Summary
holding that the plaintiff lacked standing because the defendant "did nothing with Plaintiff's data about which she was not aware" and the plaintiff did "not allege that Defendant shared her biometric information with third parties or created an immediate risk that such data would fall into the hands of third parties"
Summary of this case from Figueroa v. Kronos Inc.Opinion
No. 19 C 6622
2020-01-28
Christine BRYANT, on behalf of herself and all other persons similarly situated, known and unknown, Plaintiff, v. COMPASS GROUP USA, INC., Defendant.
Douglas M. Werman, Maureen Ann Salas, Zachary Cole Flowerree, Werman Salas P.C., Chicago, IL, for Plaintiff. Joseph Clark Wylie, II, Kenn Brotman, Molly K. McGinley, K & L Gates LLP, Chicago, IL, Paul W. Sweeney, Jr., Pro Hac Vice, K & L Gates LLP, Los Angeles, CA, for Defendant.
Douglas M. Werman, Maureen Ann Salas, Zachary Cole Flowerree, Werman Salas P.C., Chicago, IL, for Plaintiff.
Joseph Clark Wylie, II, Kenn Brotman, Molly K. McGinley, K & L Gates LLP, Chicago, IL, Paul W. Sweeney, Jr., Pro Hac Vice, K & L Gates LLP, Los Angeles, CA, for Defendant.
Virginia M. Kendall, United States District Judge. MEMORANDUM ORDER AND OPINION
Before the Court is Plaintiff's motion to remand (Dkt. 16) this case to the Circuit Court of Cook County for lack of Article III standing. For the reasons set forth below, Plaintiff's motion to remand (Dkt. 16) is granted.
BACKGROUND
Plaintiff Christine Bryant filed this putative class action in the Chancery Division of Cook County Circuit Court on August 23, 2019. In her complaint (Dkt. 1-1), Plaintiff alleges that Defendant Compass Group USA, Inc. violated Plaintiff's statutory rights under two sections of the Illinois Biometric Information Privacy Act ("BIPA") when Defendant required her to provide a fingerprint scan prior to purchasing items from Defendant's vending machine. Plaintiff first alleges that Defendant violated § 15(b) of BIPA by collecting Plaintiff's biometric data at one of Defendant's SmartMarket vending machines without obtaining Plaintiff's written consent. (Id. at ¶¶ 40–47.) Plaintiff alleges that this fingerprint collection also violated § 15(a) of BIPA because Defendant obtained Plaintiff's fingerprint without establishing a written retention schedule and destruction guidelines for possession of biometric data. (Id. at ¶¶ 48–54.) Plaintiff does not allege that Defendant collected Plaintiff's biometric data without Plaintiff's knowledge, shared Plaintiff's data with any third party, or created a risk that Plaintiff's data would fall into the hands of an unauthorized third party.
The relevant statute—740 ILCS 14/15 —reads as follows:
(a) A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information....
(b) No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information, unless it first:
(1) informs the subject or the subject's legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored;
(2) informs the subject or the subject's legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and (3) receives a written release executed by the subject of the biometric identifier or biometric information or the subject's legally authorized representative.
On October 4, 2019, Defendant filed a notice of removal in this Court. Plaintiff subsequently filed a motion for remand (Dkt. 16), claiming that she lacks standing because she has not alleged an injury-in-fact as required by Article III standing requirements. Defendant opposes remand, arguing that Plaintiff has alleged an injury-in-fact such that Plaintiff has standing to bring this claim in federal court.
LEGAL STANDARD
Defendant bears the burden in this case of establishing that this Court has jurisdiction. See Tri-State Water Treatment, Inc. v. Bauer , 845 F.3d 350, 352–53 (7th Cir. 2017) (explaining that "the party seeking removal...bears the burden of establishing federal jurisdiction"). Article III standing is a component of the jurisdictional analysis. See Collier v. SP Plus Corp. , 889 F.3d 894, 896 (7th Cir. 2018) ("As the party invoking federal jurisdiction, [Defendant] had to establish that all elements of jurisdiction—including Article III standing—existed at the time of removal."). For Defendant to establish that Plaintiff has Article III standing, Defendant must demonstrate that Plaintiff alleges an injury-in-fact that was caused by Defendant and that is redressable by this Court. See Groshek v. Time Warner Cable, Inc. , 865 F.3d 884, 886 (7th Cir. 2017) (quoting Lujan v. Defenders of Wildlife , 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) ) ("The ‘irreducible constitutional minimum of standing’ consists of three elements: injury-in-fact, causation, and redressability.").
For an injury to qualify as an injury-in-fact, it must be "concrete and particularized" and "actual and imminent, not conjectural or hypothetical." Spokeo, Inc. v. Robbins , ––– U.S. ––––, 136 S. Ct. 1540, 1548, 194 L.Ed.2d 635 (2016). For an injury to be concrete, it "must be " ‘de facto ’; that is, it must actually exist." Id. at 1548 (quoting Black's Law Dictionary 479 (9th ed. 2009). A "bare procedural violation, divorced from any concrete harm" does not qualify as an injury-in-fact. Id. at 1549. However, a procedural statutory violation may constitute an injury-in-fact on its own if the legislature has elevated a de facto injury that was "previously inadequate in law" "to the status of [a] legally cognizable injur[y]." Lujan , 504 U.S. at 578, 112 S.Ct. 2130. Nonetheless, a statutory violation only causes an injury that is concrete for Article III standing purposes if it presents an " ‘appreciable risk of harm’ to the underlying concrete interest that [the legislature] sought to protect by enacting the statute." Groshek , 865 F.3d at 887 (quoting Meyers v. Nicolet Rest. of De Pere, LLC , 843 F.3d 724 (7th Cir. 2016).
For an injury to be particularized, it must affect the plaintiff " ‘in a personal and individual way.’ " Matushkina v. Nielsen , 877 F.3d 289, 293 (7th Cir. 2017) (quoting Lujan , 504 U.S. at 560 n.1, 112 S.Ct. 2130 ). In this case, the parties do not dispute that Plaintiff alleges injuries that are particularized to her. The parties sole dispute for purposes of this motion is whether Plaintiff alleges a concrete injury.
ANALYSIS
The question before the Court is whether procedural violations of sections 15(a) and 15(b)—without any allegation of harm stemming from the violations or any distribution of biometric data to third parties—can constitute concrete injuries for Article III standing purposes. The Seventh Circuit addressed an analogous question in Miller v. Southwest Airlines Co. , 926 F.3d 898 (7th Cir. 2019). In that case, union airline workers alleged that their employers required them to use fingerprint identification without following the procedures laid out in sections 15(a) and 15(b) of BIPA. The union workers further alleged that these violations caused them concrete harms or increased the likelihood that they might suffer such harms. Specifically, the workers alleged that their employers may have shared their fingerprint data with outside administrators, which created a "greater risk of disclosure" to "criminals who hack into a computer system." Miller , 926 F.3d at 902. The workers also alleged that had they not consented to the fingerprint identification, they faced the "prospect of a material change in [the] terms and conditions of [their] employment. Id. These allegations of material harm stemming from BIPA violations gave their claims the "concrete dimension" necessary to establish Article III standing. Id.
Several courts in the Northern District of Illinois have ruled on the precise question before this Court and have uniformly held that BIPA procedural violations—without some additional action by the defendant, like surreptitious collection or disclosure to third parties—do not give rise to concrete injuries. In Colon v. Dynacast , No. 19 C 4561, 2019 WL 5536834 (N.D. Ill. 2019), Judge Chang granted a motion to remand where the plaintiff had voluntarily given her employer her fingerprint to use for authentication of her timecard entries. The employer did not surreptitiously collect the fingerprint nor did the employer share the data with any third party, but the employer did fail to obtain her written consent or create a data retention policy in violation of §§ 15(a) and 15(b). Because the plaintiff "knew that her data was being collected," however, the defendant's "failure to go through each procedural formality in BIPA did not present ‘any appreciable risk of harm to the underlying concrete interest’ in privacy, and therefore [p]laintiff has not suffered any injury in fact." Colon , 2019 WL 5536834 at *4 (quoting Groshek , 865 F.3d at 887 ). Instead, the court held that the plaintiff alleged nothing more "than a procedural violation of BIPA, which does not confer Article III standing." Id. at *4. See also McGinnis v. Cold Storage , 382 F. Supp. 3d 813, 818 (N.D. Ill. 2019) (Chang, J.) (holding that "failure to provide and obtain the statutorily required notice or consent when collecting and retaining [plaintiff's] fingerprint— without more—does not constitute a concrete injury for Article III purposes").
In Aguilar v. Rexnord LLC , No. 17 C 9019, 2018 WL 3239715 (N.D. Ill. July 3, 2018), Judge Shah held that an employer's collection of fingerprint scans for time entry purposes did not create an appreciable risk of harm to the plaintiff's privacy. While the defendant employer did appear to violate BIPA's written consent requirement, the court held that such a violation did not give rise to a concrete injury because the plaintiff knew that his employer was collecting and storing his fingerprints. Aguilar , 2018 WL 3239715, at *3. That collection alone did not give rise to an appreciable risk that the plaintiff's biometric data would be shared with third parties. Several other cases in this district have come to the same conclusion in similar circumstances. See, e.g. , Goings v. UGN, Inc. , No. 17 C 9340, 2018 WL 2966970 (N.D. Ill. June 13, 2018) (Bucklo, J.) (granting motion to remand where plaintiff knew he provided his biometric data to his employer and where there was no allegation of third party disclosure); Howe v. Speedway, LLC , No. 17 C 7303, 2018 WL 2445541 (N.D. Ill. May 31, 2018) (Wood, J.) (finding no injury-in-fact where employer did not obtain written consent nor create a retention and destruction policy before scanning plaintiff's fingerprint but where no additional harm or third party disclosure occurred).
Despite the unanimity among courts within this district, in Patel v. Facebook , 932 F.3d 1264 (9th Cir. 2019), the Ninth Circuit Court of Appeals held that violations of § 15(a) and § 15(b) constituted concrete injuries. However, the facts of Patel are distinguishable from the instant case as well as the various other cases from this district. In Patel , the plaintiffs posted images of themselves to the Facebook platform. Facebook used those images to create user face templates. Facebook then used that template to suggest "tagging" individuals in photos when other users posted photographs that include images that matched that template. Facebook created these user face templates without users providing written consent and without creating a retention or destruction policy. In so doing, Facebook used the plaintiffs' images in ways that the plaintiffs had no reason to anticipate when they uploaded images of themselves to the Facebook platform. Using the plaintiffs' images in this fashion constituted an invasion of their "private affairs and concrete interests." Patel , 932 F.3d at 1273.
In the instant matter, Defendant, like the defendants in Colon and Aguilar , did nothing with Plaintiff's data about which she was not aware. Plaintiff understood when she allowed Defendant to scan her fingerprint that Defendant would use that scan to identify her in the future. Plaintiff, unlike the plaintiffs in Miller , does not allege that Defendant shared her biometric information with third parties or created an immediate risk that such data would fall into the hands of third parties. When the plaintiffs in Patel uploaded their images to Facebook, by contrast, they had no idea that their images would be used to create a facial-recognition template that Facebook could then use to identify them in images posted by other users. As such, the instant case is readily distinguishable from Patel . See also Colon , 2019 WL 5536834, at *4 (distinguishing Patel on the grounds that Patel involved "nonconsensual collection of biometric identifiers for facial recognition technology").
Defendant argues that the Illinois Supreme Court's recent decision in Rosenbach v. Six Flags Ent. Corp. , 432 Ill.Dec. 654, 129 N.E.3d 1197 (Ill. 2019) elevated the alleged injuries in this case to constitute more than more than mere technical statutory violations. In Rosenbach, the Illinois Supreme Court held that a plaintiff may qualify as an aggrieved party entitled to relief under BIPA even without alleging some "actual injury or damage beyond infringement of the rights afforded them under the law." Rosenbach , 432 Ill.Dec. 654, 129 N.E.3d at 1207.
This Court is obligated to follow the Illinois Supreme Court's authoritative interpretation of state law, but Defendant's reliance on Rosenbach is inapposite. That case does not establish that a procedural violation of §§ 15(a) and 15(b) constitutes an " ‘appreciable risk of harm’ to the underlying concrete interest that [the legislature] sought to protect by enacting the statute." Groshek , 865 F.3d at 887 (quoting Meyers v. Nicolet Rest. of De Pere, LLC , 843 F.3d 724 (7th Cir. 2016). Nor did Rosenbach "elevat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate at law." Lujan , 504 U.S. at 578, 112 S.Ct. 2130. Instead, Rosenbach establishes that it is the policy of the Illinois courts to allow parties to sue under BIPA even if they cannot demonstrate that "they have sustained some compensable injury beyond violation of their statutory rights before they may seek recourse." Rosenbach , 432 Ill.Dec. 654, 129 N.E.3d at 1207. Put differently, it is the State's policy that "an individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under the Act, in order to qualify as an ‘aggrieved’ person" entitled to relief. Id. But it is the policy of the federal courts, by contrast, that a plaintiff must allege an "actual or imminent" injury in order to establish Article III standing. Spokeo , 136 S. Ct. at 1548. Had the Illinois Supreme Court instead characterized violations of §§ 15(a) and (b) as "actual injuries," then this Court would be obliged to construe the procedural violations alleged in the instant case accordingly. However, the Illinois Supreme Court explicitly indicated that BIPA procedural violations are not themselves actual injuries. Because the authoritative interpreter of Illinois law has dictated that procedural violations of §§ 15(a) and (b) are not "actual injuries," Plaintiff has not alleged an injury with a "concrete dimension" as required by Miller . Plaintiff— like several plaintiffs who have alleged similar claims before other courts in this district—thus lacks standing to pursue her claims in this Court.
CONCLUSION
For the reasons set forth above, Defendant has failed to establish that Plaintiff has Article III standing. Plaintiff's motion to remand (Dkt. 16) to the Circuit Court of Cook County is therefore granted. The Clerk of Court is directed to remand the case to the Circuit Court of Cook County forthwith.