Opinion
1:19-CV-01374
09-29-2024
CHRISTOPHER HOWE, individually and on behalf of all others similarly situated, Plaintiff, v. SPEEDWAY LLC, Defendant.
MEMORANDUM OPINION AND ORDER
Honorable Edmond E. Chang, United States District Judge.
Christopher Howe brings a proposed class action against Speedway LLC, alleging that Speedway's use of finger-scanning timeclocks violated Illinois's Biometric Information Privacy Act (commonly referred to as “BIPA”), 740 ILCS 14/1 et seq. R. 11, Compl. Speedway filed two motions for summary judgment and a motion to exclude the testimony of Howe's expert, Christopher Daft. R. 59, Def.'s Mot.; R. 111, Def.'s Second Mot.; R. 115, Def.'s Mot. Exclude. Howe separately filed a motion for class certification. R. 121, Pl.'s Mot.
Citations to the record are “R.” followed by the docket entry number and, if needed, a page or paragraph number. The Court has subject matter jurisdiction under the Class Action Fairness Act. 28 U.S.C. § 1332(d). Howe is a citizen of Illinois and Speedway is a citizen of Ohio and Delaware based on the citizenship of its sole member. R. 1, Notice of Removal at 2-3. The jurisdictional requirement of $5,000,000.00 under CAFA is also met: Howe seeks up to $5,000.00 in statutory damages for each proposed class member, and Speedway had over 5,000 employees in Illinois during the relevant class period. Id. at 3.
As explained below, Speedway's motions for summary judgment are both denied, and Howe's motion for class certification is granted. Speedway's motion to exclude the testimony of Daft is granted in part: Daft is precluded from offering his opinion that Speedway collected biometric information as defined by BIPA, because that is just a legal conclusion. Daft's remaining opinions and testimony are allowed.
I. Background
Howe brings this suit against Speedway on behalf of himself and a proposed class of employees who worked for Speedway in Illinois. R. 147 (sealed), Pl.'s Resp. DSOF ¶ 1; Compl. ¶¶ 1, 9. Howe worked at Speedway between 2015 and 2017 at various locations throughout Illinois, first as a manager trainee and then as a manager. Pl.'s Resp. DSOF ¶ 3; R. 113-1, Howe Dep. at 14:4-16:23.
The facts throughout this Opinion are drawn from the parties' statements of fact filed after Speedway's second motion for summary judgment. See Def.'s Second Mot.; R. 113, DSOF; R. 147 (sealed), Pl.'s Resp. DSOF; R. 148 (sealed), PSOF; R. 150, Def.'s Resp. PSOF. For convenience, the Opinion does not specify the “second” statement of facts every time. The parties submitted some of their filings under seal. The Court cites to some sealed filings, noted in parentheticals when the documents are first introduced, but the information disclosed in this Opinion cannot be justifiably sealed under the requirements of well-established Circuit law. Baxter Int'l v. Abbott Labs., 297 F.3d 544, 546-47 (7th Cir. 2002); Union Oil v. Leavell, 220 F.3d 562, 567-68 (7th Cir. 2000).
Speedway used finger-scan timeclocks for employees like Howe to clock in and out of work each day. Pl.'s Resp. DSOF ¶ 4; R. 113-1, Jones Dep. at 47:6-16. Speedway first started using finger-scan timeclocks between 2003 and 2006 and used them in Illinois through 2018. Id. Speedway began using finger-scan timeclocks to relieve store managers from manually inputting employee hours on timesheets, and to avoid the problem of “buddy punching” (clocking in and out for someone else). R. 150, Def.'s Resp. PSOF ¶¶ 9-10; R. 113-1, Green Dep. at 45:3-23. Howe received training on the timeclocks, was enrolled on them, and used them to clock in and out each workday. Pl.'s Resp. DSOF ¶¶ 14-15; Howe Dep. at 21:9-20, 41:3-22, 55:12-60:16, 102:2-19. Howe also enrolled and trained other employees on the timeclocks. Pl.'s Resp. DSOF ¶ 17; Howe Dep. at 59:10-60:12. He also understood that each time he put his finger on a timeclock, the timeclock relied on the ridges and marks on his finger to identify him and track his hours. Pl.'s Resp. DSOF ¶ 18; Howe Dep. at 80:12-22. He also understood that the data from the timeclocks was used for employees' pay. Pl.'s Resp. DSOF ¶ 16; Howe Dep. at 57:22-59:9.
The parties dispute whether Speedway had a requirement for all Illinois employees to use the finger-scan timeclocks. Pl.'s Resp. DSOF ¶ 13; Def.'s Resp. PSOF ¶ 2. Howe contends that he and the proposed class members were required to scan their fingers on the timeclocks as a condition of employment, and that the process for enrolling employees in the timeclock was consistent across all Speedway locations. R. 148 (sealed), PSOF ¶¶ 2-3; see Howe Dep. at 41:16-22, 56:3-8, 59:15-60:16, 80:922. Speedway does not dispute that the enrollment process for the timeclocks was consistent, but does dispute that their use was required. Def.'s Resp. PSOF ¶¶ 2-3; R. 113, DSOF ¶ 13; Jones Dep. at 60:15-61:8. Speedway's Civil Rule 30(b)(6) witness, Kelli Jones, stated that employees could refuse to use the finger scanner if they did not want to, and instead could request to document their time manually. Id. Jones also conceded, however, that she did not believe there were any written documents saying that employees could request this manual option, and employees would only be aware of their option to refuse if they talked to their store manager. Jones Dep. at 61:11-16.
Speedway's timeclocks scan part of an employee's finger and then create an alphanumeric code known as a “Template.” Pl.'s Resp. DSOF ¶¶ 22-24; R 113-2, Mal-lias Dep. at 111:11-114:20; R. 113-2, Exh. 12. Speedway describes the Template as a “string of letters and numbers that describes limited prominent features of the finger ridges.” DSOF ¶ 23; see Mallias Dep. at 111:11-114:20. Each time a user clocks in or out for work, they place their finger on the timeclock, and it generates a new Template based on the scan; the timeclock then tries to match the new Template to the timeclock's stored Templates. Pl.'s Resp. DSOF ¶ 25; R. 113-2, Daft Dep. at 114:16115:12. If the new Template matches one of the stored Templates, the timeclock allows the user to clock in or out. Id.
The parties' primary dispute is whether the finger scan that is captured by the timeclocks-which is used to generate the alphanumeric Template-is properly characterized as a “fingerprint” under BIPA. Speedway claims that its timeclocks do not capture a “fingerprint,” but rather scan less than a full fingerprint, which is only a portion of the “ridges and marks on the finger.” DSOF ¶¶ 23-24, 26-29. Howe argues that the image scanned by the timeclocks is properly described as a “fingerprint” constituting biometric information covered by BIPA, even if the actual scan that the timeclocks collect captures less than the full finger. Pl.'s Resp. DSOF ¶¶ 23-24, 2629; PSOF ¶ 31. The parties do agree that the size of the scanned image is determined by the size of the scanning surface, and that the timeclocks have a scanning surface that is less than the size of an entire or “typical” fingerprint. Pl.'s Resp. DSOF ¶¶ 27- 28. So the parties agree that the Templates are created based on a partial scan of the finger. And the parties also agree that the timeclocks do not store the image of the ridges after scanning, but rather discard the image after it is converted to the alphanumeric Template. Pl.'s Resp. DSOF ¶¶ 30-32; Daft Dep. at 80:2-81:3, 109:1222, 111:8-113:1; R. 118 (sealed), Exh. 17, Minta Rep. at 16-17.
Howe points out that the size of the scanned image is not determined only by the size of the scanning surface, but also depends on the resolution of the image. Pl.'s Resp. DSOF ¶ 26. Howe also takes issue with Speedway's use of the word “typical,” noting that it calls for speculation as to the size of a “typical fingerprint” Id. ¶ 28. To decide this motion, it is enough to recognize that the parties agree that the scanned image is less than a full fingerprint.
Below is an illustration from Speedway's brief that helps visualize the above process:
(Image Omitted)
R. 125, Def.'s Second Br. at 9. The first and second images from the left illustrate that the timeclock's scanning surface does not capture a full-sized fingerprint, but only a portion of the finger that covers the actual scanning surface, which is smaller than the size of a full finger. The third image depicts the scan that is collected by the timeclock, which is a digital image of the prominent ridges in the finger. The fourth image is an example of the alphanumeric Template that is created from the finger scan and stored on the timeclock. Again, the parties dispute whether the scan that is captured by the timeclock (the third image) is a “fingerprint” within the meaning of BIPA. The parties further dispute whether the Template created from the scan (the fourth image) can be reverse engineered to reconstruct the scan that it was based on. Pl.'s Resp. DSOF ¶ 35; R. 113-2, Minta Dep. at 134:9-137:24; Def.'s Resp. PSOF ¶ 36; Daft Dep. at 217:1-218:1, 245:12-19, 246:2-7. They generally agree that all the timeclocks used by Speedway in Illinois had materially identical hardware, and operated in the same general manner outlined above and depicted in the illustration. Pl.'s Resp. DSOF ¶ 21; Daft Dep. at 110:5-116:3, 149:2-7; Minta Rep. at 21.
These images are just approximations, as the actual dimensions of the scanning surface, and how those dimensions compare to the size of a full fingerprint, are not fleshed out in the record. But as already addressed, it is undisputed that the scan is smaller than a fullsized fingerprint.
The parties dispute whether Speedway ever had a written data-retention policy in place that covered the handling of finger scans and the Templates derived from those scans. See Pl.'s Resp. DSOF ¶¶ 6-10; Jones Dep. at 72:3-73:11, 134:24-137:17; R. 113-1, Exhs. 6-9; Def.'s Resp. PSOF ¶ 19; Green Dep. at 32:23-33:2, 89:1-8; R. 694, Karlson Dep. at 44:15-20. Before November 2017, Speedway had written policies made available to employees about data retention for work schedules and timesheets, and privacy policies limiting its disclosure of employee information to certain facts, such as dates of employment and work location. See id. Speedway suggests that these policies “did not exclude, and therefore included, finger-scan information,” though Howe points out the data retention policy only lists specific included documents- work schedules and timesheets-and none of the policies mention finger scans, biometrics, or any other information collected or derived from employees' fingers. Id. Speedway first created and rolled out a BIPA-specific consent form in November 2017, though Speedway claims that it was in compliance with BIPA before that date. Def.'s Resp. PSOF ¶ 16; Jones Dep. 36:15-25, 38:10-11, 39:5-21, 45:4-10, R. 113-2, Exh. 14.
Speedway removed the case to federal court after Howe brought his lawsuit for alleged violations of BIPA in state court. Notice of Removal. The parties engaged in discovery before Speedway filed its first motion for summary judgment on August 18, 2020. Def.'s Mot. After that motion was fully briefed, fact discovery was briefly reopened and the parties engaged in expert discovery. See R. 87, Minute Entry 02/18/21. Speedway then filed a second motion for summary judgment and a motion to exclude Daft's expert testimony on October 25, 2021. Def.'s Second Mot.; Def.'s Mot. Exclude. The same day, Howe moved for class certification under Rule 23. Pl.'s Mot.
This is the second removal of the same lawsuit. After the first removal, the Court remanded the action to state court for lack of an injury supporting Article III standing. See Howe v. Speedway LLC, No. 17-CV-07303, 2018 WL 2445541 (N.D. Ill. May 31, 2018). Speedway removed the case a second time after an intervening Illinois Supreme Court decision changed the Article III injury analysis. Notice of Removal.
The Court's analysis starts with the motion to exclude Daft's expert testimony, because the second summary judgment motion raises a dispute about his testimony.
II. Motion to Exclude
A. Legal Standard
The admission of expert testimony is governed by Federal Rule of Evidence 702 as interpreted by the United States Supreme Court decision in Daubert v. Merrell Dow Pharms., Inc., 509 U.S. 579 (1993). Under Rule 702:
A witness who is qualified as an expert by knowledge, skill, experience, training, or education may testify in the form of an opinion or otherwise if the proponent demonstrates to the court that it is more likely than not that:
(a) the expert's scientific, technical, or other specialized knowledge will help the trier of fact to understand the evidence or to determine a fact in issue;
(b) the testimony is based on sufficient facts or data;
(c) the testimony is the product of reliable principles and methods; and
(d) the expert's opinion reflects a reliable application of the principles and methods to the facts of the case.Fed. R. Evid. 702. In Daubert, the Supreme Court recognized the important “gatekeeping” role of the trial court and held that Rule 702 requires the court to “ensure that any and all scientific testimony or evidence admitted is not only relevant, but reliable.” Daubert, 509 U.S. at 589, 597.
The Court cites to the current language of Rule 702 as amended in December 2023, though the parties' briefs cite to the then-applicable version of the rule. The December 2023 amendments did not change the substantive requirements or standards under Rule 702 and do not impact the analysis.
Courts in this district use a three-step analysis to determine whether expert testimony is admissible, evaluating: “(1) the proffered expert's qualifications; (2) the reliability of the expert's methodology; and (3) the relevance of the expert's testimony.” Gopalratnam v. Hewlett-Packard Co., 877 F.3d 771, 779 (7th Cir. 2017) (emphasis omitted). Expert testimony may be admitted if it “rests on a reliable foundation and is relevant to the task at hand,” but should be barred if it is based only on “subjective belief or unsupported speculation.” Daubert, 509 U.S. at 590, 597; see Trs. of Chi. Painters & Decorators Pension, Health & Welfare, & Deferred Sav. Plan Tr. Funds v. Royal Int'l Drywall & Decorating, Inc., 493 F.3d 782, 787 (7th Cir. 2007).
B. Analysis
On qualifications, Daft was educated at Oxford University, received advanced degrees in physics and materials sciences, and has spent roughly 30 years working as a physicist and engineer in various capacities, including on issues of imaging, medical devices, sensors, electronics, and signal processing. R. 145 (sealed), Pl.'s Daft Resp. at 4-5; R. 145-1 (sealed), Daft Rep., Exh. 1-A. He has worked on the development of “biosensor systems” and at least one fingerprint scanner and considers himself an expert in “biosensing” technology. Id.
Howe seeks to introduce Daft's opinions that: (1) the finger scanner on Speedway's timeclocks captures a fingerprint that is not materially different from traditional ink fingerprints; (2) the fingerprint image captured by the timeclocks is a biometric identifier under BIPA; (3) the Template created from the fingerprint scan is biometric information under BIPA; (4) the software in the timeclocks distributes Templates via local area networks and/or the internet; and (5) the fingerprints can be reconstructed from the Template data. R. 145-1 (sealed), Daft Rep. ¶¶ 15-24; R. 145-3 (sealed), Daft Rebuttal Rep. ¶¶ 5-9. Daft relied on his professional experience, education, and training, as well as his review of manuals and guides for the Speedway timeclocks to reach these conclusions. Daft Rep. ¶ 14.
Speedway argues that Daft's testimony lacks foundation because his education and work experience do not qualify him as an expert on Speedway's timeclocks and his methodology-reviewing timeclock manuals but not the devices themselves-was unsound. R. 116, Def.'s Daft Br. at 7-11. Speedway thus seeks to exclude all of Daft's testimony, including his opinion that the timeclocks capture fingerprints that are biometric identifiers under BIPA. Id. at 11. Howe responds that physical inspection of Speedway's timeclocks is not necessary in this case because the parties do not dispute what information the scanners capture as a technical matter, but rather how to classify that information-as a “fingerprint” under BIPA or not. Pl.'s Daft Resp. at 9-11.
The parties' arguments miss the mark. Whether the scanned image captured by the timeclocks ultimately constitutes a “fingerprint” protected as a biometric identifier under BIPA is not a question of fact that requires testimony from a technical expert. See, e.g., Pl,'s Daft Resp. at 6 (“Ultimately, a finder of fact will be tasked with deciding whether the ‘portions' of fingerprints Speedway admittedly collects to identify its employees meet the definitions of biometric identifiers and/or biometric information set forth by BIPA.”); Def.'s Daft Br. at 1 (“A key threshold issue in this BIPA case is whether Speedway collected or possessed a ‘fingerprint.' ... Plaintiff must rely on expert testimony to demonstrate, among other things, that the Timeclocks in fact collect a fingerprint.”); Def.'s Second Br. at 14 (“Plaintiff's case needs Dr. Daft because this case requires an expert to assess whether the Timeclocks collect a fingerprint.”). But the parties are wrong: whether the scanned image captured by the timeclocks is a “fingerprint” as used in the statutory definition of “biometric identifiers” under BIPA is a question of statutory interpretation for the Court to decide, because no underlying constituent facts are disputed.
Speedway did not explicitly raise this issue in this precise way in its opening brief but mentions it in reply, stating that Daft's testimony should be excluded for the additional reason that he “is not an expert in legal interpretation ... and questions of statutory interpretation are solely the province of the Court.” R. 151, Def.'s Daft Reply at 4.
As Howe himself points out, the parties do not have a factual dispute on what information the timeclocks collect. As explained above, they agree that the scan from the timeclocks does not capture a full image or photograph of an entire finger, but a smaller portion of it. So whether the scanned portion of ridges is a “fingerprint” under BIPA turns on the statutory meaning of the term “fingerprint” as used in the definition of “biometric identifiers” in BIPA. This statutory-interpretation question is a legal one. See, e.g., Harvey v. Resurrection Univ., 2022 WL 3716213, at *3 (N.D. Ill. Aug. 29, 2022) (“Matters of statutory interpretation are questions of law.”) (citing Gaffney v. Riverboat Servs. of Ind., Inc., 451 F.3d 424, 458 (7th Cir. 2006)).
This legal question is outside the purview of any expert witness such as Daft. See, e.g., United States v. Caputo, 517 F.3d 935, 942 (7th Cir. 2008) (affirming the exclusion of expert testimony “about the meaning of the statute and regulations” because that is “a subject for the court, not for testimonial experts” and “[t]he only legal expert in a federal courtroom is the judge”); George v. Kraft Foods Global, Inc., 800 F.Supp.2d 928, 932 (N.D. Ill. 2011) (“Put simply, expert opinions that seek to define the meaning of statutes are disallowed under the Federal Rules of Evidence.”). Daft cannot offer a legal conclusion about the terms “biometric identifiers” and “biometric information” as they are used in BIPA. See id.; Scottsdale Ins. Co. v. City of Waukegan, 689 F.Supp.2d 1018, 1022 (N.D. Ill. 2010); Good Shepherd Manor Found. v. City of Momence, 323 F.3d 557, 564 (7th Cir. 2003). Daft's opinion that Speedway's timeclocks collect a “fingerprint” constituting a “biometric identifier” under BIPA is thus inadmissible and excluded, as are his related opinions that the Templates created from the finger scans are “biometric information.” The Court will decide any issue of statutory interpretation, including what constitutes a “fingerprint” as that term is used in BIPA, when ruling on Speedway's motions for summary judgment.
It is unclear whether there are other disputes over the admissibility of Daft's remaining testimony for the Court to resolve. Speedway challenges Daft's opinions- including about reverse engineering Templates into fingerprints and the network connectivity of the timeclocks-but its arguments focus on Daft's qualifications and methodology in reaching his (now-excluded) opinion that timeclocks collect biometric data. See Def.'s Daft Br. Howe also focuses his response brief on Daft's qualifications and methodology for reaching the same ultimate opinions about whether the timeclocks collect biometric data. See Pl.'s Daft Resp. The parties have not addressed whether there is anything else for Daft to testify about-beyond his (now-excluded) conclusion that the timeclocks collect fingerprints under BIPA-that would be helpful to the jury. Given the parties' general agreement on the information that the timeclocks collect, there may be little need for technical expert testimony about how the timeclocks work. Even if some testimony about the way the timeclocks work may be helpful to the jury, it is not clear that it must come from a Rule 702 expert witness at all. Daft largely restates information contained in timeclock manuals that, at least according to Speedway, are drafted for a lay audience. See Daft Rep. ¶¶ 15-23. It does not seem that a witness would require any scientific, technical, or specialized knowledge to testify to the information in these manuals, or to the general fact that the timeclocks scan a portion of the ridges of a finger and convert that scan into an alphanumeric Template.
In any event, for now, Speedway's motion to exclude is granted in part: Daft is barred from offering opinions that Speedway's timeclocks collect a “fingerprint” that is a “biometric identifier” under BIPA, and that the Template created from the fingerprint is “biometric information.” See Daft Rep. ¶ 24. The motion is denied in part without prejudice if Speedway seeks to bar Daft completely from offering any other testimony outside these opinions. If Howe intends to introduce Daft's testimony on other issues at trial and Speedway challenges that, then those arguments may be raised in a motion in limine before trial.
III. Summary Judgment
Speedway was given leave, by the previously assigned judge, to file two motions for summary judgment, one after the completion of initial fact discovery, and the second after the competition of supplemental fact discovery and expert discovery. R 59, Def.'s Mot.; R. 111, Def.'s Second Mot. Speedway's first motion offers two affirmative defenses-waiver and assumption of the risk-and brings a number of constitutional challenges to Howe's claims. R. 60, Def.'s Br. The second motion contends that, based on the factual record and the interpretation of BIPA's statutory language, Howe cannot establish any violation of BIPA as a matter of law. R. 125, Def.'s Second Br. The second motion also raises a statute of limitations defense and yet more constitutional arguments that overlap with those made in the first motion. Id. The Court will address the second motion for summary judgment first, resolving the statutory interpretation questions and the issue of whether Howe has come forth with sufficient evidence establishing a violation of BIPA, before turning to Speedway's affirmative defenses and constitutional arguments raised in its first motion.
BIPA prohibits private entities from collecting a person's “biometric identifiers” or “biometric information” without written notice and consent. 740 ILCS 14/15(b); see generally Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d 1197, 1206 (Ill. 2019) (“The Act vests in individuals and customers the right to control their biometric information by requiring notice before collection and giving them the power to say no by withholding consent.”). The statute defines “biometric identifier” as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry,” and defines “biometric information” as “any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual.” 740 ILCS 14/10.
Howe brings claims under three provisions of BIPA: Sections 15(a), 15(b), and 15(d). See Compl. Under Section 15(a), any private entity that is “in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information” after it is no longer needed. 740 ILCS 14/15(a). Section 15(b) establishes the written notice-and-consent procedures, stating that private entities may not “collect, capture, purchase, receive through trade, or otherwise obtain” an individual's protected biometrics unless it first provides that person a written notice stating that such data is being collected, and the purpose of the collection, and then receives a written release from the individual authorizing the collection. 740 ILCS 14/15(b). Finally, Section 15(d) prohibits private entities from disclosing or disseminating biometric data without consent, unless the disclosure is required by law, subpoena, or court order. 740 ILCS 14/15(d). BIPA creates a private right of action for any violations of these requirements and allows a person to recover $1,000 per negligent violation of the statute, and $5,000 per reckless or intentional violation of the statute. 740 ILCS 14/20.
A. Standard of Review
Summary judgment must be granted “if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed.R.Civ.P. 56(a). A genuine issue of material fact exists if “the evidence is such that a reasonable jury could return a verdict for the nonmoving party.” Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986). In evaluating summary judgment motions, courts must view the facts and draw reasonable inferences in the light most favorable to the non-moving party. Scott v. Harris, 550 U.S. 372, 378 (2007). The Court may not weigh conflicting evidence or make credibility determinations, Omnicare, Inc. v. UnitedHealth Grp., Inc., 629 F.3d 697, 704 (7th Cir. 2011), and must consider only evidence that can “be presented in a form that would be admissible in evidence.” Fed.R.Civ.P. 56(c)(2). The party seeking summary judgment has the initial burden of showing that there is no genuine dispute and that they are entitled to judgment as a matter of law. Carmichael v. Village of Palatine, 605 F.3d 451, 460 (7th Cir. 2010); see also Celotex Corp. v. Catrett, 477 U.S. 317, 323 (1986); Wheeler v. Lawson, 539 F.3d 629, 634 (7th Cir. 2008). If this burden is met, the adverse party must then “set forth specific facts showing that there is a genuine issue for trial.” Anderson, 477 U.S. at 256.
B. Second Motion
1. Biometric Identifiers and Information
Speedway argues that the finger-scanning technology in this case does not fall within the scope of BIPA because BIPA only applies to full fingerprints. Def.'s Second Br. at 6-13. Speedway maintains that the plain meaning of the term “fingerprint” under BIPA is an entire fingerprint, akin to the full “rolled” prints traditionally collected by law enforcement. Id. at 6-7. According to Speedway, if the Illinois legislature had intended “biometric identifiers” to include partial fingerprints or partial scans, they would have included that language. Id. at 11-12. On this theory, the timeclock's partial scan is not a biometric identifier, so the Template created from the partial finger scan is also not “biometric information,” because biometric information must be “based on an individual's biometric identifier.” See 740 ILCS 14/10. Lastly, Speedway argues that the Template created from the partial finger scan is not “biometric information” because it contains insufficient information “to identify an individual” as BIPA requires. Id. at 10-11.
Despite the ubiquity of BIPA litigation, whether a “fingerprint” under the Act includes partial prints or partial finger scans appears to be a matter of first impression. The parties have not cited, and the Court has been unable to identify, an Illinois state or a federal case addressing this issue. The Court must turn to principles of statutory interpretation, which, as noted above, is a question of law for the Court to resolve. See Gaffney, 451 F.3d at 458. “Because BIPA is an Illinois law, the Court must apply Illinois' statutory interpretation rules.” Duerr v. Bradley Univ., 590 F.Supp.3d 1160, 1168 (C.D. Ill. 2022) (citing Pastors Protecting Youth v. Madigan, 237 F.Supp.3d 746, 749 (N.D. Ill. 2017) (“As a federal court interpreting Illinois law, the Court defers to Illinois' rules of statutory interpretation.”)). When construing a statute under Illinois law, the “primary objective is to ascertain and give effect to the legislature's intent.” Rosenbach, 129 N.E.3d at 1204. “The plain language of a statute is the best indication of the legislature's intent.” Maksym v. Bd. of Election Comm'rs of City of Chi., 950 N.E.2d 1051, 1060 (Ill. 2011).
Speedway's interpretation of BIPA's language is overly narrow. The partial finger scans here fall within the statutory definition of a fingerprint and qualify as biometric identifiers. See 740 ILCS 14/10. The term “fingerprint” as commonly understood does not contain some intrinsic requirement that it can only mean an “entire” or “complete” fingerprint, presumably (to Speedway's thinking) every single ridge and furrow on the surface of a finger. (Or is it something less than 100% of the ridges and furrows? Speedway does not say.) Indeed, Speedway's own dictionary sources defining the term include no such “completeness” qualification and define a “fingerprint” as simply an “an impression of the ridges of the fingertip, unique to each human being and used as a means of identification” and “the distinctive pattern of lines on a human fingertip; no two fingerprints are identical.” Def.'s Second Br. at 6 (citing Chambers Dictionary (13th ed.); Black's Law Dictionary (11th ed. 2019)) (cleaned up). Those definitions refer to “unique” ridges and “distinctive” patterns, with no reference to some notion of completeness. So the impression of ridges or pattern lines must be sufficient to identify a particular unique individual, but they need not be a certain size or encompass a certain percentage of the entire finger. The term fingerprint refers to the ridges of the finger (or a portion of the distinctive pattern of lines on a finger), as long as that portion of the finger's ridges or pattern is sufficient to be unique to a particular individual and is capable of being used to identify a particular person.
This Opinion uses (cleaned up) to indicate that internal quotation marks, alterations, and citations have been omitted from quotations. See Jack Metzler, Cleaning Up Quotations, 18 Journal of Appellate Practice and Process 143 (2017).
This conclusion is consistent with the findings of the Illinois legislature in support of BIPA's governance of “unique” biometric identifiers. The legislative findings explain that “[b]iometrics are unlike other unique identifiers that are used to access finances or other sensitive information,” such as social security numbers, because biometrics “are biologically unique to the individual” and cannot be changed. 740 ILCS 14/5(c). Not surprisingly, courts interpreting BIPA have concluded that the defining characteristic of a “biometric identifier” for the purposes of BIPA is that it be a “unique personal feature that can be used to identify a person.” See Konow v. Brink's, Inc., No. 23-CV-760, 2024 WL 942553, at *2 (N.D. Ill. Mar. 5, 2024) (cleaned up); Rivera v. Google Inc., 238 F.Supp.3d 1088, 1096 (N.D. Ill. 2017); (“[A] ‘biometric identifier' is not the underlying medium itself, or a way of taking measurements, but instead is a set of measurements of a specified physical component (eye, finger, voice, hand, face) used to identify a person.”). There is no reason that a partial fingerprint, or a scan of a “portion of the ridges of a finger” cannot qualify as a biometric identifier, as long as that partial scan or portion is a “unique personal feature that can be used to identify a person.” See id. As this Court has observed, how the identifier is collected is beside the point: “[i]t is not the how that is important to [BIPA]; what's important is the potential intrusion on privacy posed by the unrestricted gathering of biometric information.” Rivera, 238 F.Supp.3d at 1096. Excluding partial fingerprints or scans under BIPA that could nonetheless be used to identify a unique person would undermine the fundamental purpose of the statute and leave large swaths of identifying biometric information uncovered. The term “fingerprint” includes partial impressions or partial scans of finger ridges so long as those scans are capable of being used to identify a particular person.
Whether the finger scan collected by Speedway's timeclocks is a biometric identifier depends on whether the scan is a sufficiently unique personal feature capable of being used to identify a specific person, even though it is less than the size of a full fingerprint. On the factual record presented by the parties, the scans meet that requirement. Speedway asserts that partial fingerprints or scans of less than a full fingerprint may not, as a general matter, be able to accurately identify an individual, but the factual record does not support that Speedway's timeclocks have that problem. See Def.'s Second Br. at 6-7. In fact, the purpose of Speedway's timeclocks is to figure out which specific employee is clocking in. As explained above, the timeclocks generate an alphanumeric Template for an employee based on their finger scan, and each time the employee scans their finger to clock in, the timeclock generates a new Template based on the finger scan and matches it with the stored Template. See Pl.'s Resp. DSOF ¶¶ 22-25. This system only works if the portion of the finger ridges scanned by the timeclock contains enough information to identify a specific individual. Otherwise, the Template created from the scan would be useless. So Speedway used the finger scans for the express purpose of capturing a “unique personal feature” that could be used to identify a particular employee. On the factual record presented, the scan from Speedway's timeclocks is a fingerprint, and thus is a biometric identifier under BIPA.
For this reason, the Template created from the finger scan is biometric information under BIPA. Biometric information is defined broadly to include “any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual.” 740 ILCS 14/10 (emphases added). The Templates are alphanumeric codes created based on the finger scan that describe certain prominent features of the scanned finger ridges. See Pl.'s Resp. DSOF ¶¶ 22-25. So the Templates created from the timeclocks' scans are biometric information, because they are information “based on” the scan (which is a biometric identifier on the facts presented).
Speedway's argument that the Templates are not biometric information because they are a string of numbers just like a Social Security number or driver's license number also fails. Def.'s Second Br. at 7-8. The character of the Template as an alphanumeric code is irrelevant. As explained, what makes the Template biometric information is that the code is based on protected biometric identifiers. See 740 ILCS 14/10. Other codes, such as Social Security numbers, are assigned randomly without reference to biometric identifiers, unlike the finger scans used to create Templates.
According to Speedway, the level of detail captured by the Template results in a 1 in 10,000 false acceptance rate, meaning that 1 out of every 10,000 people who scan a timeclock will have a Template generated that is close enough to a stored Template for another employee such that the timeclock might misidentify them. Def.'s Second Br. at 11 n.4. On the facts presented, this argument about the potential error rate is a nonstarter. BIPA's plain language contains no prerequisite that biometric information be of a particular accuracy or be capable of identifying an individual with the same level of preciseness as a complete fingerprint. All that matters is that the information be “based on” a biometric identifier that could be used to identify an individual. 740 ILCS 14/10; see Konow, 2024 WL 942553, at *2; Carpenter v. McDonald's Corp., 580 F.Supp.3d 512, 515 (N.D. Ill. 2022); Rivera, 238 F.Supp.3d at 1096. The Templates are accurate enough to constitute biometric information used to identify a particular individual, as demonstrated by Speedway's use of the Templates for that very purpose. See Pl.'s Resp. DSOF ¶¶ 22-25.
As explained above, the parties also dispute whether the Templates can be reverse engineered back into the partial finger scan that is initially collected. See Pl.'s Resp. DSOF ¶ 35. But this factual dispute is not outcome-determinative. BIPA contains no requirement that the biometric information that is “based on” a biometric identifier must be capable of reversereconstruction back into the biometric identifier. See 740 ILCS 14/10.
Based on the factual record as it stands, no reasonable juror could find that the timeclocks' finger scan is not a fingerprint under the statute. As already explained, on the record presented by the parties, this question is resolvable as a question of law. So Speedway is not entitled to summary judgment. Having said that, even though Howe has the better of the argument on the definition of biometric identifiers and information under BIPA, he did not make a cross motion for summary judgment at this stage of the litigation. In absence of a motion from Howe, the Court is concluding that on this record as matter of law the scan is a fingerprint, but Speedway is still permitted to litigate whether there is a factual question to decide as trial approaches. Given that the discovery record is complete, the Court is skeptical that there is a factual question remaining, but Howe did not cross-move so the Court will address this with the parties in pretrial litigation.
2. Collection and Possession
Speedway next argues, regardless of whether the timeclocks' finger scan is a biometric identifier, Speedway does not “collect” or “possess” information in violation of BIPA because the Act requires retention or control of the information. Def.'s Second Br. at 9-10. Speedway points out that the process of scanning the fingertip and converting the features into a numerical Template takes less than half a second, and the finger-scan image is instantly scanned and discarded, not stored. Id. So Speedway contends that it does not retain or control any biometric identifier and thus necessarily does not “collect, capture, and possess” such identifiers as described under BIPA. Id. at 10 (cleaned up); see 740 ILCS 14/15.
Speedway's argument is rendered largely moot because, as just explained, the Templates are biometric information based on biometric identifiers. Speedway plainly retains and controls Templates for employees, both the initial Template used to enroll employees on timeclocks, and the Templates created each time an employee clocks in or out. See Pl.'s Resp. DSOF ¶¶ 22-25. BIPA's written policy requirement under Section 15(a) and the notice-and-consent requirements under Section 15(b) both apply to biometric identifiers and biometric information. 740 ILCS 14/15(a), (b). Even if the Court agreed that some level of “retention” was necessary, that would not warrant summary judgment in Speedway's favor on the Section 15(a) and (b) claims, given Speedway's undisputed retention of biometric information in the form of Templates.
But the Court rejects Speedway's argument for another reason too: BIPA does not have an express retention requirement, at least not for claims under Section 15(b). Section 15(b) of BIPA states that “[n]o private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information” without written notice and consent. 740 ILCS 14/15(b) (emphasis added). Even assuming that the terms “capture” and “collect” include, as Speedway argues, some element of retention, the same cannot be said for the catchall phrase “or otherwise obtain” at the end of the provision. Obtain simply means “to gain or attain usually by planned action or effort.” Merriam-Webster Online Dictionary, https://www.merriam-webster.com/dictionary/obtain, (last accessed September 29, 2024.); Black's Law Dictionary (11th ed. 2019) (“To bring into one's own possession; to procure, esp. through effort.”); see Rosenbach, 129 N.E.3d at 1205 (citing Merriam-Webster and Black's Law dictionaries to interpret BIPA). Although the finger scans collected by the timeclock might only be retained for less than a half-second before being discarded, they are nonetheless “gained or attained” by the timeclock to generate the Template. See Pl.'s Resp. DSOF ¶¶ 22-25. The Court thus concludes that Speedway “otherwise obtained” biometric identifiers.
There is an open question about whether Speedway also “possessed” biometric identifiers, as required under Section 15(a), given that the finger scans were immediately discarded. The Court need not resolve that question here because Speedway separately possessed biometric information in the form of the Templates.
Once again, the Court notes that Howe did not cross-move for summary judgment. So although Speedway is not entitled to judgment as a matter of law on this issue on the factual record presented, Speedway may still litigate whether there are any factual questions to decide on this question as trial approaches. Again, the Court is skeptical that any other pertinent facts uncovered in discovery could help Speedway here, but there was no cross-motion.
3. Negligence and Reckless Disregard
Speedway next argues that BIPA does not impose strict liability, and that Howe does not have enough evidence that Speedway acted negligently, recklessly, or intentionally to survive summary judgment. Def.'s Second Br. at 15-16. According to Speedway, the record does not show that Speedway acted unreasonably given a foreseeable risk of violating BIPA (as required for negligence), much less any evidence that it acted with conscious disregard to the requirements of BIPA (as required for recklessness) or with the express intent to violate the statute. Id. at 16-19. The Court disagrees.
First, by arguing that Howe must establish at least negligence at this stage, Speedway has improperly merged the issues of liability and damages. Def.'s Second Br. at 15-16. On liability, BIPA is indeed a strict liability statute and requires no proof of a particular mental state to establish a violation of the statute's notice and consent or data-retention policy requirements under Sections 15(a) and (b). See Vaughan v. Biomat USA, Inc., No. 20-CV-4241, 2022 WL 4329094, at *12 (N.D. Ill. Sept. 19, 2022); Bradenberg v. Meridian Senior Living, LLC, No. 20-CV-03198, 2023 WL 5671275, at *3 (C.D. Ill. Sept. 1, 2023). Separately, to recover liquidated damages under the statute, Howe will need to prove Speedway either negligently or recklessly violated these requirements. 740 ILCS 14/20(a)(1), (2). The state-of-mind question for damages is separate from whether Howe can establish liability through a violation of the notice-and-consent requirements under Section 15(b) or the written policy requirements under Section 15(a). See id.; 740 ILCS 14/15. Aside from liquidated damages, there are other remedies available under BIPA, including injunctive relief and attorneys' fees. 740 ILCS 14/20(a)(3), (4). So Howe need not establish negligence or recklessness to survive summary judgment, and if he prevails on his claim he may be entitled to attorneys' fees or injunctive relief, regardless of Speedway's mental state.
Second, if Speedway does seek summary judgment on the question of liquidated damages, there is sufficient evidence at this stage to create a genuine issue of fact about Speedway's negligence or recklessness. As explained above, the record shows that the timeclocks did in fact collect protected biometric identifiers and biometric information under BIPA. Speedway began using timeclocks between 2003 and 2006, Pl.'s Resp. DSOF ¶ 4, several years before BIPA was enacted in 2008, and it is undisputed that Speedway did not provide any BIPA-specific notice and consent form until November 2017, Def.'s Resp. PSOF ¶ 16. Speedway was collecting protected biometrics for at least nine years after the enactment of BIPA without a BIPA-specific notice form. Although Speedway argues that its then-existing data-retention and employee-privacy policies were sufficient to satisfy BIPA's requirements and further that the company had a good faith belief that it was not collecting fingerprints, there is nothing in the record showing that Speedway took any effort to review the requirements of BIPA or determine whether it was following the statute at any point before 2017 when it developed and implemented the consent form. See id. ¶¶ 16-17; Def.'s Second Br. at 16-17, 19. Viewed in Howe's favor, reliance on the then-existing, generic policies appears to be an after-the-fact rationalization. So whether Speedway acted negligently or recklessly, if at all, is a factual dispute that is properly reserved for a jury.
The Court cannot conclude as a matter of law that Speedway's pre-2017 policies establish that Speedway acted without a culpable state of mind. Speedway's written data-retention and employee-privacy policies made zero mention of biometric data, nor any specific reference to the finger-scan technology and Templates collected by the timeclocks. See Pl.'s Resp. DSOF ¶¶ 6-10. Instead, as Howe points out, the policies only referred to the retention and deletion of specific documents, namely, work schedules and time sheets. See id. Speedway's Rule 30(b)(6) witness admitted that although employees could technically refuse to use the finger scan timeclock, there was no written policy about their right to refuse, and employees were required to affirmatively request an exception from their individual manager (if it even crossed their minds to do so). Jones Dep. at 60:15-61:16. Given the lack of any written policy addressing BIPA or biometrics, and the undisputed evidence that Speedway took no affirmative action to comply with BIPA's written consent requirements until late-2017, after nine years of collecting biometrics, a reasonable jury could conclude that Speedway acted negligently, recklessly, or even intentionally. See Rogers v. BNSF Ry. Co., 680 F.Supp.3d 1027, 1037-38 (N.D. Ill. 2023) (upholdingjury's finding that defendant recklessly or intentionally violated BIPA, based on evidence that the defendant took no effort to comply with BIPA until nearly 10 years after its passage); see also Horn v. Method Prods., PBC, No. 21 C 5621, 2022 WL 1090887, at *2 (N.D. Ill. Apr. 12, 2022) (collecting cases).
Whether a jury will ultimately find negligence, recklessness, or intent to support liquidated damages are fact questions that will be presented at trial. At this stage, Speedway has failed to demonstrate that it did not act negligently or recklessly as a matter of law.
4. Statute of Limitations and Preemption
Speedway also argues that all of Howe's claims are untimely because a one-year statute of limitations applies to BIPA claims, and Howe brought this action more than one year after his claims accrued (that is, the first time he scanned his finger). Def.'s Second Br. at 21-24. Speedway separately maintains that Howe's claims are preempted by the Illinois Workers' Compensation Act which, according to Speedway, provides the exclusive remedy for employment-related injuries. Id. at 24-25. These areas of law were somewhat unsettled when the parties briefed the issues, but the Supreme Court of Illinois has since issued decisions on both the statute of limitations and preemption questions.
In Tims v. Black Horse Carriers, Inc., the Supreme Court of Illinois held that a five-year statute of limitations controls all claims brought under BIPA. 216 N.E.3d 845, 847, 854 (Ill. 2023). The state high court also held, in Cothron v. White Castle Sys., Inc., that “a separate claim accrues under [BIPA] each time a private entity scans or transmits an individual's biometric identifier or information in violation of section 15(b) or 15(d).” 216 N.E.3d 918, 920 (Ill. 2023). Howe started working at Speedway in 2015, and he filed this BIPA suit on September 1, 2017, so all of his claims under BIPA accrued within five years of him filing suit and are timely. See Compl.
The Supreme Court of Illinois also rejected Speedway's preemption argument in the case of McDonald v. Symphony Bronzeville Park, LLC, 193 N.E.3d 1253, 1257 (Ill. 2022). In that case, as here, an employer argued that an employee's putative class action under BIPA was barred by the Illinois Worker's Compensation Act, which contains an exclusivity provision providing that it is the exclusive remedy for employee injuries in the workplace. Id. at 1257-58. The Illinois Supreme Court concluded that the Illinois Worker's Compensation Act does not preempt employee claims under BIPA. Id. at 1269 (“Because the [BIPA] injury alleged is not the type of injury compensable in a workers' compensation proceeding, [the plaintiff's] lawsuit is not preempted by the exclusive-remedy provisions of the Compensation Act.”). Howe's claims are not preempted and may proceed.
In sum, Speedway's second motion for summary judgment is denied.
C. First Motion
Speedway makes three arguments in its first motion for summary judgment: (1) Howe's conduct of voluntarily using the timeclock constitutes an affirmative waiver of any BIPA claim; (2) Howe's claims are barred under the doctrine of assumption of the risk; and (3) the Court should construe BIPA narrowly to avoid alleged constitutional issues. These arguments fail.
1. Waiver
Howe used Speedway's timeclock every day that he worked, and he also enrolled other employees on the timeclocks, knew the data from the timeclocks was transmitted to and used by Speedway, and generally understood that each time he put his finger on the timeclock, it relied on his fingerprint to identify him and track his time. Pl.'s Resp. DSOF ¶¶ 14-18. According to Speedway, Howe's actions implicitly waived his rights under BIPA, including his right to say no to the collection of his biometric data. R. 60, Def.'s Br. at 3-6. Howe responds that his conduct was not a waiver of his specific rights under BIPA, because there is no evidence that he understood his right under BIPA to written notice and consent for the collection of his biometric data. R. 67, Pl.'s Resp. at 6-7. Howe also argues that that Court should not recognize waiver through conduct when the statute itself outlines the express means for waiving rights to biometric data-written consent. Id. at 6.
“Waiver is the intentional relinquishment of a known right and may be express or implied.” Pielet v. Hiffman, 948 N.E.2d 87, 96 (Ill.App.Ct. 2011); see PQ Corp. v. Lexington Ins. Co., 860 F.3d 1026, 1036 (7th Cir. 2017) (describing waiver under Illinois law); Cothron v. White Castle Sys., Inc., 467 F.Supp.3d 604, 614 (N.D. Ill. 2020) (“A valid waiver of statutory rights must be knowing, voluntary, and intentional.” (cleaned up)). Where there is no express waiver, the party claiming implied waiver “has the burden of proving a clear, unequivocal, and decisive act of its opponent manifesting an intention to waive its rights.” PQ Corp., 860 F.3d at 1036 (cleaned up). As to the relevant right conferred by BIPA here, the Illinois Supreme Court has described BIPA as “vest[ing] in individuals and customers the right to control their biometric information by requiring notice before collection and giving them the power to say no by withholding consent.” Rosenbach, 129 N.E.3d at 1206.
The Court agrees with Howe that he did not knowingly and intentionally relinquish a known right and there has been no waiver as a matter of law on the record presented. There is no evidence that Howe was aware of his specific right under BIPA that Speedway was required to give written notice before collecting any biometric data, and that Howe had a right to provide or withhold written consent first before there was any collection of that data. Instead, the record shows that Howe did not appreciate his rights under BIPA until consulting with an attorney. Howe Dep. at 82:5-83:8. Howe could not have taken unequivocal action to knowingly waive a statutory right about which he was unaware.
Apart from the complete lack of evidence of knowing and intentional waiver, Howe is also correct that courts should not recognize a way to waive a statutory right that is broader than that provided by the express terms of the statute. See Pl.'s Resp. at 6-7. The Illinois legislature already decided how an individual can waive its control over biometric information-by consenting after receiving written notice. See 740 ILCS 14/15. It would be contrary to the plain language of BIPA to hold that Howe could waive his rights to receive written notice by using a device that he may understand, at a general level, is scanning his fingerprint. See, e.g., Stauffer v. Innovative Heights Fairview Heights, LLC, 480 F.Supp.3d 888, 906 (S.D. Ill. Aug. 19, 2020) (“The Court cannot say ... that the only conclusion logically drawn from Plaintiff's actions while employed ... is that she knowingly, voluntarily, and intentionally waived any right to bring a BIPA claim by continuing to scan her fingerprints at her place of work.”). Allowing Speedway's waiver argument would upend BIPA's requirement for written notice before the collection of biometrics. The Court declines to do so. See Lenoir v. Little Caesar Enters., Inc., No. 19-CV-1575, 2020 WL 4569695, at *3 (N.D. Ill. Aug. 7, 2020) (rejecting the “theory that a generalized consent to past collection, use and storage of fingerprint data necessarily invalidates a BIPA claim”).
It is true that Howe did not cross-move for summary judgment, but as a matter of law waiver cannot apply to BIPA under the circumstances presented here. So Howe has definitively defeated this affirmative defense.
2. Assumption of the Risk
Speedway advances an argument that Howe's claims are barred by the doctrine of assumption of the risk because, through his conduct, Howe “implicitly consented to encounter an inherent and known risk, thereby excusing another from a legal duty which would otherwise exist.” Def.'s Br. at 9 (quoting Edwards v. Lombardi, 1 N.E.3d 641, 646 (Ill.App.Ct. 2013) (cleaned up)). Speedway claims that any alleged “privacy risk” stemming from the use of timeclocks was an inherent and obvious part of Howe's employment, because he knew the clocks scanned his fingers and sent information to Speedway, and he voluntarily assumed any risks associated with using the timeclock by continuing to use it. Id. at 9-10. Howe responds that the doctrine is inapplicable to statutory claims under BIPA, and regardless is not satisfied here. Pl.'s Resp. at 11-14.
Under Illinois law, the defense of assumption of the risk is not available to a statutory claim under BIPA at all, because “assumption of the risk is not an available defense when a statute calls for strict liability.” Olle v. C House Corp., 967 N.E.2d 886, 890 (Ill.App.Ct. 2012). As already addressed, BIPA is a strict liability statute: BIPA does not require a mental state for liability, though it does for liquidated damages. At least two district courts in the Seventh Circuit have held that the assumption of the risk defense is unavailable under BIPA. See Snider v. Heartland Beef, Inc., 479 F.Supp.3d 762, 772 (C.D. Ill. 2020); Bradenberg v. Meridian Senior Living, LLC, 564 F.Supp.3d 627, 635 (C.D. Ill. 2021). Given the straightforward principle under Illinois law that assumption of the risk is not an available defense for strict liability statutes, and because BIPA is a strict liability statute, the defense is not available here.
Even if the defense were available, it fails for the same reasons as waiver. The record shows that Howe had an awareness that the timeclocks scanned his fingers and that information was sent to Speedway. See Pl.'s Resp. DSOF ¶¶ 14-18. But the record does not show that Howe understood that the information was “biometric information” under BIPA, or that he had a right to notice and to withhold consent to the collection of this information under BIPA. See Howe Dep. at 82:5-83:8; Jones Dep. at 61:11-16. So Howe could not have “assumed the risk” that his biometrics would be collected in violation of BIPA.
For this particular affirmative defense, because Illinois law deems assumption of the risk unavailable for strict liability statutes, this defense has been definitively defeated by Howe. As a matter of law, the defense is not available to Speedway.
3. Constitutional Arguments
Finally, Speedway argues that the Court should interpret BIPA narrowly to avoid absurd results and potential constitutional issues. Def.'s Br. at 10-11. But each of these arguments is without merit. First, Speedway argues that construing BIPA to foreclose employers like Speedway from using biometric time clocks, or punishing employers when employees voluntarily scan their fingers each day to log in for work, is an “absurd result.” Id. at 11. But just because BIPA covers the finger scans and Templates collected by Speedway does not mean there is a blanket prohibition on using those timeclocks. BIPA requires that private entities provide written notice and receive written consent before collecting biometric information and develop written policies governing their possession of such data. See 740 ILCS 14/15. Speedway was, and is still, free to use timeclocks consistent with BIPA's notice, consent, and policy requirements. This is not absurd at all. It is complying with the law.
It is very much worth noting that although Speedway challenges the constitutionality of BIPA, the record does not reflect that the company filed and served a notice on the Illinois Attorney General to give the Attorney General an opportunity to intervene. See 28 U.S.C. § 2403(b); Fed.R.Civ.P. 5.1. (“Before the time to intervene expires, the court may reject the constitutional challenge, but may not enter a final judgment holding the statute unconstitutional.”). Without that notice, this Court could not have decided this issue in Speedway's favor anyway.
Speedway next argues that if the Court allows Howe's claims to proceed, then the result could violate due process, because Speedway did not have fair notice that its conduct was forbidden under BIPA and would be subject to excessive damages that are disproportionate to the harm suffered. Def.'s Br. at 12-13. Courts have routinely rejected similar challenges that a statutory penalty provision violates the Due Process Clause if the statute simply gives rise to the potential for significant damages awards when multiplied across numerous violations or applied in a class action with many plaintiffs. See United States v. Dish Network L.L.C., 954 F.3d 970, 979 (7th Cir. 2020) (rejecting due process challenge to $10,000 maximum penalty per violation under the Telephone Consumer Protection Act and related state statutes); Arrez v. Kelly Servs., Inc., 522 F.Supp.2d 997, 1008 (N.D. Ill. 2007); Phillips Randolph Enters., LLC v. Rice Fields, No. 06 C 4968, 2007 WL 129052, at *2 (N.D. Ill. Jan. 11, 2007). Just because a statutory penalty may lead to large damages does not itself offend due process, if the individual penalty is reasonable and appropriate based on the harm addressed. See Dish Network L.L.C., 954 F.3d at 979; Rice Fields, 2007 WL 129052, at *3. And Speedway does not advance any argument that $1,000 per-negligent violation of BIPA and $5,000 per-reckless violation are themselves excessive or unconstitutional figures. What's more, the Illinois Supreme Court has interpreted BIPA's damages provisions to recognize both that large awards are possible and allowed, and at the same, trial courts have discretion to fashion appropriate awards under the statute. Cothron, 216 N.E.3d at 928-29.
Speedway also briefly raises First Amendment concerns (and does not even mention them in its reply). Def.'s Br. at 13-14; see R. 76, Def.'s Reply. Speedway perfunctorily claims that BIPA restricts speech by limiting use of biometric information without the requisite substantial interest in regulating Speedway's speech. A single paragraph is likely not a winning basis for a constitutional argument, and First Amendment challenges to BIPA have been rejected in this district, with no need to repeat the persuasive analysis. See, e.g., Sosa v. Onfido, Inc., 600 F.Supp.3d 859, 875-85 (N.D. Ill. 2022) (rejecting a First Amendment challenge to BIPA after extensive analysis).
Finally, Speedway suggests that BIPA violates the Equal Protection clause, because it arbitrarily exempts certain classes of entities that might collect biometrics, such as certain government entities and contractors and financial institutions, with no rational relation to a legitimate public interest. Def.'s Br. at 14-15. Speedway again cursorily raises the issue in its opening brief but does not mention it in its reply. The Court is persuaded by the reasoning of Bryant v. Compass Grp. USA, Inc., explaining that government agencies and financial institutions “already had privacy safeguards in place, so imposing additional obligations on them would have been minimally efficacious.” 503 F.Supp.3d 597, 601 (N.D. Ill. 2020). Speedway offers no reason to conclude otherwise.
One other point: the Court has noted along the way that Howe did not crossmove for summary judgment, so there may be some factual arguments left for Speedway to make leading up to trial even if unsuccessful on its summary judgment motions. But the constitutional arguments are denied as a matter of law because there are no possible facts for a jury to evaluate in support of these defenses. In sum, the Court denies Speedway's first motion for summary judgment.
IV. Class Certification
Turning to Howe's motion for class certification, R. 126 (sealed), Pl.'s Mot., because the requirements of Civil Rule 23 are met, Howe's motion for class certification is granted.
A. Legal Standard
To be entitled to class certification, a plaintiff must satisfy each requirement of Rule 23(a)-numerosity, commonality, typicality, and adequacy of representa-tion-as well as one of the subsections of Rule 23(b). Messner v. Northshore Univ. Health Sys., 669 F.3d 802, 811 (7th Cir. 2012) (cleaned up). “Failure to meet any of the Rule's requirements precludes class certification.” Harper v. Sheriff of Cook Cnty., 581 F.3d 511, 513 (7th Cir. 2009) (cleaned up).
“A class may be certified only if the trial court is satisfied, after a rigorous analysis, that the prerequisites of Rule 23(a) have been satisfied.” Creative Montessori Learning Ctrs. v. Ashford Gear LLC, 662 F.3d 913, 916 (7th Cir. 2011) (cleaned up) (emphasis in original). The named plaintiff bears the burden of showing by a preponderance of the evidence that all of Rule 23's requirements are satisfied. See Comcast Corp. v. Behrend, 133 S.Ct. 1426, 1432 (2013); Messner, 669 F.3d at 811. The Court “must make whatever factual and legal inquiries are necessary to ensure that requirements for class certification are satisfied before deciding whether a class should be certified, even if those considerations overlap the merits of the case.” Am. Honda Motor Co. v. Allen, 600 F.3d 813, 815 (7th Cir. 2010) (cleaned up); see also Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 351 (2011) (recognizing that class- certification analysis “[frequently ... will entail some overlap with the merits of the plaintiff's underlying claim”). In the end, the Court has “broad discretion to determine whether certification of a class-action lawsuit is appropriate.” Ervin v. OS Restaurant Servs., Inc., 632 F.3d 971, 976 (7th Cir. 2011) (cleaned up).
B. Analysis
Howe seeks to certify the following class under Rule 23(b)(3):
All individuals who used a finger scanner on a timeclock while working for Speedway in the State of Illinois between September 1, 2012, and November 1, 2017.Pl.'s Mot. at 7. Speedway argues against certification, challenging typicality and adequacy of representation under Rule 23(a), as well as predominance and superiority under Rule 23(b)(3). R. 144, Def.'s Resp. The Court addresses each of the requirements below.
1. Numerosity
Rule 23(a) requires the class to be “so numerous that joinder of all members is impracticable.” Fed.R.Civ.P. 23(a)(1). “The key numerosity inquiry . is not the number of class members alone but the practicability of joinder.” Anderson v. Weinert Enters., Inc., 986 F.3d 773, 777 (7th Cir. 2021). Although “there is no magic number that applies to every case, a forty-member class is often regarded as sufficient to meet the numerosity requirement.” Mulvania v. Sheriff of Rock Island Cnty., 850 F.3d 849, 859 (7th Cir. 2017).
Speedway does not dispute numerosity and it is satisfied here. During the class period, from September 1, 2012, to September 1, 2017, Speedway had 7,246 employees enrolled and using its timeclocks in Illinois. Pl.'s Mot. at 9; R. 121-6, Exh. 6 at 18. The actual number of putative class members may be even higher, as there may be additional employees that were enrolled and used the timeclocks after September 1, 2017, but before the BIPA-specific consent form was rolled out starting in November 2017 (the proposed end date of the class). See Pl.'s Mot. at 9. Joinder of this many potential class members would plainly be impracticable, and the numerosity requirement is readily met.
2. Commonality
Rule 23(a)(2) requires that “there are questions of law or fact common to the class.” To establish commonality, the class representative must demonstrate that members of the class “have suffered the same injury.” Dukes, 564 U.S. at 350. Commonality requires that all of the class members' claims “depend upon a common contention” that is “of such a nature that it is capable of classwide resolution-which means that determination of its truth or falsity will resolve an issue that is central to the validity of each one of the claims in one stroke.” Id. In Dukes, the Supreme Court concluded that what is most relevant to class certification “is not the raising of common ‘questions'-even in droves-but, rather the capacity of a classwide proceeding to generate common answers apt to drive the resolution of the litigation. Dissimilarities within the proposed class are what have the potential to impede the generation of common answers.” Id. (cleaned up) (emphasis in original).
Speedway does not dispute commonality. Nor could it, because all of Speedway's timeclocks used during the class period were materially identical in terms of how they operated, their hardware, and their use by employees. See Pl.'s Resp. DSOF ¶ 21. Although Speedway argues that employees could refuse to use the timeclocks, it admits that employees had the responsibility to affirmatively make that request to their store manager. Def.'s Resp. PSOF ¶¶ 2-3; DSOF ¶ 13. So the record shows that the default requirement was that all employees were expected to use the finger-scan timeclocks. These undisputed facts give rise to common questions of law and fact that would generate common answers and are capable of resolution on a class-wide basis. All of the claims in this case will turn on the common questions of: (1) whether Speedway's timeclocks in Illinois collected, captured, or otherwise obtained Howe and the putative class members' protected biometrics under BIPA Section 15(b); (2) whether Speedway provided written notice and received written releases as required under Section 15(b); (3) whether Speedway had a written policy as required under Section 15(a); and whether Speedway disclosed or disseminated protected biometrics without consent under Section 15(d). See 740 ILCS 14/15. A class-wide proceeding will generate a common answer to the question of whether Speedway's use of timeclocks violated BIPA, so Rule 23(a)(2)'s commonality requirement is met. See Dukes, 564 U.S. at 350.
3. Typicality and Adequacy of Representation
Speedway's arguments against typicality and adequacy of representation significantly overlap. See Def.'s Resp. at 3. Rule 23(a)(3) requires the class representative's claims to be typical of those of the potential class members. Fed.R.Civ.P. 23(a)(3). “As a general matter, a plaintiff's claim is typical if it arises from the same event or practice or course of conduct that gives rise to the claims of other class members and his or her claims are based on the same legal theory.” Howard v. Cook Cnty. Sheriff's Off., 989 F.3d 587, 605 (7th Cir. 2021) (cleaned up). “The individual claims may feature some factual variations as long as they have the same essential characteristics.” Beaton v. SpeedyPC Software, 907 F.3d 1018, 1026 (7th Cir. 2018) (cleaned up). Rule 23(a)(4) requires that the named plaintiff “will fairly and adequately protect the interests of the class.” Fed.R.Civ.P. 23(a)(4). The Court must assess “the adequacy of the named plaintiffs as representatives of the proposed class's myriad members, with their differing and separate interests,” and “the adequacy of the proposed class counsel." Gomez v. St. Vincent Health, Inc., 649 F.3d 583, 592 (7th Cir. 2011).
Speedway argues that it has individualized defenses to Howe's claims that Howe will devote significant time and energy to, so his claims are not typical and he is an inadequate representative. Def.'s Resp. at 3. These defenses are waiver, assumption of the risk, and the statute of limitations. Id. at 4-7. It is true that the “presence of even an arguable defense peculiar to the named plaintiff ... may destroy the required typicality of the class as well as bring into question the adequacy of the named plaintiff's representation.” CE Design Ltd. v. King Architectural Metals, Inc., 637 F.3d 721, 726 (7th Cir. 2011) (cleaned up). But as explained above the Court has concluded that Speedway's defenses fail on the record presented, so there is no reason to doubt typicality or adequacy on those grounds.
Speedway also contends that Howe is an inadequate class representative because he has not performed his duty to monitor the case and the actions of class counsel. Def.'s Resp. at 7-10. During his deposition, Howe admitted that he did not review the final complaint before it was filed and did not have a precise understanding of the attorney's-fee arrangements. See id. at 9, 10. These allegations are not fatal, because Howe adequately participated in discovery and gave testimony about his understanding of the basic facts of his claim and his role as a class member. R. 155, Pl.'s Reply at 10-11; see Scott v. Dart, 99 F.4th 1076, 1083 (explaining that to satisfy the adequacy requirement, “class members must have enough familiarity with the case”). Having said that, the Court does expect that Howe more fully familiarize himself with the litigation and the fee agreement as the case moves forward, especially when it comes to monitoring the fees and costs of the litigation.
Lastly, Howe's attorneys are adequate to represent the class. Stephan Zouras, LLP, and Edelson PC have been appointed class counsel in many other employment cases, including cases under BIPA, and have satisfactorily litigated this case on behalf of both Howe and the proposed class, including by successfully defending multiple motions for summary judgment. The adequacy and typicality requirements under Rule 23(a) are met.
4. Predominance and Superiority
Rule 23(b)(3) requires that a plaintiff demonstrate that “questions of law and fact common to class members predominate over any questions affecting only individual members.” Fed.R.Civ.P. 23(b)(3). Although similar to commonality, “the predominance criterion is far more demanding.” Messner, 669 F.3d at 814 (quoting Am-chem Prods., Inc. v. Windsor, 521 U.S. 591, 623-24 (1997)). The Court thus must compare the role of common issues of law and fact with the role of individual issues, including whether the Court must examine individual transactions in adjudicating the claim. See Messner, 669 F.3d at 815; see also Lady Di's, Inc. v. Enhanced Servs. Billing, Inc., 654 F.3d 728, 738 (7th Cir. 2011).
Speedway again argues that individual affirmative defenses will predominate over any common questions of law, because they will involve a person-by-person analysis that cannot be resolved on a class-wide basis. Def.'s Resp. at 10-11. But as already explained, the waiver, assumption of the risk, and statute of limitations defenses generally lack merit. On the record presented, it would be very surprising if any class members knowingly and intentionally waived their rights under BIPA. At most, there might be a few class members who had heard of BIPA during the class period, so the common questions would predominate over those few (if any) disputes. Indeed, the Court's conclusion that there was no waiver when Howe scanned his finger is equally applicable to any proposed class member whose supposed waiver was simply their continued use of the timeclocks. Assumption of the risk does not apply as a matter of law because BIPA is a strict liability statute. And the proposed class period, 2012 to 2017, falls within the five-year statute of limitations. If a handful of employee-class members do have unique circumstances, it does not defeat predominance here. Every element of each proposed class member's claims will be the same across the class: (1) whether Speedway collected their biometric data; and (2) if it did, whether Speedway complied with the notice, policy, and consent requirements under BIPA Sections 15(a), (b) and (d). Predominance is satisfied.
Speedway argues that superiority also defeats class certification, because damages could reach $14.4 million to $72 million, plus attorneys' fees, and are out of proportion to the harm suffered by the plaintiff and the putative class. Def.'s Resp. at 12-16. Several courts in this district have rejected this due process argument when analyzing the superiority requirement for class certification of BIPA claims. See, e.g. Tapia-Rendon v. United Tape & Finishing Co., No. 21 C 3400, 2023 WL 5228178, at *7 (N.D. Ill. Aug. 15, 2023); Svoboda v. Amazon.com, Inc., No. 21 C 5336, 2024 WL 1363718, at *14 (N.D. Ill. Mar. 30, 2024). As the court observed in Tapia-Rendon, the Seventh Circuit has expressly held that “the potential for massive class-wide damages does not render certification inappropriate.” 2023 WL 5228178, at *7 (citing Murray v. GMAC Mortgage Corp., 434 F.3d 948, 953 (7th Cir. 2006)); see also Svoboda, 2024 WL 1363718, at *14 (adopting the reasoning of Murray). Potential due process concerns will be resolved when setting the damages amount (if liability is established), and do not provide grounds to deny class certification at this stage. See id.
Finally, Speedway relies on the so-called “immature tort” theory-citing the Fifth and Third Circuits-that a class action is not the superior method for novel causes of action. Def.'s Resp. at 16-17. Speedway cites no controlling precedent to support this argument, and even if there were, BIPA claims are not novel or immature. Federal and state courts in Illinois routinely certify class actions under BIPA. See, e.g., Tapia-Rendon, 2023 WL 5228178, at *8; Svoboda, 2024 WL 1363718, at *15; Rogers v. BNSF Ry. Co., 2022 WL 854348, at *4 (N.D. Ill. Mar. 22, 2022); see also Pl.'s Reply at 17.
Here too, the Court concludes that the superiority requirement is met. As discussed above, the claims involve uniform policies and common questions of law, and the merits of each putative class members claims under Sections 15(a), (b), and (d) will be decided based on common questions of fact and law with respect to each element. The same is true for damages: whether Speedway acted negligently or recklessly will turn on the common question of Speedway's state of mind when it took actions applicable to all class members. Resolving these common questions in a single action promotes judicial economy and fairness, and there is no hint that each class members' interests would be better served in thousands of individual actions. Requiring employees to litigate these claims individually would be the exact waste of resources Rule 23 is meant to prevent.
The Court understands Speedway's concern that certification of a class action of such a large number of potential plaintiffs in one case implicates potentially significant damages. But as the Seventh Circuit observed, “[s]omeone whose maximum penalty reaches the mesosphere only because the number of violations reaches the stratosphere can't complain about the consequences of its own extensive misconduct.” Dish Network, 954 F.3d at 980; see also Rice Fields, 2007 WL 129052, at *3 (observing that legislatures do not have “an obligation to make illegal behavior affordable, particularly for multiple violations”). Ultimately, the potential for significant damages is driven by Speedway's uniform conduct affecting a large number of potential class members. This uniformity makes class-action treatment more appropriate, not less.
In sum, the requirements of Rule 23(b) are met, and class certification is appropriate.
V. Conclusion
Speedway's motions for summary judgment, R. 59 and 111, are denied. Speedway's motion to exclude Daft's testimony, R. 115, is granted in part and denied in part. Howe's motion for class certification, R. 126, is granted. The Court certifies the following class under Rule 23(b)(3):
All individuals who used a finger scanner on a timeclock while working for Speedway in the State of Illinois between September 1, 2012 and November 1, 2017.
The Court also appoints Howe's attorneys from the law firms of Stephan Zouras, LLP, and Edelson PC as class counsel. With this decision in place, the parties shall engage in settlement negotiations. The parties shall file a joint status report by October 28, 2024, to update the Court on their settlement discussions, including referral for a settlement conference with the assigned magistrate, or if settlement appears unlikely, to provide an estimate of trial length. The parties also shall confer over the class-notice form and format, as well as timing, and include the results of the conferral in the status report.