Opinion
No. 20 CV 7179
04-26-2021
KAYLA QUARLES, Plaintiff, v. PRET A MANGER (USA) LIMITED, Defendant.
MEMORANDUM OPINION AND ORDER
Pret A Manger required Kayla Quarles to use a fingerprint scanner to clock in and out. Quarles filed this lawsuit, alleging that Pret violated Illinois' Biometric Information Privacy Act by collecting and storing her biometric information without issuing proper notices, obtaining written consent, or disclosing its retention and destruction policies. Like many other defendants facing BIPA class action lawsuits, Pret moved to stay this case, first because of a pending appeal in the Illinois Appellate Court about the statute of limitations (which I denied) and now because of a pending case before the Illinois Supreme Court about preemption and another pending case before the Seventh Circuit about accrual. Pret also filed a motion to dismiss, arguing that Quarles's claims are preempted, time-barred, and fail to state a claim. Based on my prediction of how the Illinois Supreme Court would rule on the preemption and statute of limitations issues, and because Quarles plausibly alleges claims under BIPA, Pret's motions to stay and dismiss are denied.
I. Legal Standard
To survive a motion to dismiss for failure to state a claim, a complaint must contain a short and plain statement that plausibly suggests the violation of a legal right. Fed. R. Civ. P. 8(a)(2), 12(b)(6); Bell Atl. Corp. v. Twombly, 550 U.S. 544, 556-58 (2007); Ashcroft v. Iqbal, 556 U.S. 662, 677-78 (2009). I accept the plaintiff's factual allegations as true and draw all reasonable inferences in her favor. Iqbal at 678-79. I do not accept allegations that are unsupported, conclusory, or legal conclusions. Id. At the pleading stage, a claim will not be dismissed based on an affirmative defense unless the plaintiff pleads herself out of court, which means that the allegations in the plaintiff's complaint affirmatively establish all the elements of the defendant's affirmative defense. Chicago Bldg. Design, P.C. v. Mongolian House, Inc., 770 F.3d 610, 613-14 (7th Cir. 2014) ("complaints need not anticipate and attempt to plead around defenses") (citation omitted).
Federal courts have the inherent power to stay proceedings to prevent the court or litigants from wasting time, effort, or resources. Landis v. North American Co., 299 U.S. 248, 254 (1936). When deciding whether to stay a case, "courts consider the merits of the moving party's case, whether the moving party will suffer irreparable harm without a stay, whether a stay will injure other parties interested in the proceeding, and the public interest." Venckiene v. United States, 929 F.3d 843, 853 (7th Cir. 2019) (citing Nken v. Holder, 556 U.S. 418, 428 (2009) and Hilton v. Braunskill, 481 U.S. 770, 776 (1987)). "The standard calls for equitable balancing." Id.
II. Facts
Kayla Quarles worked for Pret A Manger from approximately April 2018 to January 2019. [1-1] ¶¶ 10, 24, 27, 29. For timekeeping and security purposes, the company required Quarles to clock in and out using a fingerprint scanner. [1-1] ¶¶ 9-10, 28-29, 31. The machine compared her fingerprint scans to the ones the company had on file, which Quarles had provided during the onboarding process. [1-1] ¶¶ 24, 30. Pret did not inform Quarles in writing about the company's biometric collection and storage practices or of their purpose and duration. [1-1] ¶¶ 24-25, 28-29. Quarles never consented to Pret's use of her fingerprints and never provided the company with a written release to collect, store, or use her unique biometric information. [1-1] ¶¶ 32-33. During and after Quarles's employment, Pret did not have (or provide) a publicly available retention schedule or destruction policy for biometric identifiers and information and failed to adhere to a retention schedule and delete biometric information. [1-1] ¶¶ 26, 36, 45-46, 50-51. Quarles alleges she "has no reason to believe" that Pret destroyed her biometric information after her employment ended and that there is a significant risk that Pret gave her biometric information to a third-party if Pret used an outside payroll vendor. [1-1] ¶¶ 37-38, 50-51. Quarles filed this lawsuit in Illinois Circuit Court in November 2020, alleging multiple violations of Illinois' Biometric Information Privacy Act. [1-1].
Bracketed numbers refer to entries on the district court docket. Referenced page numbers are from the CM/ECF header placed at the top of filings.
Pret removed the case to federal court, [1], and filed a motion to dismiss, [12], and a motion to stay proceedings based on a case pending before the Illinois Appellate Court that will address whether a one- or five-year statute of limitations applies to BIPA claims. [9]. I denied the motion to stay. [10]. Pret filed an amended motion to dismiss, [22], along with a second motion to stay, [20], this time based on a case pending before the Illinois Supreme Court that will address whether the exclusive remedy provision of the Illinois Workers Compensation Act bars BIPA claims, and a case pending before the Seventh Circuit that will address whether a BIPA violation accrues when the first violation occurs or each time a violation occurs.
III. Analysis
Biometrics "are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions." 740 ILCS § 14/5(c). Due to the growing use of biometrics in business and security, the Illinois legislature enacted BIPA to regulate the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information. 740 ILCS § 14/5(a), (g). Under BIPA, a private entity that obtains a person's biometric identifier or information has to inform the subject in writing that her biometrics are being collected or stored and disclose the specific purpose and length of term of the collection, storage, and usage; the private entity must also receive a written release executed by the subject. 740 ILCS § 14/15(b)(1)-(3). Additionally, private entities must develop a publicly available written policy that establishes the company's retention schedule and guidelines for permanently destroying biometric identifiers and information. 740 ILCS § 14/15(a). The Act requires entities to comply with their retention schedules and destruction guidelines. Id.
A federal court sitting in diversity applies state substantive law. Horne v. Electric Eel Manufacturing Company, Inc., 987 F.3d 704, 713 (7th Cir. 2021). The parties do not dispute that Illinois law applies.
Quarles claims that Pret never informed her about its biometric practices or obtained her written consent in violation of Section 15(b) and unlawfully retained her biometric information in violation of Section 15(a). [1-1] ¶¶ 44-52, 53-62. Pret moves to dismiss based on two affirmative defenses (preemption and the statute of limitations) and Quarles's failure to state a claim. In the alternative, Pret seeks to stay the case until the Illinois Supreme Court resolves the issue of preemption and the Seventh Circuit rules on the issue of accrual.
A. Preemption
Pret asserts that the Illinois Workers' Compensation Act preempts BIPA, an argument I rejected in another case. See Wordlaw v. Enterprise Leasing Company of Chicago, LLC, No. 20-CV-03200, 2020 WL 7490414, at *2 (N.D.Ill. 2020). Under the Illinois Supreme Court's longstanding test, the IWCA is the exclusive remedy for employees to recover against employers for work-related injuries, unless the injury 1) was not accidental; 2) did not arise from her employment; 3) was not received during the course of employment; or 4) was not compensable under the statute. Collier v. Wagner Castings Co., 81 Ill.2d 229, 237 (1980). Pret's focus on the IWCA's exclusivity provisions elides the Illinois Supreme Court's exceptions, which apply to Quarles. The BIPA violations she alleges were no accident. See Garland v. Morgan Stanley & Co., Inc., 2013 IL App (1st) 112121, ¶ 29 ("to show that an injury is not accidental, the employee must establish that [her employer] acted deliberately and with specific intent to injure the employee"). Pret intentionally collected Quarles's fingerprints using a biometric timekeeping system, well after the 2008 enactment of BIPA. [1-1] ¶¶ 9-10, 24, 28-31. These allegations are sufficient to establish specific intent. See Wordlaw, 2020 WL 7490414, at *2; Burlinski v. Top Golf USA Inc., No. 19-CV-06700, 2020 WL 5253150, at *5 (N.D.Ill. 2020). Whether an injury is compensable under the IWCA is not solely determined by whether the injury arose out of the plaintiff's employment, as Pret suggests. Rather, compensability depends on whether the injury is "the type of injury [that] categorically fits within the purview of the [IWCA]." Folta v. Ferro Engineering, 2015 IL 118070, ¶ 23. BIPA injuries are not the kind of intangible injuries compensable under the IWCA. See Wordlaw, 2020 WL 7490414, at *3 (citing McDonald v. Symphony Bronzeville Park LLC, 2020 IL App (1st) 192398, ¶¶ 27-28 and Cothron v. White Castle System, Inc., 467 F.Supp.3d 604, 615-16 (N.D. Ill. 2020)); see also Treadwell v. Power Solutions International, Inc., 427 F.Supp.3d 984, 992-93 (N.D.Ill. 2019). Moreover, "courts have unanimously rejected" the idea that IWCA preempts BIPA claims. See Wordlaw, 2020 WL 7490414, at *3 (quoting Cothron, 467 F.Supp.3d at 615-16 (collecting federal and state cases)). This conclusion allows both statutes to be construed in harmony. Pret's interpretation (which limits BIPA to a source of injunctive relief for employees suing employers) would render BIPA's statutory damages inoperative for a subset of plaintiffs (employees suing employers). Quarles has not pled herself out of court on preemption grounds. See Baylay v. Etihad Airways P.J.S.C., 881 F.3d 1032, 1039 (7th Cir. 2018) (preemption under the IWCA is an affirmative defense).
Because I conclude that BIPA is not preempted, the parties' specific arguments about whether Quarles's Section 15(a) allegations fall outside the scope of IWCA are immaterial.
Alternatively, Pret seeks a stay because the Illinois Supreme Court is set to resolve the question of preemption when it reviews McDonald, the Illinois appellate court decision cited above. See McDonald v. Symphony Bronzeville Park, LLC, No. 126511 (Ill.). The decision will be binding on this court. However, "[w]here the Illinois Supreme Court has not ruled on an issue, decisions of the Illinois Appellate Courts control, unless there are persuasive indications that the Illinois Supreme Court would decide the issue differently." Nationwide Agribusiness Ins. Co. v. Dugan, 810 F.3d 446, 450 (7th Cir. 2015); see also ADT Security Services, Inc. v. Lisle-Woodridge Fire Protection Dist., 672 F.3d 492, 498 (7th Cir. 2012) (in the absence of guidance from the state's highest court, a federal court must predict how the Illinois Supreme Court would rule on the issue). Here, one Illinois Appellate Court held that the exclusivity provision of IWCA doesn't bar a BIPA claim, McDonald, 2020 IL App (1st) 192398, ¶ 27, and the decision to take the case for review is not a compelling sign that it will be reversed. But if the Illinois Supreme Court does overturn the decision, Pret will suffer some harm by being subjected to this litigation. Predictions can be wrong, but I predict that the Illinois Supreme Court will follow its established test for accidental and compensable injuries and not carve up BIPA into a partially preempted statute. Quarles also has an interest in pursuing a statutory violation provided by the Illinois legislature. Because Pret is unlikely to succeed on the merits of its preemption argument, a stay pending McDonald is not warranted. See Hilton, 481 U.S. at 776 (explaining that stronger showings on some stay factors can offset weaker showings on others).
B. Statute of Limitations
BIPA does not contain a limitations period. Like many BIPA defendants, Pret argues that Quarles's claims are time-barred by a one- or two-year statute of limitations, while Quarles, like many BIPA plaintiffs, argues that the five-year catchall statute of limitations applies. Under Illinois law, the applicable statute of limitations depends on the nature of the injury, not the form of the action. Armstrong v. Guigler, 174 Ill.2d 281, 286 (1996). The inquiry examines the legal duty allegedly breached. Id. at 289. Limitations periods must also be construed in accordance with their objectives and purposes. Barragan v. Casco Design Corp., 216 Ill.2d 435, 449 (2005). When two statutes of limitations arguably apply, the one more specifically related to the cause of action takes precedence. Hernon v. E.W. Corrigan Const. Co., 149 Ill.2d 190, 196 (1992). In the absence of binding precedent, I must predict how the Illinois Supreme Court would rule on which limitations period applies. See ADT Security Services, Inc., 672 F.3d at 498.
"A federal court sitting in diversity must follow the statute of limitations that the state in which it is sitting would use." Thomas v. Guardsmark, Inc., 381 F.3d 701, 707 (7th Cir. 2004) (citing Guaranty Trust Co. v. York, 326 U.S. 99, 110 (1945)). Under Illinois law, statutes of limitations are procedural questions governed by the law of the forum. Id. (citing Belleville Toyota, Inc. v. Toyota Motor Sales, U.S.A., Inc., 199 Ill.2d 325, 351-52 (2002)). Illinois law governs the statute of limitations issue.
A one-year statute of limitations applies to claims based on the "publication of matter violating the right of privacy." 735 ILCS § 5/13-201. BIPA does concern an individual's right "to privacy in and control over their biometric identifiers and information." Rosenbach v. Six Flags Entertainment Corporation, 2019 IL 123186, ¶ 33. Section 15(d) protects individuals from the improper disclosure or dissemination of their biometric information. 740 ILCS § 14/15(d). However, construing the statute as a whole, BIPA protects individuals from a variety of injuries, not just injuries based on the publication of private information. See Rosenbach, 2019 IL 123186, ¶ 33 (BIPA imposes legal duties regarding the collection, retention, disclosure, and destruction of a person's biometric information).
While the one-year statute of limitations may apply to a subset of BIPA claims—like the ones in Section 15(d)—it does not apply to the ones here. Quarles alleges that Pret collected and stored her biometric information without notifying Quarles about the company's policies or obtaining her written consent. [1-1] ¶¶ 24-25, 28-29, 32-33. This amounts to an "informational injury" under Section 15(b). See Bryant v. Compass Group USA, Inc., 958 F.3d 617, 623, 626 (7th Cir. 2020) ("the informed-consent regime laid out in section 15(b) is the heart of BIPA. The text of the statute demonstrates that its purpose is to ensure that consumers understand, before providing their biometric data, how that information will be used, who will have access to it, and for how long it will be retained."). Thus, the legal duty Quarles alleges Pret breached does not involve the publication of her private information. Furthermore, Quarles does not plausibly allege that her biometric information was ever shared, published, or disclosed in any way—she admits that her case does not involve a disclosure claim. [23] at 9. Because the nature of Pret's liability is a breach of BIPA's informational requirements, and not the publication of private information, Illinois's one-year statute of limitations does not apply.
Consequently, for purposes of the analysis, it does not matter how broadly or narrowly the word "publication" is interpreted under Illinois law.
Pret argues that privacy claims subject to the one-year statute of limitations all involve the unlawful publication of personal information—regardless of whether "publication" is an element of the legal claim. [22] at 9. But not all BIPA claims involve publication (whether as a required element or closely related factual circumstance). Some BIPA violations, like the informed-consent violation here, have nothing to do with the unlawful publication of private information. And Pret doesn't argue that the one-year limitations period should apply to claims that don't involve "publication" (formally or informally).
Next Pret argues that Quarles's alleged BIPA injuries are analogous to mental anguish injuries and therefore subject to Illinois's two-year statute of limitations for personal injury actions. 735 ILCS § 5/13-202; see Feltmeier v. Feltmeier, 207 Ill.2d 263, 278 (2003) (personal injuries include emotional distress). But this characterization is too simplistic. While some BIPA claimants may suffer mental harm, the intangible, non-physical injuries under BIPA go beyond emotional distress—they encompass economic harm, privacy harm, and informational harm. See Bryant, 958 F.3d at 624-26 (describing BIPA injuries as the inability to obtain information or make informed choices, the risk of identity theft, and financial harm); see also Rosenbach, 2019 IL 123186, ¶¶ 33-35. Here, by claiming that Pret violated BIPA's informed-consent regime, the harm Quarles alleges concerns her inability to control information. See Bryant, 958 F.3d at 621 ("A key part of the right to control biometric information is 'the power to say no by withholding consent.'") (quoting Rosenbach, 2019 IL 123186, ¶ 34). This decision-making harm is not analogous to mental anguish, nor does it fit neatly into a traditional tort or contract theory that forms the basis of personal injury claims. Cf. Hecny Transp., Inc. v. Chu, 430 F.3d 402, 405 (7th Cir. 2005) (allegations based on the misuse of information—excluding trade secrets—may amount to a claim in theft, fraud, or breach of the duty of loyalty). Moreover, Quarles doesn't even allege emotional anguish in her complaint. Because Quarles alleges an informational injury and not a physical or mental one, the two-year statute of limitations does not apply.
This misalignment makes sense, since BIPA was enacted because existing state and common law remedies failed to adequately protect individuals from new safety and security issues arising from the increased use of biometric information. See 740 ILCS § 14/5; Rosenbach v. Six Flags Entertainment Corporation, 2019 IL 123186, ¶¶ 33, 37 (BIPA created new statutory rights).
I also predict that the Illinois Supreme Court would hold that BIPA is a remedial statute, so the two-year limitations period for penal statutes, 735 ILCS § 5/13-202, would not apply. See Standard Mut. Ins. Co. v. Lay, 2013 IL 114617, ¶¶ 30-31. ("[A] statute is penal if it (1) imposes automatic liability for a violation of its terms; (2) sets forth a predetermined amount of damages; and (3) imposes damages without regard to the actual damages suffered by the plaintiff ... [a remedial statute is] designed to grant remedies for the protection of rights, introduce regulation conductive to the public good, or cure public evils.") (citations omitted). BIPA allows plaintiffs to recover actual damages, 740 ILCS § 14/20, and the Illinois Supreme Court described BIPA as a statute that had "preventative and deterrent," not punitive, purposes. Rosenbach 2019 IL 123186, ¶ 37 (the act safeguards biometric identifiers and information, and by doing so, advances the public welfare, security, and safety).
Neither the one- nor two-year statute of limitations specifically relate to Quarles's cause of action. Illinois provides a default limitations period of five years for "all civil actions not otherwise provided for." 735 ILCS § 5/13-205. This catchall-limitations period applies to causes of action that have "distinctive characteristics" and don't fall neatly into one of the specified limitation periods. Armstrong, 174 Ill.2d at 294 (default limitations period applied to breach of fiduciary duty claim because the cause of action was "an amalgamation of various aspects of legal jurisprudence," specifically principles of agency, contract, and equity). Like a fiduciary duty, the legal duties under BIPA have distinctive features (as discussed above). The default five-year limitations period therefore applies to Quarles's BIPA claims. Since she filed suit within five years of the alleged violations, her claim is timely. Pret fails to establish all the elements of its statute of limitations affirmative defense. See Burnett v. West Madison State Bank, 375 Ill. 402, 408 (1940) ("The statute of limitations is an affirmative defense and the burden of proving it rests upon the party pleading it.").
Pret previously requested a stay based on a case pending before the Illinois Appellate Court that will address whether the one-year statute of limitations applies. I denied it, noting that the controlling value of the decision will depend on its persuasiveness as a prediction of the Illinois Supreme Court's evaluation of state law and that waiting for a decision of unknown persuasiveness did more harm to Quarles's interests than the speculative efficiencies raised by Pret. [10]. Pret now seeks a stay based on a case pending before the Seventh Circuit, which raises the question of when a BIPA claim accrues. See In Re: White Castle System, Inc., No. 20-8029 (7th Cir.). The district judge stayed the case because the Seventh's Circuit decision will affect whether the plaintiff has some or no timely claims. Cothron v. White Castle System, Inc., No. 19-cv-00382 (N.D. Ill. Oct. 1, 2020), ECF No. 141. The Seventh Circuit agreed that the stay was warranted. Id., ECF No. 144. However, the reasoning for a stay in Cothron is inapplicable to this case. Quarles and Pret briefed the statute of limitations issue, and as discussed above, I predict that the Illinois Supreme Court would apply the five-year limitations period. Based on this analysis, all of Quarles's claims are timely, regardless of how the Seventh Circuit rules on the accrual issue. A stay is not warranted at this early juncture. However, like the Illinois Supreme Court case about preemption, the Seventh Circuit's decision about accrual will be binding on this court and will likely affect the scope of discovery and potential remedy. As briefing and argument gets scheduled in all of these cases, including the intermediary Illinois appellate cases, it may make sense to revisit the stay issue to keep costs down.
This same logic applies to a second case pending before the Illinois Appellate Court that will address whether the two-year personal injury statute of limitations applies.
C. Merits
Quarles states a claim under BIPA. She plausibly alleges the details of an informed-consent violation under Section 15(b): she provided her fingerprints during the onboarding process; she placed her fingers on a scanner, which compared the scan to a stored digital copy of her fingerprints; she never received written information about Pret's collection, storage, and use practices; and she never executed a written release. [1-1] ¶¶ 27-34. Quarles's allegation that Pret did not provide her with a retention schedule or destruction guidelines does not allege a violation of Section 15(a), because the statute does not require individual disclosure, but Quarles nevertheless plausibly alleges a violation under that section when she alleges that Pret "did not have written, publicly available policies identifying its retention schedules or guidelines for permanently destroying biometric identifiers and/or biometric information." [1-1] ¶ 26. She also alleges that Pret "failed to comply with" the retention schedule and destruction guidelines. [1-1] ¶ 46. Consequently, Pret's motion to dismiss for failure to state a claim under 12(b)(6) fails. I note, however, that Quarles's allegations of individualized harm are razor thin. Compare Bryant, 958 F.3d at 626 (violation of requirement to have publicly available retention policy is not a particularized injury), with Fox v. Dakkota Integrated Systems, LLC, 980 F.3d 1146, 1154 (7th Cir. 2020) (failure to comply with data-retention schedule is a concrete and particularized harm). Some of Quarles's allegations of personal harm amount to an uncertain guess. See [1-1] ¶¶ 37, 51 ("Plaintiff has no reason to believe" her information was destroyed). Similarly, Quarles fails to allege her biometric information was shared. See [1-1] ¶ 38 ("to the extent Defendant uses an outside vendor to process its payroll, there is a significant risk ..."). But Quarles squeaks by with her allegation that Pret failed to comply with BIPA-mandated retention schedules and destruction guidelines, along with the reasonable inference that a timekeeping system depends on some retention of biometric information.
IV. Conclusion
Pret's motion to stay, [20], and motion to dismiss, [22], are denied. Pret's answer to the complaint is due May 17, 2021. The parties shall file a joint status report with a proposal for a discovery schedule by May 24, 2021. ENTER:
/s/_________
Manish S. Shah
United States District Judge Date: April 26, 2021