Edmond E. Chang, United States District Judge

Brandon Michael Wise, Peiffer Wolf Carr & Kane, APLC, Saint Louis, MO, David J. Fish, Mara Ann Baltabols, John C. Kunze, The Fish Law Firm, P.C., Naperville, IL, for Plaintiffs.

Gerald L. Maatman, Jr., Thomas E. Ahlering, Alexandra Sofia Oxyer, Seyfarth Shaw LLP, Chicago, IL, for Defendant.

MEMORANDUM OPINION AND ORDER

Edmond E. Chang, United States District Judge

Jada Marsh and Charles Hilson have filed this proposed class action against a plasma-donation company, CSL Plasma Inc. The Plaintiffs allege that CSL violated the Illinois Biometric Information Privacy Act (often referred to as "BIPA"). 740 ILCS 14/1, et seq. R. 18-1, Compl. The Act prohibits private entities from collecting any "biometric identifier"—including fingerprints—from a person unless that person has consented in writing and the private entity has provided certain disclosures. 740 ILCS 14/15(b). Under Section 15(a) of the Act, collectors of biometric identifiers must develop, publicly disclose, and follow a data retention and destruction policy for the biometric information. 740 ILCS 14/15(a). The Plaintiffs allege that CSL violated the Act by using a donor-identification system that relied on the collection, storage, and use of donors’ fingerprints and biometric information without proper written consent and without making required disclosures. The suit was initially filed in state court, and CSL invoked the Class Action Fairness Act, 28 U.S.C. §§ 1332(d), 1453, to remove the case to federal court. CSL moved to dismiss for failure to adequately state a claim for relief. Fed. R. Civ. P. 12(b)(6). For their part, the Plaintiffs ask this Court to remand the Section 15(a) claims to state court for lack of subject matter jurisdiction. R. 18, Mot. Remand; R. 32, Pls.’ Position Paper. For the reasons set forth below, the motion to remand is denied and the motion to dismiss is denied in large part.

I. Background

For purposes of evaluating the dismissal motion, the Court must accept as true the allegations in the Complaint. Erickson v. Pardus , 551 U.S. 89, 94, 127 S.Ct. 2197, 167 L.Ed.2d 1081 (2007). CSL Plasma is a plasma-donation business with locations in Chicago, Hazel Crest, and Melrose Park, Illinois. Compl. at ¶¶ 3–4. For purposes of diversity jurisdiction, CSL is a citizen of Delaware and Florida. R. 1 ¶ 10. Jada Marsh and Charles Hilson, both Illinois citizens, donated plasma at the Hazel Crest location some time during the year before the filing of the September 2019 complaint. Compl. ¶¶ 1-2, 22.

Each time that the Plaintiffs donated plasma, CSL required them to scan their fingerprints. Id. ¶ 26. These scans were used to create a biometric template for the Plaintiffs in CSL's database as a way to track their donations and authenticate their identities. Id. ¶ 5, 23-25. Despite collecting this biometric information, CSL never obtained consent or a written release from the Plaintiffs for the collection, capture, storage, or use of their biometric data. Id. ¶ 29. The Plaintiffs assert that they did not know or fully understand that CSL was collecting, capturing, or storing their biometric information. Id. ¶ 57. And CSL never told the Plaintiffs why their biometric information was being collected or how long it would be stored or used, id. ¶ 27, nor did CSL explain its biometric data retention policy or inform the Plaintiffs whether it would ever permanently delete their biometric data. Id. ¶ 28. In fact, the Plaintiffs do not believe that CSL even has a biometric data retention policy. Id. ¶ 59. As a result of CSL's biometric data practices (or lack of them), the Plaintiffs allege that they were continuously and repeatedly exposed to "risks and harmful conditions." Id. ¶ 30.

Initially, the Plaintiffs filed this proposed class action in state court. Compl. at 1. The Plaintiffs seek damages, along with various forms of injunctive relief. Id. ¶¶ 92–95. CSL removed the lawsuit to federal court, invoking the Class Action Fairness Act, 28 U.S.C. §§ 1332(d) and 1453. R. 1. The Plaintiffs countered by moving to remand back to state court, arguing that their claims were insufficient to establish Article III standing because they had alleged nothing more than procedural violations of BIPA. R. 18 at 2-3. But after the Seventh Circuit issued Bryant v. Compass Group USA, Inc. , 958 F.3d 617 (7th Cir. 2020), the Court ordered supplemental briefing, and the Plaintiffs amended their position. The Plaintiffs concede that Article III standing does apply to the lack-of-consent claims under Section 15(b) of the Act, but the Plaintiffs continue to insist that there is no standing for the retention-policy claims under Section 15(a). R. 32, Pls.’ Position Paper, at 1. For its part, CSL has moved to dismiss the claims on a variety of grounds. R. 36.

II. Legal Standards

Removal of a case to federal court is generally governed by 28 U.S.C. § 1441. Generally speaking, so long as a case could have been filed in federal court, the case may be removed. 28 U.S.C. § 1441(a) ; Caterpillar Inc. v. Williams , 482 U.S. 386, 392, 107 S.Ct. 2425, 96 L.Ed.2d 318 (1987) ; Ne. Rural Elec. Membership Corp. v. Wabash Valley Power Ass'n , 707 F.3d 883, 890 (7th Cir. 2013). "The party seeking removal has the burden of establishing federal jurisdiction." Schur v. L.A. Weight Loss Ctrs. , 577 F.3d 752, 758 (7th Cir. 2009). Failure to meet this burden results in the remand of the removed case. 28 U.S.C. § 1447(c) ; Doe v. Allied-Signal, Inc. , 985 F.2d 908, 911 (7th Cir. 1993). When determining whether a defendant has met this burden, the Seventh Circuit has cautioned that "[c]ourts should interpret the removal statute narrowly," id. , and resolve doubts about removal in favor of the Plaintiffs’ choice of forum in state court, Morris v. Nuzzo , 718 F.3d 660, 668 (7th Cir. 2013).

As for the complaint itself, under Federal Rule of Civil Procedure 8(a)(2) a complaint generally need only include "a short and plain statement of the claim showing that the pleader is entitled to relief." Fed. R. Civ. P. 8(a)(2). This short and plain statement must "give the defendant fair notice of what the ... claim is and the grounds upon which it rests." Bell Atl. Corp. v. Twombly , 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) (cleaned up). The Seventh Circuit has explained that this rule "reflects a liberal notice pleading regime, which is intended to ‘focus litigation on the merits of a claim’ rather than on technicalities that might keep plaintiffs out of court." Brooks v. Ross , 578 F.3d 574, 580 (7th Cir. 2009) (quoting Swierkiewicz v. Sorema N.A. , 534 U.S. 506, 514, 122 S.Ct. 992, 152 L.Ed.2d 1 (2002) ).

"A motion under Rule 12(b)(6) challenges the sufficiency of the complaint to state a claim upon which relief may be granted." Hallinan v. Fraternal Order of Police of Chi. Lodge No. 7 , 570 F.3d 811, 820 (7th Cir. 2009). "[A] complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face." Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (cleaned up). These allegations "must be enough to raise the right to relief above the speculative level." Twombly , 550 U.S. at 555, 127 S.Ct. 1955. The allegations that are entitled to the assumption of truth are those that are factual, rather than mere legal conclusions. Iqbal , 556 U.S. at 678-79, 129 S.Ct. 1937.

III. Analysis

A. Jurisdiction

As the party invoking federal jurisdiction, CSL bears the burden of establishing that federal jurisdiction applied at the time of removal. Collier v. SP Plus Corp. , 889 F.3d 894, 896 (7th Cir. 2018) (citing Lujan v. Def. of Wildlife , 504 U.S. 555, 561, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) ) ("The party invoking federal jurisdiction bears the burden of establishing" Article III standing). The Plaintiffs have Article III standing to sue if they "(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo, Inc. v. Robins , ––– U.S. ––––, 136 S. Ct. 1540, 1547, 194 L.Ed.2d 635 (2016). "To establish injury in fact, a plaintiff must show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’ " Id. at 1548 (citing Lujan , 504 U.S. at 560, 112 S.Ct. 2130 ). A "bare procedural violation, divorced from any concrete harm" does not satisfy the injury-in-fact requirement of Article III. Id. at 1549 ; see also Collier , 889 F.3d at 896 (plaintiff must have "suffered an injury beyond a statutory violation"). "Instead, the plaintiff must show that the statutory violation presented an ‘appreciable risk of harm’ to the underlying concrete interest that [the legislature] sought to protect by enacting the statute." Groshek v. Time Warner Cable, Inc. , 865 F.3d 884, 887 (7th Cir. 2017) (quoting Meyers v. Nicolet Rest. of De Pere, LLC , 843 F.3d 724, 727 (7th Cir. 2016) ).

Here, the heart of the jurisdictional dispute is over the nature and concreteness of injuries for the alleged violations of the Illinois Biometric Information Privacy Act. The Act was the Illinois General Assembly's response to the expanding use of biometrics "in the business and security screening sectors" as Chicago and other parts of Illinois became "pilot testing sites for new applications of biometric-facilitated financial transactions." 740 ILCS 14/5(a), (b). The legislative findings acknowledged that the "full ramifications of biometric technology are not fully known," but nonetheless noted that the immutability of biometric information means that once such information is compromised—unlike Social Security numbers and other personal identifiers—"the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions." Id. § 14/5(c). Given the consequences of biometric-identity theft, the General Assembly found that the "public welfare, security, and safety will be served by regulating the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information." Id. § 14/5(g).

To implement those goals, Section 15(b) of the Act prohibits private entities from collecting, capturing, or otherwise obtaining a person's biometric information without informed written consent. Id. § 14/15(b). Section 15(a) requires private entities that possess biometric information to develop, publicly disclose, and comply with a data retention schedule, including providing for the permanent destruction of biometric information after its initial purpose is satisfied, but in no event later than three years from the person's last interaction with the entity. Id. § 14/5(a).

In moving to remand, the Plaintiffs argue that there is no Article III "injury in fact" for the retention-policy claims under Section 15(a) of the Act. R. 32, Pls.’ Paper at 1; 740 ILCS 14/15(a). It is true that, in Bryant v. Compass Group , the Seventh Circuit held that the retention-policy claim alleged by the plaintiff in that case did not result in an injury in fact for purposes of Article III standing. 958 F.3d at 626. The Seventh Circuit reasoned that Bryant had alleged only that a generalized duty of disclosure to the public had been violated, with no accompanying particularized harm to Bryant. Id. ("the duty to disclose under section 15(a) is owed to the public generally, not to particular persons whose biometric information the entity collects").

Here, however, the Plaintiffs have alleged more than mere generalized harm arising from the retention-policy violation. This makes all the difference, because the Seventh Circuit recently explained that Bryant made no broad statement on whether violations of the retention-policy requirement of Section 15(a) satisfy the injury-in-fact element of standing. Fox v. Dakkota Integrated Sys., LLC , 980 F.3d 1146, 1153–54 (7th Cir. 2020). In Fox , the Seventh Circuit emphasized that Bryant considered only the theory invoked there—a violation of the generalized duty to publicly disclose the retention policy—"and did not address other provisions" in Section 15(a). Id. (emphasis in original). Fox held that, moving beyond the general duty to publicly disclose a retention policy, an injury in fact does arise from violations of the data-retention requirements themselves. Id. The Seventh Circuit explained that an "unlawful retention of biometric data inflicts a privacy injury in the same sense that an unlawful collection does" and therefore is "as concrete and particularized an injury" as violations of Section 15(b). Id. at 1154–55.

In this case, the Plaintiffs likewise complain about more than just the failure to publicly disclose a retention policy. Specifically, the Plaintiffs allege that CSL outright "lacks retention schedules and guidelines for permanently destroying Plaintiffs’ and the Class's biometric data." Compl. ¶ 19; see also id. ¶ 20 (alleging that the Plaintiffs "are aggrieved by Defendant's failure to destroy their biometric data when the initial purpose for collection or obtaining such data has been satisfied"). That is not a mere failure to disclose a retention policy; it is an allegation that CSL has failed to comply with the Act's requirement that a collector of biometric information develop a retention policy. Fox says that a violation of that sort satisfies the injury in fact needed for Article III standing. 980 F.3d at 1154–56. So the Court does have subject matter jurisdiction over the Section 15(a) retention-policy claims. The motion to remand is denied in full.

B. Motion to Dismiss

Turning next to the motion to dismiss, CSL advances five arguments in favor of dismissal: (1) the Act excludes information collected in a healthcare setting, which the plasma-donation facility supposedly was; (2) the claims are preempted by federal law; (3) the Complaint fails to plead recklessness or intent; (4) the Plaintiffs failed to sufficiently allege that their biometric data was disclosed; and (5) the Act does not apply nationwide so any nationwide class allegation should be struck. The Court addresses each argument in turn.

1. Patients in a Health Care Setting

CSL first argues that its collection of biometric information fits within an exception to the Act's requirements. R. 36 at 4. Specifically, CSL relies on the exception for information collected from a "patient" in a "health care setting":

Biometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996.

740 ILCS 14/10 (emphases added). The back half of this exception—concerning information related to the federal health-privacy law known as HIPAA—is not in dispute. See Def. Reply at 4 n.3. Instead, CSL relies on the first part of the exception, that is, for "information captured from a patient in a health care setting. " 740 ILCS 14/10 (emphases added).

Unfortunately, neither the term "patient" nor "health care setting" is further defined by the Act. CSL asserts that plasma donors such as the Plaintiffs are "patients" in a "health care setting" because they must undergo an FDA-mandated medical assessment to determine their eligibility for donation. R. 36 at 4-5. The Plaintiffs argue that the plain meaning of those terms do not fit plasma donors who are paid by CSL for donating plasma. R. 40 at 2.

The Plaintiffs are right: a person who sells plasma to CSL is not a "patient" in a "health care setting." The Plaintiffs cite to the online version of the Merriam-Webster dictionary definition of the word "patient" as "an individual awaiting or under medical care or treatment" or "the recipient of any of various personal services." Available at https://merriam-webster.com/dictionary/patient (last visited November 30, 2020). Someone who sells plasma to CSL is not awaiting or receiving health care from CSL; the only thing that CSL is providing to the seller is money. Indeed, CSL does not refute the Plaintiffs’ reliance on that particular dictionary, but adds that the secondary definition is simply "one that is acted upon." Id. There is a reason why secondary definitions are secondary. The contextual example provided for that secondary definition is a sentence fragment: "are agents as well as patients and observers in the world." Id. This phrase is attributed to philosopher C.H. Whiteley, id. , and is drawn from, as far as the Court can tell, Whiteley's 1950 book, Introduction to Metaphysics. It almost goes without saying that the expansive secondary definition cited by CSL is a far, far cry from the plain meaning of the word "patient" when used in the context of a "health care setting." Instead, the Plaintiffs have the better of the argument: a person who sells plasma to CSL is not a "patient" in a "health care setting."

Against this, CSL relies on Vo v. VSP Retail Dev. Holding, Inc. , 2020 WL 1445605, at *2-3 (N.D. Ill. Mar. 25, 2020). But the seller-CSL relationship here is quite unlike the relationship in Vo. In that case, an eyewear company captured and used facial-geometry information of its customers to help fit eyewear to the customers’ faces. Id. at *2. Not surprisingly, Vo held that the biometric information was "captured from a patient in a health care setting" because the eyewear company used the information to provide customers with the medical service of fitting eyewear to their faces. Id. at *2. Vo also reasoned that even the fitting of non-prescription eyewear involves "offering a service or procedure that affects the body—namely vision." Id. In contrast, as explained earlier, here the plasma donor sells plasma to CSL and receives only money in return, not any kind of health service. Vo is not on point. More importantly, the plain meaning of the patient-health care setting exception does not cover the seller-CSL relationship. The exception does not apply.

2. Preemption

CSL next argues that both field preemption and conflict preemption bar the Plaintiffs’ claims. Turning first to field preemption, CSL argues that federal regulation—in particular FDA regulation—on plasma donation cover subjects like "donor informed consent, screening, eligibility, suitability, confidentiality, recordkeeping, and storage" so thoroughly that "there is no room for state law to supplement the regulation." R. 36 at 8, 10. The Plaintiffs disagree and point out that "nothing in the law's text or history suggests an intent to regulate everything plasma buyers do, to the exclusion of the States." R. 40 at 12. This Court agrees with Plaintiffs.

"The touchstone of preemption analysis is the intent of Congress." Costello v. BeavEx, Inc. , 810 F.3d 1045, 1050 (7th Cir. 2016). Given the broad authority of States to enact laws, field preemption is "rare" and limited to "when federal law occupies a field of regulation so comprehensively that it has left no room for supplementary state legislation." Nelson v. Great Lakes Educ. Loan Servs., Inc. , 928 F.3d 639, 651-52 (7th Cir. 2019) (cleaned up). So federal courts must analyze congressional intent "through a lens that presumes that [ ] state law has not been preempted." Patriotic Veterans, Inc. v. Indiana , 736 F.3d 1041, 1046 (7th Cir. 2013). Here there is no suggestion that either Congress or the FDA intended so thoroughly to occupy the field of plasma donation that it meant to preempt state law even on the biometric privacy of donors. To the contrary, the Supreme Court has pointed out that, in the plasma-donation industry, the FDA "did not intend its regulations to be exclusive." Hillsborough County, Fla. v. Automated Medical Laboratories, Inc. , 471 U.S. 707, 714, 105 S.Ct. 2371, 85 L.Ed.2d 714 (1985) (citing the FDA's 1973 explanatory statement that "[t]hese regulations are not intended to usurp the powers of State or local authorities to regulate plasmapheresis procedures in their localities," 38 Fed. Reg. 19365 (1973) ). The FDA's statement "is dispositive on the question of implicit intent to pre-empt unless either the agency's position is inconsistent with clearly expressed congressional intent ... or subsequent developments reveal a change in that position." Id. at 714-15, 105 S.Ct. 2371. CSL has offered neither clearly expressed congressional intent nor any development that has undermined the FDA's statement. There simply is no textual anchor in any statute or regulation that suggests Congress has occupied the entire field of the plasma-donation industry.

The other form of preemption is conflict preemption. This form of preemption applies when federal and state law so directly conflict that it would be "impossible" for a person or organization simultaneously to comply with both. Mason v. SmithKline Beecham Corp. , 596 F.3d 387, 390 (7th Cir. 2010). Here again CSL offers no statute or regulation that it cannot comply with at the same time it complies with the Biometric Information Privacy Act. The federal Food, Drug, and Cosmetic Act (FDCA), 21 U.S.C. § 301 et seq. , does not require plasma-donation centers to collect or use biometric data. To the extent that the federal law requires screening procedures for identity, the FDCA does not specify a sole means of proof of identity. 80 Fed. Reg. 29,869 (May 22, 2015) ("[W]e have not specified the means of establishing proof. We believe that photographic identification, a valid driver's license, validated biometric means, or other means can be useful in establishing the donor's identity."). Nothing in federal law or regulation prevents CSL from obeying BIPA while complying with federal law. Conflict preemption, then, does not apply.

3. Recklessness or Intent

Moving on to narrower arguments, CSL contends that the Complaint does not adequately plead that the company acted recklessly or intentionally in violating BIPA. This state-of-mind requirement matters because Section 20 of the Act quintuples the statutory damages award when a biometric-information collector acts with recklessness or intent. For negligent violations, a prevailing plaintiff may recover "for each violation" "liquidated damages of $1,000 or actual damages, whichever is greater." 740 ILCS 14/20(1). For reckless or intentional violations, the plaintiff may recover actual damages or liquidated damages of $5,000 (instead of $1,000) per violation. 740 ILCS 14/20(2).

Arguably, there is no absolute requirement that a plaintiff plead the culpable state of mind—whether negligence, recklessness, or intent—in order to adequately allege a violation of the Act. Injunctive relief, for example, might very well be available even absent negligence: Section 20(4) authorizes "other relief, including an injunction, as the State or federal court may deem appropriate." 740 ILCS 20(4). The culpable states of mind appear in the monetary -relief provisions of Section 20. "While BIPA subjects defendants to a damage remedy only if there is negligence, recklessness, or willfulness, the cases have split as to whether a defendant's mental state is a pleading requirement." Figueroa v. Kronos Inc. , 454 F. Supp. 3d 772, 786 (N.D. Ill 2020).

In this case, there is no need to decide the issue, because the Plaintiffs have pleaded enough on recklessness or intent. Remember that Rule 12(b)(6) dismissal motions must be evaluated by assuming the factual allegations to be true and by giving reasonable inferences to the Plaintiffs. On top of that, the pleading standard is just plausibility. Here, the Act was enacted by the Illinois General Assembly in 2008. CSL allegedly captured and used the Plaintiffs’ biometric information in or around 2019. More than a decade after the Act's passage, CSL still violated the Act, despite its stature as a multi-facility corporation. Giving the Plaintiffs the benefit of reasonable inferences, those allegations are enough to satisfy the plausibility standard. To be sure, discovery might very well undermine the recklessness or intent allegation, and at a trial, the shoe would be on the other foot, with the Plaintiffs bearing the burden of proof. But at the pleading stage, the Plaintiffs have enough.

4. Section 15(d)

CSL also challenges the adequacy of the Complaint on the dissemination claim brought under Section 15(d) of the Act. The Plaintiffs concede that they are not advancing a claim premised on dissemination of biometric information to third parties. R. 40 at 15. So the Court grants this aspect of the motion as unopposed. The dismissal is without prejudice because the Plaintiffs have not yet amended the Complaint and discovery could reveal a basis for a dissemination claim.

5. Nationwide Class

Lastly, CSL argues that the Act does not apply to persons outside of Illinois, so "Plaintiffs’ attempt to impose the BIPA as to putative class members outside of Illinois must fail." R. 36 at 15. The Plaintiffs insist that they are "not seeking a nationwide class" and "intend to limit their class to those persons who donated in Illinois or whose biometric information was disclosed or stored in Illinois." R. 40 at 15. That is a wise concession because, under Illinois law, "a statute is without extraterritorial effect unless a clear intent in this respect appears from the express provisions of the statute." Avery v. State Farm Mut. Auto. Ins. Co. , 216 Ill.2d 100, 296 Ill.Dec. 448, 835 N.E.2d 801, 852 (2005). And because "none of BIPA's express provisions indicates that the statute was intended to have extraterritorial effect ... BIPA does not apply extraterritorially." Monroy v. Shutterfly, Inc. , 2017 WL 4099846, at *5 (N.D. Ill. Sept. 15, 2017). In any event, the proposed classes are limited to persons who enrolled in the biometric system at Illinois facilities.

IV. Conclusion

The Plaintiffs’ motion to remand and CSL's motion to dismiss are both denied, except that any Section 15(d) dissemination claim is dismissed without prejudice and there is no nationwide class allegation. With the motions resolved, the parties shall confer and submit a joint status report with a proposed discovery schedule by December 11, 2020. CSL shall answer the Complaint by December 23, 2020. The tracking status hearing of December 18, 2020 remains in place, but to track the case only (no appearance is required, the case will not be called). Instead, the Court will review the joint status report and set the schedule based on it.