Summary
In Wordlaw, the plaintiff alleged that, as part of her employment, she was required to use a biometric scanning device that scanned her fingerprints at the beginning and end of her shift.
Summary of this case from Robinson v. Lake Ventures LLCOpinion
No. 20 CV 3200
12-21-2020
MEMORANDUM OPINION AND ORDER
While working at an Enterprise car-rental facility in Cook County, Dawon Wordlaw scanned her fingerprints to clock in and out of each shift. She claims that Enterprise Leasing Company of Chicago, LLC, and its parent company, Enterprise Holdings, Inc., used this timekeeping system to impermissibly collect, retain, and share her fingerprints without her informed consent. Wordlaw sued both Enterprise Chicago and Enterprise Holdings for violating the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. Defendants move dismiss under Federal Rule of Civil Procedure 12(b)(6). The motion is denied.
I. Legal Standards
A complaint must contain a short and plain statement that plausibly suggests a right to relief. Fed. R. Civ. P. 8(a)(2); Ashcroft v. Iqbal, 556 U.S. 662, 677-78 (2009). To survive a motion to dismiss for failure to state a claim, a plaintiff must allege facts sufficient "to raise a right to relief above the speculative level." Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007). When evaluating a Rule 12(b)(6) motion, a court accepts all factual allegations as true and draws all reasonable inferences in the plaintiff's favor, but the court need not do the same for legal conclusions or "threadbare recitals" supported by only "conclusory statements." Iqbal, 556 U.S. at 678, 80-82. In other words, a plaintiff must provide "more than labels" or "a formulaic recitation of a cause of action's elements," and the complaint must "contain either direct or inferential allegations respecting all the material elements necessary to sustain recovery under some viable legal theory." Twombly, 550 U.S. at 555, 562.
II. Facts
Enterprise Chicago and its parent company, Enterprise Holdings, operate car-rental services in Illinois. [21] ¶ 15. Wordlaw worked at defendants' facility in Cook County. Id. ¶ 25. She received her paychecks from Enterprise Chicago, but Enterprise Holdings controlled her work environment, including timekeeping, privacy, and employee behavior and discipline. Id. ¶ 26. According to the complaint, Enterprise Holdings "exercised primary, if not exclusive, control over" Enterprise Chicago's "practices with respect to employee privacy matters and other employment conditions." Id. ¶ 22.
Bracketed numbers refer to entries on the district court docket. Referenced page numbers are taken from the CM/ECF header placed at the top of filings. Facts are taken from the first amended complaint [21] and plaintiff's opposition to the motion to dismiss [28].
Allegedly, Enterprise Holdings directed employee-management and privacy policies for its regional subsidiaries, including Enterprise Chicago. Id. ¶¶ 21-23. Enterprise Holdings's Code of Conduct, for example, referred to itself and its subsidiaries as one "Company." [21] ¶ 17; [21-1] at 3. The Code applied to all, "regardless of our position within the Company." [21] ¶ 18; [21-1] at 6. And the Code assured that Enterprise Holdings and its subsidiaries were "committed to protecting the privacy of its employees' private information," which the company protected "by limiting access to those who have a business need to know it, securing the systems that transmit or store it, and ensuring our use of the information complies with privacy laws." [21] ¶¶ 19-20; [21-1] at 16, 18.
The complaint does not distinguish between the two defendants in its central allegations. In 2016, the defendants started using biometric scanning and time-tracking devices to monitor workers' hours at the Cook County facility. [21] ¶¶ 5, 25. The new system required Wordlaw and other employees to scan their fingerprints each shift when they clocked in, and again when they clocked out. Id. ¶ 27. The defendants did not inform Wordlaw in writing that her biometric data were being collected or the purpose of the collection. Id. ¶ 29. Nor did the defendants seek or obtain her written consent, or disclose material information about retention, disclosure, and destruction of her biometric data. Id. ¶¶ 29-31. Defendants also did not make public any written policy on the company's retention and destruction of biometric data. Id. ¶ 31. Wordlaw was nevertheless required to scan her fingerprints each shift until she left in 2019. Id. ¶ 27. Without obtaining Wordlaw's written consent, defendants not only collected and retained this information, but they also shared it with third parties, including other Enterprise subsidiaries, data storage vendors, and payroll service providers. Id. ¶¶ 5, 32.
Wordlaw brings a claim against defendants under the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. She argues, in essence, that defendants' collection, retention, and dissemination of her fingerprints failed to comply with BIPA's written notice and consent requirements. Id. ¶¶ 42-52; [28] at 2-3. Defendants move to dismiss under Federal Rule of Civil Procedure 12(b)(6).
III. Analysis
Defendants make four arguments to support the motion: (1) the Illinois Workers' Compensation Act, 820 ILCS 305, preempts plaintiff's BIPA claim; (2) plaintiff fails to allege a BIPA violation against either defendant; (3) plaintiff fails to state a claim against Enterprise Holdings; and (4) plaintiff fails to plead intentionality or recklessness under BIPA. None justify dismissal of the complaint.
A. Illinois Workers' Compensation Act
Preemption under the Workers' Compensation Act is an affirmative defense. Baylay v. Etihad Airways P.J.S.C., 881 F.3d 1032, 1039 (7th Cir. 2018). A plaintiff need not anticipate affirmative defenses in a complaint, and a claim will be dismissed on a Rule 12(b)(6) motion "only where 'the allegations of the complaint itself set forth everything necessary to satisfy the affirmative defense.'" Chicago Bldg. Design, P.C. v. Mongolian House, Inc., 770 F.3d 610, 614 (7th Cir. 2014) (quoting United States v. Lewis, 411 F.3d 838, 842 (7th Cir. 2005)).
The Workers' Compensation Act does not preempt Wordlaw's BIPA claim. The Act generally provides "the exclusive means" for an employee to recover against an employer for work-related injuries. Folta v. Ferro Engineering, 2015 IL 118070, ¶ 14 (citing Meerbrey v. Marshall Field and Co., Inc., 139 Ill.2d 455, 462 (1990)). But it does not preempt independent-tort claims if (among other exceptions) an employee can establish that the injury was not accidental or was not compensable under the Act. Id. Accidental is not a "technical legal term but encompasses anything that happens without design or an event which is unforeseen by the person to whom it happens." Pathfinder Co. v. Industrial Commission, 62 Ill.2d 556, 563 (1976) (quoting International Harvester Co. v. Industrial Commission, 56 Ill.2d 84, 88 (1973)). Compensable injuries are those suffered in the line of duty during the course of employment, but the test for "whether an injury is compensable is related to whether the type of injury categorically fits within the purview of the Act." Folta, 2015 IL 118070, ¶ 23.
The alleged BIPA violations here were no accident. Rather, they were the product of a company policy that "intentionally collected employee fingerprints for purposes of maintaining a biometric timekeeping system." Burlinski v. Top Golf USA Inc., No. 19-CV-06700, 2020 WL 5253150, at *5 (N.D. Ill. Sept. 3, 2020). I agree with those courts that have rejected the preemption defense for similar BIPA claims. See id. (employer policy of collecting employee fingerprints for timekeeping was not accidental); Treadwell v. Power Solutions International, Inc., 427 F.Supp.3d 984, 990 (N.D. Ill. 2019) (same).
Further, BIPA injuries are not compensable under the Workers' Compensation Act. Intangible injuries may be compensable under the Act if tied to "a sudden, severe emotional shock traceable to a definite time, place and cause which causes psychological injury or harm has suffered an accident within the meaning of the Act, though no physical trauma or injury was sustained." Pathfinder, 62 Ill.2d at 563. The privacy injuries BIPA protects are not the kind of intangible injuries compensable under the Workers' Compensation Act. See McDonald v. Symphony Bronzeville Park LLC, 2020 IL App (1st) 192398, ¶¶ 27-28 (holding that BIPA injuries are "simply not compensable under the [Workers'] Compensation Act" and noting the unanimity of Illinois trial courts in "reaching the same general conclusion"); Cothron v. White Castle System, Inc., 467 F.Supp.3d 604, 615-16 (N.D. Ill. 2020) (collecting federal and state cases to show that "courts have unanimously rejected" the idea that BIPA claims are preempted by the Workers' Compensation Act).
The BIPA claim is not preempted.
B. Biometric Information Privacy Act
BIPA protects individuals' uniquely sensitive privacy interests in their personal biometric information, including their fingerprints. 740 ILCS 14/5-14/10. The statute is enforced through a private right of action, available to "[a]ny person aggrieved by a violation." Id. § 14/20.
Section 15—BIPA's substantive core—places restrictions on the collection, retention, and disclosure of biometric information. Three subsections are relevant here. First, section 15(a) requires private entities that possess biometric information to develop a publicly available written policy, establishing a retention schedule and guidelines for destroying the information. Id. § 14/15(a). Next, section 15(b) requires private entities seeking to collect biometric information to first (1) inform the person whose biometrics are being collected, in writing, that the information is being collected or stored; (2) inform the person in writing of the "specific purpose and length of term" for which the biometrics are being collected, stored, and used; and (3) receive a written release from the person. Id. § 14/15(b). This "informed-consent regime ... is the heart of BIPA." Bryant v. Compass Group USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020) (citing Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186). Finally, section 15(d) prohibits private entities in possession of a person's biometric data from disclosing or disseminating it without the person's consent. 740 ILCS 14/15(d).
The complaint asserts that defendants' fingerprint-timekeeping system violated sections 15(a), (b), and (d) of BIPA. Defendants argue that the complaint fails to allege a BIPA violation against either defendant because plaintiff engages in improper group pleading, and also fails to allege any facts showing that defendants collected, possessed, or disclosed plaintiff's biometric data in violation of section 15. [26] at 13-18; [29] at 12-15.
To start, there's no impermissible group pleading here. When a plaintiff brings claims against multiple defendants, "[e]ach defendant is entitled to know what he or she did that is asserted to be wrongful." Bank of America, N.A. v. Knight, 725 F.3d 815, 818 (7th Cir. 2013). Plaintiff has provided both defendants with sufficient notice of wrongdoing. The complaint asserts that the fingerprint-timekeeping system did not comply with BIPA. Plaintiff plausibly alleges that this system was in effect at the Cook County facility for at least three years. [21] ¶¶ 25-27. And she alleges that Enterprise Holdings and Enterprise Chicago jointly operated this facility, with the former controlling her work environment and setting employee privacy policy, and the latter signing her paychecks. Id. ¶¶ 15, 26. Plaintiff is saying, in other words, that she plans to prove that both defendants violated BIPA, even though she is currently unable to allege which one in particular installed and controlled the timekeeping system. [28] at 8. For now, Wordlaw has alleged enough to put both defendants on notice of their alleged wrongdoing. Under Federal Rule of Civil Procedure 11, Wordlaw's lawyers certified that their factual contentions have or are likely to have evidentiary support—they accuse both defendants of collecting, possessing, and disclosing biometric information, and I expect that they've leveled such accusations in good faith.
As for the substance of plaintiff's BIPA claims, the complaint plausibly states a claim under sections 15(a), (b), and (d). Most clearly, plaintiff alleges that while working at the Cook County facility from 2016 to 2019, her fingerprints were daily collected without her written consent, and without written notice of the collection or the purpose behind it. Id. ¶¶ 25-32. This is sufficient to state a claim for unlawful collection under section 15(b). See Bryant, 958 F.3d at 626 (failure to follow the requirements of section 15(b) before collecting fingerprints denies individuals "the opportunity to consider whether the terms of that collection and usage were acceptable given the attendant risks").
Plaintiff also adequately alleges unlawful retention under section 15(a). Unlawful retention of biometrics "inflicts a privacy injury in the same sense that an unlawful collection does." Fox v. Dakkota Integrated Systems, LLC, 980 F.3d 1146, 1154 (7th Cir. 2020); see also id. at 1154-55 ("Just as section 15(b) expressly conditions lawful collection of biometric data on informed consent, section 15(a) expressly conditions lawful retention of biometric data on the continuation of the initial purpose for which the data was collected."). Here, plaintiff alleges that although defendants collected her fingerprints each shift, they failed to provide a biometric retention schedule—publicly or otherwise—detailing who possessed the information, the length of time for its storage, or guidelines for its permanent destruction. [21] ¶¶ 31, 37(b), 47(e). A reasonable inference follows: absent a written policy or guidelines ensuring compliance, defendants' retention of plaintiff's fingerprint did not comport with BIPA. See Fox, 980 F.3d at 1155 ("The BIPA requirement to implement data retention and destruction protocols protects a person's biometric privacy just as concretely as the statute's informed-consent regime."). Defendants argue, however, that section 15(a) is inapplicable because plaintiff fails to allege "a single fact" showing that defendants "ever took 'possession' of her purported biometric data." [26] at 17. Not so. Defendants' collection of plaintiff's fingerprints at the beginning and end of each shift raises a reasonable (and obvious) inference that, once collected, defendants possessed the fingerprint data. The data needed to be possessed to connect an employee to the hours worked—the purpose of the timekeeping system implies possession.
Finally, the complaint sufficiently alleges that the defendants disseminated plaintiff's fingerprint data in violation of section 15(d). Plaintiff claims that defendants shared her biometrics with "third parties, such as other Enterprise subsidiaries, data storage vendors, and payroll service providers" without her consent. [21] ¶ 5; see also id. ¶ 30. Defendants question the sufficiency of this allegation, which is based "upon information and belief and "fails to allege any specifics relative to the alleged disclosure of information." [26] at 18. But Wordlaw is not required to include "detailed factual allegations" in her complaint. See Alexander v. United States, 721 F.3d 418, 422 (7th Cir. 2013). Instead, Wordlaw need only "give enough details about the subject-matter of the case to present a story that holds together." Swanson v. Citibank, N.A., 614 F.3d 400, 404 (7th Cir. 2010). Plaintiff has done so here. Defendants implemented a timekeeping system that collected her biometrics and then shared them—without her consent—with subsidiaries, data storage vendors, and payroll service providers. Plaintiff will have to prove unlawful dissemination to prevail, but more detail about how she will do that is not necessary at this stage of the case.
C. The Claim Against Enterprise Holdings
Defendants next argue that Enterprise Holdings had nothing to do with the timekeeping system and should be dismissed as a party. Plaintiff's BIPA claim against Enterprise Holdings hinges on two theories. The first is that Enterprise Holdings directly collected, possessed, and disseminated her fingerprints; the second, alternative ground, is that Enterprise Holdings either: (1) specifically directed Enterprise Chicago's timekeeping policy, making it as a direct-participant in the BIPA violation, or (2) exercised sufficient control over plaintiff to make it liable as her joint employer. The overarching inquiry for each, though, is whether Enterprise Holdings was sufficiently involved in the Cook County facility's fingerprint-timekeeping system. There's enough in the complaint to plausibly suggest that it was.
1. Direct Liability Under BIPA
Wordlaw first claims that Enterprise Holdings directly violated BIPA because Enterprise Holdings itself operated the timekeeping system. She points to its Code of Conduct, which she reads as portraying Enterprise Holdings and its subsidiaries as a single company and providing "clear indications that Enterprise Holdings is the primary decision-maker with respect to implementing uniform privacy practices ... across its regional subsidiaries, including Enterprise Chicago." [28] at 5. As plaintiff sees it, the Code makes "it is entirely plausible that certain aspects of the biometric practices at issue were conducted by Enterprise Holdings." Id. at 7. The complaint also draws on plaintiff's personal experience at the Cook County facility, and claims that Enterprise Holdings exerted primary control over her work environment. [21] ¶ 26. This is enough, plaintiff argues, to support an inference that Enterprise Holdings was responsible for the timekeeping system, especially when plaintiff has been "unable to allege which particular entity included in the 'Company' installed and controlled [the system]" because defendants failed to make required disclosures under BIPA. [28] at 8. Defendants counter that the complaint fails to allege that Enterprise Holdings had any role in the implementation, maintenance, or operation of the fingerprint-timekeeping system. [26] at 8-13.
Plaintiff's heavy reliance on the Code of Conduct is misguided. The Code does not suggest that Enterprise Holdings controls each individual subsidiary, nor does it plausibly show that Enterprise Holdings was responsible for the timekeeping system at the Cook County facility. Rather, it appears to be a general statement of Enterprise Holdings's principles, providing guidance to employees, subsidiaries, and other affiliates. See [21-1] at 6 ("[T]his document is intended as a guideline for achieving and maintaining the highest ethical business practices."). While it states that the company follows privacy laws and protects employees' private information, Wordlaw thinks that means that Enterprise Holdings "directed the installation of biometric timekeeping devices across its subsidiaries" and managed "the storage and dissemination of its employees' biometric information." [28] at 6. That leap is not a reasonable inference from the generic guideline in the Code. The Code does not tell us whether Enterprise Holdings directed and managed the biometric timekeeping at the Cook County facility.
But Wordlaw's factual allegations about her work environment do. Plaintiff alleges that Enterprise Holdings "exercised primary, if not exclusive, control over" Enterprise Chicago's practices "with respect to employee privacy matters and other employment conditions." [21] ¶ 22. More specifically, she alleges that "her work environment, including ... employee timekeeping, employee privacy, employee discipline, and the scope of acceptable employee behavior, were controlled by" Enterprise Holdings. Id. ¶ 26. These are specific factual statements that, at this stage, must be accepted as true. And if Enterprise Holdings controlled employee timekeeping and privacy matters at the Cook County location while plaintiff worked there, then it's plausible that Enterprise Holdings administered the timekeeping system and unlawfully collected her fingerprint scans. To recover against Enterprise Holdings, plaintiff will of course need to prove her allegations of control. But the complaint states a plausible BIPA claim against Enterprise Holdings.
2. Direct-Participant or Joint-Employer Liability
Because plaintiff plausibly states a claim against Enterprise Holdings for directly violating BIPA, plaintiff's alternative theories of liability do not provide grounds for dismissal. I briefly discuss them here, however, because plaintiff acknowledges that discovery may reveal that Enterprise Holdings did not directly collect, retain, and disclose biometric data. If that happens, she argues that recovery is still possible under a direct-participant or joint-employer theory of liability.
Defendants argue that BIPA does not permit vicarious liability. [26] at 10-11 ("There are no articulated avenues of liability in BIPA covering a company that is merely related to an entity which allegedly engages in conduct regulated by the BIPA if the related company does not engage in such activities itself."). Of course, mere relation would not suffice to establish liability. But while BIPA is limited to "private entities," the text does not close the door on traditional theories of agency liability.
Illinois courts recognize the theory of direct-participant liability as an exception to the general rule that a parent is not liable for the actions of its subsidiary. Forsythe v. Clark USA, Inc., 224 Ill.2d 274, 290 (2007). Under the theory, a plaintiff must show "a parent's specific direction or authorization of the manner in which an activity is undertaken" and that the injury that resulted was foreseeable. Id. But direction or authorization from a parent must surpass "the control exercised as a normal incident of ownership in disregard for the interests of the subsidiary." Id.
To determine whether a joint-employer relationship exists, Illinois courts consider whether "two or more employers exert significant control over the same employees—where from the evidence it can be shown that they share or co-determine those matters governing essential terms and conditions of employment." Village of Winfield v. Ill. State Labor Relations Bd., 176 Ill.2d 54, 60 (1997) (quoting Orenic v. Ill. State Labor Relations Bd., 127 Ill.2d 453, 474 (1989)). Relevant factors include the "putative joint employer's role in hiring and firing; promotions and demotions; setting wages, work hours, and other terms and conditions of employment; discipline; and actual day-to-day supervision and direction of employees on the job." Id.
The direct-participant and joint-employer theories require fact-intensive inquiries. As such, plaintiff's success will rise and fall with her ability to show that Enterprise Holdings specifically directed the timekeeping policies of Enterprise Chicago—or significantly controlled her work environment—during her tenure. Like her allegations of direct liability under BIPA, reliance on the Code of Conduct is largely a distraction. Plaintiff argues, for example, that the Code "admits" that Enterprise Holdings was plaintiff's employer and "satisfies the vast majority of the factors courts consider with respect to the joint-employer determination." [28] at 10-11 (emphasis omitted). But the Code alone does not establish that Enterprise Holdings in fact exerted significant control over plaintiff at the Cook County facility. The Code's references to the company as a single unit don't suggest anything more than an ordinary parent-subsidiary relationship. To prove one of her alternative theories of liability, Wordlaw will have to rely on other evidence specifically showing that Enterprise Holdings authorized or directed the timekeeping policy, or that it was so involved with the day-to-day that it was a joint employer.
On the other side, plaintiff's joint-employer theory is not precluded. Defendants argue that In re Enterprise Rent-A-Car Wage & Hour Employment Practices Litigation, 683 F.3d 462 (3d Cir. 2012), "definitively held" that Enterprise Holdings is not a joint employer of its subsidiaries' employees. [29] at 11 (emphasis omitted); see also [26] at 11. But that case doesn't bar plaintiff from pursuing a joint-employer theory under Illinois law. Instead, the Third Circuit there held that, under the Fair Labor Standards Act, 29 U.S.C. § 201 et seq., Enterprise Holdings was not a joint employer of its subsidiaries' assistant branch managers. In re Enterprise, 683 F.3d at 471. The case has no preclusive effect over plaintiff's claim because she was not a party to it. See Adair v. Sherman, 230 F.3d 890, 893 (7th Cir. 2000) (issue preclusion applies only when, among other things, "the party against whom estoppel is invoked was represented in the prior action."). Further, the court's determination based on the factual record before it says nothing about the relationship between Enterprise Holdings, Enterprise Chicago, and employees at the Cook County facility from 2016 to 2019.
Plaintiff has alleged that Enterprise Holdings significantly controlled her work environment in several important ways. If she can prove these allegations with facts, neither BIPA nor In re Enterprise prevents her from pursuing a claim on a joint-employer theory.
D. State of Mind
BIPA establishes a two-tiered regime for statutory damages. 740 ILCS 14/20. Private entities that negligently violate BIPA are on the hook for at least $1,000 in liquidated damages per violation, but if a violation is intentional or reckless, that amount jumps to $5,000. Id. § 14/20(1)-(2). The Act also provides that for each violation—regardless of mental state—a plaintiff may recover reasonable attorneys' fees and costs or "other relief, including an injunction." Id. § 14/20(3)-(4). Defendants argue that plaintiff has failed to plead that the alleged violations were reckless or intentional. [26] at 19. They claim that because the complaint "is devoid of any assertions to support her claim that Defendant acted recklessly or intentionally," the enhanced-damages request should be stricken or dismissed. [29] at 15-16.
Defendants' argument starts from a faulty premise: that BIPA's relief provisions create distinct legal claims. They don't. Instead, "a complaint asserting only one legal right, even if seeking multiple remedies for the alleged violation of that right, states a single claim for relief." Liberty Mutual Insurance Co. v. Wetzel, 424 U.S. 737, 743 n.4 (1976). And Rule 12(b)(6) doesn't authorize "piecemeal dismissals of parts of claims; the question at this stage is simply whether the complaint includes factual allegations that state a plausible claim for relief." BBL, Inc. v. City of Angola, 809 F.3d 317, 325 (7th Cir. 2015) (citation omitted). Wordlaw has plausibly alleged violations of her rights under section 15. That violation entitles her to some form of relief under section 20, and defendants are on notice that Wordlaw intends to pursue heightened damages under section 20(2). See Cothron, 467 F.Supp.3d at 615 (N.D. Ill. 2020) ("[I]f the complaint plausibly pleads violations of [section 15] ... then, even absent specific allegations about ... mental state with respect to each of those claims, it has stated a claim entitling [plaintiff] to litigation expenses and injunctive relief under section 20."). At the pleading stage, plaintiff need do no more.
Moreover, plaintiff has adequately alleged that defendants' BIPA violations were at least negligent, if not reckless or intentional. The defendants implemented a timekeeping policy that daily collected employee fingerprints from at least 2016 to 2019. They did so in Cook County, years after BIPA took effect, and all while claiming to comply with all privacy laws. See [28] at 14. The complaint's allegation that in 2016, "defendants knew, or were reckless in not knowing" that the timekeeping system was subject to BIPA's requirements is plausible. [21] ¶ 50. Yet defendants made no effort to comply with BIPA. This is enough to allege a negligent, reckless, or intentional violation.
Defendants' request to strike or dismiss plaintiff's damages request is denied.
IV. Conclusion
Defendants' motion to dismiss, [25], is denied. Defendants shall answer the complaint by January 11, 2021, and the parties shall file a joint status report with a proposed discovery schedule on January 19, 2021. ENTER:
/s/_________
Manish S. Shah
United States District Judge Date: December 21, 2020