Stauffer v. Innovative Heights Fairview Heights, LLC

IN THE UNITED STATES DISTRICT COURT FOR THE SOUTHERN DISTRICT OF ILLINOIS MADISYN STAUFFER, ON BEHALF ) OF HERSELF AND ALL OTHERS ) SIMILARLY SITUATED, ) ) Plaintiffs, ) Case No. 3:20-CV-00046-MAB ) vs. ) ) INNOVATIVE HEIGHTS FAIRVIEW ) HEIGHTS, LLC, ET AL., Defendants. MEMORANDUM AND ORDER BEATTY, Magistrate Judge: Presently before the Court is Defendant Sky Zone Franchise Group, LLC’s motion, and supporting memorandum, to dismiss (Docs. 119, 120). For the reasons set forth below, the motion is GRANTED. BACKGROUND This case was originally filed by Plaintiff Madisyn Stauffer (“Plaintiff”), on behalf of herself and others similarly situated, in the Twentieth Judicial Circuit, St. Clair County, Illinois on April 29, 2019 against one Defendant, Innovative Heights Fairview Heights, LLC (“Innovative Heights”), based on Plaintiff’s allegations that Innovative Heights violated the Illinois Biometric Information Privacy Act, 740 ILCS 14/1, et seq. (“BIPA”) (Doc. 1-1, p. 2). To regulate the use of these biometric identifiers, BIPA provides that a private entity in possession of biometric information “must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever occurs first.” 740 ILCS 14/15(a) (“Section 15(a)”). BIPA also outlines that a private entity may not “collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s biometric identifier or information” unless it first informs that person, in writing, that such an identifier or information is being collected or stored and informs that person, in writing, of the purpose and length for which a biometric identifier or information is being used, collected, and stored. See 740 ILCS 14/15(b)(1). Additionally, BIPA provides that a private entity must receive a written release executed by the person who is the subject of the biometric identifier or information. 740 ILCS 14/15(b)(1)-(3) (“Section 15(b)”). In the original complaint, Plaintiff alleged that Innovative Heights (Plaintiff’s employer) collected and stored her and the other putative class members’ fingerprints as part of their employment for timekeeping purposes in violation of BIPA (Doc. 1-1 at p. 4). While still in state court, Plaintiff sought leave to amend her complaint to include a second Defendant, Pathfinder Software LLC doing business as CenterEdge Software, LLC (“CenterEdge”), which Plaintiff alleges controls and operates the system and database where Innovative Heights’ stores its employees’ fingerprints (Id. at p. 94). Plaintiff alleged that both Innovative Heights and CenterEdge violated Sections 15(a) and 15(b) of BIPA while scanning and storing fingerprints for timekeeping and other purposes (Doc. 1, p. 2). Plaintiff explained that Innovative Heights and CenterEdge never informed her, in writing, the specific purpose of and the period for which her fingerprints were being collected, stored, or used in violation of BIPA (Doc. 1-1, pp. 98-99). Plaintiff alleged two separate classes of individuals: those who were employed by Defendant Innovative Heights and worked at its Sky Zone facility in Fairview Heights, Illinois, and those individuals who had their fingerprints collected, captured, purchased, received through trade, or otherwise obtained by CenterEdge (Id. at p. 91). After Plaintiff filed her amended complaint, CenterEdge removed this case on January 10, 2020 to the Southern District of Illinois pursuant to the Class Action Fairness Act (“CAFA”). See 28 U.S.C. §§ 1446 ; 1332(d)(2). Soon after, CenterEdge filed a motion to dismiss on February 5, 2020 while Plaintiff filed a motion to remand this matter to state court on March 12, 2020 (Docs. 21, 27). The Court granted, in part, Plaintiff’s motion to remand, detailing that the Court retains jurisdiction over Plaintiff’s Section 15(b) BIPA claims as they relate to both Innovative Heights and CenterEdge, but that Plaintiff’s Section 15(a) claims were remanded to state court for lack of Article III standing (Doc. 43). Additionally in this August 19, 2020 Order, the Court denied CenterEdge’s motion to dismiss. Id. The operative complaint was filed on September 17, 2021 (Doc. 99). In it, Plaintiff added a third Defendant Sky Zone Franchise Group, LLC (“Sky Zone”), bringing a BIPA Section 15(b) claim against it as well. In adding Sky Zone, Plaintiff says she now seeks to represent three putative classes. The first are individuals who were employed by Innovative Heights, worked at its Sky Zone facility, and gave their fingerprints as part of their employment (Id. at p. 3). The second putative class are individuals who had their fingerprints and/or information collected and obtained by CenterEdge (Id.). The last class are individuals who had their fingerprints and/or information collected and obtained by Sky Zone (Id. at pp. 3-4). In describing this new putative class, Plaintiff details that Sky Zone required Innovative Heights to use the CenterEdge system (Id. at p. 6). Furthermore, Plaintiff explains that Sky Zone retained “unlimited right to access all information contained in the system, including Plaintiff’s and the class members’ fingerprints and/or information used to identify such class members based on their fingerprints” (Id.). Plaintiff also outlined that Sky Zone required other Illinois franchisees to use the CenterEdge system and retained the “unlimited” right to access all of the information contained in the system for these other Illinois franchisees as well (Id. at p. 7). To further explain this relationship, Plaintiff alleges that Sky Zone requires franchisees to enter into a franchise agreement where each Illinois franchisee must purchase equipment from certain companies designated by Sky Zone (Id. at p. 16). On December 22, 2021, Sky Zone filed a motion to dismiss Plaintiff’s Section 15(b) claim (Doc. 119, 120). Plaintiff filed her response in opposition on January 23, 2022 (Doc. 124). On April 6, 2022, Sky Zone filed a motion for leave to file supplemental authority to support its motion to dismiss (Doc. 130). During the parties’ May 4, 2022 status conference, the Court granted the motion for leave (Doc. 131). Additionally, the Court granted Plaintiff leave to submit a supplemental response, which Plaintiff filed the next day on May 5, 2022 (Doc. 132).1 LEGAL STANDARD FOR MOTION TO DISMISS A motion to dismiss under Rule 12(b)(6) addresses the legal sufficiency of the plaintiff’s claim for relief, not the merits of the case or whether the plaintiff will ultimately prevail. Camasta v. Jos. A. Bank Clothiers, Inc., 761 F.3d 732, 736 (7th Cir. 2014); Gibson v. City of Chicago, 910 F.2d 1510, 1520 (7th Cir. 1990). In reviewing a motion to dismiss, the court accepts all well-pleaded facts as true and draws all reasonable inferences in the plaintiff’s favor. E.g., Dix v. Edelman Fin. Servs., LLC, 978 F.3d 507 , 512–13 (7th Cir. 2020). However, “legal conclusions and conclusory allegations . . . are not entitled to this presumption of truth.” Dix, 978 F.3d at 513 (quoting McCauley v. City of Chicago, 671 F.3d 611, 616 (7th Cir. 2011)). See also Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atlantic Corp. v. Twombley, 550 U.S, 555, 557 (2007)). “[W]hile a complaint does not need ‘detailed factual allegations’ to survive a 12(b)(6) motion to dismiss, it must allege 1 In its motion for leave to file supplemental authority, Sky Zone requests the Court to consider a Northern District of California case, Zellmer v. Facebook, Inc., No. 3:18-CV-01880-JD, 2022 WL 976981 (N.D. Cal. Mar. 31, 2022). Plaintiff says that Zellmer is not persuasive authority because it incorrectly applied a “relationship test” that has been rejected by courts in, and outside of, this Circuit (Doc. 132-1, p. 2). The parties’ arguments in the motion to dismiss and responsive pleading are focused on whether Section 15(b) claims require a plaintiff to allege that a party took an “active step,” so the Court has focused this Order on that analysis, relying on cases that were decided within this Circuit. In terms of a “relationship test,” courts within this Circuit have held that parties’ relationships to one another are not the appropriate framework under which to analyze Section 15(b) claims. See Ronquillo v. Doctor's Assocs., LLC, No. 21 C 4903, 2022 WL 1016600 , at *3 (N.D. Ill. Apr. 4, 2022) (citations omitted). See also see also Flores v. Motorola Sols., Inc., No. 1:20-cv-01128, 2021 WL 232627 , at *3 (N.D. Ill. Jan. 8, 2021) (rejecting argument that Section 15(b)’s written consent requirement “only applies where an information collector has some relationship with the individual and has an opportunity to perform the written exchange of notice”). sufficient facts ‘to state a claim to relief that is plausible on its face.’” Dix, 978 F.3d at 512– 13 (quoting League of Women Voters of Chicago v. City of Chicago, 757 F.3d 722, 724 (7th Cir. 2014)). Making the determination of plausibility is a “context-specific task that requires the reviewing court to draw on its judicial experience and common sense.” Iqbal, 556 U.S. at 679 (citation omitted). DISCUSSION In its motion to dismiss, Sky Zone explains that its relationship to Plaintiff’s biometric information is too attenuated to sustain a Section 15(b) claim as it never took the necessary “active step” required by Section 15(b) to collect class members’ biometric data. At most, Sky Zone (potentially) had access to the biometric information, but Sky Zone is adamant that this information was never collected or stored by the company itself (Doc. 120, pp. 5-6). Sky Zone says “collection” would require it to have actually done something, contrary to Plaintiff’s suggestion that collection includes a potential, speculative ability to ‘access’ data allegedly collected and used by a separate entity (Id. at pp. 9-10). Additionally, Sky Zone points to specific portions of Plaintiff’s complaint to argue that Plaintiff concedes that her biometric information was, in fact, taken by Innovative Heights and scanned into CenterEdge’s system by Innovative Heights (Id. at p. 14). Sky Zone argues Plaintiff further concedes it did not operate Innovative Height’s park or the CenterEdge system used to track Plaintiff’s time. Id. Most importantly, Sky Zone points out that Plaintiff never asserts that Sky Zone did anything to extract or obtain Plaintiff’s biometric information from the Innovative Heights’ CenterEdge system (Id. at p. 15). Plaintiff contends the complaint is clear that Sky Zone retained an “unlimited right to access the computer systems” in which biometric data was stored through Sky Zone’s agreements with its Illinois franchisees (Doc. 122, p. 5). Sky Zone’s franchise agreement included a provision in which it “retained complete control over all data that Illinois Franchisees put into the CenterEdge system” (Id. at p. 6). Plaintiff argues that the relevant case law does not require a party to take an “active step” to properly allege a Section 15(b) claim as Sky Zone argues. But even so, Plaintiff says Sky Zone did take an active step, as it was “behind every step of the process in the collection of Plaintiff’s biometric data,” which constitutes and “active step” (Id. at p. 7). The Court begins with whether Section 15(b) requires a party take an “active step” to acquire the biometric information. I. Section 15(b) “active step” Plaintiff alleges that Sky Zone violated Section 15(b) of BIPA, which outlines that a private entity may not “collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s biometric identifier or information” unless it first informs that person, in writing, that such an identifier or information is being collected or stored and informs that person, in writing, of the purpose and length for which a biometric identifier or information is being used, collected, and stored. See 740 ILCS 14/15(b)(1). The key words in a Section 15(b) claim are collecting, capturing, purchasing, or obtaining biometric information. Notably absent from the language of Section 15(b) is the word “possession,” unlike other parts of BIPA, like Sections 15(a)2 and 15(d).3 Courts have noted that since the Illinois legislature specifically used the term “possession” in certain sections of BIPA and not in others, “[the Illinois legislature] intended different results.” Namuwonge v. Kronos, Inc., 418 F. Supp. 3d 279 , 285 (N.D. Ill. 2019) (quoting Dana Tank Container, Inc. v. Human Rights Comm'n, 687 N.E.2d 102, 104 (Ill. App. Ct. 1997)). “There is a difference between possessing and collecting biometric information.” Namuwonge, 418 F. Supp. at 282-83, 286. Indeed, “BIPA imposes distinct sets of obligations on possessors and collectors of biometric data.” Id. As a result, “courts have recognized that possession of biometric data alone does not subject an entity to § 15(b)’s requirements.” Ronquillo v. Doctor's Assocs., LLC, No. 21 C 4903, 2022 WL 1016600 , at *2 (N.D. Ill. Apr. 4, 2022); see also King v. PeopleNet Corp., No. 21 CV 2774, 2021 WL 5006692 , at *8 (N.D. Ill. Oct. 28, 2021)) (“§ 15(b) doesn’t penalize mere possession of biometric information.”); Heard v. Becton, Dickinson & Co. (“Heard I”), 440 F. Supp. 3d 960 , 965–66 (N.D. Ill. 2020) (“Unlike Sections 15(a), (c), (d), and (e) of the BIPA—all of which 2 Section 15(a), in its entirety, reads as follows: “A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 ears of the individual’s last interaction with the private entity, whichever occurs first. Absent a valid warrant or subpoena issued by a court of competent jurisdiction, a private entity in possession of biometric identifiers or biometric information must comply with its established retention schedule and destruction guidelines.” See 740 ILCS 14/15(a) (emphasis added). 3 Section 15(d) reads, in the relevant part, “No private entity in possession of a biometric identifier or biometric information may disclose, redisclose, or otherwise disseminate a person’s or a customer’s biometric identifier or biometric information…” See 740 ILCS 14/15(d) (emphasis added). apply to entities ‘in possession of’ biometric data—Section 15(b) applies to entities that ‘collect, capture, purchase, receive through trade, or otherwise obtain’ biometric data. Recognizing this distinction…mere possession of biometric data is insufficient to trigger Section 15(b)’s requirements”) (citations omitted); Namuwonge, 418 F. Supp. at 286 (“[T]here is a difference between possessing and collecting biometric information.”) (emphasis in original). To recognize and honor this intentional distinction in the language used by the Illinois legislature in different sections of BIPA (“collection” vs. “possession”), district courts from within the Seventh Circuit that have confronted this question have concluded that in order for § 15(b) to apply, the defendant must take an active step to collect, capture, or otherwise obtain the plaintiff’s biometric information. Heard I, 440 F. Supp. 3d at 966 (“The court concludes that for Section 15(b)'s requirements to apply, an entity must, at a minimum, take an active step to ‘collect, capture, purchase, receive through trade, or otherwise obtain’ biometric data.”) (citation omitted); Jacobs v. Hanwha Techwin Am., Inc., No. 21 C 866, 2021 WL 3172967 , at *2 (N.D. Ill. July 27, 2021) (“Following other courts in this district, this court concludes that for Section 15(b)’s requirements to apply, an entity must, at a minimum, take an active step to collect, capture, purchase, or otherwise obtain biometric data.”) (citation omitted). II. Plaintiff’s Complaint The thrust of Plaintiff’s Section 15(b) claim against Sky Zone is that Sky Zone retained an “unlimited right to access the system in which Plaintiff’s fingerprints…were stored;” therefore, the question before the Court is whether retaining access to biometric information constitutes an active step for purposes of BIPA (Doc. 99, p. 18). Turning to the operative complaint, Plaintiff outlines that Sky Zone requires all franchisees to sign a Franchise Agreement (Id. at pp. 17-18). This Franchise Agreement, which Innovative Heights signed, requires franchisees to purchase and use the CenterEdge POS System (Id. at pp. 16-18). Plaintiff describes that this CenterEdge POS System, required by the Sky Zone Franchise Agreement, is the system that collects employee fingerprints and information used to identify such employees based on their fingerprints (Id. at p. 17). Fingerprints, and other biometric information, were stored in the CenterEdge POS Systems and used by Illinois franchisees, like Innovative Heights (Id. at p. 18). Furthermore, Plaintiff outlines that Sky Zone retained “complete control” over all of the data in the CenterEdge system (Id. at p. 17). Specifically, the Franchise Agreement states, as follows: We will have the right to have independent access to all information or data in the POS System and the surveillance system, and there are no limitations on our rights to do so. We will also have the right to use and publish the information we collect from your POS System in our discretion, including disclosure in our Franchise Disclosure Document. (Id.). Upon termination of the Franchise Agreement, Illinois franchisees could be required to turn over its computer data to Sky Zone (Id. at p. 18). In the complaint, Plaintiff makes clear that her Section 15(b) claim against Sky Zone is based on “Sky Zone Franchise Group’s unlimited right to access the system in which Plaintiff’s fingerprints and other identifying information based thereon were stored…Sky Zone Franchise Group collected, captured, received through trade, and/or otherwise obtained Plaintiff’s…fingerprints” (Id.). Plaintiff reiterates this argument in her response to the motion to dismiss. She says that since Sky Zone can freely access and use the data “from the system in which it is stored…it is just as if the data was stored on Sky Zone’s own servers or system” (Doc. 122, p. 14). She also emphasizes that Sky Zone “dictated every step of the process” and was “far from passive” in the collection of biometric identifiers (Id. at pp. 14-15). Courts have found that when a plaintiff alleges that the defendant played “more than a passive role in the process,” a motion to dismiss for failure to state a Section 15(b) claim should be denied. Ronquillo, 2022 WL 1016600 , at *3. But this “more than a passive role in the process” must push the claim “across the line from conceivable to plausible.” Heard v. Becton, Dickinson & Co. (“Heard II”), 524 F. Supp. 3d 831 , 840 (N.D. Ill. 2021) (citing Twombly, 550 U.S. at 557). For example, the plaintiff in Ronquillo described that a Subway franchisor exclusively controlled the Subway POS system at various Subway franchises and used this system to then create reference templates. The manufacturer of the computer hardware system stored the reference templates on its hardware, which the franchisor then used to compare scanned fingerprints to identify workers. Ronquillo, 2022 WL 1016600 , at *3. Based on these allegations, the Northern District determined the plaintiff’s complaint “allow[ed] for the inference that [Defendants] took active steps to obtain Ronquillo’s biometric information.” Id. (citing Smith v. Signature Sys., Inc., No. 2021-CV-02025, 2022 WL 595707 , at *4 (N.D. Ill. Feb. 28, 2022)) (complaint alleged active steps of collection by alleging that the POS system vendor scanned and collected copies of its client's employees’ fingerprints and then compared them to those stored in the database); Heard II, 524 F. Supp. 3d at 841 (plaintiff sufficiently alleged active steps by alleging that “when a user enrolls in the Pyxis system, the device scans the user's fingerprint, extracts the unique features of that fingerprint to create a user template, and then stores users’ biometric information both on the device and in [defendant's] servers”); Figueroa v. Kronos Inc., 454 F. Supp. 3d 772 , 783–84 (N.D. Ill. 2020) (allegations that the defendant stored data sufficed for § 15(b) liability because in order to store data, the defendant “necessarily first had to ‘obtain’ the data”). As another example, the Naughton plaintiff sued its employer, Amazon, for collecting sensitive biometric information without his consent. The Northern District held that the plaintiff plausibly alleged that Amazon took an “active step” in collecting plaintiff’s biometric information, as the allegations made clear that Amazon collected the information for its own use and as a condition of the work. Naughton v. Amazon.com, Inc., No. 20-CV-6485, 2022 WL 19324 , at *3 (N.D. Ill. Jan. 3, 2022) (citations omitted). Even Heard II, a case Plaintiff relies on heavily in her response, supports this finding. In Heard, the Northern District originally dismissed a section 15(b) claim against a supplier of fingerprint equipment because the complaint did not explain how the supplier, as opposed to the employer, actively collected the biometric data. Heard I, 440 F. Supp. 3d at 967. The plaintiff in Heard filed an amended complaint that the court subsequently found stated a claim under section 15(b) by alleging that the supplier of the fingerprint equipment “extracts the unique features of that fingerprint to create a user template, and then stores users’ biometric information both on the device and in [its] servers.” See Heard II, 524 F. Supp. 3d at 841. “In other words, the…system is not hermetically sealed within a hospital; users’ biometric data flows back to [the equipment supplier’s] servers (and potentially third-party data centers…for analysis and support services.” Id. at 840. The Northern District determined that this type of description satisfied the pleading requirements of the Section 15(b) claim, in that the equipment supplier was “plausibly ‘in possession’ of users’ biometric data.” Id. Nowhere in her complaint does Plaintiff allege that Sky Zone itself stored biometric information on its own computers or servers, or that Sky Zone used the biometric information for its own purposes. In fact, Plaintiff does not allege that Sky Zone actually accessed this information. Plaintiff’s allegations are simply that Sky Zone could access the biometric information one day. But equally as plausible as Sky Zone accessing the information one day is that Sky Zone never accessed the information. Plaintiff’s allegations are more similar to those of the plaintiff in Namuwonge. In Namuwonge, the plaintiff alleged Section 15(b) claims against two defendants: a provider of workforce management software and services, and the plaintiff’s employer who used a timekeeping system provided by the aforementioned defendants. Namuwonge, 418 F. Supp. 3d at 281– 82. The Northern District held that the software provider simply supplied the timekeeping system to the plaintiff’s employer and it was the employer, alone, who collected the biometric fingerprints. Id. at 286.4 4 The Northern District acknowledged that plaintiff did plead that both defendants collected and stored her biometric identifiers in violation of Section 15(b), but a close look at the complaint showed that the specific allegation at issue made clear that “Brookdale collected the fingerprints using a system that Kronos supplied to Brookdale. Together, these allegations do not plausibly allege that Kronos collected, captured, or otherwise obtained [plaintiff’s] biometric information. Without more, [plaintiff] does not plausibly allege a violation of section 15(b).” Namuwonge, 418 F. Supp. 3d at 286. Plaintiff’s allegations in the complaint do not take Plaintiff’s Section 15(b) claim against Sky Zone “across the line from conceivable to plausible,” as Plaintiff failed to plead (or sufficiently raise the inference) that Sky Zone ever did anything to extract or obtain the biometric information from Innovative Heights’ CenterEdge System. Heard II, 524 F.Supp.3d at 840 (citing Twombly, 550 U.S. at 557). Ultimately, Plaintiff did not adequately allege that Sky Zone took an active step to collect or obtain her data. Accordingly, Sky Zone’s motion to dismiss will be granted as to Plaintiff’s Section 15(b) claim. This dismissal is without prejudice and Plaintiff will be given an opportunity to cure the pleading deficiencies outlined above. CONCLUSION For the aforementioned reasons, Sky Zone’s motion to dismiss is GRANTED. Defendant Sky Zone is DISMISSED without prejudice. Plaintiff is granted leave to refile an amended complaint on or before August 19, 2022. IT IS SO ORDERED. DATED: August 5, 2022 s/ Mark A. Beatty MARK A. BEATTY United States Magistrate Judge