Opinion
3:20-CV-00046-MAB
07-05-2023
MADISYN STAUFFER, ON BEHALF OF HERSELF AND ALL OTHERS SIMILARLY SITUATED, Plaintiffs, v. INNOVATIVE HEIGHTS FAIRVIEW HEIGHTS, LLC, ET AL., Defendants.
MEMORANDUM AND ORDER
MARK A. BEATTY UNITED STATES MAGISTRATE JUDGE.
Presently before the Court is Defendant Sky Zone Franchise Group, LLC's motion to dismiss the third amended complaint and supporting memorandum (Docs. 159, 160). For the reasons set forth below, the motion is GRANTED in part and DENIED in part.
Background
In April 2019, Plaintiff Madisyn Stauffer (“Plaintiff”) filed this case in the Twentieth Judicial Circuit, St. Clair County, Illinois, alleging Defendant Innovative Heights, LLC (“Innovative Heights”) violated the Illinois Biometric Privacy Act, 740 ILCS 14/1, et. seq. (“BIPA”) (Doc. 1-1, p. 2). To regulate the use of biometric identifiers, BIPA provides that a private entity in possession of biometric information “must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual's last interaction with the private entity, whichever occurs first.” 740 ILCS 14/15(a) (“Section 15(a)”). BIPA also outlines that a private entity may not “collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or information” unless it first informs that person, in writing, that such an identifier or information is being collected or stored and informs that person, in writing, of the purpose and length for which a biometric identifier or information is being used, collected, and stored. See 740 ILCS 14/15(b)(1). Additionally, BIPA provides that a private entity must receive a written release executed by the person who is the subject of the biometric identifier or information. 740 ILCS 14/15(b)(1)-(3) (“Section 15(b)”).
When citing to documents in the record, pinpoint citations are to the page numbers generated by CM/ECF.
Plaintiff's original complaint alleged Innovative Heights (Plaintiff's employer) collected and stored her and the other putative class members' fingerprints as part of their employment for timekeeping purposes in violation of BIPA (Doc. 1-1 at p. 4). While still in state court, Plaintiff sought leave to amend her complaint to include a second Defendant, Pathfinder Software LLC doing business as CenterEdge Software, LLC (“CenterEdge”), which Plaintiff alleges controls and operates the system and database where Innovative Heights' stores its employees' fingerprints (Id. at p. 93-94). Plaintiff alleged both Innovative Heights and CenterEdge violated Sections 15(a) and 15(b) of BIPA while scanning and storing fingerprints for timekeeping and other purposes (Doc. 1, p. 2). Plaintiff explained Innovative Heights and CenterEdge never informed her, in writing, the specific purpose of and the period for which her fingerprints were being collected, stored, or used in violation of BIPA (Doc. 1-1 at pp. 98-99). Plaintiff alleged two separate classes of individuals: those who were employed by Defendant Innovative Heights and worked at its Sky Zone facility in Fairview Heights, Illinois, and those individuals who had their fingerprints collected, captured, purchased, received through trade, or otherwise obtained by CenterEdge (Id. at p. 91).
After Plaintiff filed her amended complaint, CenterEdge removed the case on January 10, 2020, to the Southern District of Illinois pursuant to the Class Action Fairness Act (“CAFA”). See 28 U.S.C. §§ 1446; 1332(d)(2). Soon after, CenterEdge filed a motion to dismiss on February 5, 2020, while Plaintiff filed a motion to remand on March 12, 2020 (Docs. 21, 27). The Court granted Plaintiff's motion to remand in part. The Court kept Plaintiff's Section 15(b) BIPA claims as they relate to both Innovative Heights and CenterEdge, but remanded Plaintiff's Section 15(a) claims for lack of Article III standing (Doc. 43). Additionally, the Court denied CenterEdge's motion to dismiss (Id.).
Plaintiff's second amended complaint was filed on September 17, 2021 (Doc. 99). In that complaint, Plaintiff added a third Defendant, Sky Zone Franchise Group, LLC (“Sky Zone”), alleging a BIPA Section 15(b) violation. In adding Sky Zone, Plaintiff sought to represent three putative classes. The first are individuals who were employed by Innovative Heights, worked at its Sky Zone facility, and gave their fingerprints as part of their employment (Id. at p. 3). The second putative class are individuals who had their fingerprints and/or information collected and obtained by CenterEdge (Id.). The last class are individuals who had their fingerprints and/or information collected and obtained by Sky Zone (Id. at pp. 3-4).
In describing this new putative class, Plaintiff says that Sky Zone required Innovative Heights to use the CenterEdge system (Id. at p. 6). Furthermore, Plaintiff explained that Sky Zone retained “unlimited right to access all information contained in the system, including Plaintiff's and the class members' fingerprints and/or information used to identify such class members based on their fingerprints” (Id.). Plaintiff also outlined that Sky Zone required other Illinois franchisees to use the CenterEdge system and retained the “unlimited” right to access all of the information contained in the system for these other Illinois franchisees as well (Id. at p. 7). To further explain this relationship, Plaintiff alleged Sky Zone requires franchisees to enter into a franchise agreement where each Illinois franchisee must purchase equipment from certain companies designated by Sky Zone (Id. at p. 16).
On December 22, 2021, Sky Zone filed a motion to dismiss Plaintiff's Section 15(b) claim (Docs. 119, 120). After the matter was fully briefed (see docs. 122, 124, 130, 132), the Court granted Sky Zone's motion to dismiss Plaintiff's Section 15(b) claim (Doc. 142). Specifically, the Court held “Plaintiff failed to plead (or sufficiently raise the inference) that Sky Zone ever did anything to extract or obtain the biometric information from Innovative Heights' Center Edge System.” (Id. at p. 14). However, the Court's dismissal was without prejudice and gave Plaintiff an opportunity to cure the pleading deficiencies.
On August 19, 2022, Plaintiff filed a third amended complaint (Docs. 144, 153) and a motion for leave to file third amended complaint (Doc. 145). In the motion for leave, Plaintiff sought to include an additional allegation against Sky Zone and CenterEdge “related to their failure to comply with a retention/destruction policy and their unlawful retention of biometric data in violation of BIPA §15(a).” (Id. at pp. 2-3). In addition to alleging a new Section 15(a) violation against Sky Zone and CenterEdge, Plaintiff's third amended complaint provided detailed allegations as to how Sky Zone accessed her biometric data in violation of Section 15(b), including: “(a) remotely via the sharing and/or providing of information by CenterEdge; (b) remotely without CenterEdge via a TeamViewer or similar application in which SZFG ‘takes over,' remotely accesses, and/or controls its franchisees' computers; (c) remotely without CenterEdge via an independent download or transfer of data; and/or (d) in-person during a field consultant inspection.” (Doc. 153 at p. 23). Plaintiff's third amended complaint, however, has prompted a new motion to dismiss by Sky Zone, which is now fully briefed.
In an order dated September 1, 2022, the Court held: (1) Plaintiff's motion was largely moot because Plaintiff already had permission to amend her complaint; and (2) Plaintiff was permitted to assert new allegations consistent with discovery (Doc. 151). However, the order was predicated on an understanding that Plaintiff was not seeking to add additional claims. (Id.).
Significantly, while the above proceedings were ongoing, Plaintiff and Sky Zone were litigating a Section 15(a) BIPA claim in state court (St. Clair County Circuit Court). (See Docs 160-2, 160-3, 160-4). On September 1, 2021, Plaintiff filed a second amended class action complaint against Innovative Heights, CenterEdge, and Sky Zone in state court (Doc. 160-3). Sky Zone moved to dismiss the state court complaint and filed a memorandum in support on December 22, 2021 (Doc. 160-4). On July 22, 2022, the state court granted Sky Zone's motion to dismiss because, among other reasons, Plaintiff “has not alleged sufficient facts in Count III to allege possession of Plaintiff's biometric data under Section 15(a).” (Doc. 160-2 at p. 4). Additionally, the state court found Section 15(a)'s data destruction requirements would not apply to Sky Zone because Sky Zone would not know when the initial purpose for collecting the data had been satisfied and 3 years after the individual's last interaction with Sky Zone would never occur (Id. at pp. 4-5).
Legal Standard for Motion to Dismiss
A motion to dismiss under Rule 12(b)(6) addresses the legal sufficiency of the plaintiff's claim for relief, not the merits of the case or whether the plaintiff will ultimately prevail. Camasta v. Jos. A. Bank Clothiers, Inc., 761 F.3d 732, 736 (7th Cir. 2014); Gibson v. City of Chicago, 910 F.2d 1510, 1520 (7th Cir. 1990); see also Ctr. for Dermatology & Skin Cancer, Ltd. v. Burwell, 770 F.3d 586, 588 (7th Cir. 2014) (similarly explaining that a motion to dismiss under Rule 12(b)(1) tests the sufficiency of the complaint, not the merits of the case). In reviewing a motion to dismiss, the court accepts all well-pleaded facts as true and draws all reasonable inferences in the plaintiff's favor. E.g., Dix v. Edelman Fin. Servs., LLC, 978 F.3d 507, 512-13 (7th Cir. 2020). However, “legal conclusions and conclusory allegations . . . are not entitled to this presumption of truth.” Dix, 978 F.3d at 513 (quoting McCauley v. City of Chicago, 671 F.3d 611, 616 (7th Cir. 2011)). See also Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atlantic Corp. v. Twombley, 550 U.S, 555, 557 (2007)). “[W]hile a complaint does not need ‘detailed factual allegations' to survive a 12(b)(6) motion to dismiss, it must allege sufficient facts ‘to state a claim to relief that is plausible on its face.'” Dix, 978 F.3d at 512-13 (quoting League of Women Voters of Chicago v. City of Chicago, 757 F.3d 722, 724 (7th Cir. 2014)). Making the determination of plausibility is a “context-specific task that requires the reviewing court to draw on its judicial experience and common sense.” Iqbal, 556 U.S. at 679 (citation omitted).
Discussion
Sky Zone moves to dismiss Plaintiff's Section 15(a) and Section 15(b) claims against it. Specifically, Sky Zone argues Plaintiff's Section 15(a) claim should be dismissed because the Court lacks subject matter jurisdiction over the claim and Plaintiff is estopped from now arguing she suffered an injury-in-fact for purposes of Article III standing. Sky Zone also contends both of Plaintiff's Section 15(a) and Section 15(b) claims against it fail because Plaintiff has not plausibly alleged that Sky Zone actually collected Plaintiff's biometric data.
For the reasons outlined below, Sky Zone's motion to dismiss Plaintiff's Section 15(a) claim is GRANTED and Sky Zone's motion to dismiss Plaintiff's Section 15(b) claim is DENIED.
I. Injury under Section 15(a)
Section 15(a) may give rise to at least two different types of claims. See Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020), as amended on denial of reh'g and reh'g en banc (June 30, 2020). The first is a narrower claim that a private entity failed to “develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information[.]” 740 ILCS 14/15(a); see also Bryant, 958 F.3d at 626. The second is a claim that the defendant failed to comply with the “established retention schedule and destruction guidelines.” Bryant, 958 F.3d at 626.
Significantly, these two types of Section 15(a) claims are not equal. Claims merely asserting a defendant violated Section 15(a)'s duty to publicly disclose data retention and destruction protocols, without more, allege no particularized harm and therefore, do not confer Article III standing. See Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1154 (7th Cir. 2020); Bryant, 958 F.3d at 626 (“[T]he duty to disclose under section 15(a) is owed to the public generally, not to particular persons whose biometric information the entity collects. This provision is not part of the informed-consent regime, and Bryant alleges no particularized harm that resulted from Compass's violation of section 15(a).”). Meanwhile, claims that a defendant failed to comply with a data retention policy and destroy data are “broader” in nature and may result in a privacy injury. Fox, 980 F.3d at 1154; Bryant, 958 F.3d at 626 (“Importantly, Bryant alleged only a claim under the provision of that section requiring development of a ‘written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information,' not under the provision requiring compliance with the established retention schedule and destruction guidelines.”).
II. Plaintiff's state court proceedings and leave to amend
Plaintiff's prior Section 15(a) claim brought against Sky Zone in state court dealt with the narrower allegation that Sky Zone failed to create and publicly disclose a data retention policy (Doc. 160-3 at p. 22). In contrast, the Section 15(a) claim in Plaintiff's third amended complaint alleges Sky Zone: (1) failed to develop and publicly disclose a data retention policy; and (2) failed to permanently destroy the biometric data in the period required by Section 15(a) (Doc. 153 at p. 36). Based upon this distinction, the question is whether Plaintiff can raise a new, broader Section 15(a) violation at this point in her case against Sky Zone. Ultimately, due to the Court's prior orders regarding Plaintiff's third amended complaint, the state court's order, and Plaintiff's prior representations to the Court, the Court concludes that Plaintiff may not raise a new, broader Section 15(a) claim at this point in the proceedings. Consequently, Sky Zone's motion to dismiss Plaintiff's Section 15(a) claim will be granted.
To be clear, the Court is not ruling on whether Plaintiff could have raised such a claim against Sky Zone at an earlier point in litigation. Instead, the Court is only considering the much narrower question of whether it is appropriate for Plaintiff to raise this claim now, in light of the state court ruling, Plaintiff's prior representations to the Court, and the Court's orders allowing Plaintiff to file a third amended complaint.
Federal courts must give full faith and credit to state court rulings. See 28 U.S.C. § 1738. (“Such Acts, records and judicial proceedings or copies thereof, so authenticated, shall have the same full faith and credit in every court within the United States and its Territories and Possessions as they have by law or usage in the courts of such State, Territory or Possession from which they are taken.”). In an order dated July 22, 2022, the state court granted Sky Zone's motion to dismiss, finding: (1) the allegations raised by Plaintiff before the state court did not amount to allegations of actual direct possession; and (2) “[w]ithout actual direct possession of the data, Sky Zone cannot destroy it. Innovative Heights collects the information. Sky Zone does not. . . . It therefore follows that Sky Zone would not know when the initial purpose for collecting the information has been satisfied, and 3 years after the last interaction with Sky Zone would never occur.” (Doc. 160-2 at pp. 4-5). In other words, based upon Plaintiff's prior representations, the state court found Sky Zone could not know when it would be required to destroy Plaintiff's biometric data. Therefore, while Plaintiff was permitted to amend her complaint, the simple fact is that the state court's finding - that Sky Zone lacked the necessary information to comply with Section 15(a)'s destruction requirements - cannot be ignored.
Furthermore, in permitting Plaintiff to amend her complaint, the Court stated Plaintiff's new allegations must be consistent with discovery (Doc. 151). Yet, in her third amended complaint, Plaintiff failed to provide any explanation as to what discovery prompted her new, broader claim under Section 15(a). Plaintiff has been litigating with Sky Zone in St. Clair County since September 2021. To justify permitting new, broader claims being raised only after the state court granted Sky Zone's motion to dismiss, the Court required Plaintiff to explain what discovery prompted the new allegations. Yet, Plaintiff failed to do so. Similarly, Plaintiff provides no explanation as to why she never previously raised her broader Section 15(a) claim in state court. See Rockstead v. City of Crystal Lake, 486 F.3d 963, 968 (7th Cir. 2007) (“The failure to complain of the taking under federal as well as state law is a case of ‘splitting' a claim, thus barring by virtue of the doctrine of res judicata a subsequent suit under federal law.”).
General principles of fairness also support granting Sky Zone's motion to dismiss Plaintiff's Section 15(a) claims. Significantly, although Plaintiff did not previously advance a Section 15(a) claim against Sky Zone in federal court, Plaintiff has done so against CenterEdge. See Stauffer v. Pathfinder Software, LLC et al., SDIL Case No. 20-cv-01332-MAB . In fact, when CenterEdge sought removal to federal court, it was Plaintiff who opposed, arguing, “Fox does not support the existence of Article III standing as to Plaintiff's § 15(a) claims, because here, unlike Fox, Plaintiff does not allege particularized harm based on violation of the data retention requirements of § 15(a).” (Id. at Doc. 29) (citing Fox, 980 F.3d 1146). Yet, without any justification, Plaintiff's third amended complaint reverses course and alleges, “Center Edge further failed to permanently destroy the biometric identifiers and/or biometric information of Plaintiff and the Center Edge Class in the period required by BIPA § 15(a).” (Doc. 153 at p. 34). Plaintiff goes on to explain that such a failure posed “a material risk of harm, to the concrete privacy interests of Plaintiff[.]” (Id.). Ultimately, the timing of Plaintiff's decision to now raise a broader Section 15(a) claim against Sky Zone and CenterEdge cannot go unnoticed. If Plaintiff wished to properly raise this claim before the Court, Plaintiff should not have previously taken a contrary position and then waited until after the state court's adverse judgment to change course. See generally Lumen Const., Inc. v. Brant Const. Co., 780 F.2d 691, 694 (7th Cir. 1985) (“The legitimacy of the court system in the eyes of the public and fairness to the individual litigants also are endangered by duplicative suits that are the product of gamesmanship or that result in conflicting adjudications.”); Cunningham Charter Corp. v. Learjet, Inc., 592 F.3d 805, 807 (7th Cir. 2010) (“[L]itigation is not pingpong.”); Spaine v. Cmty. Contacts, Inc., 756 F.3d 542, 547 (7th Cir. 2014) (“The doctrine of judicial estoppel prevents litigants from manipulating the judicial system by prevailing in different cases or phases of a case by adopting inconsistent positions.”).
The Court is not accusing any party of gamesmanship or forum shopping. Instead, the Court is only citing principles of fairness, in light of the case's unique procedural history and Plaintiff's prior contrary position, as an additional justification for its ruling.
For all these reasons, Sky Zone's motion to dismiss the Section 15(a) claim in Plaintiff's third amended complaint is granted.
III. Section 15(b) “active step”
Sky Zone's motion to dismiss argues Plaintiff's third amended complaint failed to correct the deficiencies that resulted in the Court granting Sky Zone's prior motion to dismiss Plaintiff's Section 15(b) claim. Sky Zone further contends Plaintiff's new allegations are unsubstantiated and fail to sufficiently allege possession or collection as required by Section 15(b). In response, Plaintiff claims her third amended complaint plausibly alleges Sky Zone accessed her biometric data through one of the several methods Sky Zone created to do so.
Section 15(b) of BIPA states a private entity may not “collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or information” unless it first informs that person, in writing, that such an identifier or information is being collected or stored and informs that person, in writing, of the purpose and length for which a biometric identifier or information is being used, collected, and stored. See 740 ILCS 14/15(b)(1). As the Court has previously explained, in order to violate Section 15(b), a defendant is required to take an “active step” to collect, capture, or otherwise obtain a party's biometric information (Doc. 142 at pp. 7-9). See also Heard v. Becton, Dickinson & Co. (“Heard I"), 440 F.Supp.3d 960, 966 (N.D. Ill. 2020) (“The court concludes that for Section 15(b)'s requirements to apply, an entity must, at a minimum, take an active step to ‘collect, capture, purchase, receive through trade, or otherwise obtain' biometric data.”). Accordingly, the Court found Plaintiff's second amended complaint had not adequately alleged Sky Zone took an active step to collect or obtain her data because Plaintiff merely alleged Sky Zone could access her biometric data one day (Doc. 142 at p. 13). Plaintiff “failed to plead (or sufficiently raise the inference) that Sky Zone ever did anything to extract or obtain the biometric information from Innovative Heights' CenterEdge System.” (Id. at p. 14) (citing Heard v. Becton, Dickinson & Co. (“Heard II"), 524 F.Supp.3d 831, 840 (N.D. Ill. 2021)).
The analysis and distinction between Heard I and Heard II is instructive. In Heard I, the plaintiff alleged his biometric data had been collected in violation of Section 15(b) through an automated dispensing system manufactured by the defendant, which required a fingerprint for access. 440 F.Supp.3d at 962. The plaintiff used the device at multiple hospitals. Id. After determining an “active step" was required to violate Section 15(b), the court found the plaintiff failed to adequately plead that the defendant took an active step by not alleging “how, when, or any other factual detail." Id. at 966. However, in granting the defendant's motion to dismiss, the court permitted the plaintiff to file an amended complaint. Id. at 969. After doing just that, the court was tasked with determining whether the plaintiff's amended complaint stated a claim under Section 15(b). Heard II, 524 F.Supp.3d at 840. This time, the court found the plaintiff's Section 15(b) claim to be sufficient because the plaintiff “added several allegations that, while subtle, push this claim ‘across the line from conceivable to plausible.'” Id. (“The [first amended complaint] clarifies that when a user enrolls in a Pyxis system, [the defendant] stores users' fingerprints on both the Pyxis devices and [defendant's] servers.”). Thus, the amended complaint adequately alleged the defendant played an “active role” in collecting or obtaining the plaintiff's biometric data. Id. at 841.
Here, just as in Heard II, Plaintiff has now plausibly alleged Sky Zone took an active step in collecting or obtaining her data. For one, Plaintiff now alleges Sky Zone was in actual possession of her biometric data. And perhaps more importantly, Plaintiff alleges several plausible ways Sky Zone came to be in actual possession of her biometric data. In particular, Plaintiff alleged Sky Zone obtained her biometric data: “(a) remotely via the sharing and/ or providing of information by CenterEdge; (b) remotely without CenterEdge via a TeamViewer or similar application in which SZFG ‘takes over,' remotely accesses, and/or controls its franchisees' computers; (c) remotely without CenterEdge via an independent download or transfer of data from the CenterEdge System; and/or (d) in-person during a field consultant inspection of the CenterEdge System.” (Doc. 153 at p. 7). With the methods Plaintiff alleges Sky Zone secured, “[i]t is entirely plausible that [Plaintiff's] biometric information is stored” on Sky Zone's computers or servers. Heard II, 524 F.Supp.3d. at 841.
Furthermore, the Court is not persuaded by Sky Zone's argument that Plaintiff's third amended complaint only alleges ways Sky Zone might be able to inspect, access, or collection information from Innovative Heights or CenterEdge (Doc. 160 at p. 19). A comparison of the Plaintiff's second amended complaint and third amended complaint clearly highlights the key distinctions. For example, Plaintiff's second amended complaint alleged franchisees could be required to turn over their computer data to Sky Zone and Sky Zone had an unlimited right to access her biometric data (Doc. 99 at p. 18). In sharp contrast, Plaintiff's third amended complaint alleges Sky Zone actually accessed her biometric data, in addition to providing plausible ways Sky Zone may have done so (Doc. 153 at pp. 19-26). For these reasons, Sky Zone's motion to dismiss Plaintiff's Section 15(b) claims is DENIED.
Conclusion
Sky Zone's motion to dismiss (Doc. 159) is GRANTED in part and DENIED in part. It is GRANTED with respect to Plaintiff's Section 15(a) claim, which is DISMISSED with prejudice. It is DENIED with respect to Plaintiff's Section 15(b) claim.
IT IS So ORDERED.