Opinion
21 C 866
07-27-2021
LEROY JACOBS, individually, and on behalf of all others similarly situated, Plaintiff, v. HANWHA TECHWIN AMERICA, INC, Defendant.
MEMORANDUM OPINION & ORDER
ROBERT W. GETTLEMAN UNITED STATES DISTRICT JUDGE
Plaintiff Leroy Jacobs brings a three-count putative class action complaint against defendant Hanwhan Techwin America, Inc. (“Hanwha”), alleging violation of the Illinois Biometric Information Privacy Act, 740 ILCS §§ 14/1 et seq., (“BIPA”). Count I alleges a violation of Section 15(a), Count II alleges a violation of Section 15(b), and Count III alleges a violation of Section 15(d). Defendant has moved to dismiss all three counts (Doc. 21). For the reasons stated below, defendant's motion is granted.
BACKGROUND
Defendant markets and sells video technology products, including security cameras manufactured by its parent company, Hanwha Techwin. Plaintiff alleges that, in December 2020, he saw several of defendant's security cameras installed at the entrance of a T.J. Maxx store in downtown Chicago. Plaintiff claims that he learned about the cameras' “ability to perform facial recognition” during that shopping trip. According to plaintiff, defendant collected his biometric data though facial recognition technology in the security cameras “to track, identify, and prosecute shoplifters.” Plaintiff faults defendant for failing to inform its “visitors” that it is collecting and storing biometric data, and alleges “upon information and belief” that defendant discloses such data, all in violation of BIPA. Plaintiff seeks certification of the following class: “All individuals in the State of Illinois who had their facial geometry scans, biometric identifiers, and/or biometric information collected, captured, received, or otherwise obtained, maintained, stored, disclosed, or disseminated by defendant during the applicable statutory period.”
Enacted in 2008, BIPA protects Illinois residents' privacy interest in their biometric information. BIPA “imposes numerous restrictions on how private entities collect, retain, disclose and destroy biometric identifiers, ” such as fingerprints, retina scans, and face scans. Heard v. Becton, Dickinson & Co., 440 F.Supp.3d 960, 963 (N.D. Ill. 2020) (citing Rosenbach v. Six Flags Entm't Corp., 129 N.E.3d 1197, 1199 (2019)). “Under the Act, any person ‘aggrieved' by a violation of its provisions ‘shall have a right of action against an offending party' and ‘may recover for each violation.'” Id. (quoting 740 ILCS 14/20). Plaintiff asserts claims against defendant under Sections 15(a), 15(b), and 15(d) of BIPA. Section 15(a) requires entities “in possession of” biometric data to develop a publicly available retention schedule and destruction deadline for the data. 740 ICLS 14/15(a). Section 15(b) requires entities that collect biometric data first to inform the subject in writing that they are doing so; state the “specific purpose and length of time for which” the data “is being collected, stored, and used;” and receive an executed written release authorizing them to collect the data. 740 ILCS 14/15(b). Finally, Section 15(d) prohibits entities “in possession of” biometric data from disclosing it, except in certain circumstances. 740 ILCS 14/15(d).
Defendant's response notes several crucial facts that plaintiff does not allege. For example, plaintiff does not allege that defendant installed the cameras, operated the cameras, or in any way accesses or controls T.J. Maxx's security system. Indeed, defendant notes that it has no interest in “prosecuting shoplifters” at T.J. Maxx. Plaintiff also does not allege that defendant operates any systems or servers to store any information captured by the cameras. A full reading of plaintiff's complaint suggests that defendant's only alleged connection to those cameras was its role as the manufacturer and distributor.
DISCUSSION
Defendant has moved to dismiss all three counts under Fed.R.Civ.P. 12(b)(6). To survive such a motion, a complaint must contain “enough factual matter (taken as true)” to suggest that a plaintiff is entitled to relief. Bell Atl. Corp. v. Twombly, 550 U.S. 544, 556 (2007). The complaint must include “enough facts to state a claim to relief that is plausible on its face.” Id. at 570. “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). “Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Id.
I. Section 15(b) of BIPA
Unlike Sections 15(a), (c), (d), and (e) of BIPA-all of which apply to entities “in possession of” biometric data-Section 15(b) applies to entities that “collect, capture, purchase, receive through trade, or otherwise obtain” biometric data. 740 ILCS 14/15(a)-(e). The parties appear to agree that mere possession of biometric data is insufficient to trigger Section 15(b)'s requirements. See Heard, 440 F.Supp.3d at 965 (the argument that Section 15(b) requires more than mere possession “finds ample support in the case law”); Namuwonge v. Kronos, Inc., 418 F.Supp.3d 279, 286 (N.D. Ill. 2019) (because “[t]he Illinois legislature used the term possession in certain sections of BIPA.. .but chose not to include possession in section 15(b), ” there “is a difference between possessing and collecting biometric information”); Bernal v. ADP, LLC, 2019 WL 5028609, at *1 (Cir. Ct. of Cook Cnty. Aug. 23, 2019) (crediting the argument that “the legislature intended for possession alone not to be enough to make an entity subject to § 15(b)”).
The parties dispute, however, whether Section 15(b) applies only to entities that “actively” collect biometric data. Defendant argues that it does, and that plaintiff's allegations do not sufficiently plead that defendant itself actively collected his biometric data, or that of the putative class members. Plaintiff responds that defendant is reading a nonexistent and more stringent requirement into the statute. Pointing to the “otherwise obtain” language in Section 15(b), plaintiff argues that the provision applies to any private entity that obtains biometric data, no matter the source or manner of collection. Plaintiff also emphasizes that the bankruptcy of a company called Pay By Touch-which allegedly provided major retailers with fingerprint scanners for customer transactions-motivated the Illinois legislature to pass BIPA. Plaintiff contends that because it was Pay By Touch's clients that actively collected individuals' fingerprints, active collection cannot be the touchstone of liability under Section 15(b).
Plaintiffs arguments are flawed. First, plaintiff agrees that Section 15(b) requires something more than mere possession, but is unable to articulate what that “something more” is, if not an affirmative act of collection. Plaintiff does not explain how an entity could “otherwise obtain” biometric information without taking any active steps to do so. Second, “the fact that the Pay By Touch bankruptcy may have influenced the Illinois legislature's decision to enact the BIPA does not mean that the legislature drafted every provision with Pay By Touch in mind, or that it intended for every provision to cover entities that operate exactly as Pay By Touch did.” Heard, 440 F.Supp.3d at 966. Following other courts in this district, this court concludes that for Section 15(b)'s requirements to apply, an entity must, at a minimum, take an active step to collect, capture, purchase, or otherwise obtain biometric data. See, for example, id.
Plaintiff has not sufficiently pleaded that defendant took any active steps to collect biometric data. For example, plaintiff repeatedly alleges that defendant “collected” his biometric data without alleging how, when, or any other factual detail. These allegations “merely parrot” BIPA's statutory language; they do not provide any “specific facts to ground [plaintiff's] legal claims.” Brooks v. Ross, 578 F.3d 574, 581 (7th Cir. 2009). Other allegations in plaintiff's complaint appear to come from pleadings for other cases: for instance, the complaint refers generally to defendant's failure to inform “its visitors” or its “users” of its data collection practices, even though defendant is never alleged to have any “visitors, ” and the “user” or “customer” of the technology is T.J. Maxx-not plaintiff. Plaintiff's brief makes some passing reference to a server, but there are no allegations in the complaint regarding defendant allegedly storing any biometric data on a server.
This problem appears throughout plaintiff's response brief as well, which apparently plagiarizes the pleadings in Heard. For example, plaintiff's brief refers to defendant Hanwha as “BD” or Becton Dickinson & Co, the defendant in Heard; refers to plaintiff alternatively as “his” and “her”; the biometric data in question is listed as “fingerprints, ” even though Hanwha is not alleged to have collected anyone's fingerprints; and discusses “disclosure of employee biometrics” even though defendant's employees are not at issue.
Ultimately, plaintiff has not plausibly alleged that defendant collected, captured, purchased, received through trade, or otherwise obtained biometric data from plaintiff or the putative class members. In fact, a complete reading of the complaint makes clear that defendant is merely a third-party technology provider (that is, merely provided the cameras), and that the active collector and processor of the data is T.J. Maxx. This holding comports with other courts that have addressed Section 15(b) claims levied against third-party technology providers. See Heard, 440 F.Supp.3d at 967 (dismissing a Section 15(b) claim against a third-party provider of fingerprint equipment used by plaintiff's employer, because plaintiff failed to allege that the third-party provider actively collected the biometric data); Namuonge, 418 F.Supp.3d at 286 (dismissing Section 15(b) claim because the plaintiff did not plausibly allege that the defendant scanner manufacturer itself “collected, captured, or otherwise obtained [plaintiff's] biometric information, ” and it was clear from the complaint that the employer collected the data using a system provided by the technology-provider defendant); Bernal, 2019 WL 5028609, at *2 (dismissing Section 15(b) claim against provider of biometric scanning technology because the plaintiff “failed to allege facts sufficient ... for the court to properly assess defendant's actual involvement, relative to the biometric scanning technology, beyond the fact that defendant supplied [plaintiff's employer] with the technology”).
Plaintiff identifies two cases in which the court declined to dismiss a Section 15(b) claim against a third-party technology provider: Figueroa v. Kronos, 454 F.Supp.3d 772 (N.D. Ill. 2020), and Neals v. PAR Tech Corp., 419 F.Supp.3d 1088, 1092 (N.D. Ill. 2019). Yet in both cases, the Section 15(b) claims survived because, unlike the instant case, the factual allegations made clear that the manufacturers of the fingerprint scanners had themselves collected, obtained, or stored the biometric data.
For these reasons, Count II is dismissed.
II. Sections 15(a) and 15(d)
Sections 15(a) and 15(d) of BIPA apply to entities “in possession of” biometric data. 740 ILCS 14/15(a), (d). BIPA does not define “possession, ” see 740 ILCS 14/40, and courts have routinely used the ordinary definition of the word. See Heard, 440 F.Supp.3d at 968; Rosenbach, 129 N.E.3d at 1205); Namuwonge, 418 F.Supp.3d at 284. In this context, possession occurs when someone “exercise[es] any form of control over the data or . held the data at [his] disposal.” Heard, 440 F.Supp.3d at 968. Like the plaintiff in Heard, plaintiff here does not provide any factual allegations that plausibly establish that defendant exercised control over plaintiff's data or otherwise held plaintiff's data at its disposal. And like the allegations concerning collection of data, most of plaintiff's allegations concerning possession merely parrot the statutory language. The complaint does not say whether defendant could freely access the data, or even how defendant allegedly received it. Cf. Namuwonge, 418 F.Supp.3d at 284 (the plaintiff's “allegation that Brookdale [plaintiff's employer] disclosed their employees' fingerprint data to Kronos [third-party technology provider] sufficiently alleges that Kronos possess the fingerprint data collected by Brookdale”). Plaintiff's complaint fails to plead factual matter that allows the court to draw the reasonable inference that defendant was “in possession” of his biometric data, or that of putative class members. See Heard, 440 F.Supp.3d at 968.
The court also dismisses plaintiff's claim under Section 15(d) for an independent reason: plaintiff offers no basis for its allegation that defendant disclosed his biometric data, or that of the putative class members. See 740 ILCS 14/15(d) (providing that entities “in possession of' biometric data cannot disclose it except in limited circumstances). Plaintiff concedes that he relies on “information and belief,' but argues that he is permitted to do so because the facts are within defendant's exclusive control. While plaintiffs are generally permitted to rely on information and belief in a complaint, the court is not convinced that it is appropriate to do so here. Plaintiff has not presented any legitimate reason to suspect that defendant disclosed his biometric data or that of the putative class members. See Heard, 440 F.Supp.3d at 969 (“If [plaintiff] has a legitimate reason to suspect that [defendant] disclosed his biometric data or that of the putative class members, he surely possesses information of some kind that triggered his suspicion-such as reports that [defendant] has unlawfully disseminated biometric data in the past, or indications that [plaintiff] or the putative class members experienced identity theft after they used [the technology system.').
Plaintiff's complaint contains no allegations of fact which, if true, suggest there is any basis to even suspect that defendant disseminated the biometric data at issue. “The court is not required to credit rank speculation.” Id. (citing Taha v. Int'l Bd. of Teamsters, Local 781, 947F.3d 464, 469 (7th Cir. 2020)). Consequently, the court grants defendant's motion to dismiss Count I and Count III.
CONCLUSION
For the reasons stated above, the court grants defendant's motion to dismiss (Doc. 21).