Opinion
Case No. 19 C 2529
02-20-2020
EVELYN HUNTER, individually and on behalf of all others similarly situated, Plaintiff, v. AUTOMATED HEALTH SYSTEMS, INC., a Pennsylvania corporation, Defendant.
MEMORANDUM OPINION AND ORDER
Plaintiff Evelyn Hunter, individually and on behalf of all other similarly situated, sued her former employer defendant Automated Health Systems, Inc. in the Circuit Court of Cook County, Illinois, for violations of the Illinois Biometric Information Privacy Act ("BIPA"), 740 ILCS 14/1 et seq., based on defendant having required its employees to scan their fingerprints in defendant's biometric time tracking system. Defendant removed the case to this court and, after plaintiff filed an amended complaint, moved to dismiss arguing that plaintiff's claims are barred by the statute of limitations or preempted by the Illinois Workers Compensation Act, 820 ILCS 305/5.
During the court's review of the parties' briefs on the motion to dismiss, it became apparent to the court that there is a serious question as to subject matter jurisdiction, and the court ordered the parties to submit briefs addressing whether plaintiff has alleged an injury-in-fact sufficient to establish Article III standing to proceed in federal court. Having reviewed those briefs, the court concludes that plaintiff has not alleged an injury-in-fact, and remands the case to the Circuit Court of Cook County, Illinois.
Because plaintiff removed the case to this court, it has the burden to establish jurisdiction. Tri-State Water Treatment, Inc. v. Bauer, 845 F.3d, 352-53 (7th Cir. 2017). To establish that plaintiff has Article III standing, defendant must demonstrate that plaintiff has alleged an injury-in-fact that was caused by defendant and is redressable by the court. Groshek v. Time Warner Cable, Inc., 865 F.3d 884, 886 (7th Cir. 2017).
To qualify as an injury-in-fact, the alleged injury must be "concrete and particularized" and "actual and imminent and not conjectural or hypothetical." Spokeo Inc. v. Robbins, ___ U.S. ___, 136 S.Ct. 1540, 1548 (2016). To be concrete, the injury must be de facto, or actually exist. Id. A "bare procedural violation divorced from any concrete harm" does not qualify as an injury in fact. Id. at 1549. A procedural statutory violation may constitute an injury-in-fact on its own if the legislature has elevated a de facto injury that "was previously inadequate in law" to the "statues of illegally cognizable injury." But a statutory violation causes a concrete injury for Article III standing only if it presents an "appreciable risk of harm to the underlying interest the [legislature] sought to protect by enacting the statute." Groshek, 865, F.3d at 867.
In the instant case, plaintiff alleges that defendant violated BIPA by failing to: (1) properly inform plaintiff in writing of the specific purpose and length of time for which her fingerprints were being collected, stored, and used; (2) provide a publicly available retention schedule and guidelines for permanently destroying plaintiff's fingerprints; and (3) receive a written release from plaintiff to collect, capture, or otherwise retain her fingerprints. Notably, plaintiff fails to allege that defendant collected her biometric data without her knowledge or created a risk that plaintiff's data would fall into the hands of an unauthorized third party. The amended complaint does allege that "upon information and belief, by utilizing a biometric time clock defendant systematically and automatically disclosed, redisclosed, or otherwise disseminated plaintiff's biometric identifiers and /or biometric information to at least the payroll company hired by defendant without first obtaining the consent required by [BIPA]." The original complaint, upon which removal was based, however, contained no such allegation, and in her brief on standing plaintiff asserts that she is not alleging any "disclosure of biometric data to a third party such as a payroll company," and that she is not "presently aware of any data breach, identity theft, or other similar loss."
In Crabtree v. Experian Information Solutions, Inc., ___ F.3d ___, 2020 WL 428938 (7th Cir. Jan. 28, 2020), the Seventh Circuit summarized its decisions applying Spokeo's holding with respect to consumer protection cases, concluding that the "mere retention of private consumer information absent any dissemination, did not constitute a concrete injury for Article III standing purposes." Id. at *3 (discussing Gubala v. Time Warner Cable, Inc., 846 F.3d 909, 911-12 (7th Cir. 2017)). Not surprisingly, several district courts within this circuit have addressed the precise issue before this court, and have concluded that allegations of violation of BIPA's procedural requirements absent allegations of dissemination, or at least an appreciable risk of dissemination, do not suffice to support Article III standing. Aguilar v. Rexnord, LLC, 2018 WL 3239715 (N.D. Ill. July 3, 2018) (Shah, J.); McGinnis v. United States Cold Storage, Inc., 2019 WL 7049921 (N.D. Ill. Dec. 3, 2019) (Chang, J.); Bryant v. Compass Group USA, Inc., 2020 WL 433868 (N.D. Ill. Jan. 28, 2020) (Kendall, J.); Colon v. Dynacast, 2019 WL 5536834 (N.D. Ill. Oct. 17, 2019) (Dow, J.) and; Goings v. UGN, Inc., 2018 WL 2966970 (N.D. Ill. June 13, 2018) (Bucklo, J).
In Patel v. Facebook, 932 F.3d 1264 (9th Cir. 2019), the Ninth Circuit held that procedural violations of BIPA can constitute concrete injuries. But in Patel, the plaintiffs posted images of themselves on Facebook, and Facebook used those images to create user face templates which it then used to suggest "tagging." Facebook created those templates without the users' written consent, and thus used the plaintiffs' images in ways that the plaintiffs had no reason to anticipate. In the instant case, plaintiff does not allege that defendant did anything with her data of which she was unaware, and there is no claim of dissemination to any third party.
Defendant argues that jurisdiction is proper based on the Illinois Supreme Court's decision in Rosenbach v. Six Flags Entertainment, Corp., 2019 IL 123186, ¶ 34 which held that a plaintiff may qualify as an aggrieved party entitled to relief under BIPA without alleging any "actual injury or damage beyond infringement of the rights afforded under the law." As Judge Kendall explained in Bryant, however, Rosenbach established only that it is the policy of the Illinois courts to allow parties to sue under BIPA even if they cannot demonstrate that "they have sustained some compensable injury beyond violation of their statutory rights before they may seek recourse." Bryant, 2020 WL 433868 at *3. "But, it is the policy of the federal courts, by contrast, that a plaintiff must allege an 'actual or imminent' injury to establish Article III standing," and the Illinois Supreme Court explicitly indicated that BIPA procedural violations are not themselves actual injuries. Id.
This court agrees with Judge Kendall and concludes that plaintiff lacked Article III standing at the time the case was removed because there was no allegation of any dissemination, just a claim for a bare procedural violation. As to the amended complaint, plaintiff has admitted that she has no information to support her allegation that defendant disseminated her biometric information to a payroll vendor. And, plaintiff acknowledges that McGinnis held that a bare allegation of disclosure to a payroll vendor without any allegation that such disclosure created an increased risk of harm that BIPA was designed to protect, such as identity theft, is insufficient to allege a concrete injury. McGinnis, 2019 WL 7049921 at *3. Plaintiff does not allege, and admits that she cannot allege, that the unknown payroll vendor does not have any data security controls. Consequently, the court concludes that the amended complaint also fails to allege a concrete injury.
CONCLUSION
For the reasons discussed above, the instant case is remanded to the Circuit Court of Cook County, Illinois.
ENTER: February 20, 2020
/s/ _________
Robert W. Gettleman
United States District Judge