Konow v. Brink's Incorporated

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION CHARLES KONOW, individually and on ) behalf of all others similarly situated, ) ) Plaintiff, ) ) v. ) No. 23-cv-760 ) BRINK’S, INCORPORATED, ) Judge Rebecca R. Pallmeyer ) Defendant. ) MEMORANDUM OPINION AND ORDER Plaintiff Charles Konow drove armored trucks for Defendant Brink’s, Incorporated (“Brink’s”), a private security company. Konow alleges that, while he was employed there and without his consent, Brink’s installed cameras in its trucks that scanned employees’ faces while they drove. Konow seeks to represent a class of Illinois residents who drove trucks for Brink’s, arguing that by collecting scans of their facial geometry and using those scans to analyze their driving behavior, Brink’s violated the Illinois Biometric Information and Privacy Act (“BIPA”), 740 ILCS 14/1 et seq. Defendant has moved to dismiss the complaint [14] for failure to state a claim. For the reasons discussed below, the motion is denied. BACKGROUND The standard that governs this motion is familiar. A complaint that fails to “state a claim to relief that is plausible on its face” may be dismissed under Rule 12(b)(6). Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A claim is plausible if it “pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Boucher v. Fin. Sys. of Green Bay, Inc., 880 F.3d 362, 366 (7th Cir. 2018) (quoting Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)). In other words, a complaint need only “include enough facts to present ‘a story that holds together.’” Roldan v. Stroud, 52 F.4th 335, 339 (7th Cir. 2022) (quoting Reed v. Palmer, 906 F.3d 540, 548 (7th Cir. 2018)). And the court must “accept as true all factual allegations in the complaint and draw all permissible inferences in plaintiffs' favor” when making this determination. Boucher, 880 F.3d at 365 . Accordingly, the court treats as true the following factual allegations in Plaintiff’s Complaint. Plaintiff Konow is a Cook County resident. (Class Action Compl., Ex. A to Notice of Removal (hereinafter “Compl.”) [1-1] ¶ 15.) Beginning on an unspecified date, Konow worked as an armored truck driver for Brink’s, a “private security and protection” limited liability company headquartered in Dallas and incorporated in Delaware. (Id. ¶¶ 2, 16.) At some (also unspecified) point either during or prior to Konow’s employment, Brink’s equipped its trucks with a “driverfacing camera” produced by a company called SmartDrive Systems, Inc. (“SmartDrive”). (Id. ¶¶ 3–5.) The cameras contain SmartDrive’s “SmartSense” technology, meaning that they are, as SmartDrive boasts, “loaded with sensors that deliver massive volumes of rich data that fleets can leverage to understand vehicle use and driver performance.” (Id. ¶ 6.) The SmartDrive cameras enable Defendant to monitor employee-drivers’ behavior by “scan[ning] the driver’s face, including certain face and eye movements” and interpreting that data to “identify driver risks and dangerous driving behavior, such as drowsiness.” (Id. ¶¶ 7–8.) The cameras were able to do this by wielding some combination of “purpose-built sensors,” as well as what SmartDrive calls “computer vision” and “computer-based algorithms . . . .” (Id.) In other words, these cameras used “facial mapping” to catch sleepy or otherwise inattentive or dangerous drivers. (Id. ¶ 7.) Plaintiff’s complaint attaches an image found on the website for SmartDrive’s parent company Omnitracs, LLC, which purports to show the sensors in action: 7 Es 4 te ( J —=_=_ pS apace (Id. Jf} 3.n.1, 5, 7.) Beyond this photo and the abovementioned descriptions, however, Plaintiff does not provide further detail on how the SmartDrive system operates. Whether or how the software responds to the information it gathers—in real time or otherwise—is not explained. Konow alleges that Brink’s used this technology “to collect scans of [his] facial geometry to analyze his driving behavior.” (/d. 9.) He filed a class complaint on December 7, 2022 in the Circuit Court of Cook County, on behalf of “Illinois residents who had their facial geometry scanned, captured, collected, or otherwise obtained by Defendant in Illinois between December 2017 and the present... (/d. J 23; Notice of Removal [1] at 1.) Brink’s removed the case to this court on February 7, 2023 pursuant to diversity jurisdiction ( 28 U.S.C. § 1332 (a)) and the Class Action Fairness Act of 2005 (“CAFA”), 28 U.S.C. § 1332 (d)).1 (Notice of Removal at 1.) The complaint contains a single count under BIPA—specifically, as the court reads the Complaint, 740 ILCS 14/15(b), which prohibits the collection of biometric identifiers or information without consent. (Compl. 35-41.) Defendant has moved to dismiss, arguing that Plaintiffs complaint does not plausibly allege that the material SmartDrive cameras collected constituted biometric identifiers within the meaning of BIPA. 1 The court has diversity jurisdiction, as the parties are completely diverse and the amount in controversy exceeds $75,000. (See Notice of Removal at 2-5.) Plaintiff does not challenge removal. DISCUSSION BIPA prohibits private entities from collecting “a person’s . . . biometric identifier or biometric information” without written notice and consent. 740 ILCS 14/15(b). The law defines a “biometric identifier” as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry,”2 and it defines “biometric information” as “any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual.” 740 ILCS 14/10. The statute’s legislative findings section points out that biometrics are “biologically unique to the individual” and are thus “unlike other unique identifiers . . . [such as] social security numbers [which], when compromised, can be changed.” 740 ILCS 14/5(c). Accordingly, courts interpreting the statute3 have concluded that “a biometric identifier is a unique personal feature that can be used to identify a person.” Carpenter v. McDonald’s Corp., 580 F. Supp. 3d 512 , 515 (N.D. Ill. 2022) (citing Rivera v. Google, Inc., 238 F. Supp. 3d 1088, 1096 (N.D. Ill. 2017)). Importantly, under this understanding, a defendant may violate BIPA even without using technology for the purpose of identifying an individual; instead, BIPA bars the collection of biometric data that “merely could be used to identify a plaintiff.” Id. at 518 n.2 (emphasis in original). Plaintiff’s allegation that Defendant collected scans of certain of his facial features—which are unique to him—suffices to state a BIPA claim under the plain text of the statute. Plaintiff characterizes SmartDrive’s technology as capturing “scans of [his] facial geometry”; “scan[ning] the driver’s face, including certain face and eye movements”; and conducting “facial mapping” 2 BIPA clarifies that its definition of biometric identifiers does not include: “writing samples, written signatures, photographs, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions such as height, weight, hair color, or eye color.” 740 ILCS 14/10. The law also does not include various medical materials and data in its definition, including medical scans and body parts. Id. 3 To determine “legislative intent,” Illinois law on statutory interpretation requires looking to “the language used in the statute itself, which must be given its plain and ordinary meaning.” Paris v. Feder, 179 Ill. 2d 173, 177 , 688 N.E.2d 137, 139 (Ill. 1997) (citing Kraft, Inc. v. Edgar, 138 Ill. 2d 178, 189 , 561 N.E.2d 656 (1990)). with sensors. (Compl. ¶¶ 7–9.) The information allegedly collected by SmartDrive thus falls explicitly within BIPA’s definition of biometric identifiers (“a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry”). 740 ILCS 14/10. Though not controlling, a recent case, Wilk v. Brainshark, Inc., is instructive in demonstrating that scans of facial features qualify as biometric identifiers. 631 F. Supp. 3d 522 , 529–30 (N.D. Ill. 2022). There, the plaintiff, a sales professional, was asked by her employer to submit a video of her “sales presentations” to a company called Brainshark. Id. at 526 . Brainshark analyzed the footage using “AI-powered technology” and “facial-mapping technology to identify [her] emotions and other performance indicators.” Id. It then shared the results of its analysis with the plaintiff’s employer. Id. The court found that these allegations were sufficient to state a BIPA claim, stressing that the “technology scans videos for facial features,” and that “BIPA explicitly defines ‘biometric identifier’ to include a ‘scan of hand or face geometry.’” Id. at 530 . This case is on all fours with Brainshark: Konow’s unique facial features were scanned and mapped by SmartDrive to identify performance indicators like drowsy driving, and Defendant collected such scans to “analyze his driving behavior.” (Compl. ¶ 9.) Given that the purpose of the facial scan need not be to identify, Carpenter, 580 F. Supp. 3d at 518 n.2, the allegation that Brink’s scanned and collected Plaintiff’s facial geometry plausibly states a BIPA claim. Brainshark, 631 F. Supp. 3d at 530 (“Brainshark fails to explain how the term ‘scan of face geometry’ is unclear or how what it collected from Plaintiff’s videos does not qualify.”) Challenging this conclusion, Brink’s focuses on a dispute concerning Plaintiff’s factual allegations. Defendant argues, for example, that Plaintiff merely “speculat[es]” that SmartDrive’s technology scanned his facial geometry, and, relatedly, that evidence on the website maintained by SmartDrive’s parent, Omnitracs, confirms that SmartDrive’s cameras recorded nothing more than video footage, “visually review[ed]” by SmartDrive employees to “identify risky driving behaviors.” (Mem. in Supp. of Brink’s Rule 12(b)(6) Mot. to Dismiss Pl.’s Class Action Compl. [15] at 12–14.) Neither argument is compelling. For one, Plaintiff’s claims—that SmartDrive’s cameras conducted facial scans that Brink’s used to assess his driving behavior—are plainly factual allegations accorded deference at this stage. Whether the SmartDrive technology actually conducted such scans is a factual matter to be determined at summary judgment or trial. Similarly, Defendant’s argument that Brink’s merely recorded videos of drivers does not support dismissal of the Complaint on motion. In making this argument, Defendant asks the court to take judicial notice of statements about SmartDrive that appear in a video on Omnitracs’ website, a different part of which Plaintiff cites to in his Complaint. Those statements, Brink’s contends, imply that SmartDrive merely collected videos of drivers’ faces that were reviewed by SmartDrive employees—not face scans. (Id. at 13–14 (citing Omnitracs + SmartDrive, Omnitracs, https://www.omnitracs.com/smartdrive (last visited Mar. 4, 2024)); Reply in Supp. of Def.’s Rule 12(b)(6) Mot. to Dismiss Pl.’s Class Action Compl. [23] at 7–9.) This information, if true, will certainly be relevant in resolving Plaintiff’s claim. But the court was unable to find the video Defendant quotes here; what appeared on clicking the link (where, presumably the relevant material once appeared) were the words “Media not found” in faint gray letters. See Omnitracs + SmartDrive, Omnitracs, https://www.omnitracs.com/smartdrive/ (last visited Mar. 4, 2024). If a video or other data confirms that SmartDrive does not collect the kind of scans Plaintiff alleges, Brink’s is free to present that information at the summary judgment stage. For now, the court presumes the truth of the allegation that SmartDrive collects “scan[s] . . . of facial geometry,” data that would fall within BIPA’s list of biometric identifiers. 740 ILCS 14/10. Aside from these factual disputes, Defendant also argues that simply alleging that it collected facial scans is insufficient to state a BIPA claim. More specifically, Defendant argues that Plaintiff’s claim fails because he has only alleged that Brink’s collected facial scans of drivers to determine their behavior—falling asleep at the wheel, for example—as opposed to a particular driver’s identity. The result, according to Defendant, is that Brink’s was not collecting biometric identifiers in a way that would be actionable under BIPA. This narrower reading of BIPA’s broad language has found some purchase in other recent opinions in this district, which read into the statute a requirement that scans of unique personal features must be capable of “be[ing] used to uniquely identify” a plaintiff. Carpenter, 580 F. Supp. 3d at 517–18; see also Robinson v. Lake Ventures LLC, No. 22 CV 6451, 2023 WL 5720873 , at *7 (N.D. Ill. Sept. 5, 2023) (same); see also Clarke v. Aveda Corp., __ F. Supp. 3d. __, 2023 WL 9119927 , at *2 (N.D. Ill. 2023) (stressing, granting motion to dismiss, that “Plaintiffs’ complaint contains no plausible allegations that Aveda’s collection of their biometric data made [Aveda] capable of determining their identities.” (emphasis in original) (quotation omitted)). This court is not certain that the “uniquely identifying” test is supported by BIPA’s plain language. But assuming that it is, Plaintiff’s Complaint plausibly states a claim even under this narrower approach. Courts that have adopted this stricter identification-centered approach have required, before finding a BIPA violation, that there be some explicit link between a collected scan and a plaintiff’s identity. For example, in Daichendt v. CVS Pharmacy, Inc., the plaintiffs alleged that CVS Pharmacy violated BIPA section 15(b) by collecting scans of its customers’ faces when taking their passport and ID photographs. No. 22 CV 3318, 2022 WL 17404488 , at *1 (N.D. Ill. Dec. 2, 2022), modified on reconsideration, 2023 WL 3579082 (N.D. Ill. Feb. 3, 2023) (“Daichendt I”); Daichendt v. CVS Pharmacy, Inc., No. 22 CV 3318, 2023 WL 3559669 , at *1 (N.D. Ill. May 4, 2023) (“Daichendt II”). CVS used those scans to detect facial features in customers’ photos relevant to passport requirements, showing, for example, that someone’s eyes were open, that their mouth was “closed and not smiling,” that they were not wearing glasses (or their glasses didn’t cause a glare), and the like. Daichendt I, 2022 WL 17404488 , at *1. The court was “inclined to conclude” that “scans of photographs can trigger BIPA,” but it nonetheless dismissed the complaint because the plaintiffs had not shown how such scans had “made defendant capable of determining their identities.” Id. at *4–5 (emphasis in original). To scale this additional hurdle, the court held, plaintiffs would have had to “allege that they provided defendant with . . . information, such as their names or physical or email addresses, that could connect the voluntary scans of face geometry with their identities.” Id. at *5 . On a second go-round, plaintiffs took the court’s suggestion and “allege[d] that defendant collected and stored their personal contact data . . . such as their names and email addresses” when they got their passport photos. Daichendt II, 2023 WL 3559669 , at *1. To that court, this additional information “made defendant capable of identifying them when associated with scans of their face geometry (‘biometric identifiers’)” and thus stated a BIPA claim. Id. In another recent set of cases, plaintiffs unsuccessfully challenged different companies’ “virtual try-on tool[s]”, which used facial scanning to “superimpose[] . . . selected cosmetic product[s] onto the user’s face.” Castelaz v. Estée Lauder Cos., Inc., No. 22 CV 5713, 2024 WL 136872 , at *1 (N.D. Ill. Jan. 10, 2024); Clarke, 2023 WL 9119927 , at *1 (N.D. Ill. 2023) (same). In both cases, the courts dismissed the plaintiffs’ complaints, stressing that the plaintiffs had alleged merely that the company collected scans of their facial geometry, as opposed to “demonstrating [that the defendant] was capable of identifying them from this data.” Clarke, 2023 WL 9119927 , at *2. Once again, without some additional connection between the collected scans and the plaintiffs’ identities, these courts found that the complaints “failed to plead the most foundational aspect of a BIPA claim.” Id. (quoting Daichendt I, 2022 WL 17404488 , at *5). Taken together, then, this narrower caselaw suggests that, to allege the collection of biometric identifiers, a plaintiff must show that the collected data could be used, “whether alone or in conjunction with other methods or sources of information available,” to identify them. Castelaz, 2024 WL 136872 , at *7. Plaintiff’s Complaint plausibly pleads such a connection. Plaintiff alleges that “Defendant used the SmartSense technology to collect scans of Plaintiff’s facial geometry to analyze his driving behavior.” (Id. ¶ 9.) If Brink’s collected Plaintiff’s facial scans to “analyze his driving behavior,” the obvious inference is that Brink’s could (and did) tie the scans to Konow’s identity. How else would they use the scans to assess his performance? See Brainshark, 631 F. Supp. 3d at 526, 530 (finding BIPA violation in similar employer-employee context, where company “contracted with Brainshark to use its [face-scanning] AI-technology to provide RQI with a better understanding of its employees’ sales acumen” by mapping their emotions). True, Konow does not explicitly describe how, exactly, Defendant tied (or could have tied) SmartDrive’s facial scans to Konow’s identity, and a more detailed Complaint could have been helpful. But Konow was Brink’s employee and he was driving their truck, which creates the natural inference that Brink’s had the means to connect whatever facial scans they took to the individual truck driver’s identity. Inferring in Plaintiff's favor, the court finds Plaintiff's case closer to Daichenat II than Clarke and Castelaz, and that it would thus pass muster under even a narrow reading of BIPA’s definition of “biometric identifier.” As in Daichenat //, Plaintiff has pleaded sufficient facts to support an inference that Defendant (his employer) had access to other personal data of his that, in conjunction with the facial scans, could have been used to identify him. In contrast, Clarke and Castelaz both involved commercial retailer defendants with no clear preexisting relationship to the plaintiffs, or any other alleged connection, that might support such an inference. CONCLUSION Discovery may demonstrate that SmartDrive’s cameras did not scan faces, or, to the extent it is relevant, that Brink’s did not in fact collect driver-specific data from those scans. See Carpenter, 580 F. Supp. 3d at 517-18 (noting, while refusing to dismiss BIPA claim, that discovery could doom it). But at this early stage, Plaintiff has told “a story that holds together” that his employer collected his unique facial features through SmartSense technology, and that it could (or did) associate those scans with his identity, situating Defendant’s actions within BIPA’s reach. Reed, 906 F.3d at 548 . Defendant’s motion to dismiss [14] is denied. ENTER: Dated: March 5, 2024 bree HG: a REBECCA R. PALLMEYER United States District Judge