Summary
holding that plaintiff did not have standing when she voluntarily and knowingly used her fingerprint as the key to a storage locker
Summary of this case from Colon v. Dynacast, LLCOpinion
Case No. 16 C 03777
08-01-2016
ADINA MCCOLLOUGH, individually and on behalf of all others similarly situated, Plaintiff, v. SMARTE CARTE, INC., Defendant.
MEMORANDUM OPINION AND ORDER
Plaintiff, Adina McCollough, filed a three-count Complaint for damages, injunctive relief, and unjust enrichment stemming from violations of the Illinois Biometric Information Privacy Act ("BIPA"), 740 ILCS 14/1 et seq. Smarte Carte, Inc., now moves to dismiss for lack of jurisdiction and failure to state a claim [11]. For the reasons stated below, this Court grants the motion.
Background
The following facts from the Complaint are taken as true for the purpose of ruling on the motion before the Court. (See Dkt. 1). Smarte Carte owns and operates electronic lockers, luggage carts, commercial strollers, and massage chairs for use in public places for a fee. In Illinois, Smarte Carte has made available lockers that use the renter's fingerprint as a "key."
McCollough alleges that she used a Smarte Carte locker at Union Station in Chicago, Illinois, five times in 2015. The Complaint alleges that Smarte Carte retained McCollough's fingerprint biometric information without written consent. In order to rent a Smarte Carte locker, customers must: select options (either to rent a new locker or open one previously rented) from a touchscreen display at the center of the bank of lockers; when the customer rents a locker they are prompted to select the size of locker, the duration of the rental, and the method of payment; the customer is then instructed to place their finger on a fingerprint scanner, which is then displayed on the screen; finally, the screen displays the locker number and unlocks the locker. The lockers automatically lock when they are closed after the customer places their belongings inside.
To retrieve their belongings, the customer selects from the touchscreen the option to open their rented locker. The customer places their finger on the scanner, which scans their fingerprint and displays it on the touchscreen. The matched fingerprint causes the customer's rented locker to unlock. The screen instructs the customer to retrieve their belongings from the locker and the locker locks automatically when closed.
According to the Complaint, at no point does Smarte Carte inform customers and obtain their written consent to record, collect, obtain, or store their fingerprint. Smarte Carte also does not inform its customers of the length of time it retains the information. The Complaint alleges that Smarte Carte does not publicly disclose its retention schedule or guidelines for permanently destroying biometric identifiers and information. It also alleges that Smarte Carte has not disclosed the purpose and length of time for which the biometric identifiers and information is being collected, stored, and used. The Complaint purports to be a class action based on the large number of Smarte Carte lockers available to the public.
This Court assumes that a customer would understand that Smarte Carte collects and retains their fingerprint data for at least the duration of the rental. The system would not work otherwise. --------
The Complaint alleges that Smarte Carte's practice of collecting, storing, and using of fingerprint data violates the Illinois Biometric Privacy Act, ("BIPA"), 740 ILCS 14/1 et seq. Section 14/15 provides guidelines for retention, collection, disclosure, and destruction of biometric information and identifiers by private entities. Section 14/15(a) states:
A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual's last interaction with the private entity, whichever occurs first. 740 ILCS 14/15(a).Section 14/15(b) states:
No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information, unless it first:Section 14/20 provides for a private right of action for "[a]ny person aggrieved by a violation of this Act shall have a right of action in a State circuit court or as a supplemental claim in federal district court against an offending party." 740 ILCS 14/20.
(1) informs the subject or the subject's legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored;
(2) informs the subject or the subject's legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and
(3) receives a written release executed by the subject of the biometric identifier or biometric information or the subject's legally authorized representative. 740 ILCS 14/15(b).
Legal Standard
Smarte Carte moves to dismiss for lack of jurisdiction pursuant to Federal Rule of Civil Procedure 12(b)(1). A plaintiff faced with a 12(b)(1) motion to dismiss bears the burden of establishing that the jurisdictional requirements have been met. See Western Transp. Co. v. Couzens Warehouse & Distributors, Inc., 695 F.2d 1033, 1038 (7th Cir. 1982). The plaintiff must clearly allege facts demonstrating each element of standing to invoke federal jurisdiction. Warth v. Seldin, 422 U.S. 490, 518, 95 S. Ct. 2197, 45 L. ed. 2d 343 (1975).
A motion to dismiss under Rule 12(b)(6) challenges the sufficiency of the complaint, not its merits. Fed. R. Civ. P. 12(b)(6); Gibson v. City of Chicago, 910 F.2d 1510, 1520 (7th Cir. 1990). When considering the motion, the Court accepts as true all well pleaded facts in the plaintiff's complaint and draws all reasonable inferences from those facts in the plaintiff's favor. AnchorBank, FSB v. Hofer, 649 F.3d 610, 614 (7th Cir. 2011). To survive dismissal, the complaint must not only provide the defendant with fair notice of a claim's basis, but must also be facially plausible. Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S. Ct. 1937, 173 L. Ed. 2d 868 (2009); see also Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L. Ed. 2d 929 (2007). "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Iqbal, 556 U.S. at 678.
Discussion
Smarte Carte argues that this Court lacks subject matter jurisdiction over the Complaint because McCollough does not allege that she suffered any injury to satisfy Article III standing. Smarte Carte also argues that McCollough lacks statutory standing to bring the claim because she is not an "aggrieved" individual within the meaning of BIPA.
"[T]he core component of standing is an essential and unchanging part of the case-or-controversy requirement of Article III." Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992). Recently, the United States Supreme Court in Spokeo Inc. v. Robins, -- U.S. --, 136 S. Ct. 1540, 194 L. Ed. 2d 635 (2016), reiterated the requirements for Article III standing and further explained the "concrete" element of the injury-in-fact requirement. Article III jurisprudence instructs that the "irreducible constitutional minimum" of standing has three components: (1) the plaintiff must have suffered an injury-in-fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision. Spokeo, 136 S. Ct. at 1545. At issue here is the first component: injury-in-fact.
To satisfy the first element of Article III standing, the plaintiff must allege an injury-in-fact that is both "concrete and particularized." Id. (quoting Friends of the Earth Inc. v. Laidlaw Environmental Services (TOC) Inc., 528 U.S. 167, 180-81, 120 S. Ct. 693, 145 L. Ed. 2d 610 (2000)).
For an injury to be particularized, it must affect the plaintiff in a personal and individualized way. Particularization is necessary to establish injury-in-fact, but it is not sufficient. An injury-in-fact must also be concrete. A concrete injury must be de facto; that is, it must actually exist. When we have used the adjective concrete, we have meant to convey the usual meaning of the term — 'real,' and not 'abstract.' Concreteness, therefore, is quite different from particularization. Concrete is not,
however, necessarily synonymous with tangible. Although tangible injuries are perhaps easier to recognize, we have confirmed in many of our previous cases that intangible injuries can nevertheless be concrete. Congress' role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right. Article III standing requires a concrete injury even in the context of a statutory violation. For that reason, Robins could not, for example, allege a bare procedural violation, divorced from any concrete harm, and satisfy the injury-in-fact requirement of Article III. Spokeo, 136 S. Ct. at 1548-49 (internal citations omitted).The Supreme Court has previously held that a "deprivation of a procedural right without some concrete interest that is affected by the deprivation... is insufficient to create Article III standing." Summers v. Earth Island Institute, 555 U.S. 488, 496, 129 S. Ct. 1142, 173 L. Ed. 2d 1 (2009).
In this case, McCollough alleges that Smarte Carte violated BIPA by failing to obtain advance consent and inform her that it would retain her fingerprint data and for what period of time, if any, beyond the rental period. While it is a technical violation of section 14/15(b)(2), McCollough does not allege any harm that resulted from the violation. McCollough undoubtedly understood when she first used the system that her fingerprint data would have to be retained until she retrieved her belongings from the locker. As the Seventh Circuit Court of Appeals put it in Sterk v. Redbox Automated Retail, LLC, "How could there be an injury, unless the information, not having been destroyed, were disclosed? If, though not timely destroyed, it remained secreted in the video service provider's files until it was destroyed, there would be no injury." 672 F.3d 535, 538 (7th Cir. 2012). Although the Seventh Circuit was referring to the records destruction provision of the Video Privacy Protection Act, the reasoning is applicable here. How can there be an injury from the lack of advance consent to retain the fingerprint data beyond the rental period if there is no allegation that the information was disclosed or at risk of disclosure? It was simply retained.
In Spokeo, the Supreme Court found that Robins cannot satisfy the demands of Article III standing by alleging a bare procedural violation. The Court reasoned:
A violation of one of the FCRA's procedural requirements may result in no harm.
For example, even if a consumer reporting agency fails to provide the required notice to a user of the agency's consumer information, that information regardless may be entirely accurate. In addition, not all inaccuracies cause harm or present any material risk of harm. An example that comes readily to mind is an incorrect zip code. It is difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm. Spokeo, 136 S. Ct. at 1550.Even without prior written consent to retain, if Smarte Carte did indeed retain the fingerprint data beyond the rental period, this Court finds it difficult to imagine, without more, how this retention could work a concrete harm. See also Gubala v. Time Warner Cable, Inc., No. 15-cv-1078, 2016 U.S. Dist. LEXIS, 79820, 2016 WL 3390415, *4 (E.D. Wis. June 17, 2016) (finding that the plaintiff had not alleged a concrete injury as a result of the defendant retaining his personally identifiable information even though it was a technical violation of the Cable Communications Policy Act).
Further undermining McCollough's ability to satisfy the injury requirements for standing is the need for proof of an actual injury to recovery statutory damages like those provided for in BIPA. See Doe v. Chao, 540 U.S. 614, 124 S. Ct. 1204, 157 L. Ed. 2d 1122 (2004); see also Sterk, 672 F. 3d at 539 ("liquidated damages are intended to be an estimate of actual damages"). It seems therefore that there is no concrete injury. This Court finds that plaintiff has alleged the sort of bare procedural violation that cannot satisfy Article III standing.
In addition to lacking constitutional standing, McCollough also fails to allege sufficient facts to show that she has statutory standing as a person "aggrieved by a violation" of BIPA. See 740 ILCS 14/20 (emphasis added). The statute does not define "aggrieved." Other Illinois statutes, however, do define "aggrieved party." Under the Illinois Human Rights Act, for example, it means "a person who is alleged or proved to have been injured by a civil rights violation or believes he or she will be injured by a civil rights violation...". 775 ILCS 5/1-103(B). Under the Soil and Water Conservation District Acts an aggrieved party "means any person whose property resources, interest or responsibility is being injured or impeded in value or utility or any other manner by the adverse effects of sediment caused by soil erosion...". 70 ILCS 405/3.20. These definitions each invoke the concept of injury resulting from a statutory violation. Thus, it appears that by limiting the right to sue to persons aggrieved by a violation of the act, the Illinois legislature intended to include only persons having suffered an injury from a violation as "aggrieved."
McCollough offers Black's Law Dictionary's definition of aggrieved party: "A party entitled to a remedy; esp., a party whose personal, pecuniary, or property rights have been adversely affected by another person's actions or by a court's decree or judgment." This definition also suggests an injury or adverse effect. McCollough however does not meet this definition because she has not alleged any facts to show that her rights have been adversely affected by the violation. She is essentially claiming that the very fact of a technical violation is the adverse effect. Accordingly, this Court finds that McCollough also lacks statutory standing. Since a state statute cannot confer constitutional standing, even if McCollough is an aggrieved person under BIPA, she would not necessarily have Article III standing to maintain federal jurisdiction. See, e.g., Conrad v. Boiron, Inc., 2015 WL 7008136 (N.D. Ill. Nov. 12, 2015).
On July 27, 2016, McCollough filed a Notice of Additional Authority, seeking the Court's consideration of the following recent decisions: Thomas v. FTS USA, LLC, No. 3:13-cv-825, 2016 U.S. Dist. LEXIS 85545 (E.D. Va. June 30, 2016); Church v. Accretive Health, Inc., No. 15-15708, 2016 U.S. App. LEXIS 12414 (11th Cir. July 6, 2016); Lane v. Bayview Loan Servicing, LLC, No. 15 C 10446, 2016 U.S. Dist. LEXIS 89258 (N.D. Ill. July 11, 2016)(Chang, J.); and Rosenbach v. Six Flags Entertainment Corporation et al., 16 CH 13 (Cir. Court, Lake County, IL, June 17, 2016). This Court has reviewed the additional authority and finds it readily distinguishable from the case at hand.
In Thomas v. FTS USA, LLC, the court found the allegedly unauthorized disclosure of personal information constitutes an invasion of the statutory right to privacy conferred by the Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq. ("FCRA"), and a concrete injury sufficient to establish Article III standing. 2016 U.S. Dist. LEXIS 85545, at *33. In this case, there is no similar allegation of disclosure of biometric information.
In Church v. Accretive Health, the Eleventh Circuit Court of Appeals found Article III standing where the plaintiff alleged that she was "very angry" and "cried a lot" as a result of the defendant's failure to include in a debt collection letter the disclosures required by the Fair Debt Collections Practices Act ("FDCPA"). There, the court found that Congress intended to create a cognizable injury when it enacted the disclosure provision of the FDCPA. Church, 2016 U.S. App. LEXIS 12414 at *11.
In Lane v. Bayview Loan Servicing, LLC, Hon. Edmond E. Chang discusses intangible, but concrete, harms after Spokeo. See 2016 U.S. Dist. LEXIS 89258 at *7-12. In Lane, the court found a concrete injury-in-fact to satisfy Article III standing because the alleged denial of his right to information under the FDCPA at the very least posed a risk of depriving Lane of his right to verify the debt. Id.
In Rosenbach v. Six Flags Entertainment Corp., the only case to address BIPA consent and written disclosures, the Lake County Chancellor found sufficient statutory standing for the plaintiff to survive a motion to dismiss where the plaintiff had provided fingerprints to Six Flags as part of an annual pass program to the amusement park. At the hearing, the court directly addressed Article III federal standing by noting that it was not bound by the same jurisdictional restrictions. See Dkt. 29-7 at 10. As this Court notes above, even if a state court would find McCollough to be an aggrieved person under BIPA a state statute cannot confer federal constitutional standing.
Conclusion
Based on the foregoing, this Court grants Smarte Carte's Motion to Dismiss the Complaint [11] with prejudice. Dismissal is without prejudice as to any claim that plaintiff may assert in state court. IT IS SO ORDERED. Dated: August 1, 2016
ENTERED:
/s/_________
SHARON JOHNSON COLEMAN
U. S. District Court Judge