Opinion
No. 1-20-1372
11-29-2021
Joe FISHER, Individually and on Behalf of All Others Similarly Situated, Plaintiff-Appellee, v. HP PROPERTY MANAGEMENT, LLC, Pioneer Acquisitions, LLC, and Marcon International, Inc. d/b/a KEYper Systems, Defendants (Macron International, Inc., d/b/a KEYper Systems, Defendant-Appellant).
Debra R. Bernard, of Perkins Coie LLP, of Chicago, and Nicola C. Menaldo (pro hac vice) and Anna M. Thompson (pro hac vice), of Perkins Coie LLP, of Seattle, Washington, for appellant. Ryan F. Stephan, James B. Zouras, and Teresa M. Becvar, of Stephan Zouras, LLP, of Chicago, for appellee.
Debra R. Bernard, of Perkins Coie LLP, of Chicago, and Nicola C. Menaldo (pro hac vice) and Anna M. Thompson (pro hac vice), of Perkins Coie LLP, of Seattle, Washington, for appellant.
Ryan F. Stephan, James B. Zouras, and Teresa M. Becvar, of Stephan Zouras, LLP, of Chicago, for appellee.
OPINION
PRESIDING JUSTICE HYMAN delivered the judgment of the court, with opinion.
¶ 1 Joe Fisher worked as a portfolio manager for HP Property Management, LLC (HP), a residential real estate property management company. Fisher had to scan his fingerprints into a biometric device HP installed in its offices to access keys for rental properties. Fisher filed a putative class action complaint alleging HP and its owner, Pioneer Acquisitions, LLC (Pioneer), failed to provide proper notice or obtain employees’ consent before scanning and collecting their fingerprints, as required by the Biometric Information Privacy Act (Privacy Act) ( 740 ILCS 14/1 et seq. (West 2018)). Fisher later amended his complaint naming as a defendant Marcon International, Inc., d/b/a KEYper Systems (KEYper), which sold to HP the biometric device.
¶ 2 KEYper, a North Carolina corporation, filed a motion to dismiss arguing, in part, that Fisher's complaint failed to allege facts establishing a prima facie case of personal jurisdiction. The trial court denied the motion. KEYper appeals, arguing the trial court erred because the complaint failed to allege (i) facts showing KEYper purposefully directed its conduct at Illinois residents or (ii) Fisher's alleged injuries arose from KEYper's forum-related activities. KEYper also argues personal jurisdiction cannot be conferred under a stream of commerce theory.
¶ 3 We affirm. As alleged in the complaint, the quality and nature of KEYper's contacts with Illinois, including its providing ongoing service to HP, establishes prima facie personal jurisdiction for potential injuries arising from those contacts. Accordingly, we need not and do not address KEYper's stream of commerce argument.
¶ 4 Background
¶ 5 The Biometric Information Privacy Act
¶ 6 In 2008, Illinois enacted the Privacy Act to help regulate "the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information." Id. § 5(g). "Biometric identifier" includes "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry." Id. § 10. "Biometric information" means "any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual." Id. Section 15 imposes on private entities, like defendants, various obligations regarding the collection, retention, disclosure, and destruction of biometric identifiers and biometric information, including (i) obtaining consent from individuals if the company intends to collect, store, or disclose their personal biometric identifiers; (ii) informing the individuals in writing of the specific purpose and length of term for which a biometric identifier or biometric information is collected, stored, and used; (iii) destroying biometric identifiers in a timely manner; and (iv) securely storing biometric identifiers. Id. § 15. Section 20 authorizes enforcement of these provisions through a private right of action. Statutory damages range from $1000 (or actual damages if greater) for a negligent violation to $5000 (or actual damages if greater) for an intentional or reckless violation and attorney fees, costs, and expenses. Id. § 20.
¶ 7 The Parties
¶ 8 KEYper is incorporated and doing business in North Carolina. The company provides key storage and management systems for various industries, including automotive services, government agencies, and property management companies. A user enrolls in KEYper's biometric key management system by scanning his or her fingerprint, which KEYper's database collects and stores for comparison to authenticate the user's identity each time a person removes a key from the KEYper device.
¶ 9 Defendant Pioneer owns HP, a residential rental property management company in Chicago. (Pioneer was dismissed; neither HP nor Pioneer is a party to this appeal.) In June 2018, HP installed a KEYper key management device in its offices.
¶ 10 Fisher worked as a portfolio manager for HP from June 2017 to September 2019. After initially scanning his fingerprint into the KEYper device, Fisher had to scan his fingerprint every time he accessed a key to a rental property. Fisher alleges that, whenever he used the device, KEYper's database collected and stored his fingerprint. He further alleges HP granted KEYper ongoing access to use, process, display, transmit, and store his and other employees’ biometric data in its database and, "upon information and belief," KEYper discloses authorized users’ fingerprint data to other, currently unknown, third parties, which host the biometrics in their data centers or cloud infrastructure.
¶ 11 The Class Action Complaint
¶ 12 Fisher filed his initial class action complaint on behalf of himself and others similarly situated against HP and Pioneer, alleging multiple violations of the Privacy Act. His first amended complaint adds KEYper as a defendant. Fisher alleged KEYper violated the Privacy Act by failing to (i) properly inform him in writing of the specific purpose and length of time for which his biometric data was collected, stored, and used; (ii) provide and adhere to a publicly available retention schedule and guidelines for permanently destroying his biometric data; (iii) obtain a written release from him to collect, store, or otherwise use his biometric data; and (iv) obtain consent before disseminating his biometric data to third parties.
¶ 13 Fisher's complaint alleged the trial court "has jurisdiction over Defendants under 735 ILCS § 5/2-209 because Defendants transact business within Illinois and committed the statutory violations alleged herein in Illinois." As to KEYper specifically, the complaint alleged KEYper "conducts business in the State of Illinois, including Cook County." Also, KEYper has ongoing access to the biometric data stored in its database after an individual enrolls his or her fingerprints in the device and that, "[a]ccording to KEYper Systems’ terms and conditions governing the provision of hardware, software, and services to its customers," KEYper has "the right to host, use, process, display and transmit Customer Content," including users’ personal data.
¶ 14 KEYper filed a combined motion to dismiss under section 2-619.1 of the Code of Civil Procedure (Code) ( 735 ILCS 5/2-619.1 (West 2018) ). KEYper argued that under section 2-301 of the Code (id . § 2-301), Fisher did not meet his burden to allege facts to establish a prima facie case of personal jurisdiction over KEYper.
¶ 15 After argument, the trial court entered an order denying KEYper's motion to dismiss for lack of personal jurisdiction. KEYper timely appealed, raising the sole issue of whether Fisher's complaint
established a prima facie case of personal jurisdiction.
¶ 16 Analysis
¶ 17 Standard of Review
¶ 18 The plaintiff has the burden to establish a prima facie showing to exercise personal jurisdiction over a nonresident defendant. Russell v. SNFA , 2013 IL 113909, ¶ 28, 370 Ill.Dec. 12, 987 N.E.2d 778. To overcome the prima facie showing, defendant must present uncontradicted evidence defeating jurisdiction. Id. If plaintiff fails to meet this burden or defendant fails to contradict plaintiff's case by establishing a prima facie case of a lack of jurisdiction, the inquiry ends. TCA International, Inc. v. B&B Custom Auto, Inc. , 299 Ill. App. 3d 522, 532, 233 Ill.Dec. 462, 701 N.E.2d 105 (1998). In considering personal jurisdiction, the trial court may consider the complaint, affidavits submitted by the parties, and discovery depositions. Campbell v. Acme Insulations, Inc. , 2018 IL App (1st) 173051, ¶ 10, 423 Ill.Dec. 576, 105 N.E.3d 984. When, as here, the trial court determines that the plaintiff has met the burden based solely on documentary evidence, our review is de novo. See Aspen American Insurance v. Interstate Warehousing, Inc. , 2017 IL 121281, ¶ 12, 418 Ill.Dec. 282, 90 N.E.3d 440. Given this court's independent review, we may affirm on any basis the record supports, regardless of the reasons expressed in the trial court's judgment. Hess v. Flores , 408 Ill. App. 3d 631, 636, 350 Ill.Dec. 571, 948 N.E.2d 1078 (2011).
¶ 19 Long-Arm Statute
¶ 20 Section 2-209 of the Code, Illinois's long-arm statute, governs an Illinois court's exercise of personal jurisdiction over a nonresident. The long-arm statute consists of three subsections identifying multiple grounds for exercising jurisdiction. See 735 ILCS 5/2-209 (West 2020). Relevant is subsection (c), which provides that "[a] court may also exercise jurisdiction on any other basis now or hereafter permitted by the Illinois Constitution and the Constitution of the United States." Id. § 2-209(c). For purposes of subsection (c), we assess whether the nonresident defendants’ contacts with Illinois suffice to satisfy both federal and Illinois due process. See Russell , 2013 IL 113909, ¶ 30, 370 Ill.Dec. 12, 987 N.E.2d 778.
¶ 21 Consistent with due process, an Illinois court may exercise personal jurisdiction over a nonresident defendant only where that defendant has "certain minimum contacts" with Illinois so that allowing a lawsuit to proceed "does not offend traditional notions of fair play and substantial justice." (Internal quotation marks omitted.) Aspen American Insurance , 2017 IL 121281, ¶ 14, 418 Ill.Dec. 282, 90 N.E.3d 440. In determining minimum contacts, our inquiry depends on whether the plaintiff seeks general or specific personal jurisdiction. Russell , 2013 IL 113909, ¶ 36, 370 Ill.Dec. 12, 987 N.E.2d 778. General jurisdiction requires a defendant have affiliations with the forum state so continuous and systematic as to render the defendant essentially at home there. Aspen American Insurance , 2017 IL 121281, ¶¶ 14, 16, 418 Ill.Dec. 282, 90 N.E.3d 440. Fisher does not argue general jurisdiction. So, we confine our analysis to specific jurisdiction.
¶ 22 Specific jurisdiction is case-specific and involves a two-part inquiry. First, the nonresident defendant must have minimum contacts with Illinois in that (a) the defendant purposefully directed its activities at Illinois and (b) plaintiff's claims arose from or related to those contacts. See Burger King Corp. v. Rudzewicz , 471 U.S. 462, 472, 105 S.Ct. 2174, 85 L.Ed.2d 528 (1985) (citing
Helicopteros Nacionales de Colombia, S.A. v. Hall , 466 U.S. 408, 414, 104 S.Ct. 1868, 80 L.Ed.2d 404 (1984) ). Secondly, Illinois's exercise of jurisdiction over the defendant must be reasonable. Russell , 2013 IL 113909, ¶ 34, 370 Ill.Dec. 12, 987 N.E.2d 778. A failure to satisfy either requirement dooms specific personal jurisdiction. Namely, unless the plaintiff demonstrates the defendant purposefully directed activities that gave rise to the litigation toward the forum, there is no need for the defendant to make an independent showing that exercising jurisdiction would be "unreasonable." Celgard, LLC v. SK Innovation Co. , 792 F.3d 1373, 1378 (Fed. Cir. 2015).
¶ 23 Purposeful Direction
¶ 24 KEYper contends the complaint does not allege facts showing KEYper purposefully directed conduct at Illinois residents. KEYper asserts Fisher relies on a single conclusory statement, which, according to two federal district court cases, does not sufficiently establish specific personal jurisdiction. See Ogilvie v. Beale , No. 93 C 2934, 1993 WL 408365, at *4 (N.D. Ill. Oct. 8, 1993) ("[m]erely stating in a conclusory fashion that Defendants ‘transacted business’ or performed ‘acts and transactions constituting violations’ of statutes is not enough" to make prima facie showing of personal jurisdiction); Web Specialties, Inc. v. Fitness Art Corp. , No. 94 C 290, 1994 WL 280090, at *1 (N.D. Ill. June 17, 1994) (dismissing where plaintiff alleged " ‘[defendant] transacts and conducts business in the State of Illinois,’ and that ‘[defendant] does business in all of the counties in the Northern District of Illinois’ ").
¶ 25 KEYper asserts that in contrast to HP and Pioneer, which the complaint alleges engaged in specific conduct directed at Illinois residents, Fisher alleges no "facts that plausibly suggest the other defendants’ use of the KEYper device in Illinois resulted from any Illinois-specific activity by KEYper." Relying on Salkauskaite v. Sephora USA, Inc. , No. 18-cv-08507, 2020 WL 2796122 (N.D. Ill. May 30, 2020), KEYper argues that HP's and Pioneer's contacts with Illinois cannot be imputed to KEYper for personal jurisdiction.
¶ 26 In Sephora , the plaintiff alleged that Sephora used codefendant ModiFace's biometric facial-geometry technology. Plaintiff's jurisdictional allegations centered on ModiFace developing "customized bespoke devices and technology" for Sephora "with the knowledge and intent" of deploying the devices in Illinois. (Internal quotation marks omitted.) Id. at *4. ModiFace moved to dismiss for lack of personal jurisdiction and attached a declaration from its CEO. That declaration stated that the company (i) did not target its marketing, sales, or commercial activity toward Illinois; (ii) did not meet or develop a business relationship with Sephora in Illinois; (iii) had no specific agreement about deploying or servicing its technology in Illinois, and (iv) had no knowledge about Sephora's use of the technology in Illinois.
¶ 27 The trial court found that the declaration rebutted the jurisdictional allegations and, "[d]espite having had the opportunity to conduct jurisdictional discovery to develop evidence of ModiFace's contacts with Illinois, the evidence that Salkauskaite puts forward does not support any alternative theory of personal jurisdiction." Id. at *5. Further, Sephora's contacts with Illinois could not be imputed to ModiFace—nor did ModiFace's dealings with Sephora show purposeful direction absent a showing that ModiFace "discussed with Sephora whether its *** technology would be used in Illinois [or that] the companies *** had a specific agreement about deploying or servicing the technology in Illinois." Id.
¶ 28 KEYper contends the same situation, that is, that HP and Pioneer's contacts cannot be imputed to KEYper, and Fisher does not allege KEYper discussed deployment or servicing in Illinois with either company that would support a finding of purposeful direction.
¶ 29 We find Sephora distinguishable, however. ModiFace presented a declaration from its CEO with facts relevant to the inquiry. KEYper relied exclusively on the allegations on the complaint and nothing else. And, unlike Sephora, which had numerous retail locations nationwide, KEYper entered a business relationship with HP, a company operating exclusively in Illinois.
¶ 30 Moreover, KEYper sold its biometric key management device and software to HP, and under the terms and conditions of the sale, KEYper agreed to provide ongoing data management services, including hosting, storing, transmitting, and processing the Illinois user biometric data collected by the KEYper device. According to the complaint, KEYper discloses that biometric data to third-party "cloud infrastructure providers" that facilitate the storage of KEYper's Illinois users’ biometric data. Fisher need not rely on HP's or Pioneer's contacts with Illinois to establish personal jurisdiction where KEYper purposefully directed its activities toward a business operating solely in Illinois with Illinois employees.
¶ 31 In contending it did not purposefully direct conduct toward Illinois, KEYper cites McGoveran v. Amazon Web Services, Inc. , 488 F. Supp. 3d 714, 720 (S.D. Ill. 2020), and Bray v. Lathem Time Co. , No. 19-3157, 2020 WL 1492742 (C.D. Ill. Mar. 27, 2020). We consider neither persuasive. In McGoveran , the Privacy Act litigation arose when a third party based in Massachusetts contracted with the nonresident defendants to analyze the voiceprints of its customers. McGoveran , 488 F. Supp. 3d at 716-17. Noting that the Illinois plaintiffs placed the outgoing calls to the Massachusetts-based third party, the trial court found no indication defendants reached into Illinois or purposefully directed their activities at Illinois citizens or that the litigation arose from contacts they created with Illinois. Id. at 721-22. So, the trial court found the nonresident defendants’ contacts with Illinois were attenuated and did not support specific personal jurisdiction. Id.
¶ 32 By contrast, Fisher alleges KEYper entered into an agreement with HP, an Illinois company operating exclusively in Illinois, to provide ongoing data management services and "the right to host, use, process, display and transmit Customer Content," which includes his biometric data. Thus, McGoveran provides no basis to disturb the determination that Fisher amply alleges KEYper purposefully availed itself of the privilege of conducting business in Illinois.
¶ 33 In Bray , the trial court held the plaintiff failed to establish that the Georgia incorporated and headquartered defendant-manufacturer of biometric timekeeping devices had minimum contacts with Illinois to confer personal jurisdiction. Bray , 2020 WL 1492742, at *4. The defendant sold and shipped biometric timekeeping devices to the plaintiff's employer in Arkansas, which unilaterally chose to implement the devices at its Illinois locations. The court found the defendant's contacts with Illinois "random and attenuated" because the employer, and not the defendant, chose where to use the devices. Id. at *3-4.
¶ 34 Conversely, KEYper supplied the biometric device and supporting software and services directly to HP, a company operating exclusively in Illinois, for use in the state to collect and transmit to KEYper
Illinois residents’ biometric data to support HP's business operations.
¶ 35 King v. PeopleNet Corp. , No. 21 CV 2774, 2021 WL 5006692 (N.D. Ill. Oct. 28, 2021), a recent decision from the Northern District of Illinois, supports affirming the trial court's finding of personal jurisdiction. Lamar Whiteco Outdoor Corp. v. City of West Chicago , 355 Ill. App. 3d 352, 360, 291 Ill.Dec. 318, 823 N.E.2d 610 (2005) (while appellate court is not bound to follow federal district court decisions, they can provide guidance and serve as persuasive authority).
¶ 36 In PeopleNet , plaintiff's employer required her to clock in and out of work each day using a face scanner device it purchased from PeopleNet Corporation, a Delaware company with its principal place of business in Massachusetts. PeopleNet Corp. , 2021 WL 5006692, at *2. The face scanner captured and collected the plaintiff's biometric data and sent it to PeopleNet's cloud-based servers for storage and future use. Id. The complaint alleged PeopleNet violated the Privacy Act by not informing her of the collection and storage of her biometrics or obtaining written consent before using her biometrics or providing written disclosures describing why it was using her biometrics and how long the use would last. Plaintiff also alleged PeopleNet failed to make a biometric retention or destruction policy publicly available. Id. at *3. After removing the case to federal court, PeopleNet sought dismissal for lack of personal jurisdiction.
¶ 37 The court denied the motion, finding specific personal jurisdiction over PeopleNet. The court noted PeopleNet had provided products and services to plaintiff's Illinois-based employer since 2006 and that, "[a]s a result of that commerce, [the plaintiff] scanned into her job in Chicago using PeopleNet's devices, which transmitted her biometric information to defendant's servers." Id. at *6. Besides the plaintiff, the complaint alleges that thousands of other people in Illinois have had their information "collected, captured, stored, transmitted, disseminated, or otherwise used" by PeopleNet, and the company maintains custody and control of that information. (Internal quotation marks omitted.) Id.
¶ 38 The court rejected PeopleNet's contention it was just a vendor for plaintiff's employer and its contacts with Illinois were attenuated; the result of the employer's conduct, not PeopleNet's. The court acknowledged that some of PeopleNet's "contacts with Illinois were indirect, through its relationship with its clients." Id. But, the court said, "PeopleNet had direct contacts with [Illinois] that [were not] enabled or created by a third party. For instance, defendant did business with [plaintiff's employer] and other Illinois employers, presumably by entering into contracts with them." Id.
¶ 39 The court also found that, although plaintiff's employer
"made decisions that led to contacts between PeopleNet's devices and this state, those decisions weren't unilateral. PeopleNet ‘itself set the system up this way,’ uBID, Inc. v. GoDaddy Group, Inc. , 623 F.3d 421, 428 (7th Cir. 2010), doing business in this state depended on employers requiring their employees to use PeopleNet's technology. Defendant sought out the Illinois biometric timekeeping market. It did business with companies here, shipped in devices, and handled a large quantity of biometric data from Illinois over the years. PeopleNet purposefully availed itself of the privilege of conducting business in Illinois." Id. at *7.
Thus, the court concluded, the plaintiff's Privacy Act claims arose directly out of PeopleNet's biometric information business
in Illinois, and it was "foreseeable" that PeopleNet would need to defend itself here. Id.
¶ 40 Similarly, Fisher alleges his employer, HP, granted KEYper ongoing access to use, process, display, transmit, and store his and other employees’ biometric data in KEYper's database and "upon information and belief," KEYper discloses authorized users’ fingerprint data to other, currently unknown, third parties, which host the biometrics in their data centers or cloud infrastructure. Indeed, as in PeopleNet , KEYper did not just sell a biometric device; rather it also provided HP an ongoing service.
¶ 41 Fisher alleges KEYper maintains "ongoing access to the biometric data stored in its [databases]" after someone enrolls in its device and has "the right to host, use, process, display and transmit Customer Content" and that KEYper has failed to inform Fisher and other users that it discloses their sensitive biometric data to (currently unknown) third parties, which host the biometric data in their data centers or cloud infrastructure, failed to inform users of the purposes and duration for which it collects their biometric data, and failed to obtain written releases from users before collecting their fingerprints, as required by the Privacy Act.
¶ 42 As KEYper's attorney noted at oral argument, unlike the plaintiff in PeopleNet , Fisher does not allege "thousands" of users of its device in Illinois. Nor does Fisher allege that KEYper had business relationships with numerous Illinois companies. But the number of people affected is not the determinative factor in personal jurisdiction analysis. By providing HP, an Illinois company, with a device that repeatedly scanned employees’ fingerprints in Illinois and continually serviced Illinois employees’ data for future use, KEYper met the "minimum contacts" requirement.
¶ 43 Fisher alleged KEYper engaged in an ongoing business relationship with an entity located exclusively in Illinois. As a result of that relationship, KEYper "benefitted from Illinois’ system of laws, infrastructure, and business climate" ( Russell , 2013 IL 113909, ¶ 81, 370 Ill.Dec. 12, 987 N.E.2d 778 ), and the trial court properly denied KEYper's motion to dismiss. Although KEYper takes issue with the specificity of Fisher's allegations and the quality and nature of KEYper's contacts with Illinois, the allegations suffice to establish personal jurisdiction.
¶ 44 Injuries Arise Out of Business Activities in Illinois
¶ 45 KEYper contends that because it has not purposefully directed activity at Illinois residents, Fisher cannot show his alleged injury arises out of the company's forum-related activities. We disagree.
¶ 46 As we have stated, KEYper purposefully directed activity at Illinois residents. Further, the complaint alleges KEYper violated the Privacy Act independently, separate, and distinct from HP and Pioneer's purported violations by obtaining and storing Fisher's biometric data without first informing him it was doing so or of the purposes or length of time, or securing a written release to collect, capture, obtain, and store his data, all in violation of section 15(b) of the Privacy Act. Fisher also alleges KEYper failed to publish and adhere to a publicly available retention and deletion policy in violation of section 15(a) of the Privacy Act. Finally, Fisher's complaint alleged KEYper disseminated the data it obtained without obtaining consent, in violation of section 15(d) of the Privacy Act. In short, Fisher accuses KEYper of violating an Illinois statute stemming from KEYper's contacts with an Illinois business and Illinois residents. Fisher's complaint sufficiently alleges injury arising out
of KEYper's minimum contacts with Illinois.
¶ 47 Stream of Commerce Theory
¶ 48 KEYper alternatively argues Fisher cannot establish specific personal jurisdiction under the stream of commerce theory. That theory, which the United States Supreme Court first articulated in World-Wide Volkswagen Corp. v. Woodson , 444 U.S. 286, 297-98, 100 S.Ct. 559, 62 L.Ed.2d 490 (1980), permits a forum state to exercise personal jurisdiction over a nonresident defendant that "delivers its products into the stream of commerce with the expectation that they will be purchased by consumers in the forum State." See also Hernandez v. Oliveros , 2021 IL App (1st) 200032, ––– Ill.Dec. ––––, ––– N.E.3d ––––. Because we find that Fisher's complaint has established specific personal jurisdiction, we do not address this argument.
¶ 49 Affirmed.
Justices Pucinski and Coghlan concurred in the judgment and opinion.