Adding to the confusion businesses face over the Illinois Biometric Information Privacy Act (“BIPA”), two Illinois District Court judges recently issued orders on what is required to maintain a BIPA lawsuit in federal court. In one case, Judge Robert Gettleman remanded a BIPA lawsuit to an Illinois circuit court, concluding that the plaintiff lacked standing to pursue her claim in federal court. In a separate case, Judge Rebecca Pallmeyer dismissed a BIPA lawsuit, finding that that plaintiff failed to allege sufficient facts to state a claim under the Act. These opinions seem to impose more stringent requirements on plaintiffs than the Illinois Supreme Court’s take on BIPA in the Rosenbach v. Six Flags Entertainment Corp. opinion, previously addressed by BSCR here. As discussed below, however, Judge Gettleman’s ruling suggests that an argument commonly made by defendants in BIPA lawsuits could be used against them.
In Hunter v. Automated Health Sys., 2020 U.S. Dist. Lexis 29054 (N.D. Ill. Feb. 20, 2020), the plaintiff filed suit against her former employer, alleging that it violated BIPA by requiring its employees to scan their fingerprints for timekeeping purposes without taking certain measures required by the Act. Specifically, the plaintiff alleged that the defendant violated the Act by failing to properly inform the plaintiff in writing of the specific purpose and length of time for which her fingerprints were being collected, stored, and used; failing to provide a publicly available retention schedule and guidelines for permanently destroying the plaintiff’s fingerprints; and failing to obtain a written release from the plaintiff to collect, capture, and otherwise retain her fingerprints. The employer removed the case to federal court and filed a motion to dismiss.
In reviewing the parties’ briefs on the motion to dismiss, Judge Gettleman found a “serious question” existed as to whether the court had subject matter jurisdiction. Because the defendant removed the case, the court found it bore the burden of establishing jurisdiction by demonstrating that the plaintiff alleged an injury-in-fact. Relying on the U.S. Supreme Court opinion Spokeo Inc. v. Robins, 136 S. Ct. 1540 (2016), Judge Gettleman explained that for an injury-in-fact to exist, the injury must be “concrete and particularized,” meaning it must be de facto, or actually exist. In analyzing whether the plaintiff had alleged a concrete and particularized injury, the court relied on Crabtree v. Experian Information Solutions, Inc., 2020 U.S. App. Lexis 2698 (7th Cir. Jan. 28, 2020), a case in which the Seventh Circuit Court of Appeals determined that the mere retention of private consumer information, absent any dissemination, does not constitute a concrete injury for standing purposes. In Hunter, the plaintiff failed to allege that the defendant disseminated her biometric information or that any data breach, identity theft, or other similar loss resulted from the collection of said information.
The Hunter defendant argued that jurisdiction existed based upon the Illinois Supreme Court’s holding in Rosenbach. In rejecting this argument, Judge Gettleman noted that Rosenbach established only that it is the policy of Illinois state courts to allow parties to sue under BIPA even if they cannot demonstrate that they have sustained some compensable injury beyond violation of their statutory rights for which they may seek recourse. It is the policy of the federal courts, by contrast, that a plaintiff must allege an actual or imminent injury to establish standing in federal court. According to Judge Gettleman, the Illinois Supreme Court expressly indicated in Rosenbach that BIPA procedural violations are not themselves actual injuries. Consequently, Judge Gettleman concluded that the plaintiff lacked standing at the time her case was removed because she did not allege any dissemination of her biometric information. Thus, the court remanded the case to the Circuit Court of Cook County.
In Heard v. Becton, Dickinson & Co., 2020 U.S. Dist. Lexis 31249 (N.D. Ill. Feb. 24, 2020), the plaintiff, a respiratory therapist, filed suit against Becton, alleging that he and members of a putative class were required to use fingerprint scanners to access Becton’s Pyxis MedStation system. The plaintiff further alleged that Becton violated BIPA because it never informed the plaintiff and putative class members that it was collecting, using, or storing their biometric information; failed to state the purpose and length of time for which it was doing so; failed to obtain executed written releases from them authorizing the collection of their biometric information; never provided them with a publicly available retention schedule for the permanent destruction of their biometric information; and, “upon information and belief,” disclosed their biometric information to “unknown” third parties without obtaining consent. Becton removed the case to the District Court for the Northern District of Illinois and moved to dismiss the complaint.
In its motion to dismiss, Becton first argued that the biometric information at issue was exempt from the scope of BIPA. Specifically, Becton claimed that the information fell under the “healthcare exemption” contained in BIPA. Section 14/10 of the Act states that “[b]iometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996.” 740 ILCS 14/10. According to Becton, that section applied to the plaintiff’s claims because the biometric information at issue was collected from healthcare workers in order to access medication. In addressing this argument, Judge Pallmeyer noted that she was aware of only two cases in which defendants had advanced this theory. In Diaz v. Silver Cross Hosp. & Med Ctrs., No. 2018 CH 001327 (Cir. Ct. Will Cnty. Aug. 29, 2019), the Circuit Court of Will County, Illinois, concluded that BIPA’s healthcare exemption applied to biometric information obtained from a nurse because the information was collected, used, or stored for healthcare treatment. By contrast, in Bruhn v. New Alberton’s, Inc., No. 2018 CH 01737 (Cir. Ct. Cook Cnty. July 2, 2019), the Circuit Court of Cook County, Illinois, determined that the exemption did not apply to biometric information collected from healthcare workers because their biometric information is not protected under HIPPA. Judge Pallmeyer found the reasoning in Bruhn more persuasive, noting that it seemed unlikely that the Illinois legislature intended to deprive healthcare workers of a right to privacy and control over their biometric information merely because the information was being used for patient treatment.
The court next addressed what type of action by a defendant regarding the collection of biometric information is required to trigger liability under Section 15(b) of BIPA. Becton argued that BIPA requires a defendant “actively” collect information, meaning that it did more than possess such information. The plaintiff argued that BIPA applies when a defendant obtains biometric information, no matter the source or the manner of collection. Judge Pallmeyer determined that BIPA requires a defendant to, at a minimum, take an “active step” to collect, capture, purchase, receive through trade, or otherwise obtain biometric information. The judge further concluded that the plaintiff failed to allege that Becton took any such active step. While the plaintiff alleged that Becton collected his biometric information, he failed to specify how, when, or any other factual detail regarding the collection. The plaintiff also failed to allege how his fingerprints made their way from the fingerprint scanner on Becton’s medical device into Becton’s systems.
Judge Pallmeyer then examined whether the plaintiff alleged sufficient facts to trigger liability under Sections 15(a) and (d) of BIPA, which apply to entities in possession of biometric information. BIPA does not define “possession,” leading the judge to apply the popularly understood meaning of the term. Specifically, Judge Pallmeyer adopted the definition provided by the Illinois Supreme Court, which found that possession occurs when a person has or takes control of the subject property or holds the property at his or her disposal. People v. Ward, 215 Ill.2d 317, 325 (Ill. 2005). The judge determined that the plaintiff failed to adequately plead possession by Becton because he did not allege that Becton exercised any dominion or control over his biometric information. More specifically, the plaintiff did not allege that Becton could freely access his biometric information or even how Becton allegedly received the information. Rather, the plaintiff merely alleged that he scanned his fingerprint into Becton’s device and Becton subsequently stored the plaintiff’s fingerprint in its systems.
Finally, the court dismissed the plaintiff’s claim because the plaintiff failed to allege that Becton disclosed his biometric information. Section 15(d) of BIPA provides that entities in possession of biometric information cannot disclose the information except in limited circumstances. The plaintiff alleged only “on information and belief” that Becton violation Section 15(d). Judge Pallmeyer found this allegation insufficient to satisfy the federal pleading standard.Overall, these rulings suggest that federal court may be a much better venue than state court for defendants in a BIPA lawsuit depending upon the allegations and factual circumstances of the case. As these case show, district court judges seem more likely to require more specific pleadings from plaintiffs to survive dismissal and an actual, concrete injury, as opposed to simply alleging a technical violation of a BIPA provision. However, the Hunter ruling illustrates how a defendant’s argument regarding a lack of injury can be turned against the defendant, such that the case ultimately ends up back in state court.