IN THE UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION
CHRISTINE BRYANT, on behalf of ) herself and a putative class of similarly ) situated individuals, ) ) Plaintiff, ) No. 19 C 6622 ) v. ) Judge Virginia M. Kendall ) COMPASS GROUP USA, INC., ) ) Defendant. )
MEMORANDUM OPINION AND ORDER Christine Bryant brought this action under the Illinois Biometric Information Privacy Act (“BIPA”) after Compass Group collected her fingerprint scan when she signed up to use a smart vending machine. Compass Group now moves to dismiss on the grounds that BIPA constitutes “special legislation” in violation of Article IV, Section 13 of the Illinois Constitution. In the alternative, Compass Group moves to dismiss on the grounds that both counts are time-barred and that Bryant fails to state a claim in Count II. For the reasons set forth below, the Motion to Dismiss (Dkt. 47) is granted in part and denied in part. The Court has already described the facts alleged in this case. Although Bryant has since filed an amended complaint, the underlying factual allegations are largely unchanged, so the Court incorporates herein by reference its previous description of the facts. (Dkt. 30.) Although the Parties’ briefings first address the constitutionality of BIPA, the Court will first address the other grounds for dismissal out of respect for the principle that courts should avoid deciding cases on constitutional grounds whenever possible. See In re E.H., 863 N.E.2d 231, 235 (Ill. 2006) (explaining that “courts must avoid considering constitutional questions where the case can be decided on nonconstitutional grounds”). I. Statute of Limitations Bryant provided a scan of her fingerprint to the vending machine in early 2018. (Dkt.
44 ¶¶ 5–6.) She filed this suit on August 23, 2019. (Dkt. 1-1 at p. 2.) If a one-year statute of limitations applies, this action is time-barred. BIPA itself does not contain a limitations period. Where a statutory civil cause of action does not specify a limitations period, another Illinois statute provides a default limitations period of five years. See 735 ILCS 5/13-205. Compass Group nonetheless urges that the Court should apply the one-year limitations period prescribed for “[a]ctions in slander, libel or for publications of matter violating the right of privacy.” 735 ILCS 5/13-201. BIPA does not require any publication for liability to attach, see Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020) (explaining that the injury involved in a BIPA action is the deprivation of information), so the one-year limitations period does not apply. Compass Group cites Johnson v. Graphic Commc’ns Int’l Union, 930 F.2d 1178, 1179 (7th Cir.
1991) for the proposition that the Court should apply the most analogous limitations period, but that case is inapposite because it only provides guidance on what to do if a federal statute is silent as to the limitations period. Illinois law, by contrast, is clear that civil actions for which no limitations period is specified are subject to a five-year limitations period. BIPA actions are subject to the five-year default limitations period provided for in 735 ILCS 5/13-205, so Bryant’s claims are timely. II. Count II: Section 15(a) Claim In Count II of the Amended Complaint, Bryant alleges that Compass Group violated § 15(a) of BIPA by possessing her biometric information and failing to destroy that information once the purpose for collecting that information was complete. (Dkt. 44 ¶¶ 56.) Section 15(a) provides that entities in possession of biometric information must: develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever occurs first. Absent a valid warrant or subpoena issued by a court of competent jurisdiction, a private entity in possession of biometric identifiers or biometric information must comply with its established retention schedule and destruction guidelines.
740 ILCS 14/15(a). Bryant’s original complaint in this action only alleged that Compass Group violated the provision that requires development of a written policy made available to the public. The Seventh Circuit determined that Bryant lacked standing as to this claim because the written policy requirement is “owed to the public generally, not to particular persons whose biometric information the entity collects.” Bryant, 958 F.3d at 626. The Court did not address whether she would have had standing to bring a claim “under the provision requiring compliance with the established retention schedule and destruction guidelines.” Id. (“Our analysis is . . . limited to the theory she invoked.”). The Seventh Circuit has since clarified that an allegation of particularized harm under the compliance provision of § 15(a) would give rise to standing. See Fox v. Dakkota Integrated Sys., LLC, No. 20-2782, 2020 WL 6738112, at *7 (7th Cir. Nov. 17, 2020). The issue now before the Court is not whether Ms. Bryant has standing to bring her § 15(a) claim, but instead whether she has stated the elements of such a claim. To state a claim under § 15(a), a plaintiff must allege that the defendant has failed to comply with its established retention and destruction guidelines. Making such an allegation requires making a antecedent allegation— namely, that the defendant has established retention and destruction guidelines. One cannot fail to comply with guidelines that do not exist. Merely holding on to biometric information does not give rise to a § 15(a) claim unless holding on to it violates the established retention and destruction guidelines. The Amended Complaint is silent as to whether Compass Group had any retention and destruction guidelines in place, so it fails to state a claim in Count II. Count II also fails to state a claim for another reason—it is unripe. Section 15(a) dictates
that the guidelines an entity establishes must provide for the destruction of biometric identifiers within three years of the individual’s last interaction with the entity or when the initial purpose for collecting or obtaining such identifiers has been satisfied, whichever is earlier. It is undisputed that three years have not yet passed, so the only possible way that Compass Group could have violated this Section is if the purpose for which Compass Group collected Bryant’s fingerprint has been satisfied. Bryant claims that the purpose—creating an account to purchase items from Smart Market vending machines—has been satisfied because her employment with the company that had the machine in its cafeteria has ended. Bryant fails to explain the relevance of her employment ending. Her desire to purchase items from Smart Market machines is unrelated to her employment. She may still wish to go to a Smart Market machine located in any number of places to buy herself
a snack. She gave Compass Group her fingerprint so that she could use the machines; her use of the machines was not tied to her employment. For both of the foregoing reasons, Count II is dismissed without prejudice. III.
Free access — add to your briefcase to read the full text and ask questions with AI
IN THE UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION
CHRISTINE BRYANT, on behalf of ) herself and a putative class of similarly ) situated individuals, ) ) Plaintiff, ) No. 19 C 6622 ) v. ) Judge Virginia M. Kendall ) COMPASS GROUP USA, INC., ) ) Defendant. )
MEMORANDUM OPINION AND ORDER Christine Bryant brought this action under the Illinois Biometric Information Privacy Act (“BIPA”) after Compass Group collected her fingerprint scan when she signed up to use a smart vending machine. Compass Group now moves to dismiss on the grounds that BIPA constitutes “special legislation” in violation of Article IV, Section 13 of the Illinois Constitution. In the alternative, Compass Group moves to dismiss on the grounds that both counts are time-barred and that Bryant fails to state a claim in Count II. For the reasons set forth below, the Motion to Dismiss (Dkt. 47) is granted in part and denied in part. The Court has already described the facts alleged in this case. Although Bryant has since filed an amended complaint, the underlying factual allegations are largely unchanged, so the Court incorporates herein by reference its previous description of the facts. (Dkt. 30.) Although the Parties’ briefings first address the constitutionality of BIPA, the Court will first address the other grounds for dismissal out of respect for the principle that courts should avoid deciding cases on constitutional grounds whenever possible. See In re E.H., 863 N.E.2d 231, 235 (Ill. 2006) (explaining that “courts must avoid considering constitutional questions where the case can be decided on nonconstitutional grounds”). I. Statute of Limitations Bryant provided a scan of her fingerprint to the vending machine in early 2018. (Dkt.
44 ¶¶ 5–6.) She filed this suit on August 23, 2019. (Dkt. 1-1 at p. 2.) If a one-year statute of limitations applies, this action is time-barred. BIPA itself does not contain a limitations period. Where a statutory civil cause of action does not specify a limitations period, another Illinois statute provides a default limitations period of five years. See 735 ILCS 5/13-205. Compass Group nonetheless urges that the Court should apply the one-year limitations period prescribed for “[a]ctions in slander, libel or for publications of matter violating the right of privacy.” 735 ILCS 5/13-201. BIPA does not require any publication for liability to attach, see Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020) (explaining that the injury involved in a BIPA action is the deprivation of information), so the one-year limitations period does not apply. Compass Group cites Johnson v. Graphic Commc’ns Int’l Union, 930 F.2d 1178, 1179 (7th Cir.
1991) for the proposition that the Court should apply the most analogous limitations period, but that case is inapposite because it only provides guidance on what to do if a federal statute is silent as to the limitations period. Illinois law, by contrast, is clear that civil actions for which no limitations period is specified are subject to a five-year limitations period. BIPA actions are subject to the five-year default limitations period provided for in 735 ILCS 5/13-205, so Bryant’s claims are timely. II. Count II: Section 15(a) Claim In Count II of the Amended Complaint, Bryant alleges that Compass Group violated § 15(a) of BIPA by possessing her biometric information and failing to destroy that information once the purpose for collecting that information was complete. (Dkt. 44 ¶¶ 56.) Section 15(a) provides that entities in possession of biometric information must: develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever occurs first. Absent a valid warrant or subpoena issued by a court of competent jurisdiction, a private entity in possession of biometric identifiers or biometric information must comply with its established retention schedule and destruction guidelines.
740 ILCS 14/15(a). Bryant’s original complaint in this action only alleged that Compass Group violated the provision that requires development of a written policy made available to the public. The Seventh Circuit determined that Bryant lacked standing as to this claim because the written policy requirement is “owed to the public generally, not to particular persons whose biometric information the entity collects.” Bryant, 958 F.3d at 626. The Court did not address whether she would have had standing to bring a claim “under the provision requiring compliance with the established retention schedule and destruction guidelines.” Id. (“Our analysis is . . . limited to the theory she invoked.”). The Seventh Circuit has since clarified that an allegation of particularized harm under the compliance provision of § 15(a) would give rise to standing. See Fox v. Dakkota Integrated Sys., LLC, No. 20-2782, 2020 WL 6738112, at *7 (7th Cir. Nov. 17, 2020). The issue now before the Court is not whether Ms. Bryant has standing to bring her § 15(a) claim, but instead whether she has stated the elements of such a claim. To state a claim under § 15(a), a plaintiff must allege that the defendant has failed to comply with its established retention and destruction guidelines. Making such an allegation requires making a antecedent allegation— namely, that the defendant has established retention and destruction guidelines. One cannot fail to comply with guidelines that do not exist. Merely holding on to biometric information does not give rise to a § 15(a) claim unless holding on to it violates the established retention and destruction guidelines. The Amended Complaint is silent as to whether Compass Group had any retention and destruction guidelines in place, so it fails to state a claim in Count II. Count II also fails to state a claim for another reason—it is unripe. Section 15(a) dictates
that the guidelines an entity establishes must provide for the destruction of biometric identifiers within three years of the individual’s last interaction with the entity or when the initial purpose for collecting or obtaining such identifiers has been satisfied, whichever is earlier. It is undisputed that three years have not yet passed, so the only possible way that Compass Group could have violated this Section is if the purpose for which Compass Group collected Bryant’s fingerprint has been satisfied. Bryant claims that the purpose—creating an account to purchase items from Smart Market vending machines—has been satisfied because her employment with the company that had the machine in its cafeteria has ended. Bryant fails to explain the relevance of her employment ending. Her desire to purchase items from Smart Market machines is unrelated to her employment. She may still wish to go to a Smart Market machine located in any number of places to buy herself
a snack. She gave Compass Group her fingerprint so that she could use the machines; her use of the machines was not tied to her employment. For both of the foregoing reasons, Count II is dismissed without prejudice. III. The Constitutional Challenge Given that one count of the Amended Complaint remains, the Court must now take up the question of BIPA’s constitutionality. Article IV, Section 13 of the Illinois Constitution provides that “[t]he General Assembly shall pass no special or local law when a general law is or can be made applicable. Whether a general law is or can be made applicable shall be a matter for judicial determination.” This Section “prohibits the General Assembly from conferring a special benefit or exclusive privilege on a person or a group of persons to the exclusion of others similarly situated. Best v. Taylor Machine Works, 689 N.E.2d 1057, 1069 (Ill. 1997). When addressing a special legislation challenge, Illinois courts apply the same standards applicable to an equal protection challenge. Best v. Taylor Machine Works, 689 N.E.2d 1057, 1070
(Ill. 1997). BIPA excludes financial institutions, affiliates of financial institutions that are subject to the Gramm-Leach-Bliley Act, government agencies, and government contractors working in the capacity as contractors from its coverage. 740 ILCS 14/25. It is undisputed that the exclusion of these groups is not a suspect classification, so it does not trigger heightened scrutiny. Thus, the Court applies rational basis review to determine whether these exclusions are constitutional. Best, 689 N.E.2d at 1071. Under rational basis review, the Court determines whether the statutory classifications are rationally related to a legitimate government interest. Id. The party challenging the constitutionality of a statute subject to rational basis review bears the burden of clearly establishing that the classifications are not rationally related to a legitimate government interest. Allen v. Woodfield Chevrolet, Inc., 802 N.E.2d 752, 758–59 (Ill. 2003).1
The General Assembly’s decision to exclude certain entities from BIPA’s coverage is eminently rational. The legislature could have excluded government agencies and contractors working for government agencies for any number of legitimate reasons. For starters, government agencies are generally entitled to sovereign immunity. The legislative record also revealed that the
1 The General Assembly enacted BIPA in 2008, and it has faced this same constitutional challenge on multiple occasions. The challenge has only been raised in federal district courts and state trial courts, but they have all rejected it. See, e.g., Stauffer v. Innovative Heights Fairview Heights, LLC, No. 20 CV 46, 2020 WL 4815960, at *9–10 (S.D. Ill. Aug. 19, 2020) (“BIPA is not special legislation and is therefore, not unconstitutional.”); Bruhn v. AB Acquisitions, LLC, No. 18-CH-1737, at *4–9 (Cir. Ct. Cook Cty. Jan 30, 2020) (ruling orally that the BIPA exclusions satisfy rational basis review such that the statute does not constitute special legislation); Swanson v. Hanra Chi. LLC, No. 19-CH-4554, at *6–8 (Cir. Ct. Cook Cty. Sept. 11, 2020) (ruling orally that the defendant did not overcome the presumption that BIPA is constitutional because the BIPA exclusions are rational). None of those decisions are binding on this Court, but they have some persuasive value. General Assembly planned to assess threats to privacy caused by governments’ possession of personal information in a different way—namely, by forming a study committee to review agencies’ policies and practices with respect to collection and storage of biometric identifiers. (Dkt. 52-3 at p. 2.) (“State and local government use of biometrics will be covered through the
establishment of a study committee with key government stakeholders to review current policies and practices and make recommendations for improvement by January 2009.”) Furthermore, government agencies have no profit motive to exploit individuals’ biometric information, so the perceived dangers associated with possession of sensitive information are less severe vis-à-vis government agencies and contractors subject to their supervision. The General Assembly likely excluded financial institutions because they are already subject to a comprehensive privacy protection regime under federal law. See generally Gramm-Leach-Bliley Act, Pub. L. 106–102; see also 740 ILCS 14/25(c) (specifically excluding institutions covered by the Gramm-Leach Bliley Act). The General Assembly’s decision to exclude government agencies and financial institutions was rationally related to BIPA’s legitimate government interest in protecting Illinois
residents’ privacy. Those two categories of institutions already had privacy safeguards in place, so imposing additional obligations on them would have been minimally efficacious. Accordingly, BIPA is not unconstitutional special legislation. CONCLUSION For the foregoing reasons, Compass Group’s Motion to Dismiss [47] is granted as to Count II and otherwise denied. The dismissal of Count I] is without prejudice.
fe) ApjiinM Hnthalt Mipyinta~ [ON ginia M. Kendall United States District Judge
Date: November 29, 2020