Opinion
Case No. 4:20-cv-04026-SLD-JEH
2020-08-14
Tiffanie SNIDER, individually and on behalf of all others similarly situated, Plaintiff, v. HEARTLAND BEEF, INC., Defendant.
Aaron M. Zigler, Alex J. Dravillas, Ashley C. Keller, James Dominick Larry, Travis D. Lenkner, Keller Lenkner LLC, Chicago, IL, for Plaintiff. Gary M. Miller, Matthew C. Wolfe, Shook, Hardy & Bacon LLP, Chicago, IL, Brian Scott Jones, Bose McKinney & Evans LLP, Indianapolis, IN, Colman Douglas McCarthy, Shook Hardy & Bacon LLP, Kansas City, MO, for Defendant.
Aaron M. Zigler, Alex J. Dravillas, Ashley C. Keller, James Dominick Larry, Travis D. Lenkner, Keller Lenkner LLC, Chicago, IL, for Plaintiff.
Gary M. Miller, Matthew C. Wolfe, Shook, Hardy & Bacon LLP, Chicago, IL, Brian Scott Jones, Bose McKinney & Evans LLP, Indianapolis, IN, Colman Douglas McCarthy, Shook Hardy & Bacon LLP, Kansas City, MO, for Defendant.
ORDER
SARA DARROW, CHIEF UNITED STATES DISTRICT JUDGE
Before the Court are Defendant Heartland Beef, Inc.’s ("Heartland") Motion to Dismiss Plaintiff's Complaint ("Motion to Dismiss"), ECF No. 17, and Plaintiff Tiffanie Snider's Motion to Cite Additional Authority in Support of Opposition to Defendant's Motion to Dismiss ("Motion to Cite"), ECF No. 31. For the reasons that follow, the Motion to Dismiss is DENIED and the Motion to Cite is GRANTED. The Court finds that Snider lacks standing to pursue her claim under 740 ILCS 14/15(a) and thus grants her leave to amend her complaint within 14 days to properly allege standing, if desired.
When ruling on a motion to dismiss, the court must take all well-pleaded allegations in the complaint as true and view them in the light most favorable to the plaintiff. Indep. Tr. Corp. v. Stewart Info. Servs. Corp. , 665 F.3d 930, 934 (7th Cir. 2012). The facts set forth in this section are taken from the Complaint, Not. Removal Ex. A, ECF No. 1-1.
Heartland is an Arby's restaurant franchisee which operates a location in Macomb, Illinois. Snider worked at the Arby's in Macomb from approximately April 24, 2017 to December 4, 2018. Heartland's restaurants "use[ ] a time-tracking system that requires employees to use their fingerprints as a means of authentication." Compl. ¶ 20, Not. Removal Ex. A, ECF No. 1-1. They also use a point-of-sale system that uses fingerprint authentication. Therefore, every time Snider "clocked in or out of a shift or break, or made a sale to a customer, Heartland ... captured, collected, or otherwise obtained [her] biometric identifier," meaning her fingerprint. See id. ¶ 29.
Heartland did not inform Snider "of the specific purposes or length of time for which it collected, stored, and used [her] fingerprints." Id. ¶ 30. Likewise, it "did not obtain a written release authorizing the collection, capture, other obtainment, or subsequent disclosure of [her] biometric identifier." Id. ¶ 31. Moreover, it "does not make publicly available, and has not made publicly available, any biometric data-retention policy" and it has not "informed [Snider] whether it will ever permanently delete [her] fingerprints." Id. ¶ 32.
Snider filed suit against Heartland in the Circuit Court of Cook County, Illinois on October 4, 2019. Heartland removed the suit to the Northern District of Illinois under diversity jurisdiction, 28 U.S.C. § 1332(a), and the Class Action Fairness Act, 28 U.S.C. § 1332(d). See Not. Removal, ECF No. 1. The case was subsequently transferred to this Court. See Mem. Op. & Order, ECF No. 26. Snider alleges that Heartland violated the Illinois Biometric Information Privacy Act ("BIPA"), 740 ILCS 14/1–99, by scanning and retaining employee fingerprints without informed consent and failing to maintain and publish a data-retention policy. Compl. ¶¶ 39–46. She asserts claims on behalf of herself and a putative class of "citizens of Illinois who have had their fingerprints collected, captured, received, or otherwise obtained by Heartland ... in Illinois." Id. ¶ 34. Her prayer for relief includes requests for a declaration that Heartland's actions violate the BIPA, liquidated damages for each violation of the BIPA, and injunctive relief "including an order requiring Heartland ... to stop its unlawful collection of biometric data and to delete any such data that was unlawfully obtained." Id. at 11. Heartland moves to dismiss the complaint pursuant to Federal Rule of Civil Procedure 12(b)(6).
Heartland does not identify what rule it moves under, but it cites to the Rule 8 pleading standard, Bell Atlantic Corp. v. Twombly , 550 U.S. 544, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007), and Ashcroft v. Iqbal , 556 U.S. 662, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). See Mem. Supp. Mot. Dismiss 3, ECF No. 18. Because Twombly and Iqbal involved motions to dismiss for failure to state a claim under Rule 12(b)(6), the Court construes Heartland's motion as a Rule 12(b)(6) motion.
DISCUSSION
I. Legal Background
a. Legal Standard on a Motion to Dismiss
A court will dismiss a complaint if it fails to state a claim upon which relief can be granted. Fed. R. Civ. P. 12(b)(6). In reviewing a motion to dismiss for failure to state a claim, a court must accept all well-pleaded facts in the complaint as true and draw all reasonable inferences in favor of the plaintiff. Indep. Tr. Corp. v. Stewart Info. Servs. Corp. , 665 F.3d 930, 934 (7th Cir. 2012). A court must "determine whether [the complaint's well-pleaded factual allegations] plausibly give rise to an entitlement to relief." Ashcroft v. Iqbal , 556 U.S. 662, 679, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). The allegations must "raise a right to relief above the speculative level." Tamayo v. Blagojevich , 526 F.3d 1074, 1084 (7th Cir. 2008) (quotation marks omitted).
b. The BIPA
The BIPA "was enacted in 2008 to help regulate ‘the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.’ " Rosenbach v. Six Flags Entm't Corp. , 432 Ill.Dec. 654, 129 N.E.3d 1197, 1203 (2019) (quoting 740 ILCS 14/5(g) ). The statute defines biometric identifier as "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry." 740 ILCS 14/10. Biometric information is defined as "any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual." Id.
The BIPA "imposes on private entities ... various obligations regarding the collection, retention, disclosure, and destruction of biometric i[ ]dentifiers and biometric information." Rosenbach , 432 Ill.Dec. 654, 129 N.E.3d at 1203. For example, "[a] private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public," that describes a retention schedule and the entity's procedures for destroying such information. 740 ILCS 14/15(a). Further, a private entity cannot "collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information, unless it first:" informs the individual in writing that such information is being collected or stored; informs the individual in writing of the specific purpose and length of time for which such information is being collected, stored, and used; and receives a written release from the individual. Id. at 14/15(b)(1)–(3).
"Any person aggrieved by a violation" of the BIPA has a private right of action "against an offending party." Id. at 14/20. For each negligent violation, a prevailing party may recover the greater of actual damages or liquidated damages of $1,000. Id. at 14/20(1). For each intentional or reckless violation, a prevailing party may recover the greater of actual damages or liquidated damages of $5,000. Id. at 14/20(2). A prevailing party may also be granted injunctive relief, attorneys’ fees, and costs. Id. at 14/20(3)–(4).
II. Analysis
a. Standing
Article III of the United States Constitution limits the jurisdiction of federal courts to "Cases" and "Controversies." U.S. Const. art. III, § 2, cl. 1 ; Amling v. Harrow Indus. LLC , 943 F.3d 373, 377 (7th Cir. 2019). "Standing is an essential component of Article III’ s [sic] case-or-controversy requirement." Apex Dig., Inc. v. Sears, Roebuck & Co. , 572 F.3d 440, 443 (7th Cir. 2009). To have standing, a plaintiff must "have suffered an injury-in-fact traceable to the defendant [that is] capable of being redressed through a favorable judicial ruling." Crabtree v. Experian Info. Sols., Inc. , 948 F.3d 872, 876 (7th Cir. 2020). As a jurisdictional issue, the Court has a responsibility to address standing sua sponte. See Gonzalez v. Thaler , 565 U.S. 134, 141, 132 S.Ct. 641, 181 L.Ed.2d 619 (2012) ("When a requirement goes to subject-matter jurisdiction, courts are obligated to consider sua sponte issues that the parties have disclaimed or have not presented.").
Standing in BIPA suits was recently considered by the Seventh Circuit, see Bryant v. Compass Grp. USA, Inc. , 958 F.3d 617 (7th Cir. 2020), so the Court finds it prudent to examine the issue here as well. In Bryant , the Seventh Circuit considered whether the plaintiff had standing to bring claims under sections 15(a) and 15(b) of the BIPA. Id. at 619–20. It held that the plaintiff had asserted a concrete, particularized injury that satisfied Article III's requirements with respect to her claim that the defendant violated section 15(b) by failing to "make the requisite disclosures ... or obtain her informed written consent before collecting" her biometric identifier. Id. at 626–27. The court reasoned that by failing to comply with these requirements, the defendant "inflicted the concrete injury BIPA intended to protect against, i.e. a consumer's loss of the power and ability to make informed decisions about the collection, storage, and use of her biometric information." Id. at 627. But the plaintiff's "claim under section 15(a) [that the defendant failed to publicize a data-retention policy and guidelines for destroying biometric information] [wa]s a separate matter." Id. at 626. The court found that "the duty to disclose under section 15(a) is owed to the public generally, not to particular persons whose biometric information the entity collects." Id. Because the plaintiff "allege[d] no particularized harm that resulted from [the defendant's] violation of section 15(a)" the court held that she "did not suffer a concrete and particularized injury" and she therefore lacked standing under Article III. Id.
Snider's Complaint asserts one cause of action alleging broadly that Heartland violated 740 ILCS 14/15. She does not specifically delineate what provisions she claims Heartland violated. Based on the substance of her allegations, however, it is clear that she asserts that Heartland violated section 15(b). See, e.g. , Compl. ¶¶ 42–44 (alleging that Heartland did not inform Snider and the putative class that their identifiers would be collected or stored, did not inform them of the purpose and length of time for which their identifiers were being collected, stored, and used, and did not receive written releases from Snider and the putative class authorizing such collection, storage, and use). Under Bryant , Snider has standing to seek relief based on these alleged violations.
She also asserts that Heartland violated section 15(a)’s requirements. See id. ¶ 45 (alleging that Heartland "failed and continues to fail to maintain a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information"). It appears that, like the plaintiff in Bryant , Snider is merely challenging Heartland's failure to create and publish a retention and destruction policy under section 15(a). See id. ¶¶ 23, 27, 32. If so, Bryant seems to dictate that Snider lacks standing to bring such a claim. See Figueroa v. Kronos, Inc. , No. 19 C 1306, 2020 WL 4273995, at *3 (N.D. Ill. July 24, 2020) (" Bryant straightforwardly holds that standing cannot rest on a mere violation of the publication duty."). Snider also alleges that, because of Heartland's failure to publish the required policy, "[a]n employee who leaves the company does so without any knowledge of when ... her biometric identifiers will be removed from Heartland[’s] ... databases, if ever." Compl. ¶ 23; id. ¶ 32 (alleging that Heartland has not "informed [Snider] whether it will ever permanently delete [her] fingerprints"). But this alleged injury—not knowing or being informed about whether one's biometric identifiers will be destroyed—is not the kind of harm that section 15(a) seeks to address because the duty to make available a retention policy is owed to the public, not the specific persons whose data are being collected. See Bryant , 958 F.3d at 626 ("This provision is not part of the informed-consent regime ...."). The Court sees no reason this allegation would make the analysis any different than in Bryant. See Figueroa , 2020 WL 4273995, at *4 (finding that the argument that the plaintiffs would have changed their behavior if they knew the information required by section 15(a) "misses the critical point" that "[s]ection 15(a) does not obligate [the defendant] to inform specific individuals like [the] [p]laintiffs of its policy"); Cothron v. White Castle Sys., Inc. , No. 19 CV 00382, 467 F.Supp.3d 604, 611–12 (N.D. Ill. June 16, 2016) (finding that "[a]s in Bryant , the failure to make available a written retention and destruction policy was a harm to the public, not a harm particular to" the plaintiff even though she, as compared to a member of the public, would have been "in a position to make use of the missing [s]ection 15(a) information" because that "was the case in Bryant as well" and "any particularized need for the Section 15(a) information is properly traced to the concomitant Section 15(b) violation").
Based on her Response to the Motion to Dismiss, the Court questioned whether Snider was still pursuing this claim. In the background section of the Response to the Motion to Dismiss, Snider only describes violations of section 15(b). See Resp. Mot. Dismiss 3, ECF No. 30. And in her argument that she adequately pleaded her BIPA claims, she only identifies claims under subsections (b)(1), (b)(2), and (b)(3) of section 15. Id. at 7. But Heartland did not specifically challenge Snider's section 15(a) claim, so her failure to mention it in responding to the Motion to Dismiss does not necessarily suggest she abandoned it.
740 ILCS 14/15(a) also requires that a private entity comply with its established retention schedule and destruction guidelines, which must provide for destroying biometric identifiers and information "when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual's last interaction with the private entity, whichever occurs first." In Bryant , 958 F.3d at 626, the Seventh Circuit specifically noted that the plaintiff had not alleged a violation of this part of section 15(a). Likewise, here, the Court does not read the Complaint to allege that Heartland failed to comply with any established guidelines.
The Court can find no other allegation in Snider's Complaint that shows she suffered a concrete and particularized harm from Heartland's failure to develop and make public a data-retention policy. The Court therefore finds that it lacks subject matter jurisdiction over her claim under section 15(a). Snider is granted leave to amend her complaint within 14 days to properly allege standing to pursue a claim under section 15(a). If no amended complaint is filed, or her amended allegations are insufficient to support standing to pursue the claim, the Court will sever the section 15(a) claim and remand it to state court. See Bergquist v. Mann Bracken, LLP , 592 F.3d 816, 819 (7th Cir. 2010) ("If some parts of a single suit are within federal jurisdiction, while others are not, then the federal court must resolve the elements within federal jurisdiction and remand the rest—unless the balance can be handled under the supplemental jurisdiction.").
b. Motion to Dismiss
Having determined it has jurisdiction over the remainder of the suit, the Court can now assess Heartland's Motion to Dismiss. Heartland presents three arguments for why Snider's Complaint should be dismissed: 1) her BIPA claims are preempted by the Illinois Workers’ Compensation Act ("IWCA"), 820 ILCS 305/1–30; 2) she "fails to allege the requisite negligence, recklessness, or intent to support her BIPA claims"; and 3) her "claims are barred by assumption of the risk." Mem. Supp. Mot. Dismiss 1, ECF No. 18.
c. IWCA Preemption
The IWCA "is designed to provide financial protection to workers for accidental injuries arising out of and in the course of employment." Meerbrey v. Marshall Field & Co. , 139 Ill.2d 455, 151 Ill.Dec. 560, 564 N.E.2d 1222, 1225 (1990). It generally provides the "exclusive remedy" for injuries employees suffer at work. Id. ; see also Baylay v. Etihad Airways P.J.S.C. , 881 F.3d 1032, 1038–39 (7th Cir. 2018) (explaining that the IWCA "abrogates employer liability for all common law negligence claims and provides the exclusive means by which an employee can recover against an employer for a work-related injury in Illinois" (quotation marks omitted)). Indeed, one provision of the IWCA provides that "no common law or statutory right to recover damages from the employer ... for injury or death sustained by any employee while engaged in the line of his duty ... other than the compensation herein provided, is available to any employee who is covered by" the IWCA. 820 ILCS 305/5(a). Another provides that the compensation provided under the IWCA "shall be the measure of the responsibility of any employer" covered by the IWCA for accidental injuries employees sustain at work. Id. at 305/11. But in four circumstances, the IWCA does not provide the exclusive remedy for an employee's injuries, or, in other words, preempt the employee's suit against her employer. See Collier v. Wagner Castings Co. , 81 Ill.2d 229, 41 Ill.Dec. 776, 408 N.E.2d 198, 202 (1980). A plaintiff may sue her employer if her injury: "(1) was not accidental, (2) did not arise from ... her employment, (3) was not received during the course of employment[,] or (4) was noncompensable under the [IWCA]." Id.
Heartland argues that Snider's BIPA suit is preempted by the IWCA, and thus her Complaint should be dismissed, because she is alleging a work-related injury and none of the four above-identified circumstances are applicable. Mem. Supp. Mot. Dismiss 4–6. Snider argues that her injury is not compensable by the IWCA and therefore her BIPA claim is not preempted. Resp. Mot. Dismiss 4–6, ECF No. 30. As to compensability, Heartland argues that Snider's injury—exposure to "substantial privacy risks created by the collection and storage of biometric data," Compl. ¶ 3, "is precisely the type of alleged conduct that constitutes a compensable injury under the IWCA," Mem. Supp. Mot. Dismiss 6. Other than general principles, however, Heartland cites to no law that supports its position.
IWCA preemption is an affirmative defense. Baylay , 881 F.3d at 1039. A plaintiff need not anticipate affirmative defenses in her complaint, but when the complaint "set[s] forth everything necessary to satisfy the affirmative defense," it may be dismissed. United States v. Lewis , 411 F.3d 838, 842 (7th Cir. 2005) ; cf. Chi. Bldg. Design, P.C. v. Mongolian House, Inc. , 770 F.3d 610, 614 (7th Cir. 2014) (noting that, to dismiss based on an affirmative defense, "the plaintiff must affirmatively plead himself out of court"). The Court is not going to dismiss Snider's Complaint on this basis. Instead, it finds that she has clearly pleaded an exception to IWCA preemption. The Court sees no reason it cannot deny an affirmative defense at this stage.
The Court agrees with Snider that her injury is not compensable under the IWCA and therefore her suit is not preempted. "[W]hether an injury is compensable is related to whether the type of injury categorically fits within the purview of the [IWCA]." Folta v. Ferro Eng'g , 397 Ill.Dec. 781, 43 N.E.3d 108, 114 (2015) ; id. (noting that determining compensability requires more than merely determining whether the injury was suffered in the line of duty). In Pathfinder Co. v. Industrial Commission , 62 Ill.2d 556, 343 N.E.2d 913, 916 (1976), the Illinois Supreme Court considered whether a purely psychological injury was covered by the IWCA. The plaintiff claimed she suffered from injuries like headaches, anxiety, and numbness in her hands and feet that were caused by seeing a co-worker's hand severed by machine at work. See id. at 914–15. The court concluded that "an employee who ... suffers a sudden, severe emotional shock traceable to a definite time, place and cause which causes psychological injury or harm has suffered an accident within the meaning of the [IWCA], though no physical trauma or injury was sustained." Id. at 917. Importantly, the court suggested that the relevant question in determining compensability of injuries should be "whether there was a harmful change in the human organism-not just its bones and muscles, but its brain and nerves as well." Id. at 918 (quotation marks omitted).
Many federal district courts have read Pathfinder to stand for the proposition that only physical or psychological injuries are compensable under the IWCA and that injuries to privacy interests, like those claimed in BIPA suits, are neither physical nor psychological and therefore not compensable. See Cothron , 467 F.Supp.3d at 614–16 ; Peatry v. Bimbo Bakeries USA, Inc. , No. 19 C 2942, 2020 WL 919202, at *6 (N.D. Ill. Feb. 26, 2020) ; Treadwell v. Power Sols. Int'l, Inc. , 427 F. Supp. 3d 984, 992–93 (N.D. Ill. 2019) ; cf. Mintun v. Kenco Logistics Servs. LLC , No. 19-2348, 2020 WL 1700328, at *2 (C.D. Ill. Apr. 7, 2020) (denying a motion to stay the proceedings pending the outcome of an Illinois Appellate Court decision because, "[w]ithout ruling on the question directly, the Court concludes it is unlikely that a state appellate court would rule that the IWCA preempts BIPA"). Illinois trial courts have also "found that privacy injuries are distinct from those preempted by the IWCA." See Cothron , 467 F.Supp.3d at 616–17 (citing cases).
The Court agrees with this reading of Pathfinder and the characterization of BIPA injuries as distinct from physical or psychological injuries. The Illinois Supreme Court has described the BIPA as "codif[ying] that individuals possess a right to privacy in and control over their biometric identifiers and biometric information." Rosenbach , 432 Ill.Dec. 654, 129 N.E.3d at 1206. Snider asserts an injury to this right of privacy, not a physical or psychological injury. Therefore, her injuries are not compensable under the IWCA and her suit is not preempted by the exclusive remedy provisions of the IWCA.
d. Failure to Allege State of Mind
Next, Heartland argues that Snider "must adequately allege either a negligent, reckless, or intentional violation of the statute" to avoid rendering the terms of 740 ILCS 14/20 —which creates the private cause of action for BIPA violations and provides the remedies available for different types of violations—superfluous and that she has failed to do so. Mem. Supp. Mot. Dismiss 6–10. Snider counters that "[t]he law is clear that [she] does not need to plead negligence or intent in order to state a claim under [the] BIPA." Resp. Mot. Dismiss 8. She explains that courts have found that the "BIPA's statutory language makes clear that violation of the statute gives rise to liability without need for further proof" and that the state of mind requirements set forth in 740 ILCS 14/20(1) through (3) are "terms reflecting the measure of damages that need not be pled under Rule 8." Id. at 9. Alternatively, she argues that her "allegations support a plausible inference of Heartland's negligence." Id. at 11.
Heartland's argument is a common one in BIPA litigation. See Cothron , 467 F.Supp.3d at 614–16 (describing the "three camps" of court responses to the argument and citing cases). The Court finds the Cothron court's analysis of this argument persuasive. 740 ILCS 14/20 sets forth remedies a prevailing party can obtain for violations of the BIPA, which include statutory damages for negligent, reckless, or intentional violations, but also attorneys’ fees and injunctive relief regardless of intent. The court reasoned "that separate remedies under Section 20 can attach to the same claim." Cothron , 467 F.Supp.3d at 615. It held, therefore, that "if the complaint plausibly pleads violations of [the BIPA] ... then, even absent specific allegations about [the defendant's] mental state" the complaint "has stated a claim entitling [the plaintiff] to litigation expenses and injunctive relief under Section 20, whether or not she proves an entitlement to damages based on negligent, reckless, or intentional conduct." Id. ("In short, allegations of scienter or no, [the plaintiff's] complaint states a plausible claim for relief under sections 15(b) and 15(d); Rule 12(b)(6) does not require her to plead the facts that will determine the amount of actual damages she may be entitled to recover."). This Court agrees and therefore finds that a BIPA plaintiff need not plead facts showing the defendant's mental state to state a claim for relief.
Heartland does not challenge the adequacy of Snider's allegations that it violated the BIPA, but nevertheless the Court finds her claims plausible. See Resp. Mot. Dismiss 7 (noting, for example, that "[i]n violation of Section 15(b)(2), Heartland never informed ... Snider of the purpose of its collection [of her fingerprints] or how long the information would be stored" and that "[i]n violation of Section 15(b)(3), Heartland did not obtain a written release authorizing its collection of biometric information"); Compl. ¶¶ 30–31. Regardless of whether she included allegations about Heartland's state of mind (which might entitle her to damages), she has stated a plausible claim for other relief, like injunctive relief and attorneys’ fees. See Compl. 11. The Court will not dismiss her claim in part because she may not be entitled to other remedies. See BBL, Inc. v. City of Angola , 809 F.3d 317, 325 (7th Cir. 2015) ("A motion to dismiss under Rule 12(b)(6) doesn't permit piecemeal dismissals of parts of claims; the question at this stage is simply whether the complaint includes factual allegations that state a plausible claim for relief.").
Even Heartland's memorandum suggests that it is asking Snider to plead facts showing that she is entitled to damages specifically. See Mem. Supp. Mot. Dismiss 7 ("Plaintiff fails to plead entitlement to elevated damages and her claims should be dismissed."); id. at 8 ("BIPA authorizes recovery of damages only where a defendant acted at least negligently."). It does not address that Snider asked for injunctive relief and it does not reconcile its request for the Court "to dismiss the whole case," id. at 1, with the fact that it is only asking the Court to find that she has not pleaded an entitlement to statutory damages.
In any case, the Court finds that Snider has plausibly alleged at least negligence and therefore has plausibly pleaded an entitlement to damages. She alleges that despite it being illegal since at least 2008 to collect biometric identifiers without written consent, Heartland continued to do so at least as of December 2018 when Snider stopped working for Heartland. See, e.g. , Compl. ¶¶ 2, 20–33. It is plausible that Heartland acted at least negligently in failing to follow the law for ten years. See Figueroa v. Kronos Inc. , No. 19 C 1306, 454 F.Supp.3d 772, 786–87 (N.D. Ill. Apr. 13, 2020) ("The complaint alleges that Kronos, as late as 2018 or 2019, continued to systematically collect and disseminate biometric data without complying with BIPA, which had been enacted a decade earlier in 2008. From that allegation, a plausible inference may be drawn that Kronos acted negligently."); Namuwonge v. Kronos, Inc. , 418 F. Supp. 3d 279, 286 (N.D. Ill. 2019) ("Namuwonge has alleged that Kronos failed to maintain a satisfactory biometric data retention policy, despite BIPA taking effect more than ten years ago. The Court may draw on its judicial experience and common sense and thus may plausibly infer from Namuwonge's allegations that Kronos acted negligently." (quotation marks omitted)); Rogers v. BNSF Ry. Co. , No. 19 C 3083, 2019 WL 5635180, at *5 (N.D. Ill. Oct. 31, 2019) ("As Rogers points out, the BIPA took effect more than ten years ago, and if the allegations of his complaint are true—as the Court must assume at this stage—BNSF has made no effort to comply with its requirements. This is certainly enough, at the pleading stage, to make a claim of negligence or recklessness plausible.").
Heartland makes a few arguments as to why it did not act negligently, including that an employer "would have no reason to be aware of BIPA's existence and purported obligations," and that the BIPA is not listed on the Illinois Department of Labor's website. Mem. Supp. Mot. Dismiss 9. These arguments rest on information outside the Complaint and go to the merits of whether Heartland was negligent, so they are better suited for summary judgment. See Gibson v. City of Chicago , 910 F.2d 1510, 1520 (7th Cir. 1990) ("The purpose of a motion to dismiss is to test the sufficiency of the complaint, not to decide the merits." (quotation marks omitted)); 5B Charles Alan Wright et al., Federal Practice & Procedure § 1356 (3d ed. Apr. 2020 Update) ("The purpose of a motion under Federal Rule 12(b)(6) is to test the formal sufficiency of the statement of the claim for relief; the motion is not a procedure for resolving a contest between the parties about the facts or the substantive merits of the plaintiff's case."). Snider has sufficiently alleged negligence at this stage, so even if pleading a state of mind were necessary, the Court would not dismiss her Complaint.
e. Assumption of the Risk
Lastly, Heartland argues that "to the extent that [Snider] adequately pleads negligence, her claim is barred by the doctrine of primary assumption of the risk." Mem. Supp. Mot. Dismiss 10. "Primary implied assumption of risk is an affirmative defense that arises where the plaintiff's conduct indicates that he has implicitly consented to encounter an inherent and known risk, thereby excusing another from a legal duty which would otherwise exist." Edwards v. Lombardi , 376 Ill.Dec. 929, 1 N.E.3d 641, 646 (Ill. App. Ct. 2013) (quotation marks omitted). Snider argues that this doctrine does not apply to BIPA claims. See Resp. Mot. Dismiss 13–14. She also argues that it would be inappropriate to dismiss her Complaint based on this affirmative defense because she does not admit all elements of the defense in her Complaint. Id. at 13 n.1, 14–15.
The Court is not convinced primary assumption of the risk applies to BIPA claims or that, even if it does, Snider has pleaded herself out of court. As Snider argues, see Resp. Mot. Dismiss 14, allowing a defendant to evade liability under the BIPA based on implied assumption of the risk would be inconsistent with the BIPA's requirement that an entity provide written notice that it is collecting biometric information, its purpose for doing so, and the length of such collection and obtain a written release from the person whose information it is collecting. See 740 ILCS 14/15(b) ; see also Bryant , 958 F.3d at 619 ("Section 15(b) ... requires collectors of [biometric identifiers or information] to obtain the written informed consent of any person whose data is acquired."). The Court hesitates to read a common law defense into a statute that plainly appears to abrogate it. Cf. Barthel v. Ill. Cent. Gulf R.R. Co. , 74 Ill.2d 213, 23 Ill.Dec. 529, 384 N.E.2d 323, 326 (1978) ("[C]ontributory negligence or assumption of the risk will bar recovery unless the statute provides that these defenses are not available.").
Relatedly, "assumption of the risk is not an available defense when a statute calls for strict liability." Olle v. C House Corp. , 359 Ill.Dec. 856, 967 N.E.2d 886, 890 (Ill. App. Ct. 2012). As explained above, the BIPA imposes liability regardless of whether damage can be shown and regardless of the violator's state of mind. See 740 ILCS 14/20 (providing that a prevailing party can obtain attorneys’ fees, costs, and other relief like an injunction if appropriate "for each violation" of the BIPA); cf. Rosenbach , 432 Ill.Dec. 654, 129 N.E.3d at 1207 (noting that the BIPA "subject[s] private entities who fail to follow the statute's requirements to substantial potential liability, including liquidated damages, injunctions, attorney fees, and litigation expenses for each violation of the law whether or not actual damages, beyond violation of the law's provisions, can be shown" (quotation marks omitted)). Therefore, it appears that the BIPA imposes strict liability (though the defendant's intent may impact recovery) and assumption of the risk would not be available as a defense.
Even if the assumption of the risk doctrine applies to BIPA suits, the Court would not dismiss Snider's Complaint on this basis. Heartland argues that "[a] plaintiff, including an employee, assumes risks that are inherent in the nature of an activity, including employment." Mem. Supp. Mot. Dismiss 10 (citing Clark v. Rogers , 137 Ill.App.3d 591, 92 Ill.Dec. 136, 484 N.E.2d 867, 869 (1985) ). And it argues that "[a]ny alleged privacy risks stemming from the use of finger-scan timekeeping technology were ... inherent in the activity [Snider] voluntarily chose to undertake: her employment." Id. (quotation marks omitted). But even if subjecting oneself to privacy risks could be considered inherent to Snider's employment, Heartland does not address the other part of the assumption of the risk defense—a plaintiff must implicitly consent to encounter a known risk. See Edwards , 376 Ill.Dec. 929, 1 N.E.3d at 646 ; Russo v. Range, Inc. , 76 Ill.App.3d 236, 32 Ill.Dec. 63, 395 N.E.2d 10, 13 (1979) ("Essential to all [assumption of risk defenses] is specific knowledge on the part of the plaintiff of the risk he is about to be subjected to."). Snider does not plead that she was aware of the risks and, as she points out, the Illinois legislature enacted the BIPA because "[t]he full ramifications of biometric technology are not fully known." Resp. Mot. Dismiss 15 (quoting 740 ILCS 14/5(f) ). Snider has not pleaded that she consented to encounter a known risk and therefore, even if the affirmative defense of assumption of the risk applies, it would be inappropriate to dismiss her Complaint on that basis.
Moreover, "a plaintiff assumes the risks that are inherent in the nature of the activity itself, [but] does not assume risks created by the defendant's negligence." Edwards , 376 Ill.Dec. 929, 1 N.E.3d at 646. Arguably, there may be no inherent risk in a fingerprint scan and the risks involved—the risk of potential identity theft or compromised privacy—are really a product of Heartland's alleged failure to protect Snider's biometric information.
CONCLUSION
Accordingly, the Motion to Dismiss Plaintiff's Complaint, ECF No. 17, is DENIED and the Motion to Cite Additional Authority in Support of Opposition to Defendant's Motion to Dismiss, ECF No. 31, is GRANTED. The Court finds that Plaintiff Tiffanie Snider lacks standing to pursue her claim under 740 ILCS 14/15(a). It grants her leave to amend her complaint within 14 days to sufficiently allege standing to pursue the claim. If no amended complaint is filed, or the amended allegations remain insufficient to find standing to pursue the claim in federal court, the Court will sever that claim and remand it to state court.