Summary
finding that under Rule 9(b), states of mind may be alleged generally, and Rule 8 does not demand that a plaintiff plead facts he or she would have no way of knowing prior to discovery
Summary of this case from Hazlitt v. Apple Inc.Opinion
No. 19 C 5660
2019-12-18
Kandice NEALS, individually and on behalf of all others similarly situated, Plaintiff, v. PAR TECHNOLOGY CORP., Defendant.
Benjamin Harris Richman, J. Eli Wade Scott, Schuyler Ufkes, Edelson PC, Chicago, IL, David J. Fish, John C Kunze, Kimberly A. Hilton, The Fish Law Firm, P.C., Naperville, IL, for Plaintiffs. Richard Henry Tilghman, Henry Caldwell, John T. Ruskusky, Nixon Peabody, LLP, Chicago, IL, for Defendants.
Benjamin Harris Richman, J. Eli Wade Scott, Schuyler Ufkes, Edelson PC, Chicago, IL, David J. Fish, John C Kunze, Kimberly A. Hilton, The Fish Law Firm, P.C., Naperville, IL, for Plaintiffs.
Richard Henry Tilghman, Henry Caldwell, John T. Ruskusky, Nixon Peabody, LLP, Chicago, IL, for Defendants.
ORDER
Ronald A. Guzmán, United States District Judge
Defendant's motion to dismiss the complaint [19] is granted, and the complaint is dismissed without prejudice. Plaintiff may file by January 15, 2020 an amended complaint to cure the deficiency described in this order. A status hearing is set for January 22, 2020 at 9:30 a.m. The parties are directed to refer to and comply with the Court's requirements for initial appearances, as outlined in the Court's case management procedures, which can be found at www.ilnd.uscourts.gov.
STATEMENT
Plaintiff, Kandice Neals, brought this putative class action in the Circuit Court of Cook County against PAR Technology Corp. ("PAR"), alleging that PAR violated the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. (the "BIPA" or the "Act"). PAR removed the action to this court on the basis of diversity jurisdiction, and it now moves to dismiss the complaint under Federal Rule of Civil Procedure 12(b)(6).
Neals is an Illinois citizen. PAR is a citizen of Delaware and New York.
When evaluating the sufficiency of a complaint under Rule 12(b)(6), the Court construes the complaint in the light most favorable to the plaintiff, accepts all well-pleaded facts as true, and draws all reasonable inferences in plaintiff's favor. See Bell v. City of Chi. , 835 F.3d 736, 738 (7th Cir. 2016). Federal notice-pleading standards require only "a short and plain statement of the claim showing that the pleader is entitled to relief." Fed. R. Civ. P. 8(a)(2). That is, a complaint must contain "sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’ " Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (quoting Bell Atl. Corp. v. Twombly , 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ). "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. (citing Twombly , 550 U.S. at 556, 127 S.Ct. 1955 ).
Neals alleges the following. PAR develops cloud-based point of sale ("POS") systems for the hospitality industry and offers a range of POS systems that enable businesses, primarily restaurants, to track their employees' time by using a biometric finger scanner. In May 2018, Neals began working at a restaurant called Charley's Philly Steaks, which uses PAR's POS system and required Neals to scan her fingerprint into that system so it could track her time. PAR subsequently collected and stored Neals's biometric identifier into its database. Each time Neals began and ended her workday, she was required to scan her fingerprint into the POS system. Neals claims that PAR violated the BIPA by never informing her (1) in writing that her biometric identifier was being collected and stored; (2) about the specific purpose or length of time for which it collected, stored, or used her fingerprint; or (3) of any biometric data retention policy it has developed. Neals alleges that PAR also violated the BIPA by failing to obtain a written release from her that allowed it to collect or store her fingerprint. She seeks to represent a class of persons defined as "[a]ll residents of the State of Illinois who had their fingerprints collected, captured, received, otherwise obtained, or disclosed by PAR Technology while residing in Illinois." (ECF No. 1-1, Compl. ¶ 35.)
PAR first contends that Neals's claims are barred by Illinois's "extraterritoriality doctrine," because Neals has not alleged that PAR engaged in any conduct in Illinois that violated the BIPA. PAR cites Avery v. State Farm Mutual Automobile Insurance Co. , 216 Ill.2d 100, 296 Ill.Dec. 448, 835 N.E.2d 801 (2005), in which the Illinois Supreme Court held that the Illinois Consumer Fraud and Deceptive Business Practices Act does not apply to transactions that take place outside Illinois, applying the principle that a statute is without extraterritorial effect unless a clear intent appears from its express provisions. Id. , at 852-53. The court explained that while there is no bright-line test for determining whether a transaction occurs within the state, a non-resident plaintiff has a claim for statutory fraud only if the circumstances that relate to the disputed transaction occur "primarily and substantially in Illinois." Id. at 853-54.
The BIPA creates a right of action for any person aggrieved by a violation of the Act. 740 ILCS 14/20. It provides as follows in pertinent part:
No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information, unless it first:
(1) informs the subject ... in writing that a biometric identifier or biometric information is being collected or stored;
(2) informs the subject ... in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and
(3) receives a written release executed by the subject of the biometric identifier or biometric information ....
740 ILCS 14/15(b). PAR asserts that the complaint fails to allege that the relevant circumstances occurred primarily and substantially in Illinois, because PAR is a "non-resident corporation" that offers point-of-sale technology to its customers, not customers' employees, and there is no allegation that PAR holds property in Illinois or stores data in Illinois. (ECF No. 19, Def.'s Mot. at 4.) The Court is unpersuaded. PAR's physical location and property holdings, the location of its servers, and the identity of its customers are not determinative of the Act's application; these factors have little to do with the transaction and conduct at issue—the collection of plaintiff's fingerprint. The Court is also unpersuaded by PAR's contention that plaintiff must "substantiate" her allegation that PAR "collected" her biometric information. (ECF No. 29, Def.'s Reply at 8.) Plaintiff presents "a story that holds together" by alleging that PAR collected such information through its customer's use of PAR's system; nothing more is needed under federal notice-pleading standards. See Swanson v. Citibank, N.A. , 614 F.3d 400, 404 (7th Cir. 2010).
PAR also maintains that Neals fails to allege that PAR collected her fingerprint in Illinois, noting that she fails to identify "where the alleged biometric identifier was stored by PAR." (Id. ) Neals contends that this assertion "makes no sense" because she "scanned her fingerprints at a PAR system sitting on a counter at a restaurant in Illinois." (ECF No. 25, Pl.'s Opp'n at 8.) Neals cites paragraph 28 of the complaint, which does not actually allege such facts. It alleges that "Charley's Philly Steaks required Neals to scan her fingerprint into the PAR POS system so that it could use it as an authentication method to track her time. PAR subsequently collected and stored Neals's biometric identifier into its database." In the Court's view, what is required for plaintiff to avoid application of the extraterritoriality doctrine lies somewhere in between the parties' positions. Contrary to Neals's characterization of her allegations, she does not allege that she scanned her fingerprints into PAR's system in Illinois. And, in light of the fact that Neals does not specify the location of the Charley's Philly Steaks at which she worked, the Court is unable to reasonably infer from the complaint that her fingerprint was collected in Illinois. If plaintiff were able to so allege, then she would sufficiently allege facts indicating that the circumstances relating to the alleged transaction occurred primarily and substantially in Illinois; the transaction would allegedly involve an Illinois resident having her biometric information collected in Illinois by a private entity, without the entity's having provided the requisite disclosures and obtained the requisite consent there. See Patel v. Facebook, Inc. , 932 F.3d 1264, 1275-76 (9th Cir. 2019) (rejecting Facebook's argument that because its servers are located outside Illinois, the necessary elements of a BIPA violation occurred extraterritorially, and reasoning that the Illinois legislature contemplated the statute's application to individuals who reside in Illinois and used Facebook in Illinois, even if some relevant activities occurred outside the state). Thus, the complaint will be dismissed with leave to amend.
Next, PAR asserts that the complaint should be dismissed because in the context of employment, the obligations of the BIPA do not apply to entities other than an employer. According to PAR, the Illinois legislature "did not contemplate a duplicative process by which the employer and a third-party technology vendor with no relationship or interaction with its customer's employees would both be required to provide notice and obtain consent from the employees." (Def.'s Mot. at 6.) This interpretation of the BIPA, however, has no support in the text of the statute. PAR argues that because the statute defines "written release" as "informed written consent or, in the context of employment, a release executed by an employee as a condition of employment," 740 ILCS 14/10, the only entity that could be liable for conduct violating the BIPA in the employment context is an individual's employer. That conclusion does not follow from the premise; the fact that the statute defines "written release" in a more particularized way for employment situations has no bearing on which entities face liability under the statute. PAR cites two state trial court decisions in support of its argument. To the extent those decisions stand for the proposition that the BIPA exempts a third-party non-employer collector of biometric information when an action arises in the employment context, the Court disagrees with those decisions because there is no textual support whatsoever for such a restricted view of the statute's application. The Court also rejects PAR's contention that it would be "absurd" to require both an employer and a third-party vendor who collect information from an employee to comply with the BIPA, because only the employer has a preexisting relationship with its employees. The statute obligates any private entity that collects a person's biometric information to comply with its requirements; the salient "relationship" is created by the act of collection. There is nothing absurd about that. The Court also rejects PAR's contention that it has "no feasible means to obtain informed consent." (Def.'s Mot. at 8.) That notion seems at odds with common sense, and in any event is beyond the scope of a motion to dismiss.
PAR's third and final argument is that Neals has not sufficiently alleged a negligent, reckless, or intentional violation of the BIPA because she does not allege actual damages, nor does she allege facts that would entitle her to statutory damages based on negligent or reckless violations of the Act. The Court disagrees. Under Rule 9, states of mind may be alleged generally, Fed. R. Civ. P. 9(b), so the issue is whether the complaint is facially plausible. As Judge Kennelly noted in a similar case, "the BIPA took effect more than ten years ago, and if the allegations of [the] complaint are true—as the Court must assume at this stage—[defendant] has made no effort to comply with its requirements. This is certainly enough, at the pleading stage, to make a claim of negligence or recklessness plausible." Rogers v. BNSF Ry. , No. 19 C 3083, 2019 WL 5635180, at *5 (N.D. Ill. Oct. 31, 2019). Rule 8 "does not demand that a plaintiff prove [her] case at the outset of the litigation," nor does it demand that a plaintiff plead facts that she has no way of knowing prior to discovery. Id.
The BIPA states that for each negligent violation of the Act, a prevailing party may recover liquidated damages of the greater of $1,000.00 or actual damages, and for each intentional or reckless violation of the Act, the greater of liquidated damages of $5,000.00 or actual damages. 740 ILCS 14/20(1), (2).
The complaint therefore is dismissed without prejudice, with leave to file by January 15, 2020 an amended complaint that alleges in what state the relevant transaction occurred (where plaintiff's fingerprint was scanned and collected) and amends the class definition accordingly.