Summary
denying argument that former employees where " ‘necessarily claiming a workplace injury’ by alleging that they experienced emotional distress as a result of Defendant's BIPA violations, and therefore their ‘exclusive remedy’ is through the IWCA"
Summary of this case from Roberson v. Maestro Consulting Servs.Opinion
Case No. 19-cv-1575
08-07-2020
NIVEA LENOIR and BRIANNA STARTS, Plaintiffs, v. LITTLE CAESAR ENTERPRISES, INC, Defendant.
MEMORANDUM OPINION AND ORDER
Plaintiffs Nivea Lenoir ("Lenoir") and Brianna Starts ("Starts") (together, "Plaintiffs") bring this proposed class action against Defendant Little Caesar Enterprises, Inc. ("Defendant" or "LCE") for alleged violations of the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. ("BIPA"). Currently before the Court is Defendant's motion [28] to dismiss Plaintiffs' governing first amended complaint ("Complaint") for failure to state a claim. For the following reasons, Defendant's motion [28] is denied. Counsel are directed to file a joint status report no later than August 21, 2020, setting out at a minimum (1) a proposed discovery plan and (2) a statement in regard to any settlement discussions or if the parties would like a referral to the Magistrate Judge for a settlement conference. The Court will set a status hearing date after reviewing the joint status report.
I. Background
The following facts are taken from Plaintiffs' Complaint and assumed to be true for purposes of Defendant's motion to dismiss. Lenoir and Starts are both former employees of Defendant. Lenoir worked at a Little Caesars pizza restaurant in Chicago, Illinois from July 2018 to May 2019, while Starts worked at a Little Caesars pizza restaurant in Tinley Park, Illinois from February 2018 to July or August 2018. During their employment, Defendant required Plaintiffs and other employees to use a biometric time clock system to record their time worked. In particular, Defendant required Plaintiffs and other employees to scan their fingerprints in the biometric time clock when they started working a shift, stopped for a break, returned from a break, and finished working a shift. By requiring employees to use their fingerprints to record their time, instead of identification numbers or badges only, Defendant ensured that one employee could not clock in for another.
According to the Complaint, Defendant collected, stored, used, and transferred the unique biometric fingerprint identifiers and information of Plaintiffs and others similarly situated without following the detailed requirements of BIPA. In particular, the Complaint alleges, Defendant never obtained Plaintiffs' written consent or release before collecting, storing, disseminating, or using their fingerprints. Defendant also shared Plaintiffs' unique biometric identifiers with its time-keeping vendor without Plaintiffs' consent. Further, Defendant allegedly stored Plaintiffs' biometric identifiers without publishing data retention and destruction policies required by BIPA. Plaintiffs allege that they suffer emotional distress "over whether Defendant is currently storing, or will eventually dispose of, their biometric identifiers and information securely" and "because they recognize that they will not learn of any data breach that compromises their biometric identifiers and information until after that data breach has occurred." [25] at 5.
According to the Complaint, Defendant knew or should have known of the requirements of BIPA because the law was enacted in 2008 and numerous articles and court filings about the statute's requirements were published before Defendant employed Plaintiffs. Therefore, the Complaint alleges, Defendant's violations of BIPA were reckless or, in the alternative, negligent. Plaintiffs seek liquidated monetary damages for each violation of BIPA, injunctive relief, and attorneys' fees and costs. Currently before the Court is Defendant's motion to dismiss the Complaint for failure to state a claim.
II. Legal Standard
Defendant's Rule 12(b)(6) motion challenges the legal sufficiency of the Complaint. For purposes of a motion to dismiss under Rule 12(b)(6), the Court "'accept[s] as true all of the well-pleaded facts in the complaint and draw all reasonable inferences in favor of the plaintiff.'" Calderon-Ramirez v. McCament, 877 F.3d 272, 275 (7th Cir. 2017) (quoting Kubiak v. City of Chicago, 810 F.3d 476, 480-81 (7th Cir. 2016)). To survive a motion to dismiss under Rule 12(b)(6), the Complaint must allege facts which, when taken as true, "'plausibly suggest that the plaintiff has a right to relief, raising that possibility above a speculative level.'" Cochran v. Illinois State Toll Highway Auth., 828 F.3d 597, 599 (7th Cir. 2016) (quoting EEOC v. Concentra Health Servs., 496 F.3d 773, 776 (7th Cir. 2007)). The Court reads the Complaint and assesses its plausibility as a whole. See Atkins v. City of Chicago, 631 F.3d 823, 832 (7th Cir. 2011).
III. Analysis
A. BIPA
BIPA provides standards of conduct governing private entities' collection and possession of biometric identifiers and biometric information (together, "biometric data"). 740 ILCS 14/15. BIPA requires private entities that "possess[]" biometric data to develop a written policy, made available to the public, establishing a retention schedule and guidelines for destruction of biometric data. Id. § 14/15(a). It also requires private entities that "collect, capture, purchase, receive through trade, or otherwise obtain" a person's biometric data to: (1) inform the individual that the data is being collected or stored; (2) inform the individual of the purpose and length of the collection and storage; and (3) obtain written consent to collect the data. Id. § 14/15(b). BIPA additionally prohibits private entities "in possession of" biometric data from selling the data and forbids such entities from "disclos[ing]" the data without consent or other authorization. Id. § 14/15(c)-(d). Finally, BIPA requires "using the reasonable standard of care within the private entity's industry" to store and protect biometric data. 740 ILCS 14/15(e).
B. Waiver and Consent
Defendant argues that Plaintiff Lenoir voluntarily gave up any right to pursue a BIPA claim because she "affirmatively consented to provide her finger scan for the stated purpose of verifying her identity to access Caesar Vision, LCE's timekeeping system." [29] at 6. More particularly, on January 16, 2019—six months after she began working for Defendant—Lenoir allegedly consented to "the past, present and future collection, use, and storage of your fingerprint data" when she registered her finger scan in Caesar Vision. Id. at 7. In support of this argument, Defendant attaches to the motion to dismiss "representative sample screens of those viewed by Lenoir on January 16, 2019 when she consented, waived, and agreed to registering her finger scan." Id. at 6 n.2. Plaintiff responds that these exhibits are not properly before the Court on a motion to dismiss and, even if they were, do not warrant dismissal of Lenoir's BIPA claims. The Court agrees with Plaintiff on both points.
"A motion under Rule 12(b)(6) can be based only on the complaint itself, documents attached to the complaint, documents that are critical to the complaint and referred to in it, and information that is subject to proper judicial notice." Geinosky v. City of Chicago, 675 F.3d 743, 745 n.1 (7th Cir. 2012); see also Paulsen v. Abbott Labs., 368 F. Supp. 3d 1152, 1180 (N.D. Ill. 2019). The "representative sample screens" provided by Defendant are not attached to the Complaint, and Defendant has made no attempt to establish that such documents are "subject to proper judicial notice." Geinosky, 675 F.3d at 745 n.1. That leaves only the possibility that the documents are "critical to the complaint and referred to in it." Id. Defendant asserts that its "basis for attaching [the documents] is that they are central to Lenoir's claims in that she routinely states that she 'never' received a written consent," which Defendant's documents show is false. [33] at 2. However, Defendant misstates the Complaint. The Complaint alleges that Defendant "never provided Plaintiffs any written materials about its collection, retention, destruction, use, or dissemination of their fingerprints before requiring them to use a biometric time clock" and "never obtained Plaintiffs' written consent, or release as a condition of employment, before collecting, storing, disseminating, or using their fingerprints. [25] at 4-5, ¶¶ 24-25 (emphasis added). These allegations are not rendered false by Defendant's alleged evidence that Lenoir signed a consent six months after Defendant had already collected, retained, used, and disseminated her fingerprints.
"[A] court may judicially notice only a fact that is not subject to reasonable dispute," such as public records. Tobey v. Chibucos, 890 F.3d 634, 648 (7th Cir. 2018). The unauthenticated "sample" documents, which apparently were taken from Defendant's computerized records, are not the type of documents that are subject to judicial notice. --------
Even if the documents attached to the motion to dismiss were properly before the Court on a motion to dismiss, they fail to establish that Lenoir's BIPA claim is necessarily barred as a matter of law. BIPA makes clear that a private entity may not "collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information, unless it first : (1) informs the subject ... in writing that a biometric identifier or biometric information is being collected or stored; (2) informs the subject ... in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and (3) receives a written release executed by the subject of the biometric identifier or biometric information ..." 740 ILCS 14/15(b) (emphasis added). While this language does not forbid a private entity from attempting to obtain consent retroactively, Defendant has not identified any legal theory under which the consent it obtained from Lenoir bars her BIPA claim as a matter of law.
Defendant first claims that Lenoir is equitably estopped from bringing a BIPA claim. See [29] at 8. "In order to raise a successful defense of equitable estoppel, the party claiming estoppel must show (1) the other party misrepresented or concealed material facts, (2) the other party knew, at the time the representations were made, that those representations were false, (3) the party claiming estoppel did not know of the falsity of the representations when they were made or when they were acted upon, (4) the other party intended or reasonably expected the representations to be acted upon by the party claiming estoppel, (5) the party claiming estoppel reasonably relied upon the representations in good faith to his detriment, and (6) the party claiming estoppel has been prejudiced by his reliance on the representations." Ruiz v. Cal-Ful Condominium Ass'n, 144 N.E.3d 1229, 1234 (Ill. App. 2019). Defendant does not identify any material facts that Lenoir has concealed or misrepresented. As explained in the preceding paragraph, the Complaint alleges only that Defendant failed to provide the necessary disclosures and obtain the necessary consents before making Lenoir use her fingerprints to clock in and out of work. Defendant does not even attempt to explain how the remaining elements of equitable estoppel have been satisfied.
Defendant also asserts a theory of waiver. See [29] at 8-9. "Individuals generally may waive substantive rules of law, statutory rights, and even constitutional rights enacted for their benefit," if "the waiver is knowing, voluntary, and intentional." In re Estate of Ferguson, 730 N.E.2d 1205, 1210 (Ill. App. 2000); see also RTP LLC v. Orix Real Estate Capital, Inc., 2014 WL 12696867, at *1 (N.D. Ill. Dec. 1, 2014). "Questions of estoppel and waiver are left to the trier of fact where the material facts are in dispute or where reasonable people might draw different conclusions from the evidence." Safeway Ins. Co. v. Ebijimi, 117 N.E.3d 1227, 1240 (Ill. App. 2018) (internal quotation marks and citation omitted). The Court cannot say based on the pleadings and the minimal documentation provided by Defendant that the only conclusion that could be drawn from Lenoir's alleged January 16, 2019 consent is that Lenoir knowingly, voluntarily, and intentionally gave up any right to bring a BIPA claim for violations that occurred prior to signing the consent. The consents on which Defendant relies do not mention BIPA or any other right to sue. Nor do they acknowledge that Defendant previously collected Lenoir's biometric data, which is the basis for her right to sue. Further, Defendant has not identified any case law supporting its theory that a generalized consent to past collection, use and storage of fingerprint data necessarily invalidates a BIPA claim. The Court therefore concludes that it would be inappropriate, at this early stage of the case, to dismiss Lenoir's claims based on the January 16, 2019 consent.
C. Negligent or Reckless Violation
Defendant argues that the Complaint should be dismissed because Plaintiffs fail to adequately allege that Defendant's violation of BIPA was negligent or reckless. According to Defendant, "[i]n order to recover under BIPA, Plaintiffs must adequately allege either a negligent or reckless violation of the statute." [29] at 10 (citing 740 ILCS § 14/20). However, BIPA provides for a private right of actions for "[a]ny person aggrieved by a violation" of the statute. 740 ILCS § 14/20 (emphasis added). The Illinois Supreme Court has explained that "when a private entity fails to comply with one of section 15's requirements, that violation constitutes an invasion, impairment, or denial of the statutory rights of any person or customer whose biometric identifier or biometric information is subject to the breach." Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d 1197, 1206 (Ill. Sup. 2019). "The violation, in itself, is sufficient to support the individual's or customer's statutory cause of action." Id. The "negligent" and "intentionally and recklessly" standards come into play when determining remedies, with negligent violations worth $1,000 in liquidated damages (or actual damages, if greater) and intentional or reckless violations worth $5,000 in liquidated damages (or actual damages, if greater). 740 ILCS § 14/20(1), (2). Additional remedies of attorneys' fees, costs, and injunctive relief are also available, and the statutory language does not limit these remedies to only negligent, intentional, or reckless violations. Id. § 14/20(3), (4); see also Cothron v. White Castle System, Inc., 2020 WL 3250706, at *5 (N.D. Ill. June 16, 2020) ("[I]f the complaint plausibly pleads violations of Section 15(b) and Section 15(d)—which the Court finds that it does—then, even absent specific allegations about White Castle's mental state with respect to each of those claims, it has stated a claim entitling Ms. Cothron to litigation expenses and injunctive relief under Section 20, whether or not she proves an entitlement to damages based on negligent, reckless, or intentional conduct.").
Defendant further argues that BIPA "sets out a negligence standard, which requires entities who possess 'biometric identifiers' and 'biometric information' to employ a 'reasonable standard of care within the private entity's industry.'" [29] at 10 (quoting 740 ILCS 14/15(e)). Defendant maintains that the Complaint is deficient because Plaintiffs "fail to include any allegations indicating how LCE deviated from the reasonable standard of care taken by other employers in any industry with respect to BIPA." Id. at 10-11. The Court fails to see why such allegations should be required to state a BIPA claim. Plaintiffs complain about Defendant's failure to provide them with BIPA-required notices or obtain their written consent prior to collecting and using their fingerprints—not about the reasonableness of Defendant's storage, transmittal, or protection of biometric identifiers in its possession, which are the subjects of subsection 14/15(e).
Finally, assuming for sake of argument that Plaintiffs must at minimum allege that Defendant's violation of BIPA was negligent in order to survive a motion to dismiss, the Complaint's allegations are sufficient. As Plaintiffs allege, BIPA "was enacted in 2008 and numerous articles and court filings about the Act's requirements were published before Defendant employed [Plaintiffs]." [25] at 8, ¶¶ 51-52. And Defendant apparently became aware of BIPA at some point prior to Plaintiffs filing this lawsuit, as it attempted to obtain retroactive consent from Lenoir for the collection of her fingerprint data. These facts plausibly suggest that, at a minimum, Defendant was negligent for its earlier failures to comply with BIPA.
D. Illinois Workers' Compensation Act
Defendant's final argument is that the Complaint is barred by the Illinois Workers' Compensation Act, 820 ILCS 305/1 et seq. ("IWCA"). Defendant asserts that Plaintiffs are "necessarily claiming a workplace injury" by alleging that they experienced emotional distress as a result of Defendant's BIPA violations, and therefore their "exclusive remedy" is through the IWCA. [29] at 14. "Courts have unanimously rejected" this argument, and this Court will do the same. Cothron, 2020 WL 3250706, at *5-6 (collecting cases). Although the IWCA provides the exclusive remedy for many injuries sustained by employees in the course of their employment, see 820 ILCS 305/5(a), ICWA preemption does not apply where the plaintiff establishes that: "(1) that the injury was not accidental; (2) that the injury did not arise from his or her employment; (3) that the injury was not received during the course of employment; or (4) that the injury was not compensable under the Act." Meerbrey v. Marshall Field & Co., Inc., 564 N.E.2d 1222, 1226 (Ill. Sup. 1990). "Although the IWCA can cover psychological injuries" like the emotional distress claimed by Plaintiffs, "courts have generally required that the psychological injury stem from 'a sudden, severe emotional shock traceable to a definite time, place and cause.'" Cothron, 2020 WL 3250706, at *6 (quoting Pathfinder Co. v. Indus. Comm'n, 343 N.E.2d 913, 917 (Ill. Sup. 1976)). More generally, the Illinois Supreme Court in Pathfinder stated that the ""test for whether an employee suffered a compensable injury" is "whether there was a harmful change in the human organism—not just its bones and muscles, but its brain and nerves as well." Pathfinder, 343 N.E.2d at 918. "Under this test, multiple courts in this district have found that the IWCA does not preempt BIPA injuries—even if those injuries happen in the workplace." Cothron, 2020 WL 3250706, at *6; see also Treadwell v. Power Solutions Int'l, Inc., 427 F. Supp. 3d 984, 993 (N.D. Ill. 2019) (alleged BIPA violations not accidental so IWCA preemption did not apply). "Similarly, numerous trial courts in Illinois have found that privacy injuries are distinct from those preempted by the IWCA." Cothron, 2020 WL 3250706, at *6 (collecting unpublished Illinois trial court decisions); see also Peatry v. Bimbo Bakeries USA, Inc., 2020 WL 919202, at *6 (N.D. Ill. Feb. 26, 2020); [30] at 14 & Exs. A-D. The Court will follow the other courts that have addressed this issue and deny the motion to dismiss on the basis of IWCA preemption.
IV. Conclusion
For these reasons, Defendant's motion to dismiss [28] is denied. Counsel are directed to file a joint status report no later than August 21, 2020, setting out at a minimum (1) a proposed discovery plan and (2) a statement in regard to any settlement discussions or if the parties would like a referral to the Magistrate Judge for a settlement conference. The Court will set a status hearing date after reviewing the joint status report. Dated: August 7, 2020
/s/_________
Robert M. Dow, Jr.
United States District Judge