Opinion
20 C 390
04-10-2024
David Fleury and Alvin Turner, individually and on behalf of a class of similarly situated individuals, Plaintiffs, v. Union Pacific Railroad Company, Defendant.
MEMORANDUM OPINION AND ORDER
LaShonda A. Hunt, United States District Judge
Plaintiffs David Fleury and Alvin Turner filed this putative class action lawsuit against Defendant Union Pacific Railroad Company for violations of the Illinois Biometric Information Privacy Act, 740 ILCS 14/1-14/99 (BIPA). Currently before the Court is Defendant's motion to dismiss Plaintiffs' Third Amended Complaint (TAC). For the reasons stated below, Defendant's motion [227] is denied.
Unless otherwise noted, these facts are gleaned from the non-conclusory factual allegations of the TAC, which are taken as true for purposes of this motion. See Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009).
Defendant operates one of the largest freight railroad networks in North America. (TAC ¶ 2, Dkt. 208). Plaintiffs are truck drivers who have visited Defendant's Illinois railyards. (Id. ¶¶ 14, 18, 19). Defendant requires truck drivers like Plaintiffs to provide their fingerprints to access its Illinois railyards through an automated gate system. (Id. ¶¶ 3, 56). Defendant generally requires truck drivers to provide fingerprints as part of the registration process during their initial visit to a railyard and on subsequent visits. (Id. ¶¶ 20, 24). Defendant has contracted with multiple third-party vendors to install, maintain, operate, and customize the railyard access system that uses the truck drivers' fingerprints. (Id. ¶ 26). In doing so, Defendant disclosed, redisclosed, and disseminated truck drivers' fingerprints to the vendors. (Id. ¶ 27).
Defendant neither provided any written disclosures concerning the purpose or duration of such collection and use nor received informed written consent to collect, capture, or store such information before requiring truck drivers to provide their fingerprints. (Id. ¶ 25). In 2020, after this lawsuit had been filed, Defendant began seeking truck drivers' consent to obtain their fingerprints. (Id. ¶¶ 28, 29, 53). Defendant sought and received written consent from Fleury to obtain his fingerprints, (id. ¶ 29), but Turner never gave consent, (id. ¶ 30).
According to Turner, Defendant failed to destroy his fingerprints for months or years after being notified through a system that Turner was no longer driving for his previous employer. (Id. ¶¶ 32-35). Thus, Plaintiffs allege that Defendant retained Turner's and other truck drivers' fingerprints after the initial purpose of collection and possession had been satisfied. (Id. ¶ 31). Defendant claims that Turner last visited one of its Illinois railyards on August 4, 2019, that it never received notice that Turner had stopped driving for his employer, and, in any event, that his biometrics were destroyed on April 6, 2021. (Def.'s Mem., Ex. A (Hayden Decl.) ¶¶ 10, 12, 16, Dkt. 230-1).
PROCEDURAL HISTORY
This case has an extended procedural history, and brief discussion of some of the prior orders entered by the Court is warranted for context. First, on March 24, 2021, Judge Alonso, the district judge previously presiding over this matter, entered a Memorandum Opinion and Order denying Defendant's motion to dismiss Plaintiffs' first amended complaint. (Mem. Op. & Order, Dkt. 47). In doing so, Judge Alonso rejected Defendant's argument that BIPA is preempted by the Federal Railroad Safety Act (FRSA) and the Interstate Commerce Commission Termination Act (ICCTA) and held that Plaintiff Fleury's post-suit consent did not justify dismissal or limitation of damages at that time. Second, on July 14, 2023, Judge Cole, the magistrate judge overseeing discovery, granted Plaintiffs' motion to compel Defendant to produce discovery concerning drivers holding non-Illinois commercial driver's licenses who accessed Defendant's Illinois railyards. (Mem. Op. & Order, Dkt. 174). Defendant objected to Judge Cole's decision on the grounds that it made a substantive ruling on the applicability of BIPA to such drivers. (Def.'s Obj., Dkt. 177). The Court overruled the objection because the order's scope was limited to discovery and did not foreclose Defendant from raising arguments concerning extra-territorial application of BIPA at class certification. (Minute Order, Dkt. 179).
The TAC asserts four claims under BIPA: Count I, for violation of 740 ILCS 14/15(b) for collection of fingerprints without consent; Count II, for violation of 740 ILCS 14/15(a) for failure to publish a policy concerning use of the fingerprints; Count III, for violation of 740 ILCS 14/15(a) for failure to timely destroy the fingerprints; and Count IV, for violation of 740 ILCS 14/15(d) for disclosure to third parties without consent. For these claims, Plaintiffs seek injunctive relief, statutory damages for each BIPA violation, attorneys' fees and costs, and pre- and post-judgment interest. Defendant first attacked the TAC by filing a motion to strike the request for statutory damages for each BIPA violation (i.e., “per scan” damages), (Def.'s Mot. to Strike, Dkt. 209), which the Court denied as premature for the reasons stated on the record on November 15, 2023, (Minute Order, Dkt. 221). Defendant then filed the instant motion to dismiss the TAC under Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). (Def.'s Mot. to Dismiss, Dkt. 227).
LEGAL STANDARDS
Rule 12(b)(1) allows parties to challenge a pleading based on a lack of subject-matter jurisdiction. Fed.R.Civ.P. 12(b)(1). Courts review standing arguments under Rule 12(b)(1) because standing implicates subject matter jurisdiction. Smith v. City of Chi., 143 F.Supp.3d 741, 748 (N.D. Ill. 2015). In reviewing a Rule 12(b)(1) dismissal motion based on standing, “the district court must accept as true all material allegations of the complaint, drawing all reasonable inferences therefrom in the plaintiff's favor, unless standing is challenged as a factual matter.” Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688, 691 (7th Cir. 2015) (quoting Reid L. v. Ill. State Bd. of Educ., 358 F.3d 511, 515 (7th Cir. 2004)). “If standing is challenged as a factual matter, the plaintiff must come forward with ‘competent proof'-that is a showing by a preponderance of the evidence-that standing exists.” Lee v. City of Chi., 330 F.3d 456, 468 (7th Cir. 2003). The burden of establishing the required elements of standing falls on the party invoking federal jurisdiction. Johnson v. U.S. Off. of Pers. Mgmt., 783 F.3d 655, 661 (7th Cir. 2015). “If the court determines at any time that it lacks subject-matter jurisdiction, the court must dismiss the action.” Fed.R.Civ.P. 12(h)(3).
Rule 12(b)(6) permits a party to move for dismissal based on a pleading's “failure to state a claim upon which relief can be granted.” Fed.R.Civ.P. 12(b)(6). In determining whether a complaint states a claim under Rule 12(b)(6), courts must accept all non-conclusory factual allegations as true. Ashcroft, 556 U.S. at 678. However, legal conclusions and “[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Id. at 678 (citing Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007)). In addition, the Court must construe the complaint in the light most favorable to the plaintiff and draw all reasonable inferences in the plaintiff's favor. Levy v. W. Coast Life Ins. Co., 44 F.4th 621, 626 (7th Cir. 2022). When ruling on a motion to dismiss for failure to state a claim, a court may generally consider only the plaintiff's complaint, exhibits to the complaint, items subject to judicial notice, and matters central to the plaintiff's claim and incorporated into the complaint by reference. Geinosky v. City of Chi., 675 F.3d 743, 745 n.1 (7th Cir. 2012). Applying these principals, a complaint will survive a motion to dismiss if it “states a plausible claim for relief.” Ashcroft, 556 U.S. at 679 (2009) (citing Twombly, 550 U.S. at 556). To state a plausible claim for relief, a complaint must “permit the court to infer more than the mere possibility of misconduct[.]” Id. at 679. The movant has the ultimate burden to show that dismissal is warranted. Marcure v. Lynn, 992 F.3d 625, 631 (7th Cir. 2021).
DISCUSSION
Defendant moves for dismissal on several grounds, some of which have been addressed in prior orders, some of which are new. Plaintiffs respond that the issues decided by earlier rulings should not be revisited and offer substantive reasons for rejecting all the arguments raised by Defendant. Before discussing the arguments, a brief summary of BIPA's framework is appropriate.
I. Illinois Biometric Information Privacy Act (BIPA)
BIPA regulates the collection, retention, disclosure, and destruction of biometric identifiers or biometric information in Illinois. See 740 ILCS 14/15. The statute “is designed to protect consumers against the threat of irreparable privacy harms, identity theft, and other economic injuries arising from the increasing use of biometric identifiers and information by private entities.” Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 619 (7th Cir. 2020). For purposes of BIPA, the term “biometric identifier” is “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILCS 14/10. The term “biometric information” is “any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual.” Id. Throughout this decision, the Court will refer to “biometric identifiers” and “biometric information” as “biometrics”.
Under BIPA, private entities in possession of biometrics are required to develop and publish a written policy establishing a retention schedule and guidelines for permanent destruction when the initial purpose for collecting or obtaining the biometrics has been satisfied or within three years of the individual's last interaction with the entity, whichever occurs first. 740 ILCS 14/15(a). No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's biometrics, unless it first: (1) informs the person in writing that biometrics are being collected or stored; (2) informs the person in writing of the specific purpose and length of term for which biometrics are being collected, stored, and used; and (3) receives a written release executed by the person. 740 ILCS 14/15(b). No private entity in possession of biometrics may disclose, redisclose, or otherwise disseminate a person's biometrics unless the person consents to the disclosure or redisclosure. 740 ILCS 14/15(d).
Any person who prevails on an action for violation of BIPA may recover for each violation: (1) for negligent violations, liquidated damages of $1,000 or actual damages, whichever is greater; (2) for intentional or reckless violations, liquidated damages of $5,000 or actual damages, whichever is greater; (3) reasonable attorneys' fees and costs; and (4) other relief, including an injunction, as the court deems appropriate. 740 ILCS 14/20.
II. Issues Decided in Prior Rulings
Defendant moves for dismissal based on Fleury's post-suit consent, FRSA and ICCTA preemption, and the unconstitutionality of per scan damages, all of which have been addressed in prior rulings on the pleadings. (See Dkts. 47, 221). The Court sees no reason why the earlier decisions should be revisited at this time. See Santamarina v. Sears, Roebuck & Co., 466 F.3d 570, 571-72 (7th Cir. 2006) (“The authority of a district judge to reconsider a previous ruling in the same litigation, whether a ruling made by [the district judge] or by a district judge previously presiding in the case . . . is governed by the doctrine of the law of the case, which authorizes such reconsideration if there is a compelling reason, such as a change in, or clarification of, law that makes clear that the earlier ruling was erroneous.”); Brengettcy v. Horton, 423 F.3d 674, 680 (7th Cir. 2005) (“Generally speaking, a successor judge should not reconsider the decision of a transferor judge at the same hierarchical level of the judiciary when a case is transferred.”). But if the facts borne out in discovery, any intervening changes in law, or other compelling reasons justify raising the arguments again at class certification or summary judgment, Defendant may do so.
III. Recklessness
Defendant's first new argument for dismissal is that the allegations of recklessness are insufficient to state a claim upon which relief may be granted under Rule 12(b)(6). The liquidated damages available under BIPA vary depending on a defendant's mental state. A court may award up to $5,000 for each intentional or reckless violation but only up to $1,000 for each negligent violation. 740 ILCS 14/20. Thus, by arguing that the allegations of recklessness are insufficient and should be dismissed, Defendant seeks to limit its potential exposure by excluding intentional or reckless violations.
The majority of recent cases that directly address this issue hold that a plaintiff is not required to make specific allegations about a Defendant's mental state to successfully plead a BIPA claim. See generally Kyles v. Hoosier Papa LLC, No. 20 C 7146, 2023 WL 2711608, at *7 (N.D. Ill. Mar. 30, 2023); Sosa v. Onfido, Inc., 600 F.Supp.3d 859, 875 (N.D. Ill. 2022); Ibarra v. Prospera, LLC, No. 20 C 7015, 2021 WL 1921015, at *4 (N.D. Ill. May 12, 2021); Brandenburg v. Meridian Senior Living, LLC, 564 F.Supp.3d 627, 634 (C.D. Ill. 2021); Cothron v. White Castle Sys., Inc., 467 F.Supp.3d 604, 615 (N.D. Ill. 2020); Snider v. Heartland Beef, Inc., 479 F.Supp.3d 762, 770 (C.D. Ill. 2020). These cases reason that BIPA's text makes mental state part of the remedy, which is governed at the pleadings stage by Rule 8(a)(3), not part of the claim governed by Rules 8(a)(2) and 12(b)(6). Rule 8(a)(3) merely requires that a pleading contain a “demand for the relief sought[.]” It does not require “a short and plain statement of the claim showing that the pleader is entitled to relief” like Rule 8(a)(2) or statement of “a claim upon which relief can be granted” like Rule 12(b)(6). See, e.g., Sosa., 600 F.Supp.3d at 875. Thus, because mental states are relevant only for purposes of remedies under 740 ILCS 14/20, a plaintiff “need not plead facts (such as facts plausibly suggesting negligence, recklessness, or intentional conduct) that show . . . entitlement to these precise forms of relief.” Id. at 874.
Defendant cited only two cases reaching the opposite conclusion, Rogers v. CSX Intermodal Terminals, Inc., 409 F.Supp.3d 612, 619 (N.D. Ill. 2019) & Namuwonge v. Kronos, Inc., 418 F.Supp.3d 279, 286 (N.D. Ill. Nov. 22, 2019), and one of them was authored by a judge who subsequently reversed course on the issue, see Sosa, 600 F.Supp.3d at 875 at n.7 (“We came to a contrary conclusion in [Rogers]. But Rogers does not bind us. And although we strive to rule consistently from case to case, we will not hesitate to depart from a ruling in a previous case if we determine that it is appropriate to do so.”).
This Court agrees with the rationale of the majority of courts that have considered the issue. Rules 8 and 12 do not require Plaintiffs to plead specific facts regarding Defendant's mental state to show entitlement to the forms of relief available under BIPA. Accordingly, Plaintiffs allegations concerning Defendant's mental state, (see, e.g., TAC ¶¶ 10, 54, 57, 66, 68, 7584), are sufficient.
IV. Disclosure to Third Parties
Next, Defendant argues that the allegations of third-party disclosure are too thin to state a claim under 740 ILCS 14/15(d) and therefore must be dismissed pursuant to Rule 12(b)(6). Defendant adds that Plaintiffs have conducted discovery on this issue but failed to include any additional allegations using information from discovery. Plaintiffs respond that the allegations concerning disclosure of biometrics to third-party vendors in connection with Defendant's railyard access system meet the federal pleading standards. Furthermore, Plaintiffs contend that some of the relevant discovery on Defendant's interactions with third parties was conducted after the TAC was filed and note that statements in Defendant's biometrics consent form essentially admit disclosure to third parties.
In determining whether Plaintiff's allegations of disclosure to third parties are sufficient to survive a Rule 12(b)(6) dismissal motion, the Court's focus is on whether the allegations include “factual content that allows the court to draw the reasonable inference” that Defendant disclosed Plaintiffs' biometrics to third parties. See Iqbal, 556 U.S. at 678. Plaintiffs allege that Defendant disclosed their biometrics to multiple third-party technology providers in connection with installation, maintenance, operation, and customization of the automated gate system. (TAC ¶¶ 2627, 80-88). Although these allegations do not explain exactly how the disclosure between Defendant and the third parties took place, it is reasonable to infer that Defendant at least disclosed biometric information to third parties engaged in work on the automated gate system, which is all that is required at the pleading stage. In addition, as Plaintiffs note, Defendant's biometrics consent agreement expressly references disclosure to third parties. (Def.'s Mem., Ex. B-1 (Finger Scan Collection Authorization), Dkt. 230-2).If Plaintiffs fail to produce evidence of actual disclosure and Defendant comes forward with proof that establishes that no such disclosure took place, Defendant is free to raise the issue at summary judgment or trial, if appropriate.
Although this information is not found in the TAC, the Court is permitted to consider it because it elaborates on and is consistent with the allegations. See Geinosky, 675 F.3d at 745 n.1.
Furthermore, Defendant's insistence that Plaintiffs should have included information from discovery in their disclosure allegations is misplaced. First, the fact that the deposition of a material witness had not taken place at the time the TAC was filed will not be held against Plaintiffs. Rather, it tends to show that this issue is premature and should not be resolved on such a limited record. Second, the case Defendant cites on this point dealt with allegations based on information and belief, which is not the case here. See Heard v. Becton, Dickinson & Co., 440 F.Supp.3d 960, 969 (N.D. Ill. 2020) (rejecting the plaintiff's argument that allegations on information and belief were permissible because the defendant alone had possession of the facts necessary to his BIPA disclosure claim). For these reasons, Defendant's request to dismiss Plaintiffs' disclosure claim under 740 ILCS 14/15(d) is denied.
V. Standing of Turner and the Subclass
As to Count III for failure to destroy the biometrics, Defendant argues that Turner and the putative subclass do not have standing to sue and that the claim should therefore be dismissed under Rule 12(b)(1) for lack of subject-matter jurisdiction. Based on a declaration from one of its employees, Defendant claims that Turner's biometrics were destroyed within the timeframe required under BIPA. Plaintiffs object to the use of extraneous evidence but also offer their own evidence that Defendant did not completely destroy Turner's biometrics and argue that the existence of factual disputes concerning the destruction of data preclude dismissal.
Article III of the United States Constitution limits the jurisdiction of federal courts to actual cases or controversies. U.S. Const. art. III § 2; Spokeo, Inc. v. Robins, 578 U.S. 330, 337 (2016). Rooted in the case or controversy requirement, a plaintiff must have “standing” to sue. Id. at 338.
To have standing, a plaintiff “must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, 578 U.S. at 338 (citing Friends of the Earth, Inc. v. Laidlaw Env't Servs. (TOC), Inc., 528 U.S. 167, 180-181 (2000); Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-561 (1992)). Section 14/15(a) of BIPA requires private entities to destroy biometrics “when the initial purpose for collecting or obtaining [the biometrics] has been satisfied or within 3 years of the individual's last interaction with the private entity, whichever occurs first.” 740 ILCS 14/15(a). Thus, if Turner's biometrics were properly destroyed within the timeframe established by the statute, he would not have standing to sue.
For its part, Defendant relies on an employee declaration to claim that Turner last visited one of its Illinois railyards on August 4, 2019, that it never received notice that Turner stopped working for his former employer, and that Turner's biometrics were destroyed on April 6, 2021. Based on this timeline, Defendant concludes that it never knew that the initial purpose for collecting or obtaining Turner's biometrics had been satisfied but that his biometrics were destroyed within three years of his last interaction with the company, so the requirements of 740 ILCS 14/15(a) are satisfied. Plaintiffs cast doubt on the veracity of Defendant's position because they received Turner's biometrics from Defendant pursuant to discovery in this lawsuit after the biometrics had supposedly been destroyed. In addition, Plaintiffs question whether Defendant's employee's declaration tells the entire story because he testified during his deposition that it was likely that backups and copies were created and he lacked information about whether biometrics provided to third parties were also destroyed.
The parties' reliance on extraneous information illuminates the reason why Defendant's request for dismissal on these grounds should be denied-there are factual issues that must be resolved before the Court can make any determination about whether Turner's biometrics were properly destroyed under BIPA. Although the Court has no reason to doubt the statements of Defendant's employee, Defendant did not provide evidence to support his contentions about Turner's interactions with Defendant, the status of Turner as an authorized driver in the system, and the destruction of biometrics. In addition, Defendant's employee's statement that Turner's biometrics were “permanently destroyed” is worth little without more information about how the biometrics were stored, whether there were backups and copies (apparently there was at least one back up pursuant to the litigation hold), and whether any biometrics disclosed to third parties had also been destroyed. Thus, as is the case with many of Defendant's arguments for dismissal, the record before the Court is simply too limited at this stage in the proceeding to conclude that Defendant fully complied with 740 ILCS 14/15(a)'s destruction requirements.
VI. Federal Aviation Administration Authorization Act (FAAAA) Preemption
Last, Defendant argues that the TAC should be dismissed because BIPA is preempted by the FAAAA. The preemption section of the FAAAA provides that no state may “enact or enforce a law, regulation, or other provision having the force and effect of law related to a price, route, or service of any motor carrier.” 49 U.S.C. § 14501(b)(1). “Preemption is an affirmative defense, on which the defendant bears the burden of proof.” Kislov, 2022 WL 846840, at *2 (citing Benson v. Fannie May Confections Brands, Inc., 944 F.3d 639, 645 (7th Cir. 2019)). Although affirmative defenses should generally be raised under Rule 12(c), dismissal under Rule 12(b)(6) is appropriate if the defense is apparent in the complaint itself. Id. (citing Gunn v. Cont'l Cas. Co., 968 F.3d 802, 806 (7th Cir. 2020); Burton v. Ghosh, 961 F.3d 960, 965 (7th Cir. 2020)).
In support of preemption, Defendant relies on a case in which a court found that BIPA claims brought against an airline for recording customer's voiceprints were preempted by the Airline Regulation Act. See Kislov v. Am. Airlines, Inc., No. 17 C 9080, 2022 WL 846840 (N.D. Ill. Mar. 22, 2022). Plaintiffs respond that no court has found FAAAA preemption in a BIPA case against a railroad and note that this argument has been recently rejected in nearly identical cases. See, e.g., Rogers v. BNSF Ry. Co., 19 C 3083, 2022 WL 787955, at *3 (N.D. Ill. Mar. 15, 2022); Rogers v. BNSF Ry. Co., 19 C 3083, 2019 WL 5635180, at *2 (N.D. Ill. Oct. 31, 2019). According to Plaintiffs, this is because compliance with BIPA is straightforward and the FAAAA does not preempt laws that affect carriers in only a tenuous, remote, or peripheral manner. Rogers, 2022 WL 787955, at *3 (quoting Dan's City Used Cars, Inc. v. Pelkey, 569 U.S. 251, 261 (2013)).
The Court finds the cases cited by Plaintiffs more persuasive. The Rogers case also involved BIPA claims brought by truck drivers against a railroad that required the drivers to scan their fingerprints. Rogers, 2022 WL 787955, at *1; Rogers, 2022 WL 787955, at *1. At the pleadings stage, the court rejected the railroad's FAAAA preemption argument because “the impact of the BIPA on motor carrier prices, routes, or services [was] ‘too tenuous, remote, or peripheral' to give rise to FAAAA preemption.” Rogers, 2019 WL 5635180, at *3 (quoting Costello v. BeavEx, Inc., 810 F.3d 1045, 1055 (7th Cir. 2016)). At that point, the record did not show any impact, so the argument was “highly speculative.” Id. At summary judgment, the court found the railroad's argument that compliance with BIPA would impact efficiency to be unpersuasive and reached the same conclusion about preemption. Rogers, 2022 WL 787955, at *6. In Kislov, the court briefly discussed the Rogers decisions and other cases involving too tenuous a connection to support preemption and distinguished itself, stating “[t]hat is not case here.” 2022 WL 846840, at *8.
Given that the present case involves claims by truck drivers against a railroad for scanning their fingerprints without consent, the Court finds the present case to be much more in line factually with the Rogers decisions than Kislov. Beyond that, the record currently before the court is most similar to the record in the Rogers dismissal decision-that is, Defendant has made no showing of any impact on its prices, routes, or services. See Rogers, 2019 WL 5635180, at *3. Indeed, “any such contention is highly speculative, to say the least.” Id. For these reasons, the Court rejects Defendant's FAAAA preemption argument at this stage in the proceeding.
CONCLUSION
For the reasons stated above, Defendant's motion to dismiss denied. Defendant's answer to the Third Amended Complaint is due by 5/1/24.