Illinois District Court Addresses Standing, Pleading Requirements in Illinois Biometric Lawsuits
ABSTRACT: Does your company or one of your clients use biometric technology? If so, be aware of two recent rulings from the District Court for the Northern District of Illinois on federal pleading and standing requirements governing lawsuits filed under the Illinois Biometric Information Privacy Act.
Adding to the confusion businesses face over the Illinois Biometric Information Privacy Act (“BIPA”), two Illinois District Court judges recently issued orders on what is required to maintain a BIPA lawsuit in federal court. In one case, Judge Robert Gettleman remanded a BIPA lawsuit to an Illinois circuit court, concluding that the plaintiff lacked standing to pursue her claim in federal court. In a separate case, Judge Rebecca Pallmeyer dismissed a BIPA lawsuit, finding that that plaintiff failed to allege sufficient facts to state a claim under the Act. These opinions seem to impose more stringent requirements on plaintiffs than the Illinois Supreme Court’s take on BIPA in the Rosenbach v. Six Flags Entertainment Corp. opinion, previously addressed by Baker Sterchi here. As discussed below, however, Judge Gettleman’s ruling suggests that an argument commonly made by defendants in BIPA lawsuits could be used against them.
In Hunter v. Automated Health Sys., 2020 U.S. Dist. Lexis 29054 (N.D. Ill. Feb. 20, 2020), the plaintiff filed suit against her former employer, alleging that it violated BIPA by requiring its employees to scan their fingerprints for timekeeping purposes without taking certain measures required by the Act. Specifically, the plaintiff alleged that the defendant violated the Act by failing to properly inform the plaintiff in writing of the specific purpose and length of time for which her fingerprints were being collected, stored, and used; failing to provide a publicly available retention schedule and guidelines for permanently destroying the plaintiff’s fingerprints; and failing to obtain a written release from the plaintiff to collect, capture, and otherwise retain her fingerprints. The employer removed the case to federal court and filed a motion to dismiss.
In reviewing the parties’ briefs on the motion to dismiss, Judge Gettleman found a “serious question” existed as to whether the court had subject matter jurisdiction. Because the defendant removed the case, the court found it bore the burden of establishing jurisdiction by demonstrating that the plaintiff alleged an injury-in-fact. Relying on the U.S. Supreme Court opinion Spokeo Inc. v. Robins, 136 S. Ct. 1540 (2016), Judge Gettleman explained that for an injury-in-fact to exist, the injury must be “concrete and particularized,” meaning it must be de facto, or actually exist. In analyzing whether the plaintiff had alleged a concrete and particularized injury, the court relied on Crabtree v. Experian Information Solutions, Inc., 2020 U.S. App. Lexis 2698 (7th Cir. Jan. 28, 2020), a case in which the Seventh Circuit Court of Appeals determined that the mere retention of private consumer information, absent any dissemination, does not constitute a concrete injury for standing purposes. In Hunter, the plaintiff failed to allege that the defendant disseminated her biometric information or that any data breach, identity theft, or other similar loss resulted from the collection of said information.
The Hunter defendant argued that jurisdiction existed based upon the Illinois Supreme Court’s holding in Rosenbach. In rejecting this argument, Judge Gettleman noted that Rosenbach established only that it is the policy of Illinois state courts to allow parties to sue under BIPA even if they cannot demonstrate that they have sustained some compensable injury beyond violation of their statutory rights for which they may seek recourse. It is the policy of the federal courts, by contrast, that a plaintiff must allege an actual or imminent injury to establish standing in federal court. According to Judge Gettleman, the Illinois Supreme Court expressly indicated in Rosenbach that BIPA procedural violations are not themselves actual injuries. Consequently, Judge Gettleman concluded that the plaintiff lacked standing at the time her case was removed because she did not allege any dissemination of her biometric information. Thus, the court remanded the case to the Circuit Court of Cook County.
In Heard v. Becton, Dickinson & Co., 2020 U.S. Dist. Lexis 31249 (N.D. Ill. Feb. 24, 2020), the plaintiff, a respiratory therapist, filed suit against Becton, alleging that he and members of a putative class were required to use fingerprint scanners to access Becton’s Pyxis MedStation system. The plaintiff further alleged that Becton violated BIPA because it never informed the plaintiff and putative class members that it was collecting, using, or storing their biometric information; failed to state the purpose and length of time for which it was doing so; failed to obtain executed written releases from them authorizing the collection of their biometric information; never provided them with a publicly available retention schedule for the permanent destruction of their biometric information; and, “upon information and belief,” disclosed their biometric information to “unknown” third parties without obtaining consent. Becton removed the case to the District Court for the Northern District of Illinois and moved to dismiss the complaint.
In its motion to dismiss, Becton first argued that the biometric information at issue was exempt from the scope of BIPA. Specifically, Becton claimed that the information fell under the “healthcare exemption” contained in BIPA. Section 14/10 of the Act states that “[b]iometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996.” 740 ILCS 14/10. According to Becton, that section applied to the plaintiff’s claims because the biometric information at issue was collected from healthcare workers in order to access medication. In addressing this argument, Judge Pallmeyer noted that she was aware of only two cases in which defendants had advanced this theory. In Diaz v. Silver Cross Hosp. & Med Ctrs., No. 2018 CH 001327 (Cir. Ct. Will Cnty. Aug. 29, 2019), the Circuit Court of Will County, Illinois, concluded that BIPA’s healthcare exemption applied to biometric information obtained from a nurse because the information was collected, used, or stored for healthcare treatment. By contrast, in Bruhn v. New Alberton’s, Inc., No. 2018 CH 01737 (Cir. Ct. Cook Cnty. July 2, 2019), the Circuit Court of Cook County, Illinois, determined that the exemption did not apply to biometric information collected from healthcare workers because their biometric information is not protected under HIPPA. Judge Pallmeyer found the reasoning in Bruhn more persuasive, noting that it seemed unlikely that the Illinois legislature intended to deprive healthcare workers of a right to privacy and control over their biometric information merely because the information was being used for patient treatment.
The court next addressed what type of action by a defendant regarding the collection of biometric information is required to trigger liability under Section 15(b) of BIPA. Becton argued that BIPA requires a defendant “actively” collect information, meaning that it did more than possess such information. The plaintiff argued that BIPA applies when a defendant obtains biometric information, no matter the source or the manner of collection. Judge Pallmeyer determined that BIPA requires a defendant to, at a minimum, take an “active step” to collect, capture, purchase, receive through trade, or otherwise obtain biometric information. The judge further concluded that the plaintiff failed to allege that Becton took any such active step. While the plaintiff alleged that Becton collected his biometric information, he failed to specify how, when, or any other factual detail regarding the collection. The plaintiff also failed to allege how his fingerprints made their way from the fingerprint scanner on Becton’s medical device into Becton’s systems.
Judge Pallmeyer then examined whether the plaintiff alleged sufficient facts to trigger liability under Sections 15(a) and (d) of BIPA, which apply to entities in possession of biometric information. BIPA does not define “possession,” leading the judge to apply the popularly understood meaning of the term. Specifically, Judge Pallmeyer adopted the definition provided by the Illinois Supreme Court, which found that possession occurs when a person has or takes control of the subject property or holds the property at his or her disposal. People v. Ward, 215 Ill.2d 317, 325 (Ill. 2005). The judge determined that the plaintiff failed to adequately plead possession by Becton because he did not allege that Becton exercised any dominion or control over his biometric information. More specifically, the plaintiff did not allege that Becton could freely access his biometric information or even how Becton allegedly received the information. Rather, the plaintiff merely alleged that he scanned his fingerprint into Becton’s device and Becton subsequently stored the plaintiff’s fingerprint in its systems.
Finally, the court dismissed the plaintiff’s claim because the plaintiff failed to allege that Becton disclosed his biometric information. Section 15(d) of BIPA provides that entities in possession of biometric information cannot disclose the information except in limited circumstances. The plaintiff alleged only “on information and belief” that Becton violation Section 15(d). Judge Pallmeyer found this allegation insufficient to satisfy the federal pleading standard.
Overall, these rulings suggest that federal court may be a much better venue than state court for defendants in a BIPA lawsuit depending upon the allegations and factual circumstances of the case. As these case show, district court judges seem more likely to require more specific pleadings from plaintiffs to survive dismissal and an actual, concrete injury, as opposed to simply alleging a technical violation of a BIPA provision. However, the Hunter ruling illustrates how a defendant’s argument regarding a lack of injury can be turned against the defendant, such that the case ultimately ends up back in state court.About Illinois Law Blog
Baker Sterchi's Illinois Law Blog examines significant developments, trends and changes in Illinois law on a broad range of topics that are of interest to Illinois practitioners and to businesses evaluating risks under Illinois law or managing litigation subject to Illinois law. Learn more about the editor, Lisa Larkin.
Subscribe via email
Subscribe to rss feeds
RSS FeedsABOUT baker sterchi blogs
Baker Sterchi Cowden & Rice LLC (Baker Sterchi) publishes this website as a service to our clients, colleagues and others, for informational purposes only. These materials are not intended to create an attorney-client relationship, and are not a substitute for sound legal advice. You should not base any action or lack of action on any information included in our website, without first seeking appropriate legal or other professional advice. If you contact us through our website or via email, no attorney-client relationship is created, and no confidential information should be transmitted. Communication with Baker Sterchi by e-mail or other transmissions over the Internet may not be secure, and you should not send confidential electronic messages that are not adequately encrypted.
The hiring of an attorney is an important decision, which should not be based solely on information appearing on our website. To the extent our website has provided links to other Internet resources, those links are not under our control, and we are not responsible for their content. We do our best to provide you current, accurate information; however, we cannot guarantee that this information is the most current, correct or complete. In addition, you should not take this information as a promise or indication of future results.
Disclaimer
The Illinois Law Blog is made available by Baker Sterchi Cowden & Rice LLC for educational purposes only as well as to give you general information and a general understanding of the law, not to provide specific legal advice. Your use of this blog site alone creates no attorney client relationship between you and the firm.
Confidential information
Do not include confidential information in comments or other feedback or messages related to the Illinois Law Blog, as these are neither confidential nor secure methods of communicating with attorneys. The Illinois Law Blog should not be used as a substitute for competent legal advice from a licensed professional attorney in your state.