Heard v. Becton, Dickinson and Company

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION COREY HEARD, individually and on behalf of ) all others similarly situated, ) ) Plaintiff, ) ) v. ) Case No. 19 C 4158 ) BECTON, DICKINSON & CO. ) Judge Rebecca R. Pallmeyer ) Defendant. ) MEMORANDUM OPINION AND ORDER Since 2015, Plaintiff Corey Heard has worked as a respiratory therapist at several hospitals in Illinois that use the Pyxis MedStation system—an automated medication dispensing system manufactured by Defendant Becton, Dickinson and Company ("BD"). A user gains access to Pyxis devices by scanning his fingerprint. Heard alleges that he "was required" to access Pyxis devices with his fingerprint "[a]s a condition of his employment" at the hospitals. (Compl. [11] ¶ 50.) He has sued BD on behalf of a putative class for allegedly collecting, storing, and disseminating biometric data—specifically, fingerprints—in violation of the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. (the "BIPA"). Heard initially filed this lawsuit in the Circuit Court of Cook County, Illinois. BD removed the action to this court on the basis of diversity jurisdiction and the Class Action Fairness Act (see Notice of Removal [1], 1), and now moves for dismissal of all claims under Federal Rule of Civil Procedure 12(b)(6). In addition, BD has moved to strike Heard's class allegations. For the following reasons, BD's motion to dismiss is granted and its motion to strike the class allegations is terminated as moot. BACKGROUND The court recounts the following facts from Heard's Complaint. BD is a leading manufacturer and seller of medical technology, including the Pyxis MedStation system and related Pyxis devices (hereinafter, "Pyxis" or "Pyxis devices"). (Compl. ¶ 1.) As noted, Pyxis devices "require . . . users to scan a fingerprint" for access to the system and the medication it dispenses. (Id. ¶¶ 1-2.) "[W]hen an employee first begins work at a company that uses a Pyxis device," he is "required to have [his] fingerprint or palm print scanned in order to enroll [him] in the Pyxis database." (Id. ¶ 38.) Once the employee has done so, he has "access to multiple Pyxis devices" at his place of employment. (Id. ¶ 2.) BD "markets its Pyxis devices . . . as superior" to other medication-disbursement methods by emphasizing that they "improve[] precision and accuracy of user access via biometric information." (Id. ¶ 42.) BD "provides Pyxis devices to dozens of hospitals" in Illinois. (Id. ¶ 1.) Between 2015 and the present, Heard has worked for at least five hospitals (the "Hospitals") that use Pyxis devices. (Id. ¶ 49.) "As a condition of employment" at the Hospitals, Heard "was required to scan his fingerprint so it could be used as an authentication method to access the Pyxis devices." (Id. ¶ 50.) BD "subsequently stored [Heard's] fingerprint data in their systems." (Id. ¶ 51; see also id. ¶ 44 (alleging that BD has "assembl[ed] a database of biometric data through broadly deployed fingerprint scanners").) The Hospitals, too, "subsequently stored [Heard's] fingerprint data in their systems." (Id. ¶ 52.) Heard was "required to scan his fingerprint each time he accessed the Pyxis devices." (Id. ¶ 53.) Heard alleges "[u]pon information and belief" that BD "improperly discloses Pyxis user's [sic] fingerprint data to other, currently unknown, third parties, including but not limited to third parties that host biometric data in their data center(s)." (Id. ¶ 11.) The BIPA "imposes numerous restrictions on how private entities collect, retain, disclose and destroy biometric identifiers," including fingerprints. Rosenbach v. Six Flags Entm't Corp., 129 N.E.3d 1197, 1199 , 432 Ill. Dec. 654, 656 , 2019 IL 123186 ¶ 1 (2019). "Under the Act, any person 'aggrieved' by a violation of its provisions 'shall have a right of action against an offending party' and 'may recover for each violation.'" Id. (quoting 740 ILCS 14/20). Heard asserts claims against BD under Sections 15(a), 15(b), and 15(d) of the BIPA. Section 15(a) requires entities "in possession of" biometric data to develop a publicly available retention schedule and destruction deadline for the data. 740 ILCS 14/15(a). Section 15(b) requires entities that collect biometric data to first inform the subject in writing that they are doing so; state the "specific purpose and length of term for which" the data "is being collected, stored, and used"; and receive an executed written release authorizing them to collect the data. 740 ILCS 14/15(b). Finally, Section 15(d) prohibits entities "in possession of" biometric data from disclosing it except in certain circumstances. 740 ILCS 14/15(b). In recent months, employees who have been subject to fingerprint scans have brought suit against their employers under the BIPA.1 In this case, Heard sues the manufacturer of the fingerprint scanning device itself, Defendant BD. He alleges that BD never informed him or similarly situated individuals that it was collecting, using, or storing their biometric data, and never stated the purpose and length of time for which it was doing so, in violation of Section 15(b). (See, e.g., Compl. ¶¶ 10, 39, 94.) He also alleges that BD failed to obtain an executed written release from him or similarly situated individuals authorizing the collection of their biometric data, in violation of Section 15(b). (See, e.g., id. ¶¶ 10, 93.) In addition, Heard alleges that BD never provided him or similarly situated individuals with a publicly available retention schedule for permanent destruction of the biometric data it collected, in violation of Section 15(a). (See, e.g., id. ¶¶ 10, 84.) Finally, Heard alleges "[u]pon information and belief" that BD disclosed his biometric data and that of similarly situated individuals to "unknown" third parties without obtaining consent, in violation of Section 15(d). (Id. ¶ 11; see also id. ¶ 103.) Heard seeks to represent a class defined as "[a]ll individuals working in the State of Illinois who had their fingerprints collected, captured, received, or otherwise obtained or disclosed by Defendant during the applicable 1 Heard himself is a lead plaintiff in at least four other putative class actions brought under the BIPA in Illinois state courts. (See BD Mem. in Supp. of Mot. to Strike Class Allegations [19], 1 n.1 (referencing Heard v. Omnicell, Inc., No. 2019-CH-06817 (Cir. Ct. of Ill. Cook Cnty.); Heard v. Weiss Mem'l Hosp., No. 2019-CH-06763 (Cir. Ct. of Ill. Cook Cnty.); Heard v. St. Bernard Hosp., No. 2017-CH-16828 (Cir. Ct. of Ill. Cook Cnty.); Heard v. TCH-North Shore, Inc., No. 2017CH-16918 (Cir. Ct. of Ill. Cook Cnty.)).) statutory period." (Id. ¶ 68.) DISCUSSION A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) tests the sufficiency of the complaint. See, e.g., Bell v. City of Country Club Hills, 841 F.3d 713, 716 (7th Cir. 2016). In ruling on a Rule12(b)(6) motion, the court accepts all well-pleaded facts in a plaintiff's complaint as true and views them in the light most favorable to the plaintiff. See United States ex rel. Berkowitz v. Automation Aids, Inc., 896 F.3d 834, 839 (7th Cir. 2018). To survive a motion to dismiss, the complaint must contain sufficient factual information to "state a claim to relief that is plausible on its face." Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A claim has facial plausibility when "the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). "Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice." Id.; see also, e.g., Brooks v. Ross, 578 F.3d 574, 581 (7th Cir. 2009) (plaintiffs cannot satisfy the notice pleading rule by "merely parrot[ing] the statutory language of the claims that they are pleading"; rather, they must provide "some specific facts to ground those legal claims"). A. Whether the BIPA's "Health Care Exemption" Is Limited to Patient Information BD argues that the court should dismiss Heard's claims outright because, according to BD, the biometric data at issue falls under a "health care exemption" to the BIPA, which can be found in the Act's definition of biometric identifiers. (BD Mem. in Supp. of Mot. to Dismiss ("BD Mot.") [16], 4.) The definition states, in relevant part, that "[b]iometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996 ["HIPAA"]." 740 ILCS 14/10 (emphasis added). BD contends that the latter clause—"information collected, used, or stored for health care treatment, payment, or operations under" HIPAA—"must be read to reach information other than that collected from a patient so as to avoid rendering it superfluous." (See BD Mot. 4.) It then emphasizes that according to Heard's Complaint, Pyxis users scan their fingerprints in order to access medication (presumably for patients, considering that Heard is a hospital employee). Thus, in BD's view, Heard's "purported biometric data is exempted [from the BIPA] as 'information collected, used, or stored for health care treatment, payment, or operations' under HIPAA." (Id. (quoting 740 ILCS 14/10).) The court is aware of only two other cases in which defendants have advanced this theory. Both were in Illinois circuit courts, and the courts reached opposite conclusions concerning the theory's viability. (See Ex. A to BD Reply in Supp. of Mot. to Dismiss [29-1], Diaz v. Silver Cross Hosp. & Med. Ctrs., No. 2018 CH 001327 (Cir. Ct. of Ill. Will Cnty.), Aug. 29, 2019 Hrg. Tr. 4:1-6, 19:16-18, 21:11-24 (determining that HIPAA protects not only data that is "patient-driven," but also data that "relates to the patient" in a "secondary" sense; finding that a plaintiff-nurse's fingerprint was "information collected, used, or stored for health care treatment"; agreeing that the BIPA exempts such information; and dismissing the plaintiff's claims on that basis); Ex. 1 to Heard Opp. to BD Mot. to Dismiss [25-1], Bruhn v. New Alberton's, Inc., No. 2018 CH 01737 (Cir. Ct. of Ill. Cook Cnty.), July 2, 2019 Hrg. Tr. 53:1-22 (stating that interpreting the statute in the same manner BD proposes here would be "nonsensical" because it would leave "large categories" of health care workers—whose biometric information is not protected under HIPAA—without recourse to protect that information under the BIPA, and stating if the Illinois legislature had intended to create such a significant "doughnut hole," it would have said so in clearer terms).) The court finds the reasoning in Bruhn more persuasive, particularly considering the Illinois Supreme Court's recent statement that the Illinois legislature "codified [in the BIPA] that individuals possess a right to privacy in and control over their biometric" data. Rosenbach, 129 N.E.3d at 1206 , 432 Ill. Dec. at 663 , 2019 IL 123186 ¶ 33 . It seems unlikely that the legislature intended to deprive health care workers of that privacy and control merely because they are using their biometric information for the purpose of patient treatment. Ultimately, however, the court need not decide whether BD's statutory interpretation is correct because, for the reasons discussed below, Heard fails to state a claim under the BIPA in any event. B. Section 15(b) of the BIPA Unlike Sections 15(a), (c), (d), and (e) of the BIPA—all of which apply to entities "in possession of" biometric data—Section 15(b) applies to entities that "collect, capture, purchase, receive through trade, or otherwise obtain" biometric data. 740 ILCS 14/15(a)-(e). Recognizing this distinction, the parties agree that mere possession of biometric data is insufficient to trigger Section 15(b)'s requirements. (See BD Mot. 8; Heard Opp. to BD Mot. to Dismiss ("Heard Opp.") [25], 10.) This interpretation of Section 15(b) finds ample support in case law. See Namuwonge v. Kronos, Inc., No. 1:19-cv-03239, 2019 WL 6253807 , at *5 (N.D. Ill. Nov. 22, 2019) (because "[t]he Illinois legislature used the term possession in certain sections of BIPA . . . but chose not to include possession in section 15(b)," there "is a difference between possessing and collecting biometric information");2 Bernal v. ADP, LLC, No. 2017-CH-12364, 2019 WL 5028609 , at *1 (Cir. Ct. of Ill. Cook Cnty. Aug. 23, 2019) (crediting the argument that "the legislature intended for possession alone to not be enough to make an entity subject to § 15(b)"); see also, e.g., Dana Tank Container, Inc. v. Human Rights Comm'n, 292 Ill. App. 3d 1022, 1026 , 227 Ill. Dec. 179, 181 , 687 N.E.2d 102, 104 (1st Dist. 1997) ("Where the legislature uses certain words in one instance and different words in another, it intended different results."). The parties dispute, however, whether Section 15(b) applies only to entities that "actively" collect biometric data. (BD Mot. 8.) BD argues that it does and contends that Heard's allegations do not sufficiently plead that BD itself actively collected his biometric data (or that of the putative class members). (See id. at 7-10.) Heard maintains that BD is reading a nonexistent requirement into the statute. (See Heard Opp. 10.) Pointing to the "otherwise obtain" language in Section 15(b), Heard contends that the provision applies to "any entity that obtains biometric data, no 2 Namuwonge was issued after the parties had fully briefed BD's motion to dismiss. matter the source or the manner of collection." (Id.) He also emphasizes that the bankruptcy of a company called Pay By Touch—which allegedly "provided major retailers . . . with fingerprint scanners to facilitate consumer transactions"—motivated the Illinois legislature to pass the BIPA. (See Compl. ¶¶ 25-26 (alleging, inter alia, that Pay By Touch's bankruptcy "was alarming to the Illinois Legislature because suddenly there was a serious risk that millions of fingerprint records" could be "sold, distributed, or otherwise shared through the bankruptcy proceedings without adequate protections for Illinois citizens"); Heard Opp. 11 (citing same).) Heard contends that because "it was Pay By Touch's clients that 'actively collected' individuals' fingerprints," active collection cannot be "the touchstone of liability under Section 15(b)." (Heard Opp. 11 (emphasis added).) Heard's arguments are flawed. First, Heard agrees that Section 15(b) requires something more than mere possession of biometric data, but does not explain what that "something more" is, if not an affirmative act of collection. In this vein, Heard does not specify how an entity could "otherwise obtain" biometric information without taking an active step to do so. And as BD points out, Black's Law Dictionary defines "obtain" as "[t]o bring into one's own possession; to procure, esp. through effort." (Obtain, BLACK'S LAW DICTIONARY (11th ed. 2019) (emphasis added); see BD Mot. 8 (quoting same).) Second, the fact that Pay By Touch's bankruptcy may have influenced the Illinois legislature's decision to enact the BIPA does not mean that the legislature drafted every provision with Pay By Touch in mind, or that it intended for every provision to cover entities that operate exactly as Pay By Touch did. Moreover, it is not clear from Heard's own allegations that Pay By Touch did not engage in an affirmative act of collection. The court concludes that for Section 15(b)'s requirements to apply, an entity must, at a minimum, take an active step to "collect, capture, purchase, receive through trade, or otherwise obtain" biometric data. 740 ILCS 14/15(b). Heard has not adequately pleaded that BD took such any such step. For example, Heard repeatedly alleges that BD "collected" his biometric data without alleging how, when, or any other factual detail. (See, e.g., Compl. ¶¶ 9, 37, 39-40, 54, 68, 82, 91, 94, 95, 101; see also id. ¶ 93 (alleging that BD "systematically and automatically collected" Heard's and the putative class members' biometric data).) These allegations "merely parrot" the BIPA's statutory language; they do not provide any "specific facts to ground [Heard's] legal claims." Brooks, 578 F.3d at 581 . Heard also alleges that "[a]s a condition of employment" at the Hospitals, he "was required to scan his fingerprint" to use Pyxis—and that BD "subsequently stored [his] fingerprint data in their systems." (Compl. ¶¶ 50-51.) But Heard does not allege how the data made its way to BD's systems. Nor does he argue or allege that there is a difference between storage and mere possession. Heard's allegations are much like those in Namuwonge, where a court dismissed the plaintiff's Section 15(b) claims under Rule 12(b)(6). See 2019 WL 6253807 , at *5. The plaintiff in Namuwonge alleged that her employer (Brookdale) and the supplier of Brookdale's fingerprint scanning equipment (Kronos) each "systematically and automatically collected, used, stored and disseminated" her biometric information. Id. But "the more precise allegation" in the plaintiff's complaint "ma[de] clear that Brookdale collected the fingerprints using a system that Kronos supplied to Brookdale." Id. The court held that "[t]ogether, these allegations do not plausibly allege that Kronos collected, captured, or otherwise obtained [the plaintiff's] biometric information." Id. So too here. Similarly, an Illinois circuit court recently dismissed a Section 15(b) claim against a provider of biometric scanning technology because the plaintiff "failed to allege facts sufficient . . . for the Court to properly assess Defendant's actual involvement, relative to the biometric scanning technology, beyond the fact that Defendant supplied [the plaintiff's employer] with the technology." Bernal, 2019 WL 5028609 , at *2. As in Bernal, Heard's allegations do not enable the court to "assess [BD's] actual involvement" in the alleged collection of biometric data. Notably, in Neals v. PAR Technology Corp., a court in this district determined that to state a claim for a Section 15(b) violation, the plaintiff did not need to "substantiate her allegation that [the defendant] collected her biometric information." Neals, No. 19 C 5660, 2019 WL 6907995 , at *2 (internal quotation marks omitted).3 Rather, the allegation that the defendant "collected such information through its customer's use of" its fingerprint scanning system was sufficient. Id. Whatever the merit of that conclusion, Neals is distinguishable in that Heard does not even allege that BD collected biometric information "through its customer's use of" Pyxis. Id. He instead alleges with no factual support that BD "collect[ed]" his biometric data and "stored [it] in their systems." (See, e.g., Compl. ¶¶ 9, 51.) Additionally, in his opposition to BD's motion to dismiss, Heard relies on information that appears nowhere in his Complaint. Specifically, Heard states that BD "does not directly collect biometric data with every Pyxis system it sells; some of its products collect and store biometric data only locally in the network in which they are deployed." (Heard Opp. 3 n.1.) He continues, "That is not the case for the named Plaintiff in this action and the putative class alleged in the Complaint, from whom BD collects the information directly." (Id. (citing Compl. ¶¶ 51, 68, which state nothing of the sort).) And he states that BD "chose to market biometric devices that transmit data to BD-controlled servers for storage." (Heard Opp. 9.) These statements suggest that Heard has some understanding, based on some factual source, of how BD allegedly collects biometric data. Yet Heard chose not to include the information in these statements—or any factual content concerning the critical issue of collection—in his pleadings. The court concludes that Heard has not plausibly alleged that BD "collect[ed], capture[d], purchase[d], receive[d] through trade, or otherwise obtain[ed]" biometric data from Heard or the putative class members. 740 ILCS 14/15(b). The court therefore grants BD's motion to dismiss Heard's Section 15(b) claim and declines to address BD's alternative argument that because it "is not [Heard's] employer," it "does not have to (and could not) comply with Section 15(b)'s notice and consent provisions." (BD Mot. 6.) C. Sections 15(a) and 15(d) of the BIPA Sections 15(a) and 15(d) of the BIPA apply to entities "in possession of" biometric data. 3 Neals, too, was decided after the parties had fully briefed BD's motion to dismiss. 740 ILCS 14/15(a), (d). The BIPA does not define "possession." See 740 ILCS 14/10. Accordingly, the court "assumes [that] the legislature intended for [the term] to have its popularly understood meaning," or its "settled legal meaning" if one exists. Rosenbach, 129 N.E.3d at 1205 , 432 Ill. Dec. at 662 , 2019 IL 123186 ¶ 29 (applying these canons of construction to the term "aggrieved," which is also undefined in the BIPA). The Illinois Supreme Court has held that "possession, as ordinarily understood, occurs when a person has or takes control of the subject property or holds the property at his or her disposal." People v. Ward, 215 Ill.2d 317, 325 , 830 N.E.2d 556, 560 , 249 Ill. Dec. 144 , 148 (2005) (internal quotation marks omitted); see Namuwonge, 2019 WL 6253807 , at *3 (citing same). BD argues that the term "possession" in the BIPA contemplates an exercise of dominion and control "to the exclusion of others" (BD Mot. 11), but the court disagrees. The ordinary meaning of possession does not contemplate exclusive control, see Ward, 215 Ill.2d at 325 , 830 N.E.2d at 560 , 249 Ill. Dec. at 148, and nothing in the BIPA indicates that the ordinary definition of possession does not apply. See Namuwonge, 2019 WL 6253807 , at *3 (same). If anything, the Illinois legislature's findings that "[t]he use of biometrics is growing" and "[t]he full ramifications of biometric technology are not fully known" reflect a recognition that multiple entities could control the same data. 740 ILCS 14/5(a), (f). Nonetheless, the court agrees with BD that Heard has not adequately pleaded "possession" because he fails to allege that BD "exercised any dominion or control over [his] biometric data." (BD Mot. 11.) Like Heard's allegations concerning collection, most of his allegations concerning possession merely parrot the statutory language. (See Compl. ¶¶ 9, 37, 39-40, 54, 68, 93-95 (alleging, without more, that BD "stored" biometric information).) Only one paragraph of the Complaint provides more detail: it states that at some time after the hospitals required Heard to scan his fingerprint into Pyxis devices, BD "subsequently stored [Heard's] fingerprint data in their systems." (Id. ¶ 51.) This allegation does not plead that BD exercised any form of control over the data or that it held the data "at [its] disposal." Ward, 215 Ill.2d at 325 , 830 N.E.2d at 560 , 249 Ill. Dec. at 148. Indeed, it does not say whether BD could freely access the data or even how BD allegedly received it. (Compl. ¶ 51.) Compare Namuwonge, 2019 WL 6253807 , at *3 (the plaintiff's "allegation that Brookdale disclosed their employees' fingerprint data to Kronos sufficiently alleges that Kronos possessed the fingerprint data collected by Brookdale"). Heard's allegations that BD improperly disseminated the data—which, if true, would suggest that BD had control over the data—do not alter the court's conclusion because, as the court discusses below, Heard's pleadings do not plausibly indicate that BD ever disseminated the data. Accordingly, the court concludes that Heard has failed to "plead[] factual content that allows the court to draw the reasonable inference" that BD was "in possession" of his biometric data, or that of the putative class members. Iqbal, 556 U.S. at 678 . The court, therefore, grants BD's motion to dismiss Heard's claims for violations of Section 15(a) and 15(d). The court also dismisses Heard's claim under Section 15(d) for an independent reason: Heard offers no basis for the allegation that BD disclosed his biometric data (or that of the putative class members). See 740 ILCS 14/15(d) (providing that entities "in possession of" biometric data cannot disclose it except in limited circumstances). Heard concedes that he relies solely on "information and belief" in alleging that BD violated Section 15(d), but argues that he is permitted to do so because the "facts of necessity" are within BD's exclusive control. (See Heard Opp. 13; Compl. ¶ 11.) "The Twombly plausibility standard . . . does not prevent a plaintiff from pleading facts alleged upon information and belief where the facts are peculiarly within the possession and control of the defendant." Arista Records, LLC v. Doe 3, 604 F.3d 110, 120 (2d Cir. 2010) (internal quotation marks omitted); see also Green v. Beth, 663 F. App'x 471, 474 (7th Cir. 2016) (same). Heard has not satisfied the court that BD alone has possession of the facts necessary to Heard's Section 15(d) claim. If Heard has a legitimate reason to suspect that BD disclosed his biometric data or that of the putative class members, he surely possesses information of some kind that triggered his suspicion—such as reports that BD has unlawfully disseminated biometric data in the past, or indications that Heard or the putative class members experienced identify theft after they used their employers' Pyxis systems. Such information would not be within BD's exclusive possession. Heard, therefore, is not entitled to plead disclosure based upon information and belief. In its current form, Heard's Complaint contains no allegations of fact which, if true, suggest there is any basis to even suspect that BD disseminated the biometric data at issue. The court is not required to credit rank speculation. See Taha v. Int'l Bhd. of Teamsters, Local 781, 947 F.3d 464, 469 (7th Cir. 2020). For the reasons stated above, the court grants BD's motion to dismiss Heard's claims for violations of Sections 15(a), 15(b), and 15(d) of the BIPA. The dismissal is without prejudice. If Heard wishes to file an amended complaint, he must do so by March 31, 2020. Because the court is dismissing Heard's Complaint in its entirety, it terminates BD's motion to strike the class allegations as moot, without prejudice to refiling in the event that Heard files an amended complaint. CONCLUSION For the foregoing reasons, the court grants Defendant Becton, Dickinson and Company's Motion to Dismiss [15] and terminates Defendant Becton, Dickinson and Company's Motion to Strike Class Allegations [18] as moot, without prejudice to refiling. If Heard wishes to file an amended complaint, he must do so by March 31, 2020. ENTER: Dated: February 24, 2020 Lbrern Hf foseape—— REBECCA R. PALLMEYER United States District Judge