Opinion
Case No. 1:21-cv-01092
04-28-2021
CHRIS KALB, on behalf of himself and all others similarly situated, Plaintiff, v. GARDAWORLD CASHLINK LLC, Defendant.
ORDER & OPINION
This matter is before the Court on Plaintiff Chris Kalb's Motion to sever and partially remand. (Doc. 10). Defendant has responded (doc. 11), so this matter is ripe for review. For the following reasons, the Motion is denied.
DISCUSSION
Plaintiff filed this putative class action alleging violations of the Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/1, et seq., in the Eleventh Judicial Circuit Court in McLean County, Illinois. Defendant timely removed the case to this Court on March 16, 2021. The Complaint raises claims under sections 15(a) and (b) of BIPA. (Doc. 1-1 at 9-10). Section 15(b) requires informed consent to "collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information." 740 ILCS 14/15(b). Section 15(a) states:
Defendant reports Plaintiff has incorrectly sued GardaWorld CashLink LLC, and the proper defendant in this matter is Garda CL Great Lakes, Inc. (Doc. 1 at 1). The two are seemingly related entities, and all filings from the defense thus far have been made on both entities' behalf.
A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual's last interaction with the private entity, whichever occurs first. Absent a valid warrant or subpoena issued by a court of competent jurisdiction, a private entity in possession of biometric identifiers or biometric information must comply with its established retention schedule and destruction guidelines.740 ILCS 14/15(a). Presently before the Court is the unusual circumstance in which Defendant bears the burden of proving standing lies while Plaintiff argues he lacks standing to raise his claim under section 15(a), which he maintains must be severed and remanded. (Docs. 10, 11).
"Where, as here, a case is removed from state court, the roles are reversed and the burden flips: [i]n this procedural posture, the defendant, as the proponent of federal jurisdiction, must establish the plaintiff's Article III standing." Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1151 (7th Cir. 2020) (citation omitted).
Every case proceeding in federal court must satisfy the familiar elements of standing; "[t]he plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Fox, 980 F.3d at 1151 (quoting Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547). The instant Motion challenges the injury-in-fact element, and a smattering of recent BIPA cases speak to this question: Bryant v. Compass Group. USA, Inc., 958 F.3d 617 (7th Cir. 2020), as amended on denial of reh'g and reh'g en banc (June 30, 2020), Miller v. Southwest Airlines Co., 926 F.3d 898 (7th Cir. 2019), Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019), cert. denied, 140 S. Ct. 937 (2020), and Fox, 980 F.3d 1146.
Miller involved "unionized airline employees who were required to clock in and out of work by scanning their fingerprints." Id. (citing Miller, 926 F.3d at 901). "[T]he employees alleged that the airlines violated sections 15(a) and (b) of BIPA by failing to obtain informed consent before collecting and using their fingerprints in the biometric timekeeping systems, and by failing to maintain and publish data-retention protocols." Id. The Seventh Circuit concluded the plaintiffs had demonstrated an injury in fact "sufficiently concrete to confer Article III standing because the collection and use of biometrics for timekeeping is a subject of collective bargaining between unions and management[,]" reasoning:
[T]he stakes . . . include whether the air carriers can use fingerprint identification. If the unions have not consented, or if the carriers have not provided unions with required information, a court or adjustment board may order a change in how workers clock in and out. The prospect of a material change in workers' terms and conditions of employment gives these suits a concrete dimension that Spokeo . . . lacked. Either the discontinuation of the practice, or the need for the air carriers to agree to higher wages to induce unions to consent, presents more than a bare procedural dispute.Id. at 1152-53 (quoting Miller, 926 F.3d at 902).
In Patel, the plaintiffs "sued Facebook for [violations of sections 15(a) and (b) of BIPA] stemming from its 'Tag Suggestions' feature, which uses facial-recognition technology to identify whether a user's Facebook friends are depicted in an uploaded photo." Id. at 1153 (citing Patel, 932 F.3d at 1268). The plaintiffs argued Facebook failed "to maintain and publicly disclose a data-retention schedule and data-destruction guidelines" and "to obtain written informed consent before collecting and using biometrics." Id. (citing Patel, 932 F.3d at 1274). Analogizing the injury at issue to that suffered in a tort claim for invasion of privacy, the Ninth Circuit concluded:
The Facebook users necessarily suffered a concrete and particularized injury when Facebook did not obtain their informed consent before collecting their biometric data and failed to maintain data retention and destruction protocols to keep their biometric data private. The court concluded that because BIPA protects concrete privacy interests and the alleged violations of the statute actually harm[ed] or pose a material risk of harm to those privacy interests, the plaintiffs had alleged an injury in fact sufficient to confer Article III standing.Id. (citing Patel, 932 F.3d at 1274-75) (internal quotation marks omitted).
Plaintiff's Motion here is premised on Bryant. Bryant involved a vending machine that did not accept cash; instead, customers had to create and maintain an electronic payment account, which was accessed at the vending machine via a fingerprint scanner. Bryant, 958 F.3d at 619. The plaintiff, a customer of the vending machine, filed a putative class action alleging the owner and operator of the vending machine committed two BIPA violations: "it 'never made publicly available' a data-retention schedule and data-destruction guidelines, violating section 15(a), and it never obtained her informed consent in writing, violating section 15(b)." Fox, 980 F.3d at 1153-54 (citing Bryant, 958 F.3d at 619). Similar to the Ninth Circuit in Patel, the Seventh Circuit likened some BIPA claims to tortious invasion of privacy. Id. at 1154. It thus concluded the plaintiff's claim under section 15(b) involved a concrete, particularized injury in fact because the plaintiff asserted "a violation of her own rights—her fingerprints, her private information, which was an invasion of her private domain, much like an act of trespass would be." Id. (quoting Bryant, 958 F.3d at 624). The defendant's "failure to comply with the informed-consent requirements of section 15(b) deprived [the plaintiff] of her right to make informed choices about the use of and control over her inherently sensitive biometric data." Id. (citing Bryant, 958 F.3d at 626).
However, the Seventh Circuit reached a different conclusion with respect to her section 15(a) claim, which merely alleged the defendant failed to "make data-retention and data-destruction policies publicly available." Id. (citing Bryant, 958 F.3d at 626). "That violation . . . was insufficiently particularized to support [the plaintiff's] standing . . . [because] the duty to disclose [data-retention policies] under section 15(a) is owed to the public generally, not to particular persons whose biometric information the entity collects." Id. (quoting Bryant, 958 F.3d at 626). So, because the plaintiff "allege[d] no particularized harm that resulted from [the defendant's] violation of section 15(a)," she lacked standing to assert the section 15(a) claim. Id. (quoting Bryant, 958 F.3d at 626). However, the plaintiff's claim in Bryant "was extremely narrow, alleging only a violation of the section 15(a) duty to publicly disclose data retention and destruction protocols." Id. (emphasis in original). The Seventh Circuit emphasized that its "analysis was limited to the theory the plaintiff invoked and did not address other provisions in section 15(a)." Id. (quoting Bryant, 958 F.3d at 626).
At first blush, Bryant appears to suggest Plaintiff lacks standing to assert the claim under section 15(a). Like in Bryant, Plaintiff and the putative class members (current and former unionized employees of Defendant's) challenge Defendant's failure to publish—publicly or even to Plaintiff and the putative class members privately—"a retention schedule or guidelines for permanently destroying the biometric identifiers and/or biometric information" obtained from Plaintiff and the putative class members. (Doc. 1-1 at 11). However, unlike in Bryant, Plaintiff further alleges: "In direct violation of § 15(a) of BIPA, Defendant does not have written, publicly available policies identifying their retention schedules, or guidelines for permanently destroying any of these biometric identifiers or biometric information," thereby reasonably suggesting Defendant has unlawfully retained this data. (Doc. 1-1 at 5). This allegation renders Plaintiff's claim much broader than that alleged in Bryant, an important distinction emphasized in Fox:
Though the Complaint does not indicate Plaintiff and the putative class members were unionized with respect to their employment by Defendant, Defendant has submitted documentation establishing as much. (Doc. 6-3). The Court is permitted to consider this documentation in deciding whether standing lies. Apex Digital, Inc. v. Sears, Roebuck & Co., 572 F.3d 440, 444 (7th Cir. 2009).
Fox's section 15(a) claim is much broader than Bryant's. She does not allege a mere failure to publicly disclose a data-retention policy. She accuses [the defendant] of violating the full range of its section 15(a) duties by failing to develop, publicly disclose, and comply with a data-retention schedule and guidelines for the permanent destruction of biometric data when the initial purpose for collection ends.Fox, 980 F.3d at 1154. Thus, on closer inspection, Plaintiff's section 15(a) claim is less like that alleged in Bryant and more like those alleged in Fox and Miller. The Fox court concluded the plaintiff had standing to assert the section 15(a) claim there because "an unlawful retention of a person's biometric data is as concrete and particularized an injury as an unlawful collection of a person's biometric data." Id. at 1155. The same reasoning applies here.
Furthermore, the Miller court emphasized the role of union negotiations in this context. The plaintiffs there had standing to assert their claim under section 15(a) "because they faced the prospect of a material change in [their] terms and conditions of employment, if the employer, in light of [BIPA], had to bargain with the employee union to obtain . . . consent or change how the employees clocked in." Fox, 980 F.3d at 1154 (internal quotation marks omitted and alterations in original). This is a further distinction from Bryant in that the plaintiff there was not a unionized employee and had not sued her employer, id.; the only stake she had with regard to the disclosure requirement in section 15(a) was that belonging to the general public. Conversely, in Miller, the unionized employees had a greater, particularized interest in the disclosure requirement because it directly impacted their ability to collectively bargain. See 926 F.3d at 902; see also Fox, 980 F.3d at 1152 ("[T]he [plaintiffs in Miller] alleged an injury that was sufficiently concrete to confer Article III standing because the collection and use of biometrics for timekeeping is a subject of collective bargaining between unions and management[.]"). The same is true here.
For these reasons, the Court finds the Complaint sufficiently establishes an injury in fact and Article III standing therefore lies.
CONCLUSION
IT IS THEREFORE ORDERED that Plaintiff's Motion to sever and partially remand (doc. 10) is DENIED. Plaintiff shall respond to Defendant's Motion to Dismiss (doc. 5) and Motion to Stay (doc. 7) within twenty-one (21) days. SO ORDERED. Entered this 28th day of April 2021.
s/ Joe B. McDade
JOE BILLY McDADE
United States Senior District Judge