Hernandez v. Omnitracs, LLC

UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION JOHN HERNANDEZ, on behalf of himself ) and all other persons similarly situated, ) known and unknown, ) ) Plaintiff, ) No. 1:22-CV-00109 ) v. ) ) Judge Edmond E. Chang OMNITRACS, LLC, ) ) Defendant. ) MEMORANDUM OPINION AND ORDER John Hernandez brings this proposed class action against Omnitracs, LLC—a technology company that supplies driver-monitoring products to trucking companies—for violating the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. (commonly referred to as “BIPA”).1 BIPA prohibits private entities from collecting someone’s “biometric identifier,” including face-geometry scans, unless that person has consented in writing and the private entity has provided certain disclosures. 740 ILCS 14/10, 14/15(b). BIPA also requires collectors of biometric identifiers to 1 Although subject matter jurisdiction almost surely applies under the Class Action Fairness Act, 28 U.S.C. § 1332 (d), which requires only minimal diversity, Omnitracs shall confirm this in a Jurisdictional Memorandum due on April 8, 2024. Hernandez is an Illinois citizen. R. 1, Compl. ¶ 21. The Complaint alleges that Omnitracs is a citizen of Delaware and Texas because it is incorporated in Delaware with its principal place of business in Texas. Id. ¶ 22 . But an LLC’s citizenship is not like a corporation’s; instead, the citizenship of an LLC is that of each of its members. Wise v. Wachovia Securities, LLC, 450 F.3d 265, 267 (7th Cir. 2006). In the Jurisdictional Memorandum, Omnitracs shall identify each of its members and set forth their respective citizenship (including tracing through additional LLC or partnerships if applicable). Separately, the amount-in-controversy requirement is satisfied because Hernandez alleges over $5,000,000 is in controversy on the class action, id. ¶ 24. develop, publicly disclose, and follow a data retention and destruction policy for the biometric information. 740 ILCS 14/15(a). Hernandez alleges that Omnitracs violated BIPA by using its in-truck camera device to collect his and other proposed class members’ facial geometries without their consent and without making the required BIPA disclosures. R. 1, Compl.2 Omnitracs moves to dismiss, arguing that (1) the Court lacks personal jurisdiction over Omnitracs; (2) the extraterritorial doctrine precludes Hernandez’s claim; and (3) Hernandez fails to adequately state a claim for relief. R. 68, Def.’s Mot. at 2; Fed. R. Civ. P. 12(b)(2), 12(b)(6). For the reasons below, the motion to dismiss is denied. I. Background The Court accepts all well-pleaded factual allegations in the Complaint as true. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). With over 15,000 customers, Omnitracs is a “technology company that provides telematics products to fleet operators, including routing and predictive analytics technology.” Compl. ¶ 1. One of Omnitracs’ products is its Omnitracs Critical Event Video hardware (the parties call it the CEV hardware), an in-truck camera device that uses artificial intelligence, machine learning, and computer vision to track driver behavior. Id. ¶¶ 2–3. This product mounts to the inside of a truck’s windshield and videorecords the road ahead and the interior of the truck, monitoring driver activity. Id. ¶¶ 4–5. For example, the product detects inattentive driver 2Citations to the record are “R.” followed by the docket entry number and, if needed, a page or paragraph number. — 2 — behavior that may be caused by driver fatigue or by looking at a cell phone. Id. ¶ 6. To detect drivers’ behavior, Omnitracs’ facial-mapping technology, via its CEV hardware, collects scans of drivers’ facial geometries. Id. ¶¶ 7–8 (describing how the hard- ware provides “complete visibility” into the vehicle and details of the driver’s face, eyes, and hands to detect “drowsiness, sleep, phone use, cigarette use, seatbelt use, and other safety-critical behaviors”). Hernandez is an Illinois citizen who “previously worked as a truck driver in Illinois.” Compl. ¶¶ 12, 21. Omnitracs’ CEV hardware was installed in Hernandez’s truck, monitoring Hernandez and his facial geometry. Id. ¶ 13. Hernandez alleges that Omnitracs collected scans of his facial geometry to analyze his driving behavior, and then analyzed these scans to identify driving behaviors. Id. ¶¶ 14–15. But, according to Hernandez, Omnitracs never informed him—in writing or otherwise—that it was collecting his facial-geometry scans or biometric data and never informed Hernandez, in writing, of the purpose and length of time for which it would collect his facial scans. Id. ¶¶ 16, 18. Nor did Omnitracs obtain Hernandez’s written consent to collect his scans or data. Id. ¶ 17. According to Hernandez, in 2021, a third-party, Solela Holdings, Inc., acquired Omnitracs. Id. ¶ 20. To date, upon Hernandez’s information and belief, Omnitracs has not disclosed to any of its users whether it has transferred drivers’ biometric information to Solera. Id. In this proposed class action, Hernandez asserts that Omnitracs violated BIPA by capturing, collecting, or otherwise obtaining his and proposed class members’ facial-geometry scans without their informed written consent and without first — 3 — informing them in writing that it was doing so. See Compl. ¶¶ 44–46. Hernandez seeks liquidated damages for each BIPA violation, see 740 ILCS 14/20(1)–(2), as well as injunctive relief. Compl. ¶ 47. Moving on from the merits-related allegations, the allegations related to personal jurisdiction start with the fact that Omnitracs is a Delaware limited liability company with its principal place of business in Texas. Compl. ¶ 22. But, at least at some point during the relevant time period, Omnitracs maintained an office in Evanston, Illinois (Omnitracs “leased and used [the Evanston office] from June 2019 until … March 2020”). See R. 71-2, Exh. B at 2–3; Def.’s Mot. at 4 n.5. Also, from January 2017 to June 2022, Omnitracs had Illinois-related employees: six sales em- ployees, six research and development employees, one marketing employee, and one operations management employee—all of whom were responsible for (albeit not exclusively) the Illinois territory and were residents of Illinois during that time. R. 712, Exh. B at 3; Def.’s Mot. at 4 nn.5–6. The six sales employees were responsible for selling Omnitracs products—including the CEV hardware—into Illinois. R. 71-1, Exh. A at 8:22–10:16, 11:23–12:23; see Def.’s Mot. 4 n.6. And on a broader scale, from 2017 to 2022, Omnitracs sold (or leased) and installed a total of 264 CEV hardware units to seven Illinois customers; from 2017 to 2022, Omnitracs derived $2,078 in total revenue from the sales of its CEV hardware to Illinois customers. R. 68-1 at 5; R. 68-3 at 5; R. 71-1, Exh. A at 34:9– 13, 65:20–67:16. Omnitracs also offered CEV services—including warranties and technical assistance—on the CEV systems that it sold in Illinois and charged a — 4 — monthly subscription fee of up to $15 per unit. R. 71-1, Exh. A at 45:18–48:16, 51:6– 16, 61:24–62:18. Also, Omnitracs had six research and development employees with Illinois as their designated territory; they worked on product development and were tasked with traveling through Illinois as needed for Illinois customers. Id. at 18:20– 21:7. Omnitracs maintained at least one service center3 in Illinois where local customers could obtain installation and maintenance services for its products, including CEV hardware. See id. at 39:5–43:4; see also R. 68-1, Exh. A at 5. II. Standard of Review Personal jurisdiction / Rule 12(b)(2). When personal jurisdiction is challenged by the defendant, the plaintiff bears the burden of demonstrating that personal jurisdiction exists. Purdue Research Found v. Sanofi-Synthelabo, S.A., 338 F.3d 773, 782 (7th Cir. 2003). For personal jurisdiction challenges, the operative rule is Federal Rule of Civil Procedure 12(b)(2). If material facts are disputed, then the Court must consider the need for discovery and perhaps an evidentiary hearing to resolve the disputes. See Hyatt Int’l Corp. v. Coco, 302 F.3d 707, 713 (7th Cir. 2002). In that instance, “the plaintiff must establish jurisdiction by a preponderance of the evi- dence,” Purdue Research Found., 338 F.3d at 782 , and “prove what it alleged,” Hyatt Int’l Corp., 302 F.3d at 713 . This contrasts with the normal rule for a motion to 3According to Hernandez, Omnitracs continues to advertise that it has two Illinois locations, despite Omnitracs answering in an interrogatory response that its location near Chicago had closed (leaving the southern Illinois service center as the sole remaining center). R. 71 at 5 n.2; R. 71-1, Exh. A at 39:5–40:3; R. 68-1 at 5. In any event, Omnitracs has at least one Illinois service center. — 5 — dismiss, under which “a judge must accept as true all of the factual allegations contained in the complaint.” Erickson v. Pardus, 551 U.S. 89, 94 (2007). Adequacy of Claim / Rule 12(b)(6). “A motion under Rule 12(b)(6) chal- lenges the sufficiency of the complaint to state a claim upon which relief may be granted.” Hallinan v. Fraternal Order of Police Chicago Lodge No. 7, 570 F.3d 811, 820 (7th Cir. 2009). “When ruling on a defendant’s motion to dismiss, a judge must accept as true all of the factual allegations contained in the complaint.” Erickson, 551 U.S. at 94 (cleaned up).4 A “complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Iqbal, 556 U.S. at 678 (cleaned up). These allegations “must be enough to raise a right to relief above the speculative level.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). And the allegations that are entitled to the assumption of truth are those that are factual, rather than mere legal conclusions. Iqbal, 556 U.S. at 678–79. III. Analysis With the standards of review in place, the Court turns to Omnitracs’ motion. Omnitracs first argues that Hernandez fails to plead facts to support specific personal jurisdiction. Def.’s Mot. at 2. Next, Omnitracs contends that even if personal jurisdiction applies, the extraterritorial doctrine precludes Hernandez’s claim. Id. at 9–11. Lastly, Omnitracs argues that Hernandez fails to state a claim under Rule 12(b)(6), 4This Opinion uses (cleaned up) to indicate that internal quotation marks, alterations, and citations have been omitted from quotations. See Jack Metzler, Cleaning Up Quotations, 18 Journal of Appellate Practice and Process 143 (2017). — 6 — specifically that Hernandez fails to adequately allege that (1) the alleged facial-geometry scans are “biometric identifiers” under BIPA and (2) Omnitracs violated the various provisions of BIPA in §§ 15(a)–(d). Id. at 11–15. The Court will address each argument in turn. A. Personal Jurisdiction Omnitracs argues that Hernandez fails to allege a direct connection between Omnitracs’ relevant conduct and Illinois to support personal jurisdiction. For the reasons below, however, the Court holds that it has personal jurisdiction over Omnitracs in this case. A court has personal jurisdiction over a nonresident defendant if the forum state’s long-arm statute permits service of process and the assertion of personal jurisdiction comports with due process. See Hyatt Int’l Corp., 302 F.3d at 713 . “The Illinois long-arm statute permits the exercise of personal jurisdiction to the full extent permitted by the Fourteenth Amendment’s Due Process Clause.” Bilek v. Fed. Ins. Co., 8 F.4th 581 , 590 (7th Cir. 2021) (cleaned up). Thus, the relevant inquiry is “whether the exercise of personal jurisdiction would violate federal due process.” Mo- bile Anesthesiologists Chi., LLC v. Anesthesia Assocs. of Houston Metroplex, P.A., 623 F.3d 440, 443 (7th Cir. 2010). The Due Process Clause of the Fourteenth Amendment “protects an individual’s liberty interest in not being subject to the binding judgments of a forum with which he has established no meaningful contacts, ties, or relations.” Burger King Corp. v. Rudzewicz, 471 U.S. 462 , 471–72 (1985) (cleaned up). To this end, it allows — 7 — courts to exercise personal jurisdiction over an out-of-state defendant only if that defendant has “sufficient minimum contacts with [the forum State] such that the maintenance of the suit does not offend traditional notions of fair play and substantial justice.” Tamburo v. Dworkin, 601 F.3d 693 , 700–01 (7th Cir. 2010) (cleaned up). Personal jurisdiction may be general or specific, see Daimler AG v. Bauman, 571 U.S. 117 , 126–27 (2014). For both types, a key issue is foreseeability: whether “the defendant’s conduct and connection with the forum State are such that [the defendant] should reasonably anticipate being haled into court there,” World-Wide Volkswagen Corp. v. Woodson, 444 U.S. 286, 297 (1980). Hernandez does not argue that the Court has general jurisdiction over Defendants, so only specific jurisdiction is at issue. Specific personal jurisdiction allows courts to adjudicate lawsuits where the “plaintiff’s claims … arise out of or relate to the defendant’s contacts” with the forum. Ford Motor Co. v. Montana Eighth Jud. Dist. Ct., 141 S. Ct. 1017 , 1025 (2021) (cleaned up). To establish specific personal jurisdiction over a defendant, a plaintiff must show that “(1) the defendant has purposefully directed his activities at the fo- rum state or purposefully availed himself of the privilege of conducting business in the state; (2) the alleged injury arises out of or relates to the defendant’s forum-related activities; and (3) [the] exercise of personal jurisdiction ... comport[s] with traditional notions of fair play and substantial justice.” Rogers v. City of Hobart, 996 F.3d 812 , 819 (7th Cir. 2020) (cleaned up). Omnitracs’ contacts with Illinois meet all three elements. — 8 — First, Hernandez sufficiently alleges that Omnitracs has purposefully availed itself of the privilege of conducting business in Illinois or purposefully directed the company’s activities at Illinois. On this element, courts look to see if there are “mini- mum contacts” between the defendant and the forum State. Lexington Ins. Co. v. Hotai Ins. Co., Ltd., 938 F.3d 874 , 878–79 (7th Cir. 2019). “In all cases, the point of the purposeful-direction requirement is to ensure that an out-of-state defendant is not bound to appear to account for merely random, fortuitous, or attenuated contacts with the forum state.” Tamburo, 601 F.3d at 702 (cleaned up); see also Burger King Corp., 471 U.S. at 475 . Omnitracs’ contacts with the state of Illinois can hardly be described as “ran- dom, fortuitous, or attenuated.” Tamburo, 601 F.3d at 702 . After all, it leased and used an office in Illinois from June 2019 to March 2020; employed 14 employees in Illinois (all of whom were responsible for the Illinois territory and six of whom were responsible for selling Omnitracs products, including the CEV product, into Illinois); and maintained at least one service center in Illinois where local customers could obtain installation and maintenance services for its products, including the CEV product. See Def.’s Mot. 4 nn.5–6; see also R. 68-1, Exh. A at 5; R. 71-1, Exh. A at 8:22–10:16, 11:23–12:23, 39:5–43:4; R. 71-2, Exh. B at 2–3. In sum, Hernandez has sufficiently shown that Omnitracs purposefully directed its activities toward Illinois and purposefully availed itself of the Illinois market. See, e.g., MG Design Assocs., Corp. v. Costar Realty Info., Inc., 224 F. Supp. 3d 621, 630 (N.D. Ill. 2016) (“Setting — 9 — up offices in and sending employees to the forum state for tradeshow operations is enough for minimum contacts in this case.”). Omnitracs counters that it has only received $2,078 in total revenue from the CEV products that it sold to customers in Illinois from 2017 to 2022; has not directed any Google, Facebook, or other advertisement set to Illinois; and denies providing hardware, set-up services or technical support at customer sites in Illinois. See Def.’s Mot. at 4; R. 75, Def.’s Reply at 2; R. 68-3, Exh. C at 4, 9. Omnitracs also contends that the servers for its CEV system are in Nevada, not Illinois. Def.’s Mot. at 4; R. 681, Exh. A at 3. Omnitracs adds that only a “tiny fraction” of its employees reside in Illinois and none played a “meaningful role in the development or operation of the CEV technology.” Def.’s Mot. at 4. But Omnitracs’ contentions go more to the absence of connections that would only add to a finding of personal jurisdiction, while at the same time ignoring the plentiful Illinois-specific contacts. As detailed above, Hernandez has proven that Omnitracs had an actual office in Illinois; employed workers in Illinois, some of whom were responsible for selling its products into Illinois; and maintained a service center in Illinois. Yes, $2,078 is not an enormous revenue figure, but it still proves that Omnitracs obtained some revenue from selling into Illinois and is supplemented by the fact that Omnitracs sold (or leased) and installed 264 CEV units in Illinois from 2017 to 2022 and still charges a monthly subscription fee of up to $15 per unit. That number of CEV units sold to Illinois customers is more than enough to show purposeful direction of sales activities into Illinois. — 10 — What’s more, Omnitracs sufficiently shows the second element, that is, that the contacts “arise-under” or “relate to” this lawsuit. Ford, 141 S.Ct. at 1026 (explaining that the litigation must “arise out of or relate to the defendant’s contacts with the forum”) (emphasis in original). The defendant’s activities in a forum state need not have directly caused the plaintiff’s injury if there exists a “strong relationship among the defendant, the forum, and the litigation.” Id. at 1029 (cleaned up). Again, foreseeability is key: “potential defendants should have some control over—and certainly should not be surprised by—the jurisdictional consequences of their actions.” Tamburo, 601 F.3d at 701 (cleaned up). In Ford, the Supreme Court rejected a strict “causation-only approach” to personal jurisdiction, clarifying that specific personal juris- diction requires only that a lawsuit “arise out of or relate to the defendant’s contact with the forum.” Ford, 141 S.Ct. at 1026. Ford held that despite the defendant-manufacturer (Ford) there not designing, manufacturing, or selling the two particular cars that had malfunctioned in the forum states (the cars involved in the productliability suit), specific personal jurisdiction still attached because Ford “systematically served a market in [the forum states]” for the cars. Id. at 1019, 1028. Similar reasoning applies here. Hernandez’s claim stems from Omnitracs’ alleged unauthorized use of its CEV product to collect his biometric information, which relates to Omnitracs’ sales and servicing of its CEV product in the Illinois market. See Kukovec v. Estée Lauder Cos., Inc., 2022 WL 16744196 , at *1, *4 (N.D. Ill. Nov. 7, 2022) (holding that personal jurisdiction applied over plaintiff’s BIPA claim, which centered on defendant’s virtual makeup try-on tool collecting her facial-geometry — 11 — data, because the claim related to defendant’s sale of cosmetics in Illinois and defendant purposefully availing itself of Illinois to sell its products). Omnitracs need not have sold the specific CEV capturing Hernandez’s or the proposed class members’ biometric information in Illinois; the fact that Omnitracs sold its CEV products in Illinois (and availed itself of Illinois in other ways related to the CEVs, as described earlier) suffices to meet the arise-under or relate-to element. Indeed, there exists a “strong relationship” among Omnitracs, Illinois, and this lawsuit. Ford, 141 S.Ct. at 1029. This relationship is arguably more compelling here than in Ford, because Hernandez is not suing Omnitracs for personal injury due to a specific malfunctioning CEV product. Rather, he is suing Omnitracs due to its use of the same CEV system that it sells to other customers in Illinois. What’s more, Hernandez has shown that his lawsuit arises out of Omnitracs’ contacts with Illinois. Hernandez alleges that he previously worked as a truck driver in Illinois. Compl. ¶ 12. He then alleges that the truck was equipped with CEV hardware, which “monitored [Hernandez] and his facial geometry” and that Omnitracs collected the scans of his facial geometry without his consent. Id. ¶¶ 13–17. Drawing reasonable inferences in Hernandez’s favor, it is reasonable to infer from these allegations that at least some of the facial scans were collected in Illinois. This inference is even more reasonable given that Omnitracs provides nothing (a declaration, for example) supporting the contrary inference—that Omnitracs did not collect scans in Illinois. On the record evidence so far, the Court concludes that Hernandez has shown — 12 — that at least some of the facial-geometry collection happened while he was driving in Illinois, and so the litigation arises out of Omnitracs’ contacts with Illinois. It bears emphasizing that this inference seems like an unnecessarily close call. Hernandez did not explicitly say that he was driving in Illinois when his facial geometry was scanned and collected, nor does he say anything about his employer’s or (if he was an independent contractor) his clients’ locations. Nonetheless, the facts that Hernandez has alleged are sufficient at this stage for personal jurisdiction to apply, especially given Omnitracs’ failure to support a contrary inference. As explained earlier, it is reasonable to infer that Hernandez’s facial geometry was scanned by Omnitracs’ CEV product in when he was driving in Illinois. Out of an abundance of caution and to resolve any ambiguity, in the next status report, Hernandez shall confirm that he is actually alleging that Omnitracs’ CEV system scanned his facial geometry when he was driving in Illinois. By meeting the first two elements (at least for now), Hernandez has made a prima facie case for personal jurisdiction, so the burden shifts to Omnitracs to make a “compelling case that the presence of some other considerations would render juris- diction unreasonable [and that exercising jurisdiction would violate due process].” Burger King Corp., 471 U.S. at 476–77. A number of factors are relevant to this showing, including: (1) “the burden on the defendant,” (2) “the forum State’s interest in adjudicating the dispute,” (3) “the plaintiff’s interest in obtaining convenient and effective relief,” (4) “the interstate judicial system’s interest in obtaining the most efficient resolution of controversies,” and (5) “the shared interest of the several States in — 13 — furthering fundamental substantive social policies.” Id. (quoting World-Wide Volkswagen, 444 U.S. at 292 ). Omnitracs fails to show that exercising jurisdiction over it would be unreason- able or unfair here in Illinois. Other than being located out of state, Omnitracs does not claim any unusual burden in defending this lawsuit in Illinois nor has Omnitracs discussed any of the above considerations in its pleadings. See Curry v. Revolution Lab’ys, LLC, 949 F.3d 385 , 398, 402 (7th Cir. 2020); Illinois v. Hemi Group LLC, 622 F.3d 754, 760 (7th Cir. 2010). Moreover, Illinois has an interest in providing a forum for its residents, like Hernandez and the proposed class members, to seek redress for the collection of their biometric information in violation of BIPA, an Illinois statute. Unless something else calls the finding into question later, this Court has specific jurisdiction over Omnitracs. B. Extraterritorial Doctrine Omnitracs argues that because Hernandez failed to adequately allege that the injury happened in Illinois, the extraterritorial doctrine bars his claim. Under Illinois law, “a statute is without extraterritorial effect unless a clear intent in this respect appears from the express provisions of the statute.” Avery v. State Farm Mut. Auto. Ins. Co., 835 N.E.2d 801, 852 (Ill. 2005) (cleaned up). Because “none of BIPA’s express provisions indicates that the statute was intended to have extraterritorial effect ... BIPA does not apply extraterritorially.” Monroy v. Shutterfly, Inc., 2017 WL 4099846 , at *5 (N.D. Ill. Sept. 15, 2017). The extraterritoriality doctrine does not apply where “the circumstances that relate to the [claim] occur[red] primarily and — 14 — substantially in Illinois.” Avery, 835 N.E.2d at 854 ; see also Monroy, 2017 WL 4099846 , at *6. The Illinois Supreme Court has explained that “there is no single formula or bright-line test for determining whether a transaction occurs within this state.” Avery, 835 N.E.2d at 854 . But the state high court has outlined relevant factors to consider, including the plaintiff’s residence and the location of the alleged harm. Id. Omnitracs argues that Hernandez never made clear where the alleged violations of BIPA occurred. And yes, Hernandez does not explicitly allege that Omnitracs’ CEV hardware scanned and collected his facial geometry while he was driving the truck in Illinois. But, as explained above, although Hernandez should have been more explicit about this point, it is reasonable to infer from the allegations he does make that the alleged violations happened in Illinois.5 To recap, Hernandez alleges that he worked as a truck driver in Illinois; Omnitracs’ CEV hardware was installed in his truck; and the CEV system in Hernandez’s truck scanned and collected his facial geometry without his consent. See Compl. ¶¶ 12–17; R. 71, Pl.’s Resp. at 12–13. Based on these allegations, the Court can reasonably infer that Omnitracs’ alleged viola- tions occurred “primarily and substantially” in Illinois. And so the extraterritorial doctrine does not bar Hernandez’s claim, at least at this stage. Of course, if discovery reveals that Hernandez’s scans were not collected in Illinois, then Omnitracs can 5Again, Hernandez must timely file a status report confirming that he makes this allegation—that he drove the truck in Illinois equipped with the CEV system and that system scanned his face geometry in Illinois. — 15 — pursue summary judgment on those grounds after discovery. For now, though, the extraterritorial doctrine does not apply to block the claim. C. Adequacy of Claim 1. Facial Scans as “Biometric identifiers” Moving on to the merits, Omnitracs contends that Hernandez fails to adequately allege that the facial-geometry scans are “biometric identifiers” under BIPA. Omnitracs argues that the scans are not used to affirmatively identify an individual and BIPA regulates “only data that can be used for identification.” Def.’s Mot. at 12 (citing Rivera v. Google Inc., 238 F. Supp. 3d 1088, 1095 (N.D. Ill. 2017)). According to Omnitracs, Hernandez alleges that the CEV hardware collected drivers’ facial-geometry scans to monitor drivers’ attentiveness (or lack thereof), but the Complaint does not allege that these features can be used to affirmatively identify individuals. Def.’s Mot. at 13. As Hernandez correctly points out, the flaw in Omnitracs’ argument is that it simply fails to account for BIPA’s explicit definition that “biometric identifier” includes “a scan of … face geometry.” See Pl.’s Resp. at 14 (citing 740 ILCS 14/10). Om- nitracs’ interpretation of what does not constitute “biometric identifiers” under BIPA contravenes BIPA’s plain language. To support its agreement, Omnitracs seems to cherry pick text from an opinion issued by the Illinois Attorney General, but ignores BIPA’s explicit statutory language defining “biometric identifiers” as covering “scan[s] of … face geometry.” 740 ILCS 14/10; see Sosa v. Onfido, Inc., 600 F. Supp. 16 3d 859, 871 (N.D. Ill. 2022) (“[T]he dispositive question is whether the information [defendant] allegedly obtains plausibly constitutes a scan of face geometry.”). It is a closer call on whether Hernandez the scans were “used to identify an individual,” as required to qualify as “biometric information.” See 740 ILCS 14/10 (“biometric information” means “any information … based on an individual’s biometric identifier used to identify an individual) (emphasis added). But Hernandez does allege that the scans were used to identify the driver’s attentiveness and Hernandez’s “driving behavior”—all of which requires identifying the driver being monitored. See Compl. ¶¶ 7, 14. At this stage, these allegations suffice to state a claim. Drawing reasonable inferences in Hernandez’s favor, the Complaint alleges that the collected facial-geometry scans were used, in part, as identification tools, or, at minimum, could have been used for identification. See Carpenter v. McDonald’s Corp., 580 F.Supp.3d 512 , 518 n.2 (N.D. Ill. 2022) (“To the extent that Defendant argues that it must have actually used Plaintiff’s [biometrics for identification] to implicate BIPA, the Court disagrees [because] pursuant to the plain language of the statute, a defendant may violate BIPA by collecting [biometrics] that merely could be used to identify a plaintiff.”) (emphasis in original). In any event, the substantive provisions in Section 15 also apply to “biometric identifiers,” 740 ILCS 14/15(a)–(d), which (as explained above) explicitly include scans of “face geometry,” 740 ILCS 14/10. 2. BIPA §§ 15(a)–(d) BIPA § 15(a). As a threshold matter, Hernandez inaccurately argues that Omnitracs attacks his complaint based on each subsection of BIPA, and because — 17 — Hernandez has not carved out a separate count for claims under BIPA 15(a), it would be procedurally improper to consider Omnitracs’ argument as a Rule 12(b)(6) dismissal motion does not allow “piecemeal dismissal of parts of claims.” Pl.’s Resp. at 15. But of course there are such things as partial motions to dismiss. Just because one claim under one subsection is valid would not immunize the others against dismissal if the other claims are inadequately pleaded. In any event, turning first to BIPA § 15(a): Section 15(a) covers a private entity that is “in possession of biometric identifiers or biometric information.” 740 ILCS § 14/15(a). Omnitracs contends that Hernandez fails to allege that Omnitracs “possessed” the data in question. But Hernandez alleges that Omnitracs collected and analyzed the facial geometry scans and that Omnitracs “captured, collected, or otherwise obtained Plaintiff’s facial geometry and the facial geometry of others similarly situated ….” See Compl. ¶¶ 14–19. It can be reasonably (and obviously) inferred from those allegations that Omnitracs’ collection (or “obtain[ing]”) of the facial geometry scans entailed Omnitracs being “in possession” of the scans. See Wordlaw v. Enter. Leasing Co. of Chicago, 2020 WL 7490414 , at *4 (N.D. Ill. Dec. 21, 2020) (reasoning that defendants’ “collection” of biometric data “raises a reasonable (and obvious) inference that, once collected, defendants possessed the [data]”). At this stage, then, Hernandez has adequately stated a § 15(a) claim. Discovery may reveal that — 18 — Omnitracs does not hold onto the data, so perhaps the claim will not survive summary judgment. But that factual question is for later.6 BIPA § 15(b). Omnitracs goes on to argue that Hernandez fails to state a § 15(b) claim. According to Omnitracs, § 15(b) only covers “affirmative actions,” which include a private entity “collect[ing], captur[ing], purchas[ing], receiv[ing] through trade, or obtain[ing] biometric information.” Def.’s Mot. at 13. Omnitracs contends that § 15(b) does not regulate entities that “merely possess” biometric data. Id. at 14. But this argument falls short. As Omnitracs itself recognizes, § 15(b) regulates entities that “collect” biometric data. See id. And Hernandez repeatedly alleges that Omnitracs unlawfully collected his (and others’) facial-geometry scans. Compl. ¶¶ 14–19; see also King v. PeopleNet Corp., 2021 WL 5006692 , *8 (N.D. Ill. Oct. 28, 2021) (concluding plaintiff met § 15(b) “active step” test, because plaintiff alleged defendant “did more than possess [plaintiff’s] biometric information” by alleging that defendant “collected and obtained” the data). Omnitracs tries to distinguish Hernandez’s allegations from the “active collecting” of data. That is, Omnitracs argues that Hernandez only alleges that the CEV product collects scans and that Omnitracs merely plays the “passive role of providing 6 It is worth noting that if Hernandez later is only able to show a generalized failure to disclose a retention policy to the general public, then that would not suffice to show an injury-in-fact as required for Article III standing. Martinez v. Ralph Lauren Corp., Inc., 2022 WL 900019 , at *5 (N.D. Ill. March 27, 2022) (citing Bryant v. Compass Grp. USA, Inc., 958 F.3d 617 , 626 (7th Cir. 2020). But given the allegations that Hernandez himself was harmed by the failure to comply with a retention policy (not just disclose one to the public generally), there is a sufficient allegation of an injury in fact. Id. (citing Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146 , 1154 (7th Cir. 2020). — 19 — the technology used by a separate entity”—Hernandez’s unidentified former employer or clients. Def.’s Mot. at 14. But again, Hernandez explicitly alleges that Omnitracs, not his unidentified employer, “captured, collected, or otherwise obtained Plaintiff’s facial geometry and the facial geometry of others similarly situated” and analyzed the data. Compl. ¶¶ 14–19; see Karling v. Samsara Inc., 610 F. Supp. 3d 1094 (N.D. Ill. 2022) (holding that the plaintiff sufficiently alleged defendant’s “active collection, storage, and use of his data” by alleging that defendant collected his facial geometry scans, processed and stored the data, and provided access to dashboard and services based on that data to plaintiff’s employer). That factual allegation is assumed to be true at this stage of the case. BIPA §§ 15(c) & (d). Omnitracs argues Hernandez’s § 15(c) claim is timebarred because Hernandez does not allege conduct that occurred within one year of the Complaint’s filing. See Def.’s Mot. at 14–15 (arguing that 735 ILCS § 5/13-201’s one-year limitations applies to BIPA claims). Omnitracs contends that even under Tims v. Black Horse Carriers, where an Illinois appellate court held that the one-year limitations applies only to §§ 15(c)–(d) clams, the § 15(c) claim must still be dismissed because Hernandez filed his complaint in January 2022 but fails to allege his facial geometry was collected after January 2021. 2021 IL App (1st) 200563 (Ill. App. 1 Dist. 2021). Omnitracs’ limitations argument fails, however, because shortly after the briefing on this dismissal motion concluded, the Illinois Supreme Court decided Tims v. Black Horse Carriers on appeal. 216 N.E.3d 845 , 853–54 (Ill. 2023). There, the state — 20 — high court held that the limitations for BIPA claims is five years, not one year. And, in any event, the limitations question is not appropriate for this motion to dismiss, because Hernandez did not allege the timeframe for which the alleged collection oc- curred, and the statute of limitations is an affirmative defense that he need not plead around. See Bell v. SDH Services West, LLC, 2020 WL 9812014 , at *2 (N.D. Ill. 2020) (citing United States v. Lewis, 411 F.3d 838, 842 (7th Cir. 2005)). In the same vein, Omnitracs argues that § 15(d)’s “disclosure” claim fails for limitations reasons, again citing a one-year limitations period. Omnitracs also argues that Hernandez’s allegation that Omnitracs disclosed his biometric data without his consent is conclusory and contradicted by his allegation that he does not know the status of his data. Omnitracs’ limitations argument fails for the same reasons it failed against § 15(c). But more to the point, Hernandez explains that he does not advance a stand-alone § 15(d) claim anyway. Pl.’s Resp. at 19. If discovery shows that there is a plausible § 15(d) claim, then Hernandez may seek leave to amend the complaint. For now, however, the Court need not address the viability of this claim. IV. Conclusion Omnitracs’ motion to dismiss is denied. The parties shall confer on a discovery schedule and file a joint status report on or before April 10, 2024. As previously discussed, in the status report, Hernandez also must confirm that he is alleging that he — 21 — drove a truck in Illinois equipped with the CEV product and that the system scanned his facial geometry when he was driving in Illinois. ENTERED: s/Edmond E. Chang Honorable Edmond E. Chang United States District Judge DATE: March 31, 2024 — 22 —