MANISH S. SHAH JUDGE

MEMORANDUM OPINION AND ORDER

MANISH S. SHAH JUDGE

Plaintiff Sharena King's employer required her to clock in and out of work each day using a face scanner. That scanner was part of biometric technology and services that defendant PeopleNet Corporation provided to King's employer, along with other clients in Illinois. PeopleNet's scanner collected King's biometric data and sent it to PeopleNet, which stored and used the information. King sued PeopleNet in state court, alleging violations of § 15(a), (b), and (c) of the Illinois Biometric Information Privacy Act. PeopleNet removed the case to federal court and moves to dismiss for lack of personal jurisdiction and failure to state a claim. King moves to remand two of her three claims. For the reasons discussed below, plaintiff's motion is granted, and defendant's motion is denied.

I. Legal Standards

A defendant can remove a lawsuit filed in state court to federal court if the federal court has original jurisdiction over the dispute. 28 U.S.C. § 1441(a). Federal district courts have original jurisdiction over any class action where at least one 1 plaintiff is diverse from at least one defendant, the amount in controversy exceeds $5 million in the aggregate, and there are 100 or more class members. 28 U.S.C. § 1332(d); Sabrina Travelers Com. Ins. Co., 869 F.3d 568, 578 (7th Cir. 2017) (citations omitted). The party invoking federal jurisdiction must also prove that Article III standing existed at the time of removal. See Collier v. SP Plus Corp., 889 F.3d 894, 896 (7th Cir. 2018) (citing Lujan v. Def. of Wildlife, 504 U.S. 555, 561 (1992)). If it appears that the court lacks subject-matter jurisdiction over a claim before final judgment, that claim shall be remanded. 28 U.S.C. §§ 1441(c)(2), 1447(c); see Bergquist v. Mann Bracken, LLP, 592 F.3d 816, 819 (7th Cir. 2010) (citations omitted).

Federal Rule of Civil Procedure 12(b)(2) governs dismissals based on lack of personal jurisdiction. A plaintiff need not include facts alleging personal jurisdiction in the complaint, but once a defendant moves to dismiss for lack of personal jurisdiction, the plaintiff bears the burden of establishing it. Curry v. Revolution Lab'ys, LLC, 949 F.3d 385, 392 (7th Cir. 2020) (quoting Purdue Rsch. Found. v. Sanofi-Synthelabo, S.A., 338 F.3d 773, 782 (7th Cir. 2003)). Where the determination is made solely on the basis of written materials and not an evidentiary hearing, the plaintiff only needs to make a prima facie showing of personal jurisdiction. Matlin v. Spin Master Corp., 921 F.3d 701, 705 (7th Cir. 2019) (citation omitted). I take plaintiff's asserted facts as true and resolve any factual disputes in her favor. See uBID, Inc. v. GoDaddy Grp., Inc., 623 F.3d 421, 423-24 (7th Cir. 2010) (citations omitted). 2

To survive a motion to dismiss under Rule 12(b)(6), a complaint must state a claim upon which relief may be granted. Fed.R.Civ.P. 12(b)(6). The complaint must contain “sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.'” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). In reviewing a motion to dismiss, I construe all factual allegations as true and draw all reasonable inferences in plaintiff's favor. Calderone v. City of Chicago, 979 F.3d 1156, 1161 (7th Cir. 2020) (citing Shipley v. Chicago Bd. Of Election Comm'rs, 947 F.3d 1056, 1060 (7th Cir. 2020)).

II. Background

PeopleNet, a Delaware corporation with its principal place of business in Massachusetts, sold time and attendance solutions to Illinois employers. [18-1] ¶¶ 4, 15, 22. To perform workforce management services (including timekeeping and work scheduling), PeopleNet supplied its clients with biometric-enabled hardware such as fingerprint and facial recognition scanners. Id. ¶¶ 4-5, 19. The devices captured employee data and transmitted it to defendant's cloud-based time and attendance systems, hosted on PeopleNet's servers. Id. ¶¶ 4-5, 19-20, 25. PeopleNet marketed its devices and software as superior to traditional time clocks, and gained a competitive advantage and made profits from the use of biometric data. Id. ¶ 45. 3

Beginning in 2006, PeopleNet provided technology and services to Paramount Staffing, an Illinois corporation based in Northbrook, Illinois. [18-1] ¶ 21. Sharena King worked for Paramount in Chicago. Id. ¶ 23. As part of her job, King was required to clock in and out of shifts using PeopleNet's face scanner, or timeclock. Id. ¶¶ 24- 25. During each scan, PeopleNet's device collected King's biometric identifiers, converted them into an electronic format, and transmitted that information to PeopleNet. Id. ¶ 25. PeopleNet didn't tell King that her biometrics were being collected and stored, id. ¶ 43, didn't get informed written consent from King before using her biometrics, id. ¶¶ 26, 43, didn't provide written disclosures describing why it was using King's biometrics or how long the use would last, id., and failed to make a biometric retention or destruction policy publicly available. Id. ¶¶ 26, 41. In addition to King, thousands of other people in Illinois were scanned by PeopleNet's systems, and defendant collected, stored, transmitted, and disseminated their biometric data. Id. ¶¶ 28, 30.

III. Analysis

A. Standing: Motion to Remand

Federal courts may resolve only “cases” or “controversies.” U.S. Const. art. III, § 2, cl. 1. Standing doctrine “limits the category of litigants empowered to maintain a lawsuit in federal court” so as to “ensure that federal courts do not exceed their authority” under Article III. Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (citations omitted). The requirements of standing guarantee that the plaintiff has a “personal stake” in the litigation. TransUnion LLC v. Ramirez, 141 S.Ct. 2190, 2203 4 (2021) (quoting Raines v. Byrd, 521 U.S. 811, 819 (1997)). Without that, there's no Article III case or controversy, and federal courts lack jurisdiction. See id.

To establish Article III standing, the party who wants the federal forum must show “(1) that [the plaintiff] suffered an injury-in-fact that is concrete, particularized, and actual or imminent, (2) that the injury was caused by the defendant, and (3) that the injury would likely be redressed by the requested judicial relief.” Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1244 (7th Cir. 2021) (quoting Thole v. U.S. Bank N.A., 140 S.Ct. 1615, 1618 (2020)). While PeopleNet bears the burden of showing standing in this case, see [1], the court also has an independent obligation to confirm that it has subject-matter jurisdiction before proceeding to the merits. See Carroll v. Stryker Corp., 658 F.3d 675, 680 (7th Cir. 2011) (citations omitted).

King argues that she hasn't suffered an injury in fact that will support her claims under § 15(a) and (c) of BIPA, 740 ILCS 14/15(a), (c). [18]. An injury in fact that satisfies the requirements of Article III “must be both concrete and particularized.” Thornley, 984 F.3d at 1245-46 (citing Spokeo, 578 U.S. at 340). A legislature can “elevat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law, ” Spokeo, 578 U.S. at 341 (quoting Lujan v. Def. of Wildlife, 504 U.S. 555, 578 (1992)), but violations of duties “owed to the public generally, not to particular persons, ” are not particularized injuries, and cannot be the basis for standing. Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020), as amended on denial of reh'g and reh'g en banc (June 30, 2020); see Thornley, 984 F.3d at 1247. 5

1. 15(a)

Section 15(a) of BIPA requires covered private entities to do two things. 740 ILCS 14/15(a); see Fox v. Dakkota Integrated Sys., 980 F.3d 1146, 1154-55 (7th Cir. 2020). First, they must “develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information.” 740 ILCS 14/15(a). Second, covered private entities must comply with that policy: retain and destroy biometric information in accordance with the law. Id. Because the first of these duties- publishing the policy-is “owed to the public generally, not to particular persons whose biometric information the entity collects, ” a violation of just that part of § 15(a) is not an injury in fact under Article III because the resulting harm is not particularized. Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020); Fox, 980 F.3d at 1154-56. Where a plaintiff has been injured by a defendant's failure to comply with a policy, however, the resulting “unlawful retention of biometric data inflicts a privacy injury” sufficient to support a plaintiff's § 15(a) claim in federal court. Fox, 980 F.3d at 1154-56.

The issue here is the precise claim alleged. King argues that she is not suing on the basis of PeopleNet's unlawful retention of her biometrics, but only alleging that PeopleNet violated § 15(a)'s publication requirement. [18] at 3-6. According to PeopleNet, the complaint alleges violations of all of § 15's duties. [20] at 7.

King is right. She has alleged that PeopleNet violated its duty to publish a policy, and also that defendant retained her biometric information. [18-1]. But 6 plaintiff hasn't alleged that PeopleNet's retention of her data was unlawful. See id. The complaint has a conclusory allegation that PeopleNet “[violated King's] biometric privacy rights under BIPA.” Id. ¶ 10. But the specific claim is that defendant collected and stored King's biometrics, id. ¶¶ 4-5, 19-25, but “failed to make publicly available any biometric retention or destruction policy.” Id. ¶ 26. That is only alleging a violation of BIPA's publication requirement.

In order to show injury in fact, at the pleading stage a “plaintiff must ‘clearly ... allege facts demonstrating' each element.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (quoting Warth v. Seldin, 422 U.S. 490, 518 (1975)). “In other words, allegations matter.” Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1246 (7th Cir. 2021). King's general allegations that PeopleNet violated her privacy rights under BIPA, [18-1] ¶¶ 10, 27, and that she was injured by defendant's conduct, id. at 1, are not allegations that the defendant unlawfully retained her information. And an allegation of retention of biometric information, even coupled with a defendant's failure to publish a policy, is insufficient to state an injury in fact. See Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 619 (7th Cir. 2020) (defendant “was collecting and storing” plaintiff's biometric information but plaintiff nonetheless lacked standing for her § 15(a) claim where she only alleged a violation of the duty to publish a policy). 7

Nothing about how PeopleNet used King's information was an injury to her rights under § 15(a)'s retention and deletion requirements. King alleged that PeopleNet still maintains control of her biometric information, [18-1] ¶ 40, but she didn't claim that defendant had no biometric information policy, that PeopleNet's purpose for collection had been satisfied, or that she no longer interacted with defendant, and so she hasn't alleged that defendant violated the retention and deletion requirements of § 15(a). See [18-1]; 740 ILCS 14/15(a). It's not clear that PeopleNet disseminated King's information and, even if it did, § 15(a) doesn't make all dissemination or disclosure unlawful, or in other words, injurious. See 740 ILCS 14/15(a). Bryant isn't distinguishable, either. Like this case, Bryant involved a 8 vendor (rather than an employer) gathering biometric information in a “workplace.” Bryant, 958 F.3d at 619. PeopleNet's duty to publish a biometric retention policy was owed to the public, not just to employees of the company's clients. Id. at 626. And a mere violation of that duty, as alleged here, is not enough to bring a § 15(a) claim in federal court.

2. 15(c)

Section 15(c) of BIPA makes it illegal for a corporation in possession of biometric information to “sell, lease, trade, or otherwise profit from” that information. 740 ILCS 14/15(c). As is the case for § 15(a) claims, to show an injury in fact under § 15(c), a plaintiff must allege a concrete and particularized injury. See Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1247 (7th Cir. 2021). Standing may exist, for instance, (1) where a collector of biometric data has deprived a plaintiff of the opportunity to profit from her own information; (2) where the sale and dissemination of a plaintiff's data “amplified the invasion of her privacy that occurred when the data was first collected;” or (3) if a defendant profiting from a plaintiff's biometric information raises her costs. Id. Where these or other concrete and particularized harms aren't shown, however, and a plaintiff alleges “only a general, regulatory violation, ” a § 15(c) claim fails in federal court for lack of standing. Id. at 1248-49.

According to PeopleNet, the complaint alleges that defendant's dissemination of King's data amplified the invasion of her privacy. [20] at 14. But that's not what 9 the complaint says. True, King claims that PeopleNet violated her rights to biometric privacy, [18-1] ¶¶ 10, 27, and that defendant transmitted her biometric information from its devices back to PeopleNet or its servers in order to provide services for King's employer. Id. ¶¶ 25, 40. The complaint may also allege some level of dissemination of King's information from PeopleNet to plaintiff's employer. See [18-1]. But King nowhere alleges that PeopleNet sold her data or that the transmission or dissemination of her biometric information amplified the invasion of her privacy. Id. What the complaint does say is that PeopleNet profits through the use of King's biometrics because it “markets its biometric time clocks and associated software to employers as superior options” and thereby gains “a competitive advantage over other timekeeping vendors and secures profits from its use of biometric data.” [18-1] ¶ 45.

That King alleged actual (not just statutory) injury, id. at 1, where the Thornley plaintiff did not, doesn't change the analysis. See Collier v. SP Plus Corp., 889 F.3d 894, 896 (7th Cir. 2018) (citations omitted) (“actual damages” are not magic words that automatically allege an injury in fact). A broad allegation of injury or a violation of privacy isn't enough under Article III. The question here is whether King has alleged a concrete and particularized harm caused by PeopleNet's profiting off her biometric information. See Thornley, 984 F.3d at 1247. She hasn't. PeopleNet's competitive advantage in the biometric timekeeping marketplace isn't an injury particular to King. The complaint doesn't allege an injury in fact stemming from PeopleNet's profiting off of King's biometric data, and so her claim under § 15(c) of BIPA doesn't belong in this court, either. 10

Plaintiff's motion to remand, [18], is granted. King's claims under BIPA § 15(a) and (c) are severed and remanded. See Bergquist v. Mann Bracken, LLP, 592 F.3d 816, 819 (7th Cir. 2010) (“If some parts of a single suit are within federal jurisdiction, while others are not, then the federal court must resolve the elements within federal jurisdiction and remand the rest.”).

B. Personal Jurisdiction

One of plaintiff's three claims remains: this one for a violation of § 15(b) of BIPA. By challenging this court's personal jurisdiction, PeopleNet argues that it shouldn't have to defend that claim in Illinois.

When a federal court sits in diversity, the court exercises personal jurisdiction to the same extent as a state court. Philos Techs., Inc. v. Philos & D, Inc., 645 F.3d 851, 855 n.2 (7th Cir. 2011). The Illinois long-arm statute permits jurisdiction to the same limits as the Due Process Clause. See Curry v. Revolution Lab'ys, LLC, 949 F.3d 385, 393 (7th Cir. 2020); 735 ILCS 5/2-209(c). The Due Process Clause allows personal jurisdiction over an out-of-state defendant if the defendant has “certain minimum contacts with [the state] such that the maintenance of the suit does not offend ‘traditional notions of fair play and substantial justice.'” Kipp v. Ski Enter. Corp. of Wisconsin, 783 F.3d 695, 697 (7th Cir. 2015) 11 (quoting Int'l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945)). “There are two types of personal jurisdiction: general and specific.” J.S.T. Corp. v. Foxconn Interconnect Tech. Ltd., 965 F.3d 571, 575 (7th Cir. 2020).

King argues that this court has specific jurisdiction over PeopleNet. [21] at 5- 9. Specific jurisdiction is about “the relationship among the defendant, the forum, and the litigation.” Walden v. Fiore, 571 U.S. 277, 284 (2014) (quoting Keeton v. Hustler Mag., Inc., 465 U.S. 770, 775 (1984)). The defendant's contacts with the forum state must “directly relate to the challenged conduct or transaction.” Matlin v. Spin Master Corp., 921 F.3d 701, 705 (7th Cir. 2019) (quoting Tamburo v. Dworkin, 601 F.3d 693, 702 (7th Cir. 2010)). For this court to exercise specific personal jurisdiction over PeopleNet, the corporation's contacts with Illinois must show that PeopleNet purposefully availed itself of the privilege of conducting business here; King's injury must have arisen out of defendant's forum-related activities; and any exercise of jurisdiction must comport with traditional notions of fair play and substantial justice. See Curry, 949 F.3d at 398 (quoting Lexington Ins. v. Hotai Ins. Co., Ltd., 938 F.3d 874, 878 (7th Cir. 2019)).

PeopleNet has provided products and services to King's employer, Illinois-based Paramount Staffing, since 2006. [18-1] ¶ 21. Defendant does similar business 12 with other clients here. Id. ¶¶ 4-5, 22, 40. As a result of that commerce, King scanned into her job in Chicago using PeopleNet's devices, which transmitted her biometric information to defendant's servers. Id. ¶¶ 24-25. Besides King, the complaint alleges that thousands of other people in Illinois have had their information “collected, captured, stored, transmitted, disseminated, or otherwise used” by PeopleNet, and that the company maintains custody and control of that information. Id. ¶¶ 28, 30, 40.

PeopleNet argues that it was just a vendor for King's employer, Paramount, and that any contacts it had with Illinois were attenuated: the result of Paramount's conduct, not PeopleNet's. [15] at 5-7. It's true that some of PeopleNet's contacts with Illinois were indirect, through its relationship with its clients, including Paramount. Defendant sold products and services to Illinois businesses; those businesses required their employees to use PeopleNet's biometric technology. See [18-1] ¶ 24. But in contrast to other cases involving biometric technology vendors, PeopleNet had direct 13 contacts with the forum state that weren't enabled or created by a third party. For instance, defendant did business with Paramount and other Illinois employers, presumably by entering into contracts with them. [18-1] ¶¶ 4-5, 15, 19, 21-22. Putting that business into context, see Purdue Rsch. Found. v. Sanofi-Synthelabo, S.A., 338 F.3d 773, 781 (7th Cir. 2003) (citing Burger King Corp. v. Rudzewicz, 471 U.S. 462, 479 (1985)), PeopleNet wasn't engaged in a one-off transaction. See [18-1]. PeopleNet shipped devices to this state and has provided services to King's employer for at least fifteen years. Id. ¶¶ 4, 21. While PeopleNet may have also served a nationwide market, defendant's business here centered on scanning Illinois employees' biometric information and handling the resulting data. Id. ¶¶ 4-5, 15, 19, 21-22. Given the length of PeopleNet's relationship with Paramount, defendant's business with other Illinois customers, and the “thousands” of Illinois residents whose information PeopleNet processed, id. ¶¶ 28, 30, it's reasonable to infer that PeopleNet knew that its technology was being used in this state, and that the company intended to exploit the Illinois market for biometric workforce management services.

In other words, PeopleNet reached out “beyond one state and create[d] continuing relationships and obligations with citizens of” Illinois, and is “subject to 14 regulation and sanctions” here “for the consequences of [its] activities.” Burger King Corp. v. Rudzewicz, 471 U.S. 462, 473 (1985) (citations omitted). That non-party employers (including Paramount) played a role in creating some contacts between PeopleNet's technology and Illinois doesn't necessarily make those contacts independent or attenuated, either. See Ford Motor Co. v. Montana Eighth Jud. Dist. Ct., 141 S.Ct. 1017, 1026-30 (2021) (rejecting the proposition that a showing of minimal contacts requires “a strict causal relationship between the defendant's instate activity and the litigation”). While Paramount and other Illinois employers made decisions that led to contacts between PeopleNet's devices and this state, those decisions weren't unilateral. PeopleNet “itself set the system up this way, ” uBID, Inc. v. GoDaddy Grp., Inc., 623 F.3d 421, 428 (7th Cir. 2010), doing business in this state that depended on employers requiring their employees to use PeopleNet's technology. Defendant sought out the Illinois biometric timekeeping market. It did business with companies here, shipped in devices, and handled a large quantity of biometric data from Illinois over a period of years. PeopleNet purposefully availed itself of the privilege of conducting business in Illinois. See Illinois v. Hemi Grp. LLC, 622 F.3d 754, 757-59 (7th Cir. 2010); Curry v. Revolution Lab'ys, LLC, 949 F.3d 385, 398-99 (7th Cir. 2020). 15

King's claims relate to PeopleNet's contacts with Illinois because there is “a connection between the forum and the specific claims at issue.” Curry, 949 F.3d at 400 (quoting Bristol-Myers Squibb v. Superior Ct. of California, 137 S.Ct. 1773, 1781 (2017)). PeopleNet's conduct in the Illinois biometric information market led to it capturing King's biometric data in Chicago. That PeopleNet relied on third parties like Paramount to deploy its technology does not sever the relationship between King's claims and PeopleNet's contacts with the forum. See id. at 401 (sales to Illinois consumers through third-party websites constituted related contacts); Ford Motor Co., 141 S.Ct. at 1028-29 (personal jurisdiction existed where a defendant had systematic contacts with the forum state related to the claims at issue even though there were intervening actions by third parties). King's BIPA claims arise directly out of PeopleNet's biometric information business in Illinois, and it was foreseeable that defendant would need to defend itself here. See Curry, 949 F.3d at 401 (finding claim-related contacts where a defendant made direct sales of a product that “[form] the very basis of this action”).

King has shown purposeful availment and claim-related contacts. Because plaintiff has made “a threshold showing of minimum contacts, ” PeopleNet must present compelling reasons why haling it into court here offends traditional notions of fair play and substantial justice. Curry, 949 F.3d at 402 (quoting Burger King Corp. v. Rudzewicz, 471 U.S. 462, 477 (1985)). Defendant has not pointed to any reason why litigating these claims in Illinois would be unreasonable or unfair. See [15]. 16

Defendant's motion to dismiss for lack of personal jurisdiction is denied. The complaint makes out a prima facie case for personal jurisdiction. But PeopleNet may preserve its objection by asserting the lack of personal jurisdiction in its answer, see Fed. R. Civ. P. 12(h)(1)(B)(ii), and may renew its motion if the facts reveal that PeopleNet's contacts with Illinois are not suit-related. See Rice v. Nova Biomedical Corp., 38 F.3d 909, 914-15 (7th Cir. 1994) (“[T]he denial of a preliminary challenge to personal jurisdiction ... is not an automatic bar to the renewal of the motion after evidence bearing on it has been obtained by pretrial discovery or presented at trial.”).

C. Failure to State a Claim

Section 15(b) of BIPA prohibits a private entity from obtaining a person's biometric information unless it first (1) tells the person in writing that the information is being obtained; (2) tells the person in writing why the information is being used and for how long; and (3) receives a written release. 740 ILSC 14/15(b); Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1245 (7th Cir. 2021). A written release is “informed written consent or, in the context of employment, a release executed by an employee as a condition of employment.” 740 ILCS 14/10.

PeopleNet argues that the requirements of § 15(b) don't apply to companies in its position. [15] at 8. That's because this case arises in the context of employment, and third-party vendors (selling products to an employer) can't impose conditions of employment on their clients' employees in order to secure the required written release. Id. Defendant also argues that § 15(b) doesn't apply to it because, unlike related subsections, § 15(b) doesn't penalize an entity merely for being “in possession” 17 of biometric data. Id. at 8-9. In order to impose liability under § 15(b), defendant seeks a requirement that an entity take an “active step” to obtain biometric data, and says it didn't in King's case. Id. at 10 (quoting Heard v. Becton, Dickinson & Co., 440 F.Supp.3d 960, 966 (N.D. Ill. 2020)); [22] at 7 (citing Jacobs v. Hanwha Techwin Am., Inc., No. 21 C 866, 2021 WL 3172967, at *1 (N.D. Ill. July 27, 2021)).

PeopleNet is right that § 15(b) doesn't penalize mere possession of biometric information. Compare 740 ILCS 14/15(b) with 740 ILCS 14/15(a), (c), (d). But that doesn't help PeopleNet because the complaint alleges that defendant did more than possess King's biometric information: it says that PeopleNet collected and obtained it. [18-1] ¶ 22 (“Defendant collects, stores, and otherwise uses information and data generated from the timekeeping systems it provided to [King's employer].”). I accept that factual allegation as true, see Calderone v. City of Chicago, 979 F.3d 1156, 1161 (7th Cir. 2020) (citation omitted), and it's reasonable to infer that PeopleNet, not its client-employers, was doing the capturing and obtaining of King's biometric information. Even if the statute requires a showing that PeopleNet took an “active step” towards collection of biometric information, plaintiff's claim survives that test 18 because the complaint spells out how PeopleNet obtained King's information. See [18-1].

PeopleNet's argument about the definition of “written release” in the employment context doesn't carry the day, either. Since the release is just one of the requirements imposed by § 15(b), the employment context of King's case doesn't excuse PeopleNet from informing King that it was collecting her biometrics, explaining why it was using her information, and for how long. See 740 ILCS 14/10, 14/15; Figueroa v. Kronos Inc., 454 F.Supp.3d 772, 783 (N.D. Ill. 2020). And while it's probably true that PeopleNet wasn't in a position to impose a condition of employment on its clients' employees, the statutory definition of a written waiver doesn't excuse vendors like PeopleNet from securing their own waivers before obtaining a person's data. See 740 ILCS 14/10; Figueroa, 454 F.Supp.3d at 783; Neals v. PAR Tech. Corp., 419 F.Supp.3d 1088, 1092 (N.D. Ill. 2019). It's not absurd to read § 15(b) as applicable to vendors as well as employers. A waiver imposes a minor compliance cost and does not threaten BIPA's underlying purposes. See 740 ILCS 14/5(g) (“The public welfare, security, and safety will be served by regulating the 19 collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.”).

The bottom line is this: PeopleNet was a private entity that allegedly obtained King's biometric information. Defendant didn't tell King about the collection, spell out why it was collecting the information or for how long, and didn't get a written release before-hand. King has stated a claim under § 15(b).

IV. Conclusion

King's motion to remand, [18], is granted. The claims under BIPA § 15(a) and (c) are severed and remanded to the Circuit Court of Cook County. PeopleNet's motion to dismiss, [14], is denied. The complaint states a claim under BIPA § 15(b). Defendant's answer to the complaint is due November 18, 2021 and the parties shall file a joint status report on November 29, 2021 with a proposed discovery schedule. 20