GUTTERMAN v. INDIANA UNIVERSITY, BLOOMINGTON

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF INDIANA INDIANAPOLIS DIVISION TYLER CAMERON GUTTERMAN, DALE ) NELSON, HUNTER JOHNSON, and BRIAN ) HILTUNEN, ) ) No. 1:20-cv-02801-JMS-MJD Plaintiffs, ) ) vs. ) ) INDIANA UNIVERSITY, BLOOMINGTON and ) PAMELA S. WHITTEN, in her official capacity ) as President of Indiana University, ) ) Defendants. ) ORDER Plaintiffs Tyler Gutterman, Dale Nelson, Hunter Johnson, and Brian Hiltunen are all undergraduate students at Defendant Indiana University, Bloomington ("IU"). In 2018, Plaintiffs were pledges at Beta Theta Pi, a fraternity at IU. They allege that IU used data gathered from their Official University Identification Card ("CrimsonCard") to track their movements as part of an investigation into hazing at Beta Theta Pi, which violated their rights under the Fourth and Fourteenth Amendments to the United States Constitution, and constituted a breach of contract. IU and Defendant Pamela Whitten,1 IU's President, have filed a Motion to Dismiss pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6), [Filing No. 19], which is now ripe for the Court's consideration. 1 Plaintiffs originally sued Michael McRobbie, who was IU's President when this litigation was initiated. [See Filing No. 1.] Since then, Pamela Whitten became IU's President, IU moved to substitute her for former-President McRobbie as a Defendant, [Filing No. 46], and the Court granted the motion, [Filing No. 47]. The Court will consider all references that the parties make to former-President McRobbie in their filings to apply equally to President Whitten. I. STANDARD OF REVIEW Rule 12(b)(1) "allows a party to move to dismiss a claim for lack of subject matter jurisdiction." Hallinan v. Fraternal Order of Police of Chicago Lodge No. 7, 570 F.3d 811, 820 (7th Cir. 2009). When deciding a motion to dismiss under Rule 12(b)(1), the Court accepts the allegations in the plaintiff's complaint as true and draws all reasonable inferences in the plaintiff's favor. Long v. Shorebank Dev. Corp., 182 F.3d 548 , 554 (7th Cir. 1999). The burden is on the plaintiff to prove, by a preponderance of the evidence, that subject matter jurisdiction exists for his or her claims. See Lee v. City of Chicago, 330 F.3d 456, 468 (7th Cir. 2003). Under Rule 12(b)(6), a party may move to dismiss a claim that does not state a right to relief. The Federal Rules of Civil Procedure require that a complaint provide the defendant with "fair notice of what the…claim is and the grounds upon which it rests." Erickson v. Pardus, 551 U.S. 89, 93 (2007) (quotation and citation omitted). In reviewing the sufficiency of a complaint, the Court must accept all well-pled facts as true and draw all permissible inferences in favor of the plaintiff. See Active Disposal Inc. v. City of Darien, 635 F.3d 883, 886 (7th Cir. 2011). A Rule 12(b)(6) motion to dismiss asks whether the complaint "contain[s] sufficient factual matter, accepted as true, to 'state a claim to relief that is plausible on its face.'" Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 570). The Court will not accept legal conclusions or conclusory allegations as sufficient to state a claim for relief. See McCauley v. City of Chicago, 671 F.3d 611, 617 (7th Cir. 2011). Factual allegations must plausibly state an entitlement to relief "to a degree that rises above the speculative level." Munson v. Gaetz, 673 F.3d 630, 633 (7th Cir. 2012). This plausibility determination is "a context-specific task that requires the reviewing court to draw on its judicial experience and common sense." Id. II. BACKGROUND The following factual allegations are taken from the Complaint, and are accepted as true solely for the purpose of this Order. A. Plaintiffs' Membership in Beta Theta Pi Plaintiffs are undergraduate students at IU and in the fall of 2018, they were all freshmen completing their first semester of study. [Filing No. 1 at 3.] As freshmen, Plaintiffs chose to take part in IU's campus traditions and activities, including IU's Greek life. [Filing No. 1 at 3.] Plaintiffs all chose to pledge the same fraternity, Beta Theta Pi. [Filing No. 1 at 3.] B. CrimsonCards and Swipe Data Plaintiffs were required to carry their CrimsonCard as a condition of their attendance at IU, and IU retains historical records of CrimsonCard usage. [Filing No. 1 at 4.] IU's records track every time a student "swipes" their CrimsonCard to gain access to a university building or to use a university facility ("Swipe Data"). [Filing No. 1 at 4.] IU's website explains: "CrimsonCard is much more than a photo ID. It's a print release card, keycard to authorized university buildings, library card, and if you're enrolled in a dining service plan, it's your meal ticket." [Filing No. 1 at 4.] The back of the CrimsonCard provides: INDIANA UNIVERSITY If found, please contact: (317) 274-0400 Manage your account online: crimsoncard.iu.edu Use of this card constitutes acceptance of the CrimsonCard terms and conditions. This card is the property of Indiana University and is intended for use only by Indiana University and its affiliates. Unauthorized use, lending, or tampering with the card warrants confiscation and/or disciplinary action. [Filing No. 20 at 11.]2 The CrimsonCard Terms and Conditions provide as follows: The CrimsonCard…is issued by [IU] to its students and employees, and others associated with [IU], to verify their identity and manage access to [IU] services and facilities. The Card also functions as a stored value card, and is associated with an account, the "CrimsonAccount – CrimsonCash." * * * This Agreement is entered into between [IU] and each student…. In exchange for being issued a Card, Cardholder agrees to abide by the Official University Identification Card Policy (available on the University Policies website at http://policies.iu.edu) (the "Policy") and to the following terms and conditions: * * * Use and Ownership Cardholder understands and agrees that the Card is the property of [IU]. * * * Damaged, Lost, Stolen, Misused or Expired Cards Cardholder is responsible for care and protection of the Card. If the magnetic stripe, or any of the technology contained in or on the card, is damaged and becomes 2 Defendants have included a photo of the back of the Crimson Card in their brief in support of their Motion to Dismiss, and have attached the CrimsonCard Terms and Conditions, IU's Official University Identification Card Policy (UA-13), and IU's Management of Institutional Data Policy (DM-01) to their brief. [Filing No. 20 at 11; Filing No. 20-1; Filing No. 20-2; Filing No. 20-3.] When reviewing a motion to dismiss, the Court considers only the factual allegations of the complaint and any reasonable inferences; however, the Court may also consider any documents to which the complaint refers and that are central to the plaintiff's claims. Adams v. City of Indianapolis, 742 F.3d 720, 729 (7th Cir. 2014). Here, Plaintiffs refer to the CrimsonCard and all of the documents that Defendants attach to their Motion to Dismiss, and the Court finds that the CrimsonCard and those documents are central to Plaintiffs' claims. Consequently, the Court may consider the CrimsonCard, the CrimsonCard Terms and Conditions, IU's Official University Identification Card Policy (UA-13), and IU's Management of Institutional Data Policy (DM-01) in connection with Defendants' Motion to Dismiss. unreadable by any Card reader or terminal, Cardholder is required to obtain a replacement of the Card at Cardholder's expense…. [Filing No. 20-1 at 2-3.] IU's Official University Identification Card Policy (UA-13) provides: Policy Statement [IU] issues Photo Identification Cards…to employees, students, and others associated with [IU] to verify their identity and manage their access to [IU] services and facilities. The ID card will be used to verify the identity of the bearer of the card in [IU] facilities when such identification is needed to be present at those facilities or on [IU] grounds. * * * Intended Use of the Official University Identification Card * * * 2. The Official University Identification Card is intended for use as an electronic identification, validation, and authentication credential for authorized access to services and facilities. The Official University Identification Card is the property of the University and will be deactivated and/or invalidated by the University upon expiration of its intended use. * * * 4. The Official University Identification Card may be used to verify the identity of the bearer of the card while on University grounds. [Filing No. 20-2 at 4-6.] IU's Management of Institutional Data Policy (DM-01) states: Scope This policy applies to all users of [IU] information and information technology resources regardless of affiliation, and irrespective of whether these resources are accessed from on-campus or off-campus locations. This policy applies to all institutional data, and is to be followed by all those who capture data and manage administrative information systems using university assets. Policy Statement * * * The permission to access institutional data should be granted to all eligible employees and designated appointees of the university for all legitimate university purposes. [Filing No. 20-3 at 4.] The Swipe Data includes the whole range of students' movements and activities, including access to dorm buildings, individual dorm rooms, elevators, and dorm building common areas. [Filing No. 1 at 5.] The Swipe Data also reflects students' movements around campus, including checking out library books, accessing academic buildings, accessing parking garages, using parking meters, purchasing meals at university dining halls, purchasing sodas and snacks from campus vending machines, using laundry machines, printing materials they need for class on university printers, and other daily activities. [Filing No. 1 at 5.] The Swipe Data is not limited to campus facilities, as the CrimsonCard operates as a payment card at numerous businesses near campus, including restaurants, grocery stores, pharmacies, airport shuttles, tanning salons, and wellness centers. [Filing No. 1 at 6.] The subject of a search of Swipe Data is not given "the opportunity to obtain precompliance review before a neutral decisionmaker." [Filing No. 1 at 6.] C. IU's Investigation Into Hazing at Beta Theta Pi During the fall 2018 semester, Beta Theta Pi was being investigated by IU for a suspected hazing incident. [Filing No. 1 at 3.] As part of its investigation, IU officials accessed Plaintiffs' Swipe Data, which it retained for several months, to track Plaintiffs' movements. [Filing No. 1 at 3-4.] Specifically, IU compared the Swipe Data associated with Plaintiffs to their testimony regarding their whereabouts at the time of the incident. [Filing No. 1 at 4.] Plaintiffs had testified that they were in their dorm rooms at the time of the suspected hazing incident. [Filing No. 1 at 4.] The investigation resulted in sanctions for Beta Theta Pi, but Plaintiffs were not found guilty of any wrongdoing. [Filing No. 1 at 4.] D. The Lawsuit Plaintiff initiated this litigation on October 29, 2020, and set forth claims for: (1) violation of the right to be free of unreasonable searches under the Fourth and Fourteenth Amendments to the United States Constitution; (2) violation of the Fourth and Fourteenth Amendments to the United States Constitution because IU's use of Swipe Data does not provide an opportunity for students being searched to obtain "precompliance review from a neutral third party"; and (3) breach of contract. [Filing No. 1 at 10-12.] Plaintiffs seek nominal damages, declaratory relief, and attorneys' fees and costs, and request that the Court enjoin IU from "further use of swipe data in investigations except where [IU] has obtained a warrant or can demonstrate exigent circumstances," and require IU to "expunge the investigation for which [IU] used swipe data of Plaintiffs from their permanent records, to the extent that Plaintiffs' records include information about such investigation." [Filing No. 1 at 13.] IU and President Whitten have filed a Motion to Dismiss all of Plaintiffs' claims. [Filing No. 19.] III. DISCUSSION A. Constitutional Claims Defendants argue in their Motion to Dismiss that Plaintiffs' constitutional claims are barred by Eleventh Amendment immunity (with the exception of their claim for prospective injunctive relief against President Whitten), and that their constitutional claims do not state claims for which relief can be granted because IU did not perform a search of their information, and because any search was reasonable in any event. The Court addresses each issue in turn. 1. Whether Defendants Are Immune From Liability Under the Eleventh Amendment In support of their Motion to Dismiss, Defendants argue that IU is entitled to sovereign immunity under the Eleventh Amendment because it has not waived that immunity or consented to this lawsuit. [Filing No. 20 at 6.] Defendants also assert that President Whitten is entitled to Eleventh Amendment immunity for the constitutional claims against her in her official capacity that seek damages, but acknowledge that immunity does not shield her from Plaintiffs' constitutional claims for prospective injunctive relief. [Filing No. 20 at 7.] In their response, Plaintiffs argue that IU employees are state actors and can be sued under 42 U.S.C. § 1983 for violating the Fourth Amendment. [Filing No. 28 at 4.] They then appear to concede that Eleventh Amendment immunity shields IU from their constitutional claims, and also shields President Whitten in her official capacity except in connection with their claims for prospective injunctive relief, but assert that to the extent they seek declaratory and injunctive relief, their constitutional claims are not barred by sovereign immunity. [Filing No. 28 at 4-5.] In their reply, Defendants contend that § 1983's enactment did not abrogate the State's Eleventh Amendment immunity and reiterate the arguments set forth in their opening brief. [Filing No. 33 at 3-4.] Eleventh Amendment immunity bars suits against states and their agencies regardless of whether the relief sought is monetary damages or injunctive relief. Seminole Tribe of Florida v. Florida, 517 U.S. 44, 58 (1996); Pennhurst State School & Hosp. v. Halderman, 465 U.S. 89 , 10102 (1984). The only exceptions to this rule are when a state has waived immunity by consenting to suit in federal court or Congress has abrogated the state's immunity "through a valid exercise of its powers under recognized constitutional authority." Ind. Prot. & Adv. Servs. v. Ind. Fam. & Soc. Servs. Admin., 603 F.3d 365 , 371 (7th Cir. 2010). IU is a state entity. See Ind. Code § 21-20-2-1 ("Indiana University is recognized as the university of the state"); Haynes v. Ind. Univ., 902 F.3d 724, 731 (7th Cir. 2018) ("[IU] and its Board of Trustees are state agencies for sovereign-immunity purposes") (citing Peirick v. Ind. Univ.-Purdue Univ. Indianapolis Athletics Dep't, 510 F.3d 681, 695 (7th Cir. 2007)); Woods v. Ind. Univ.-Purdue Univ. at Indianapolis, 996 F.2d 880, 883 (7th Cir. 1993) ("Indiana University enjoys the same Eleventh Amendment immunity as the State of Indiana itself…."); Feresu v. Ind. Univ. Bloomington, 2015 WL 5177740 , at *3 (S.D. Ind. 2015) ("IU is an 'instrumentality,' 'arm,' or 'alter ego' of the State of Indiana for purposes of the Eleventh Amendment"). Because IU is a state entity, and since it has not consented to being sued in federal court, Plaintiffs' constitutional claims against it for damages and injunctive relief are barred by Eleventh Amendment immunity. McDonough Assoc., Inc. v. Grunloh, 722 F.3d 1043, 1049 (7th Cir. 2013) ("[T]he general rule is that private individuals are unable to sue a state in federal court absent the state's consent"). As for Plaintiffs' constitutional claims against President Whitten, it is well-settled that claims against state officials in their official capacities for monetary relief are barred by the Eleventh Amendment. Id. (Eleventh Amendment bars claims seeking "awards of 'accrued monetary liability which must be met from the general revenues of a State'") (quoting Edelman v. Jordan, 415 U.S. 651, 664 (1974)). However, a state official is not entitled to Eleventh Amendment immunity where the relief sought is prospective injunctive relief to remedy an ongoing violation of federal law. Ex parte Young, 209 U.S. 123, 159-60 (1908). A plaintiff may file suit "against state officials seeking prospective equitable relief for ongoing violations of federal law." Marie O. v. Edgar, 131 F.3d 610, 615 (7th Cir. 1997); see also Ind. Prot. & Adv. Servs., 603 F.3d at 371 (discussing exceptions to the Eleventh Amendment's bar to actions in federal court against state officials acting in their official capacities). Accordingly, Eleventh Amendment immunity shields President Whitten from Plaintiffs' constitutional claims to the extent they seek monetary or declaratory relief, but not to the extent that they seek prospective injunctive relief. The Court GRANTS Defendants' Motion to Dismiss Plaintiffs' constitutional claims against IU and Plaintiffs' constitutional claims against President Whitten to the extent that those claims seek monetary or declaratory relief. The Court goes on to discuss the viability of Plaintiffs' constitutional claims against President Whitten to the extent that they seek prospective injunctive relief. 2. Whether Plaintiffs Have Stated A Claim For Constitutional Violations Against President Whitten In support of their Motion to Dismiss, Defendants argue that Plaintiffs' constitutional claims are premised on IU conducting searches by tracking Plaintiffs' movements with their CrimsonCards, retaining the data, and continuing to access the data without giving the subject of the search an opportunity to obtain precompliance review before a neutral decisionmaker. [Filing No. 20 at 9.] Defendants argue that these allegations do not amount to a search under the Fourth Amendment because IU did not infringe upon Plaintiffs' privacy. [Filing No. 20 at 10-11.] Defendants assert that IU owns all CrimsonCards, and IU policy provides that "'permission to access institutional data should be granted to all eligible employees and designated appointees of the university for all legitimate university purposes.'" [Filing No. 20 at 10.] They assert that IU accessed the Swipe Data "to protect the safety and well-being of its students, which is a legitimate university purpose under [IU] policy." [Filing No. 20 at 10 (quoting Filing No. 20-3 at 4).] Defendants also point to the back of the CrimsonCard, which states that use of the card "constitutes acceptance of the CrimsonCard terms and conditions," and that the card "is the property of [IU] and is intended for use only by [IU] and its affiliates." [Filing No. 20 at 11.] Defendants argue further that Plaintiffs did not have a reasonable expectation of privacy in their use of the CrimsonCard because they were "aware of the capabilities of the CrimsonCard, and its connection to both IU and University life, from the very beginning." [Filing No. 20 at 12.] Defendants note that the CrimsonCard Terms and Conditions state that the CrimsonCard is used "to verify [students' and employees'] identity and manage access to university services and facilities," and that users are required to obtain a replacement if the magnetic strip is damaged or becomes unreadable. [Filing No. 20 at 13.] Further, Defendants argue that Plaintiffs' movements were out in the open and "anyone could have visually observed [them]," so tracking their movements in not considered a search. [Filing No. 20 at 14.] Defendants distinguish the Swipe Data from data gathered from a GPS device installed on a car, and note that the Swipe Data "provides a single data point for each 'swipe' or access to a student's residence hall or dorm room," but does not show where Plaintiffs went when they were inside or what they did while inside. [Filing No. 20 at 15-16 (emphasis omitted).] Defendants assert that Plaintiffs accepted the CrimsonCard in exchange for the privilege of attending IU and for using the conveniences afforded by the CrimsonCard, and cannot now object to IU's use of the Swipe Data for the legitimate purpose of investigating an alleged hazing incident. [Filing No. 20 at 16.] They argue that the Swipe Data constitutes IU's business records, since the CrimsonCards are IU property. [Filing No. 20 at 17.] Finally, Defendants argue that even if gathering the Swipe Data is considered a search, any search was reasonable because the Swipe data was collected without physical entry into Plaintiffs' homes and it was not collected with prosecutorial intent – but rather to confirm that Plaintiffs were not the victims of hazing. [Filing No. 20 at 20.] In response, Plaintiffs point to case law which they contend stands for the proposition that students enjoy the protection of the Fourth Amendment in their dormitory rooms. [Filing No. 28 at 7.] They distinguish cases allowing universities to routinely inspect dorm rooms, and contend that IU's use of Swipe Data "is fundamentally a prosecutorial function that implicates [IU's] role as the government, rather than its role as landlord." [Filing No. 28 at 12.] They note that IU "was investigating alleged off-campus conduct and the search of Plaintiffs' [Swipe Data] to determine their presence in the dorms was orthogonal to that investigation." [Filing No. 28 at 12.] Plaintiffs also argue that they did not consent to the gathering and use of Swipe Data because they could not waive their constitutional rights "unwittingly or by implication." [Filing No. 28 at 12.] They contend that even if using the Swipe Data was considered an administrative search, they would then be entitled to "precompliance review before a neutral decisionmaker." [Filing No. 28 at 13.] Finally, Plaintiffs argue that the Swipe Data "tracks [them] all around campus: where and when they eat, sleep, do laundry, study, shop, and even go to the bathroom – single datapoints add up to a comprehensive portrait of their movements." [Filing No. 28 at 19.] In their reply, Defendants argue that Plaintiffs focus on the interior of their dorm rooms, but that "[t]here are simply no allegations that support any inference that [IU] searched or entered [their] dorm rooms" or otherwise invaded their privacy in their homes. [Filing No. 33 at 6.] They note that they only accessed limited Swipe Data for the time of the hazing incident and to determine whether members of Plaintiffs' pledge class were the victims of hazing. [Filing No. 33 at 6.] Defendants assert that Plaintiffs' argument regarding IU's use of Swipe Data – that it was used to track Plaintiffs "all around campus" – is "vastly different from the allegations in their Complaint that [IU] retained only a few months of data and used it for the limited purpose of checking their whereabouts 'at the time of the [hazing] incident.'" [Filing No. 33 at 6-7.] Defendants point again to IU's policies, which provide that CrimsonCards and the Swipe Data are IU's property, and note that the CrimsonCard generates data when it is voluntarily used to access a building or room and not continuously or involuntarily. [Filing No. 33 at 8-9.] Defendants reiterate their arguments that even if gathering and using the Swipe Data was a search, it was reasonable. [Filing No. 33 at 11- 13.] The Fourth Amendment protects "[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures." U.S. Const. amend. IV. "The 'touchstone' of the Fourth Amendment analysis is whether a person has a 'constitutionally protected reasonable expectation of privacy.'" Henry v. Hulett, 969 F.3d 769, 776-77 (7th Cir. 2020) (quoting Oliver v. United States, 466 U.S. 170, 177 (1984)). To trigger protection, an individual must have "a subjective expectation of privacy and…society [must be] prepared to recognize [that expectation] as reasonable." United States v. Hammond, 996 F.3d 374, 383-84 (7th Cir. 2021) (quotations and citations omitted). "To determine whether someone has a legitimate expectation of privacy, courts must consider (1) whether that person, by his conduct, has exhibited an actual, subjective expectation of privacy and (2) whether his expectation of privacy is one that society is prepared to recognize as reasonable." United States v. Sawyer, 929 F.3d 497, 499 (7th Cir. 2019). The Seventh Circuit has instructed that a search occurs "either when the government physically intrudes without consent upon 'a constitutionally protected area in order to obtain information,' or 'when an expectation of privacy that society is prepared to consider reasonable is infringed.'" United States v. Thompson, 811 F.3d 944, 948 (7th Cir. 2016) (quoting United States v. Jones, 565 U.S. 400, 407 (2012) and United States v. Karo, 468 U.S. 705, 712 (1984)). Only searches which are unreasonable violate the Fourth Amendment. Florida v. Jimeno, 500 U.S. 248, 250 (1991). When an alleged search is not performed as part of a criminal investigation, the Court may "turn immediately to an assessment of whether [the search is] reasonable." Naperville Smart Meter Awareness v. City of Naperville, 900 F.3d 521, 528 (7th Cir. 2018). The Court follows this principle, assumes without deciding that a search occurred, and turns directly to the question of whether the search was reasonable. In order to determine whether a search was reasonable, the Seventh Circuit has instructed that the Court should "balance[e] [the search's] intrusion on the individual's Fourth Amendment interests against its promotion of legitimate government interests." Hiibel v. Sixth Judicial Dist. Court, 542 U.S. 177, 187-88 (2004); see also United States v. White, 781 F.3d 858, 862 (7th Cir. 2015). This requires considering "[t]he totality of the circumstances" by assessing "one's status and privacy expectations and the context in which the search occurs." United States v. Wood, 426 F.Supp.3d 560 , 565-66 (N.D. Ind. 2019) (citing Vernonia Sch. Dist. 47J v. Acton, 515 U.S. 646, 654 (1995)). The Court first considers Plaintiffs' status and privacy expectations. Plaintiffs allege that they were students at IU when their Swipe Data was accessed, and when they became IU students, they received their CrimonCards and had access to the CrimsonCard Terms and Conditions. The CrimsonCard itself states on the back that the user of the card accepts its terms and conditions, and that the card is the property of IU. [Filing No. 20 at 11.] The CrimsonCard Terms and Conditions state that the CrimsonCard is used "to verify [a student's] identity and manage access to [IU] services and facilities." [Filing No. 20-1 at 2.] Given that Plaintiffs were on notice that the CrimsonCard was used to access IU's services and facilities, and that IU owned the card, it is not reasonable to conclude that Plaintiffs expected their use of the CrimsonCard – which, in turn, reflected which IU facilities and services they accessed – to be private. The Court finds that this is particularly true in today's day and age, when Plaintiffs were likely carrying cell phones which also could be used to track their locations to some extent, and where cameras on buildings, traffic lights, and businesses were likely to capture many of Plaintiffs' public movements. While the CrimsonCard does not explicitly state that Plaintiffs were agreeing to IU using the Swipe Data to verify their whereabout at a specific point in time, Plaintiffs were certainly on notice that the CrimsonCard would reflect their movements to some degree. As for the context in which the search occurred, Plaintiffs allege that IU retains "historical records" of Swipe Data, and "retained the [Swipe Data] for several months and used it to check the alibis of several students – including Plaintiffs." [Filing No. 1 at 3-4.] But Plaintiffs only allege that Defendants accessed their personal Swipe Data for a limited time period, and for the purpose of checking Plaintiffs' whereabouts at the time of the hazing incident for which the Beta Theta Pi house was ultimately disciplined. See Naperville Smart Meter Awareness, 900 F.3d at 528 (finding that collection of energy use data was a reasonable search and noting "[c]ritically, Naperville conducts the search with no prosecutorial intent. Employees of the city's public utility – not law enforcement – collect and review the data"). Plaintiffs do not allege that IU used the Swipe Data to track their movements all around campus, or to track their locations for an extended period of time. The collection of Swipe Data is "far less invasive than the prototypical Fourth Amendment search of a home." Id. Moreover, the limited nature of Defendants' use of the Swipe Data, as alleged in the Complaint, indicates that the Swipe Data does not provide "an intimidate window into [a student's] life, revealing…his familial, political, professional, religious, and sexual associations" to the degree the United States Supreme Court has recognized as unreasonable. Carpenter v. U.S., 138 S.Ct. 2206, 2217 (2018). Finally, according to Plaintiffs' own allegations, the Swipe Data was used to verify Plaintiffs' whereabouts at the time of the alleged hazing incident, and "as freshmen pledges, [Plaintiffs] would have been far more likely to be the victims of any hazing activity, rather than the perpetrators." [Filing No. 1 at 4.] In other words, as Plaintiffs allege, the Swipe Data was used to ensure Plaintiffs' safety by confirming that Plaintiffs were not subjected to hazing – an interest the Court finds to be plainly legitimate. In short, the Court finds that, assuming a search occurred in the first instance, such a search was reasonable based on Plaintiffs' status as IU students who agreed to the Terms and Conditions of the CrimsonCard, and based on IU's limited, non-prosecutorial use of the Swipe Data to confirm that Plaintiffs were not present during a hazing incident. The Court GRANTS Defendants' Motion to Dismiss Plaintiffs' constitutional claims against President Whitten to the extent that they seek prospective injunctive relief. B. Breach of Contract Claim In support of their Motion to Dismiss, Defendants argue that they are entitled to Eleventh Amendment immunity on Plaintiffs' breach of contract claim because the Court's supplemental jurisdiction does not extend to state-law claims against "non-consenting state defendants." [Filing No. 20 at 8 (quotation omitted).] Defendants also argue that Plaintiffs lack standing to assert a breach of contract claim because they do not allege any injury, and that IU did not breach a contract with Plaintiffs. [Filing No. 20 at 21-29.] In response, Plaintiffs argue that privacy violations constitute an inherent injury, and that retaining the Swipe Data caused an ongoing injury. [Filing No. 28 at 21.] They contend that IU breached its own policies by using the Swipe Data "to check past entries to University buildings to check the alibis of students during an investigation," and that this "does not comport with the intended purpose of the [CrimsonCard]." [Filing No. 28 at 22-23.] In their reply, Defendants reiterate many of their arguments. [Filing No. 33 at 13-20.] Because the Court has dismissed all of Plaintiffs' federal claims, it must determine whether it will exercise jurisdiction over Plaintiffs' breach of contract claim. A district court ultimately has discretion whether to exercise supplemental jurisdiction over a plaintiff's state law claims. Carlsbad Tech., Inc. v. HIF Bio, Inc., 556 U.S. 635, 639 (2009); 28 U.S.C. § 1367 (c) ("The district courts may decline to exercise supplemental jurisdiction over a claim…if…the district court has dismissed all claims over which it has original jurisdiction…"). When deciding whether to exercise supplemental jurisdiction, "a federal court should consider and weigh in each case, and at every stage of the litigation, the values of judicial economy, convenience, fairness, and comity." City of Chicago v. Int'l Coll. of Surgeons, 522 U.S. 156, 173 (1997) (quotations and citations omitted). The Court finds that the balance of factors weighs in favor of declining to exercise supplemental jurisdiction over the remaining state law claim. First, as to judicial economy, the parties have not yet engaged in discovery on the breach of contract claim. Second, as far as convenience, witnesses and evidence related to the breach of contract claim would likely be located in Bloomington, where a state court could decide the claim, and not in Indianapolis, where this Court is located. And third and fourth, whether IU breached the Terms and Conditions of the CrimsonCard or its own policies through activities which occurred at a university located in Bloomington is quintessentially a local issue which is best decided by a state court, making the interests of fairness and comity factors weigh in favor of this Court declining to exercise supplemental jurisdiction over the state law breach of contract claim. The Court DENIES Defendants' Motion to Dismiss Plaintiffs' breach of contract claim, but declines to exercise supplemental jurisdiction over that claim and DISMISSES it WITHOUT PREJUDICE to re-file that claim in state court. IV. CONCLUSION One day, in a not-so-distant future, millions of Americans may well wake up in a smart-home-dotted nation. As they walk out their front doors, cameras installed on nearby doorbells, vehicles, and municipal traffic lights will sense and record their movements, documenting their departure times, catching glimpses of their phone screens, and taking note of the people that accompany them. These future Americans will traverse their communities under the perpetual gaze of cameras…. [A]s society's uptake of a new technology waxes – cars, GPS devices, cameras, and the Internet come to mind – expectations of privacy in those technologies wane. In today's interconnected, globalized, and increasingly digital world, for example, Americans largely accept that cell phones will track their locations, their Internet usage will leave digital footprints, and ever-watching fixed cameras will monitor their movements. These evolving expectations thus continually undermine themselves. As long as the government moves discreetly with the times, its use of advanced technologies will likely not breach society's reconstituted (non)expectations of privacy. United States v. Tuggle, 4 F.4th 505, 509-10 (7th Cir. 2021). Given the very limited scope of Plaintiffs' reasonable privacy expectations as IU students required to use the CrimsonCard to access various facilities and use certain amenities, and the context in which Plaintiffs allege that IU used the Swipe Data, the Court finds that Plaintiffs have not plausibly alleged that IU's use of the Swipe Data, to the extent it constituted a search, was unreasonable. Accordingly, the Court: • GRANTS Defendants' Motion to Dismiss to the extent that it DISMISSES [19] Plaintiffs' federal constitutional claims WITH PREJUDICE;3 and 3 The Court is dismissing Plaintiffs' constitutional claims with prejudice. Pursuant to Federal Rule of Civil Procedure 15(a)(1)(B), a plaintiff may amend his complaint once as a matter of course in response to a motion to dismiss. Fed. R. Civ. P. 15(a)(1)(B). The 2009 notes to that rule emphasize that this amendment "will force the pleader to consider carefully and promptly the wisdom of amending to meet the arguments in the motion. A responsive amendment may avoid the need to decide the motion or reduce the number of issues to be decided, and will expedite determination of issues that otherwise might be raised seriatim." Plaintiffs chose not to exercise their right to amend their Complaint pursuant to Rule 15(a)(1)(B) in response to Defendants' Motion to Dismiss but, instead, chose to brief the motion and have the Court adjudicate the issues. The Court is not required to give Plaintiffs another chance to plead their claims because they have already had an opportunity to cure deficiencies in their pleadings. See Emery v. Am. Gen. Fin., Inc., 134 F.3d 1321 , 1322-23 (7th Cir. 1998). Consequently, the Court, in its discretion, dismisses Plaintiffs' constitutional claims with prejudice. e DENIES Defendants' Motion to Dismiss Plaintiffs’ breach of contract claim, but declines to exercise supplemental jurisdiction over that claim and DISMISSES it WITHOUT PREJUDICE [19]. Final judgment shall enter accordingly. Date: 9/1/2021 Hon. Jane Magnus-Stinson, Judge ‘United States District Court Southern District of Indiana Distribution via ECF only to all counsel of record -19-