Opinion
No. 17 CV 9019
07-03-2018
SALVADOR AGUILAR, Plaintiff, v. REXNORD LLC and REXNORD INDUSTRIES LLC, Defendants.
MEMORANDUM OPINION AND ORDER
Plaintiff Salvador Aguilar alleges that his employer collected and stored his and other similarly-situated individuals' fingerprints in violation of the Illinois Biometric Information Privacy Act, 740 ILCS 14/1, et seq. Aguilar initially filed this action against Rexnord LLC and Rexnord Industries LLC in state court, but Rexnord removed the lawsuit to this court. Rexnord now moves to dismiss the complaint for the failure to state a claim. For the reasons below, the action is remanded to state court for a lack of subject-matter jurisdiction.
I. Facts
Plaintiff Salvador Aguilar worked for Rexnord Industries LLC, a subsidiary of Rexnord LLC. [16] ¶¶ 10, 32. While Aguilar was an employee, Rexnord implemented a time clock system that used employees' fingerprints to track when employees began and ended their workdays. [16] ¶¶ 29-33. The system required employees to have their fingerprints collected so the prints could be stored and used to authenticate the employees' identities when they clocked in and out. [16] ¶¶ 33-34. When Aguilar got to work, he clocked in by scanning his fingerprint and clocked out by scanning it again when he left. [16] ¶ 35. Aguilar never signed a written release allowing Rexnord to collect or store his fingerprint, and Rexnord never explained the specific purposes of collecting the fingerprint or told Aguilar how long it would keep or use his fingerprint, including what the retention policy was and whether the fingerprint would ever be deleted. [16] ¶¶ 36-38.
Bracketed numbers refer to docket numbers on the district court docket. Page numbers are taken from the CM/ECF header at the top of filings. The facts are taken from the operative complaint, [16].
Aguilar filed suit in the Circuit Court of Cook County, Illinois, [1-2], and Rexnord removed the suit to this court. [1].
II. Analysis
A. Biometric Information Privacy Act
The Biometric Information Privacy Act "regulat[es] the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information." 740 ILCS 14/5(g). "Biometric identifier" is defined to include a fingerprint, among other things. 740 ILCS 14/10. Biometric information is particularly sensitive because unlike social security numbers, which can be changed if necessary, biometric identifiers cannot be changed. 740 ILCS 14/5(c). Recognizing this concern, the Illinois legislature enacted a statute to protect the privacy of biometric information.
The act requires private entities that possess biometric information to develop a publicly available written policy that includes a retention schedule and destruction guidelines. 740 ILCS 14/15(a). In order to collect biometric information, private entities must first (1) inform the person whose biometric information is being collected that it is being collected or stored; (2) inform the person of the "specific purpose and length of term" for which the biometrics are being collected, stored, and used; and (3) receive a written release from the person. 740 ILCS 14/15(b). The act also regulates the sale, disclosure, and careful storage of biometric information. 740 ILCS 14/15(c)-(e). The statute is enforced by a private right of action, available to "[a]ny person aggrieved by a violation." 740 ILCS 14/20.
B. Rexnord's Motion to Dismiss under Rule 12(b)(6)
Rexnord's core argument for dismissal of Aguilar's BIPA claim is that Aguilar has suffered no actual injury from any alleged violation and therefore is not an "aggrieved" person entitled to a private right of action under the act. But if Rexnord is correct that Aguilar has not alleged any actual injury from the purported privacy violations, how can he satisfy the injury-in-fact requirement for Article III standing? Although constitutional and statutory standing are separate inquiries, here they raise similar (but not identical) questions. As other courts have observed, many of the federal cases cited by the parties that examine the issue of whether a plaintiff is "aggrieved" under BIPA also address standing issues. See, e.g., Dixon v. Washington & Jane Smith Cmty.-Beverly, No. 17 C 8033, 2018 WL 2445292, at *4 (N.D. Ill. May 31, 2018) (collecting cites); Howe v. Speedway LLC, No. 17-CV-07303, 2018 WL 2445541, at *3 (N.D. Ill. May 31, 2018) (same).
The complaint pleaded a negligence claim, which Rexnord also moved to dismiss. Aguilar voluntarily withdrew the negligence claim in his response brief. [25] at 15.
Rexnord does not argue that Aguilar lacks standing to pursue his claims in federal court, likely to avoid remand of the lawsuit that it removed; nor does Aguilar request remand based on standing, likely to avoid the somewhat awkward (but not impossible) position of arguing that he did not suffer sufficient injury to confer Article III standing but that the injury was sufficient to render him aggrieved within the meaning of the statute. See Howe, 2018 WL 2445541, at *3-4. Nevertheless, I have an independent obligation to ensure subject-matter jurisdiction exists, even if no party raises the issue, and standing is an important component of subject-matter jurisdiction. United States v. $304,980.00 in U.S. Currency, 732 F.3d 812, 817 (7th Cir. 2013).
C. Article III Standing
Article III of the Constitution limits the jurisdiction of federal courts to "Cases" and "Controversies," and the doctrine of standing enforces that limitation. Spokeo, Inc. v. Robins, 136 S.Ct. 1540, 1547 (2016). A plaintiff has standing to sue if she "(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Id. Aguilar alleges that Rexnord violated the statute's notice and consent provisions, and the question is whether he has alleged an injury in fact as a result of those violations. Not just any injury will do—Aguilar must have suffered "'an invasion of a legally protected interest' that is 'concrete and particularized' and 'actual or imminent, not conjectural or hypothetical.'" Id. at 1548 (citation omitted). Tangible harms, like financial losses, may be more easily identifiable as concrete injuries, but intangible harms can also satisfy the injury-in-fact requirement. Groshek v. Time Warner Cable, Inc., 865 F.3d 884, 886 (7th Cir. 2017).
Sometimes a procedural statutory violation constitutes an injury in fact on its own and does not require a showing of any additional harm. Spokeo, 136 S.Ct. at 1549. That is because legislatures can "elevat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law." Lujan v. Defs. of Wildlife, 504 U.S. 555, 578 (1992). Even so, a procedural statutory violation "divorced from any concrete harm" does not satisfy standing requirements. Spokeo, 136 S.Ct. at 1549. Rather, a statutory violation only causes an injury concrete enough to satisfy Article III standing if it "present[s] an 'appreciable risk of harm' to the underlying concrete interest that [the legislature] sought to protect by enacting the statute." Groshek, 865 F.3d at 887. So the question becomes whether Rexnord's alleged violations of the act's notice and consent provisions create a risk of harm to the concrete interests the statute was enacted to protect.
Just as the United States Congress can create injuries in fact, so too can state legislatures. See Patel v. Facebook Inc., 290 F.Supp.3d 948, 953 (N.D. Cal. 2018).
This argument could also be articulated as one of "informational injury," in which a "plaintiff fails to obtain information which must be publicly disclosed pursuant to a statute." Fed. Election Comm'n v. Akins, 524 U.S. 11, 21 (1998). Whether phrased as an informational injury or a violation of a statute mandating the disclosure of information, the question is the same.
The statute lists legislative findings including the growing use of biometric information and the unique sensitivity of biometric data given that "once compromised, the individual has no recourse." 740 ILCS 14/5(a)-(c). The legislature also found that the public was wary of entering into transactions that used biometric identifiers. 740 ILCS 14/5(d)-(e). So the legislature concluded that "[t]he public welfare, security, and safety will be served by regulating the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information." 740 ILCS 14/5(g). These findings demonstrate that the core interest the legislature sought to protect is the privacy of biometric information. See Howe, 2018 WL 2445541, at *5 ("[T]he concrete interest underlying BIPA is the protection and security of biometric data."); Dixon, 2018 WL 2445292, at *9 ("The Illinois legislature's intent to create a legal right to privacy in personal biometric data and to protect the right to control one's biometric identifiers and information is evident from its statement of legislative findings and intent as well as from the substantive provisions of the Act."); In re Facebook Biometric Info. Privacy Litig., 185 F.Supp.3d 1155, 1169 (N.D. Cal. 2016) ("BIPA manifests Illinois' substantial policy of protecting its citizens' right to privacy in their personal biometric data."). The complaint also adopts this understanding of the act's purpose. [16] ¶ 16 (noting the statute's "goal of protecting individuals' privacy rights").
Rexnord's violations of the notice and consent provisions do not create an "appreciable risk of harm" to Aguilar's right to privacy in his fingerprints. A person's privacy may be invaded if her biometric information is obtained or disclosed without her consent or knowledge. See Dixon, 2018 WL 2445292, at *9 ("Obtaining or disclosing a person's biometric identifiers or information without her consent or knowledge necessarily violates that person's right to privacy in her biometric information."). But notice and consent violations do not without more create a risk of disclosure, and Aguilar knew his biometric information was being collected, even though he did not receive formal notice and give formal consent. Aguilar knew his fingerprints were being collected because he scanned them each time he clocked in and out at work, and it was clear that the fingerprints were stored since they were used for authentication purposes. So "proper compliance with BIPA's disclosure and written authorization requirements would only have made explicit what should have already been obvious," and "the procedural violation from disclosure omissions causes negligible harm for Article III purposes." Howe, 2018 WL 2445541, at *6. This has also been the conclusion of other courts that have considered the question in the context of an employer's biometric clocking system, and I agree with their analysis. See id.; Goings v. UGN, Inc., No. 17-CV-9340, 2018 WL 2966970, at *3 (N.D. Ill. June 13, 2018).
Whether Aguilar was given notice of the contents of Rexnord's retention policy would not make it any more or less likely that his biometric information would be compromised. Whether the practices outlined in the retention policy violated the statute's requirements for safeguarding biometric information (and therefore potentially created a risk of disclosure) is a separate question and a different statutory violation that is not alleged in Aguilar's complaint. --------
That is not to say that violations of the notice and consent provisions can never constitute an injury in fact without additional harm. For instance, collecting a person's biometric information without her knowledge or consent could violate her privacy interests and constitute an injury in fact. See Patel, 290 F.Supp.3d at 955; Monroy v. Shutterfly, Inc., No. 16 C 10984, 2017 WL 4099846, at *8 n.5 (N.D. Ill. Sept. 15, 2017). And violations of the statute's other provisions may also be enough to satisfy the injury-in-fact requirement without other harms. See Dixon, 2018 WL 2445292, at *10 (finding Article III standing in a BIPA case where biometric information was alleged to have been disclosed to a third party). But here, the violations are divorced from concrete harm, including harm to Aguilar's privacy interest in his biometric information and harm to his right to know that the information was collected, and therefore do not constitute injuries in fact.
Apart from the statutory violations, the privacy and emotional injuries pleaded in the complaint do not constitute injuries in fact either. Violations of privacy are actionable and can constitute injuries in fact. See Gubala v. Time Warner Cable, Inc., 846 F.3d 909, 912 (7th Cir. 2017); Patel, 290 F.Supp.3d at 954. But, as explained above, there is no allegation that Rexnord ever disclosed Aguilar's biometric information and there are no alleged facts from which to infer a risk of disclosure, so any privacy injury is conjectural. See Gubala, 846 F.3d at 912. Since Aguilar knew his fingerprints were being scanned and stored, at least for time-keeping purposes, the absence of additional disclosures required by the act did not cause any appreciable risk of harm to his right to know that his biometric information was collected. And Aguilar's alleged emotional injuries, even those based on the unknown retention period, are based on fears that derive from his biometric data being compromised or disclosed, [16] ¶ 40, which similarly have no factual basis in the allegations of the complaint and are therefore "precisely the type of conjectural or hypothetical injury that cannot support Article III standing." Howe, 2018 WL 2445541, at *4. See also Goings, 2018 WL 2966970, at *4.
Without an injury in fact sufficient to satisfy Article III standing requirements, Aguilar cannot maintain his action in federal court.
III. Conclusion
Because this court lacks subject-matter jurisdiction, the action is remanded to the Circuit Court of Cook County, Illinois, forthwith pursuant to 28 U.S.C. § 1447(c). No fees or costs will be awarded under § 1447(c), because jurisdiction was reasonably debatable and plaintiff's failure to seek a remand indicates that he was not prejudiced by the removal. Defendants' motion to dismiss [22] will be transferred to the Circuit Court of Cook County. ENTER:
/s/_________
Manish S. Shah
United States District Judge Date: July 3, 2018