclusivity provisions of the Compensation Act do not bar a claim for statutory, liquidated damages, where an employer is alleged to have violated an employee’s statutory privacy rights under the Privacy Act, as such a claim is simply not compensable under [Workers’ Compensation Act].” McDonald v. Symphony Bronzeville Park LLC, ____ N.E. 3d ___, 2020 WL 5592607 at *8 (Ill. App. 1 Dist., 2020). While the Illinois court limited its review to the specific issue of liquidated damages, it observed that federal courts have generally concluded that Workers’ Compensation Act does not preempt a suit by an employee against an employer under BIPA and that Illinois circuit courts appear unanimous in reaching the same conclusion. Id. To the extent that Plaintiff claims damages in addition to statutory liquidated damages, those would also not be preempted by IWCA. As acknowledged in other cases, compensable injuries are generally limited to debilitating physical or psychological ailments that interfere with the plaintiff’s ability to work. See, e.g., Watts v. Indus. Com., 394 N.E.2d 1171, 1172 (Ill. 1979) (“Recovery under the Workmen’s Compensation Act is not limited to disabilities from physical injury but may be allowed, under certain circumstances, for disability from psychological causes.”); Schroeder v. RGIS, Inc., 992 N.E.2d 509 , 519 (Ill. App. 1 Dist., 2013) (mental injuries tied to a physical injury, known as the “physical mental” category, are compensable); Pathfinder Co. v. Industrial Com., 343 N.E.2d 913, 917 (Ill. 1976) (Worker’s Compensation Act provides compensation for “sudden severe emotional shock traceable to a definite time, place, and cause which causes psychological injury or harm”). Courts that have considered the issue have held the invasion of one’s statutory privacy rights is not compensable under the Workers’ Compensation Act and rejected the exact preemption argument Defendant advances here. Lenoir, 2020 WL 4569695 , at *14 (“Courts have unanimously rejected this argument, and this Court will do the same.”) (citations and quotations omitted); Cothron v. White Castle, Inc., No. 19 CV 00382, 2020 WL 3250706 , at *2 (N.D. Ill. June 16, 2020) (joining with courts that rejected argument that the Workers’ Compensation Act preempts BIPA claims); Peatry v. Bimbo Bakeries USA, INC., 2020 WL 919202 , at *19 (N.D. Ill. February 26, 2020) (“the [Workers’ Compensation Act] does not cover the injury Peatry alleges—the invasion of her privacy rights.”) In light of the recent Illinois Appellate Court case clarifying that Workers’ Compensation Act does not preempt statutory, liquidated damages under BIPA and the unanimous rejection of arguments that Workers’ Compensation Act might otherwise preempt privacy claims, the Defendant’s argument fails on this point as well. CONCLUSION For the reasons stated above, it is ORDERED that Defendant’s Motion to Dismiss [9] is DENIED. Defendant is ORDERED to answer Plaintiff’s Amended Complaint on or before November 30, 2020. The Plaintiff is further ORDERED to file his motion for conditional class certification on or before December 7, 2020 and Defendant shall file a response on or before January 4, 2020. ENTERED this day 12th day of November, 2020. /s/ Michael M. Mihm Michael M. Mihm United States District Judge