Meegan v. NFI Industries Inc

UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION DAWN MEEGAN, Plaintiff, No. 20 C 465 v. Judge Thomas M. Durkin NFI INDUSTRIES, INC., Defendant. MEMORANDUM OPINION AND ORDER Dawn Meegan alleges that her former employer, NFI Industries, violated the Illinois Biometric Information Protection Act, 740 ILCS 14/15 (“BIPA”). NFI removed the case from state court and filed a motion to dismiss the complaint as untimely. R. 9. Rather than address the timeliness of the complaint, the Court sua sponte found that the complaint failed to allege an injury in fact under federal law, and remanded the case to state court. R. 19. NFI filed a motion to reconsider. R. 20. That motion is granted to the extent that the Court’s finding of a failure to allege an injury in fact, and the remand order, are vacated in light of the Seventh Circuit’s recent decision in Bryant v. Compass Group, 958 F.3d 617 (7th Cir. 2020). In Bryant, the Seventh Circuit clarified what violations of BIPA constitute an injury in fact and reversed a district court decision this Court relied upon in its remand order. That decision compels a finding that the Court has subject matter jurisdiction in this case. The Court now addresses the timeliness issue and denies the motion to dismiss on that basis. Legal Standard A Rule 12(b)(6) motion challenges the “sufficiency of the complaint.” Berger v. Nat. Collegiate Athletic Assoc., 843 F.3d 285, 289 (7th Cir. 2016). A complaint must provide “a short and plain statement of the claim showing that the pleader is entitled to relief,” Fed. R. Civ. P. 8(a)(2), sufficient to provide defendant with “fair notice” of the claim and the basis for it. Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). This standard “demands more than an unadorned, the-defendant-unlawfullyharmed-me accusation.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). While “detailed factual allegations” are not required, “labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Twombly, 550 U.S. at 555 . The complaint must “contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Iqbal, 556 U.S. at 678 (quoting Twombly, 550 U.S. at 570 ). “‘A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.’” Boucher v. Fin. Sys. of Green Bay, Inc., 880 F.3d 362, 366 (7th Cir. 2018) (quoting Iqbal, 556 U.S. at 678 ). In applying this standard, the Court accepts all well-pleaded facts as true and draws all reasonable inferences in favor of the non-moving party. Tobey v. Chibucos, 890 F.3d 634, 646 (7th Cir. 2018). Additionally, a “plaintiff is not required to plead elements in his or her complaint that overcome affirmative defenses, such as statute-of-limitations defenses.” NewSpin Sports, LLC v. Arrow Elecs., Inc., 910 F.3d 293, 299 (7th Cir. 2018). As long as the Court can “imagine” a scenario in which the claim is timely, it is improper to dismiss it on the pleadings. See U.S. Gypsum Co. v. Ind. Gas Co., Inc., 350 F.3d 623, 628 (7th Cir. 2003) (holding that the “right question” is not whether the plaintiff has alleged “facts that tend to defeat affirmative defenses,” but “whether it is possible to imagine proof of the critical facts consistent with the allegations in the complaint” that would fall within the period of limitations). “But when a plaintiff’s complaint nonetheless sets out all of the elements of an affirmative defense, dismissal under Rule 12(b)(6) is appropriate.” Indep. Trust Corp. v. Stewart Info. Servs. Corp., 665 F.3d 930, 935 (7th Cir. 2012). Background Meegan worked for NFI from May to August 2016. R. 1-1 ¶ 41. NFI required Meegan to scan her fingerprints in order to clock in and out of work. Id. ¶ 42. Meegan’s fingerprints were stored in NFI’s employment database, which is maintained by third-party Kronos. Id. ¶¶ 43, 53. NFI did not inform Meegan of its policy for retaining and destroying her fingerprints. Id. ¶ 45. NFI never obtained Meegan’s written consent regarding the use of her fingerprints. Id. ¶ 47. Meegan alleges that NFI violated subsections (a), (b), and (d) of BIPA § 14/15. Subsection (a) requires an entity to develop a policy for retaining and destroying biometric identifiers, including fingerprints, no more than three years after the fingerprint owner is no longer affiliated with the entity. Subsection (b) requires written consent for collection of biometric information. And subsection (d) prohibits disclosure or dissemination of biometric information without written consent. Analysis BIPA does not include a statute of limitations. Under Illinois law, “all civil actions not otherwise provided for, shall be commenced within 5 years next after the cause of action accrued.” 735 ILCS 5/13-205. To determine whether there is a more specifically applicable statute of limitations, Illinois courts analyze “the type of injury at issue, irrespective of the pleader’s designation of the nature of the action.” Travelers Cas. & Sur. Co. v. Bowman, 893 N.E.2d 583, 587 (Ill. 2008). “[G]eneral rules of statutory construction” govern this analysis. See Hernon v. E.W. Corrigan Const. Co., 595 N.E.2d 561, 562 (Ill. 1992). NFI argues that either a one- or two-year statute of limitations applies to BIPA. NFI argues further that since Meegan left NFI almost four years ago in August 2016, her claims are untimely. I. One-Year Statute of Limitations A. Subsections (a) and (b) & “Publication” NFI argues that Illinois’s one-year statute of limitations for privacy claims applies here. Under 735 ILCS 5/13-201, “actions for slander, libel, or for publication of matter violating the right of privacy, shall be commenced within one year next after the cause of action accrued.” NFI concedes that “publication” must be an element of any claim governed by the one-year statute of limitation of § 13-201. BIPA subsections (a) and (b) do not have a publication element, so § 13-201 cannot provide the statute of limitations for subsections (a) or (b). B. Subsection (a) & Accrual Even if the one-year statute of limitations in § 13-201 applies, Meegan’s claim under subsection (a) that NFI has failed to destroy her fingerprint information is not time-barred because, based on Meegan’s allegations, the claim did not accrue until three years after she left NFI. Subsection (a) requires NFI to destroy Meegan’s fingerprint information “when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever occurs first.” 740 ILCS 14/15(a). Meegan alleges that NFI does not have a policy setting forth a “purpose” for collecting fingerprint information. Absent such a stated purpose, NFI was permitted to retain Meegan’s fingerprint information for up to three years after her departure from NFI, or August 2019. Since NFI’s retention of Meegan’s fingerprints did not violate BIPA until August 2019, her claim did not accrue until that date. Meegan filed this case about six months later in January 2020, meaning it was well within a one-year statute of limitations. NFI argues that Meegan’s allegation that NFI has failed to destroy her fingerprints is not well-plead because it is based on “information and belief.” But Meegan alleges that NFI did not provide her with a fingerprint destruction policy. That allegation is well-pled because she has personal knowledge of that fact. NFI’s failure to establish or communicate such a policy permits the plausible inference that it does not have a policy requiring destruction of fingerprint information and, further, that it has not destroyed Meegan’s fingerprint information. Discovery may reveal otherwise, in which case NFI may again argue on summary judgment that the claim is untimely.1 But Meegan’s allegations are sufficient for her claim under subsection (a) to survive a challenge to its timeliness on the pleadings.2 C. Subsection (d) The Court has found that the one-year statute of limitations provided by § 13201 does not apply to subsections (a) and (b) because they do not contain a “publication” element. To the extent Illinois law allows different subsections of a single act to be governed by different statutes of limitations, BIPA’s subsection (d) might be governed by § 13-201. Subsection (d) prohibits dissemination of biometric information to a third-party without consent. Meegan argues that dissemination to a single third-party does not constitute “publication” because “publication” requires dissemination to the general public. But the dissemination required to state a claim for slander or libel—the torts specifically mentions in § 13-201—need not be so broad. Rather, dissemination to a single third-party is enough. See Black's Law Dictionary (11th ed. 2019) (“Publication means the act of making the defamatory statement known to any person or persons other than the plaintiff himself. It is not necessary 1 If that should occur, the Court expects that the parties will brief the issues raised in this opinion so that the Court can ultimately determine the appropriate statute of limitations. 2 Meegan also argues that NFI’s “ongoing” failure to destroy her fingerprint information is a “continuing violation” that has not accrued. It is unnecessary for the Court to determine whether Meegan has alleged a continuing violation in order to decide this motion. But to the extent it is relevant later in the case, the Court notes that other courts have found that ongoing illegal retention of personal property is not a continuing violation, but accrues when the property is first illegally obtained. See Sherry v. City of Chicago, 2019 WL 2525887 , at *3 (N.D. Ill. June 19, 2019). that there should be any publication in the popular sense of making the statement public. A private and confidential communication to a single individual is sufficient.”); see also W. Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc., 2020 WL 1330494 , at *5 (Ill. App. Ct. 1st Dist. Mar. 20, 2020) (relying on Black’s definition of “publication”). Thus, the dissemination of private information prohibited by BIPA subsection (d) could constitute “publication” for purposes of § 13-201. But it is unnecessary for the Court to reach this issue at this point in the proceedings because Meegan’s complaint does not allege when she learned that NFI disseminated her fingerprint information to Kronos. Meegan’s claim under BIPA subsection (d) only accrued when she discovered that NFI gave her fingerprint information to Kronos. See Belleville Toyota, Inc. v. Toyota Motor Sales, U.S.A., Inc., 770 N.E.2d 177, 192 (Ill. 2002) (“[U]nder the discovery rule, a cause of action accrues, and the limitations period begins to run, when the party seeking relief knows or reasonably should know of an injury and that it was wrongfully caused.”). There is nothing in the complaint definitively demonstrating that Meegan learned that NFI gave her fingerprint information to Kronos more than one year prior to filing this case. And since plaintiffs are not required to anticipate affirmative defenses in their complaints, to the extent § 13-201 is the applicable statute of limitations for BIPA subsection (d), it is not a basis to dismiss that claim on the pleadings. II. Two-Year Statute of Limitations NFI also argues that Meegan’s claims are subject to the two-year statute of limitations provided by 735 ILCS 5/13-202. The Court has found that Meegan’s claims under both subsection (a) and (d) survive a motion to dismiss regardless of the applicable statute of limitations. However, the Court must address whether the twoyear statute of limitations provided by 735 ILCS 5/13-202 applies to subsection (b), which prohibits collection of biometric information without consent. The last time NFI could have collected Meegan’s fingerprints without her consent was more than two years ago because Meegan has alleged that she left NFI in 2016. This claim would be untimely under the two-year statute of limitations of section 13-202, if applicable.3 Section 13-202 provides that actions “for a statutory penalty . . . shall be commenced within 2 years.” Meegan argues that section 13-202 does not apply because BIPA is not penal, but remedial. A statute “is penal if it (1) imposes automatic liability for a violation of its terms; (2) sets forth a predetermined amount of damages; and (3) imposes damages without regard to the actual damages suffered by the plaintiff.” Standard Mut. Ins. Co. v. Lay, 989 N.E.2d 591 , 599 (Ill. 2013). By contrast, remedial statutes “are designed to grant remedies for the protection of rights, introduce regulation conducive to the public good, or cure public evils.” Id. However, remedial statutes may also impose penalties as “one part of the regulatory scheme, intended as a supplemental aid to enforcement rather than as a punitive measure,” without thereby being considered “penal statutes.” Scott v. Ass’n for Childbirth at Home, Int’l, 430 N.E.2d 1012, 1017 (Ill. 1981). 3 The same would be true of Meegan’s claim under subsection (a) if discovery shows that accrual of that claim occurred more than two years prior to the filing of this case. BIPA provides for liquidated damages penalties. See 740 ILCS 14/20. But it also permits recovery of actual damages. See id. And as NFI concedes, BIPA is concerned with the protection of personal privacy, and regulating the use of biometric information. In enacting the statute, the legislature found that “[t]he public welfare, security, and safety will be served by regulating the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” 740 ILCS 14/5. BIPA’s provision for actual damages and the regulatory intent of its enactment show that it is a remedial statute not within the scope of the two-year statute of limitation imposed by section 13-202. Therefore, Illinois’s catchall statute of limitations of five years applies to subsection (b) such that Meegan’s claim under that subsection is timely. The one Illinois court to have addressed this issue in a published decision agrees. See Robertson v. Hostmark Hospitality Group, Inc., 2019 WL 8640568 , at *4 (Ill. Cir. Ct. Chan. Div. July 31, 2019). Conclusion For these reasons, NFI’s motion to reconsider [20] is granted, to the extent that the remand order of March 26, 2020 [19] is vacated. The Clerk is ordered to reopen the case. Further, on reconsideration, the motion to dismiss [9] is denied. By July 7, 2020 the parties should file a joint status report proposing a discovery schedule, and otherwise addressing how they would like to proceed. ENTERED: Abonsts M Suthur. Honorable Thomas M. Durkin United States District Judge Dated: June 4, 2020