Opinion
No. 17-cv-9340
06-13-2018
George Goings, individually, and on behalf of all others similarly situated Plaintiff, v. UGN, Inc., AEP NVH OPCO, LLC d/b/a/ Applied Acoustics International, Defendants.
Memorandum Opinion and Order
From October of 1996 to October of 2017, George Goings was employed by defendants UGN and AAI, the latter entity having purchased the former during plaintiff's employment. Approximately twelve years ago, UGN began requiring plaintiff to scan his fingerprint at the beginning and end of each workday to track his time. AAI continued this practice upon its acquisition of UGN, and around June of 2017, AAI began requiring employees to scan their entire handprints.
I follow the parties' lead in referring to defendant AEP NVH OPC, LLC as "AAI." --------
Plaintiff sued defendants in the Circuit Court of Cook County on behalf of himself and a class, alleging that defendants' practice of collecting, storing, and using employees' finger- and handprints violates Illinois' Biometric Information Privacy Act ("BIPA"), 740 ILCS, 14/1, et seq., and common law of negligence. Defendant UGN removed the action to this court, where it now seeks dismissal under Fed. R. Civ. P. 12(b)(6) for failure to state a claim on which relief may be granted. In a separate motion to dismiss, AAI likewise argues that dismissal is appropriate under Rule 12(b)(6), and it adds that plaintiff lacks Article III standing because the complaint does not articulate any "concrete injury" as required for federal jurisdiction. In response to defendants' motions, plaintiff filed a motion to remand, arguing that if neither defendant is willing to argue in favor of federal jurisdiction, the case should be remanded to state court. Plaintiff also seeks attorneys' fees and costs associated with "Defendants' improper removal of this case." For the reasons that follow, I grant plaintiff's motion for remand but deny his request for fees and costs.
I.
The Illinois legislature passed BIPA in 2008 "in response to concerns about the growing use of biometric identifiers and information in financial transactions and security screening procedures." Dixon, 2018 WL 2445292, at *8 (citing 740 ILCS 14/5). The legislature found that:
Biometrics are unlike other unique identifiers that are used to access finances or other sensitive information. For example, social security numbers, when compromised, can be changed. Biometrics, however, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.740 ILCS 14/5(c). In view of these findings, the legislature determined that public welfare and safety would be served by the enactment of a statute "regulating the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifies and information." Id. at § 14/5(g). Plaintiff alleges that defendants violated substantive provisions of BIPA that require private entities to: 1) inform plaintiff and the class in writing of the specific purpose and length of time for which the prints were being collected, used and stored; 2) provide a publicly available retention schedule and guidelines for destruction of the prints; and 3) obtain a written release authorizing them to collect and store the prints. Id. at § 14/15(b). Plaintiff asserts that defendants' failure to take these steps also amounts to actionable negligence.
This case joins the growing ranks of BIPA actions filed in this district and elsewhere in which courts have adjudicated the sufficiency of the complaint against challenges brought under Rules 12(b)(1) and/or 12(b)(6). See, e.g., Vigil v. Take-Two Interactive Software, Inc., 235 F. Supp. 3d 499, 507-19 (S.D.N.Y. Jan. 27, 2017), aff'd in part, vacated in part, remanded sub nom. Santana v. Take-Two Interactive Software, Inc., 717 F. App'x 12 (2d Cir. 2017) (dismissing under Rule 12(b)(1) for failure to plead Article III injury-in-fact); Patel v. Facebook Inc., 290 F. Supp. 3d 948 (N.D. Cal. 2018) (holding injury-in-fact requirement satisfied and declining to dismiss under Rule 12(b)(1)); Dixon v. The Washington and Jane Smith Community, No. 17 C. 8033, 2018 WL 2445292 (May 31, 2018) (Kennelly, J.) (analyzing implicit challenge to Article III standing and declining to dismiss under Rules 12(b)(1) or 12(b)(6)); Howe v. Speedway, No. 17 C 7303, 2018 WL 2445541 (May 31, 2018) (Wood, J.) (analyzing implicit challenge to Article III standing and remanding for lack of federal jurisdiction); Barnes v. ARYZTA, LLC, 288 F. Supp. 3d 834 (N.D. Ill. 2017) (remanding without deciding whether federal jurisdiction existed where no party argued in favor of federal jurisdiction); Monroy v. Shutterfly, Inc., No. 16 C 10984, 2017 WL 4099846, at *8 n.5 (N.D. Ill. Sept. 15, 2017) (finding federal jurisdiction secure and declining to dismiss under Rule 12(b)(6)); Rivera v. Google Inc., 238 F. Supp. 3d 1088 (N.D. Ill. 2017) (declining to dismiss under Rule 12(b)(6)); McCollough v. Smarte Carte, Inc., No. 16 C 03777, 2016 WL 4077108 (N.D. Ill. Aug. 1, 2016) (dismissing under Rules 12(b)(1) and 12(b)(6) for failure to allege injury-in-fact or statutory standing as person "aggrieved" by BIPA violation); Norberg v. Shutterfly, Inc., 152 F. Supp. 3d 1103 (N.D. Ill. 2015) (declining to dismiss under Rule 12(b)(6)).
Before examining where this case falls in the taxonomy of federal BIPA litigation, however, I pause briefly to address plaintiff's argument that the case must be remanded (and fees and costs awarded) on the ground that defendants inappropriately removed the case to federal court only to turn around and seek dismissal for lack of federal jurisdiction. It is true that the Seventh Circuit recently admonished the defendant in Collier v. SP Plus Corporation, 889 F.3d 894, 897 (7th Cir. 2018) for taking such an approach, deeming it a "dubious strategy." But the basis on which the Collier court remanded the case was its conclusion that the plaintiffs lacked Article III standing. Id. at 896. In other words, the court did not remand based on the defendants' litigation gamesmanship, but rather on its affirmative conclusion that the plaintiffs had not pled the injury-in-fact required for federal jurisdiction. Id. at 896-97. See also Dixon, 2018 WL 2445292 at *4-*5 (declining to remand based on defendants' unwillingness, post-removal, to argue in favor of federal jurisdiction and holding affirmatively that the plaintiff's allegations satisfied constitutional standing requirements). Accordingly, I turn to the substance of the standing issue.
A survey of federal BIPA cases reveals that the vast majority of courts to have evaluated standing in this context have acknowledged that more than "bare procedural violations" of the statute must be alleged to satisfy the requirement of a "concrete and particularized" injury that is "actual or imminent, not conjectural or hypothetical" under Spokeo Inc. v. Robins, 136 S. Ct. 1540, 1548 (2016). See, e.g., Dixon, 2018 WL 2445292 at *8-*9; Howe, 2018 WL 2445541, at *4; Vigil, 235 F. Supp. 3d at 511; McCollough, 2016 WL 4077108, at *3-*4. But see Patel, 290 F. Supp. 3d at 953-54 (observing that procedural violations alone can "manifest concrete injury" where the legislature "conferred the procedural right to protect a plaintiff's concrete interests and where the procedural violation presents a real risk of harm to that concrete interest," and holding that "the abrogation of the procedural rights mandated by BIPA necessarily amounts to a concrete injury."). The violations plaintiff attributes to his former employers, namely, their failure to comply with the statute's notice and consent provisions, are accurately described as procedural. See, e.g., Dixon, 2018 WL 2445292 at *9.
Of the cases cited above, plaintiff's is most akin to Howe, in which the plaintiff likewise asserted BIPA and negligence claims against his employer for its collection, storage, and use of fingerprint scans in conjunction with timekeeping. See 2018 WL 2445541, at *1. Indeed, the complaints filed in the two cases are near carbon-copies in material respects, asserting the same substantive provisions of the statute and claiming the same injuries: invasion of privacy rights; informational injuries based on the defendants' failure to provide information required by the statute; and mental anguish. Compare Goings Am. Cmplt. at ¶¶ 49-51 with Howe Cmplt., No. 17 C 7303 DN 1-1 at ¶¶ 44-47. Although the defendant in Howe ostensibly challenged only the plaintiff's "statutory standing" under Rule 12(b)(6), because its arguments "cast doubt on Howe's Article III standing," the court evaluated the defendant's implicit constitutional argument and concluded that remand was appropriate.
The court began by observing that the complaint lacked allegations suggesting that the plaintiff's biometric data was compromised or was likely to be compromised. Accordingly, it dismissed the plaintiff's claims of mental anguish and invasion of privacy as "precisely the type of conjectural or hypothetical injury that cannot support Article III standing." Howe, 2018 WL 2445541, at *4 (citing Clapper v. Amnesty Int'l USA, 568 U.S. 398, 416 (2013), Whitmore v. Arkansas, 495 U.S. 149, 158 (1990), and Gubala v. Time Warner Cable, Inc., 846 F.3d 909, 912 (7th Cir. 2017). The court then analyzed the plaintiff's asserted informational injury and concluded that because BIPA's "core object" is to protect biometric data, not to require the disclosure of information, that injury was insufficient, standing alone, to support standing. Id. at *5 (citing Federal Election Commission v. Akins, 524 U.S. 11, 21 (1998), and Groshek v. Time Warner Cable, Inc., 865 F.3d 884, 888 (7th Cir. 2017).
With respect to plaintiff's alleged privacy and emotional injuries, Gubala is particularly instructive. The plaintiff in Gubala—a former cable subscriber—discovered eight years after cancelling his subscription that the cable operator continued to store his personal information, including his home address, date of birth, social security number, and credit card information. 846 F.3d at 911. He claimed that the cable operator's failure to destroy that information violated provisions of the Cable Communications Policy Act requiring cable operators to destroy their customers' personal information if it is no longer necessary for the purpose for which it was collected. Id. The court assumed that the defendant's conduct violated the statute but affirmed dismissal of the complaint on the ground that the plaintiff lacked standing, reasoning that absent any allegation that the cable operator "has ever given away or leaked or lost any of his personal information or intends to give it away or is at risk of having the information stolen from it," any risk of harm to plaintiff's privacy rights was too remote to satisfy Article III standing. Id. at 910-11.
The same is true of the privacy and emotional injuries plaintiff asserts here. Indeed, a comparison between this case and Howe, on the one hand, and Dixon on the other, illustrates the distinction between conjectural, abstract privacy injuries and concrete and particularized ones. In Dixon, the plaintiff alleged that her employer required her to scan her fingerprints into a biometric timekeeping device and "systematically disclosed" her biometric data to a third-party without her knowledge or consent. 2018 WL 2445292, at *1. The court emphasized that "in addition to alleging what might accurately be characterized as 'bare procedural violations' of BIPA, Dixon also has alleged that [the defendant] disclosed her fingerprint data to [a third party] without her knowledge and that the defendants violated her right to privacy in her biometric information—the very right that the drafters of BIPA sought to protect." 2018 WL 2445292, at *9. The court observed that "[o]btaining or disclosing a person's biometric identifiers or information without her consent or knowledge necessarily violates that person's right to privacy" and held that it was the defendant's alleged disclosure of Dixon's biometric data that distinguished the case from McCollough, Vigil, and Gubala. Id. at *9-*10 ("Dixon has alleged what the plaintiffs in McCollough, Vigil, and Gubala did not. Specifically, she has alleged that [the defendant] disclosed her fingerprint scan to [a third party] without informing her or obtaining her consent to do so.").
Plaintiff's allegations here, by contrast, are more closely aligned with those in McCollough and Vigil. In McCollough, the plaintiff alleged that the defendant violated BIPA by requiring her to scan her fingerprint in order to rent its product, but did not provide her with the notice required by the statute or obtain her consent. 2016 WL 4077108, at *1. The court assumed, however, that "a customer would understand that [the defendant] collects and retains their fingerprint data for at least the duration of the rental [since] the system would not work otherwise," id. at n. 1. It went on to hold that absent allegations that the defendant had disclosed her data to any other entity, the technical violations she alleged did not give rise to a concrete privacy injury. Id. at *3. In Vigil, the plaintiffs challenged the defendants' use of facial scans to create personalized avatars for use in video games. The court noted that the plaintiffs had provided the defendant their biometric information after agreeing to terms and conditions stating that the facial scans would "be visible to you and others you play with and may be recorded or screen captured during gameplay," and after providing their biometric data in "a lengthy involved process that takes about 15 minutes, during which time the gamer must stare up-close at the camera while also turning his or her head from side-to-side at regular intervals." 235 F. Supp. 3d at 505. Citing McCollough and Gubala among other cases, the court held that the alleged technical violations of BIPA failed to articulate a concrete injury. Id. at 511.
Like the plaintiffs in each of these cases, Goings was aware that he was providing his biometric data to defendants and does not claim that defendants have disclosed (either purposely or unwittingly) that information to any other entity without his consent. This scenario is unlike the one in Dixon, where the defendant allegedly disclosed the plaintiff's data to third parties, and it is also unlike the ones in Patel and Monroy, where the plaintiffs' biometric data was allegedly collected and stored without their knowledge. See Patel, 290 F. Supp. 3d at 955 (distinguishing McCollough and Vigil on the ground that the plaintiffs in those cases knew that their biometric data was being collected and stored); Monroy, 2017 WL 4099846 at *8 n. 5 (same). Consistently with all of these cases, I conclude that the privacy and emotional injuries plaintiff alleges are too speculative and abstract to support Article III standing. And because BIPA is not essentially concerned with information disclosure, I agree with the courts in Howe and Vigil that plaintiff's alleged violation of BIPA's notice provisions is insufficient, on its own, to support federal jurisdiction. In short, this case falls neatly in line with Howe, Vigil, and McCollough and sits apart from Dixon, Patel, and Monroy.
In accord with these cases and with the Seventh Circuit's decisions in Gubala and Groshek, I conclude that plaintiff lacks standing to pursue his claims in federal court and remand the case to the Circuit Court of Cook County. I deny plaintiff's request for attorneys' fees and costs, however. The basis for the request is defendants' putative manipulation of the litigation process by successively asserting and repudiating federal jurisdiction. As noted above, the defendants adopted that "dubious strategy" in Collier; yet the court declined to award fees and costs resulting from the defendants' tactical maneuvering. See 889 F.3d at 897. Moreover, plaintiff's request for fees and costs is even less compelling than in Collier, since neither defendant in this case has "tried to have it both ways by asserting, then immediately disavowing, federal jurisdiction." Mocek v. Allsaints USA Ltd., 220 F. Supp. 3d 910, 914 (N.D. Ill. 2016). Only UGN sought removal to federal court, and only AAI seeks dismissal for lack of federal jurisdiction. Indeed, UGN maintains that federal jurisdiction is appropriate. See UGN Resp. to Mot. for Remand, DN 41 at 2-3. Neither Mocek, nor any other authority plaintiff cites, supports an award of fees and costs on under such circumstances.
ENTER ORDER:
/s/_________
Elaine E. Bucklo
United States District Judge Dated: June 13, 2018