IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION
LATRINA COTHRON, Individually ) and on behalf of similarly situated ) individuals, ) ) Plaintiff, ) No. 19 CV 00382 ) v. ) Judge John J. Tharp, Jr. ) WHITE CASTLE SYSTEM, INC. ) D/B/A WHITE CASTLE, ) ) Defendant.
MEMORANDUM OPINION AND ORDER The present case is one of many recent suits concerning Illinois’ Biometric Information Privacy Act (BIPA). Plaintiff Latrina Cothron brings suit against her employer, White Castle System, Inc. (“White Castle”), alleging violations of BIPA Section 15(a), Section 15(b), and Section 15(d). White Castle has moved to dismiss Ms. Cothron’s claims under Rule 12(b)(6). Because the Court finds that Ms. Cothron lacks standing to pursue her Section 15(a) claim, that claim is dismissed without prejudice. Ms. Cothron has, however, adequately alleged violations of Section 15(b) and Section 15(d) and White Castle’s motion to dismiss those claims is therefore denied. BACKGROUND1 Latrina Cothron began working for White Castle in 2004 and is still employed by the restaurant-chain as a manager. Sec. Am. Compl. ¶ 39, ECF No. 44. Roughly three years after Ms. Cothron was hired, White Castle introduced a fingerprint-based computer system that required Cothron, as a condition of continued employment, to scan and register her fingerprint in order “to
access the computer as a manager and access her paystubs as an hourly employee.” Id. ¶ 40. According to Ms. Cothron, White Castle’s system involved transferring the fingerprints to two third-party vendors—Cross Match and Digital Persona—as well as storing the fingerprints at other separately owned and operated data-storage facilities. Id. ¶¶ 28-31. Perhaps unsurprisingly—given that the Illinois Biometric Information Privacy Act (“BIPA”) did not exist yet—White Castle did not receive a written release from Ms. Cothron to collect her fingerprints or to transfer them to third parties before implementing the system. Id. ¶ 41. White Castle also did not provide Ms. Cothron with information regarding the purpose of collection or the length of storage and did not make its data retention policy publicly available. Id.
When the Illinois legislature passed BIPA in mid-2008, the legal landscape changed but White Castle’s practices did not—at least not for roughly ten years. Id. ¶¶ 27-28. White Castle continued to use its fingerprint system in the years following BIPA’s passage and continued to disseminate that data to the same third parties. Id. ¶¶ 28-31. It was not until October 2018 that
1 As with all motions to dismiss, the Court must accept all well-pleaded facts in the second amended complaint as true and draw all permissible inferences in favor of the plaintiffs. Agnew v. NCAA, 683 F.3d 328, 334 (7th Cir. 2012). The Court must also consider “documents attached to the complaint, documents that are critical to the complaint and referred to in it, and information that is subject to proper judicial notice,” along with facts set forth in Plaintiffs’ briefing insofar as those facts “are consistent with the pleadings.” Phillips v. Prudential Ins. Co. of Am., 714 F.3d 1017, 1020 (7th Cir. 2013) (internal quotation marks omitted). 2 White Castle provided Ms. Cothron with a consent form. Id. ¶ 45. Similarly, White Castle did not post a publicly available retention schedule and guidelines for destroying fingerprint data until near the end of 2018. Id. ¶ 48; see also Resp. Mot. Dismiss 7, ECF No. 60. DISCUSSION
BIPA “imposes numerous restrictions on how private entities collect, retain, disclose and destroy biometric identifiers”—a category that includes fingerprints. Rosenbach v. Six Flags Entm’t Corp., 432 Ill. Dec. 654, 656, 129 N.E.3d 1197, 1199 (Ill. 2019); see also 740 ILCS 14/10 (“‘Biometric identifier’ means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.”). Ms. Cothron has alleged that White Castle violated the restrictions contained in Section 15(a), Section 15(b), and Section 15(d) of BIPA. Section 15(a) requires that a private entity “in possession of” biometric data (1) develop a written, publicly available policy that includes a retention schedule and destruction guidelines and (2) permanently destroy data upon the satisfaction of the “initial purpose for collecting or obtaining” it or “within 3 years” of the entity’s last interaction with the person, whichever comes first. 740 ILCS 14/15(a). Section 15(b) provides
that, prior to collecting biometric data, entities must first (1) inform the person in writing that the information is being collected or stored; (2) state the “specific purpose and length of term for which” the data “is being collected, stored, and used”; and (3) receive a written release from the person. 740 ILCS 14/15(b). Finally, Section 15(d) states that entities in possession of biometric data may only disclose or “otherwise disseminate” a person’s data upon obtaining the person’s consent or in limited other circumstances inapplicable here. 740 ILCS 14/15(d). BIPA creates a private right of action for “[a]ny person aggrieved by a violation.” 740 ILCS 14/20.
3 I. Standing Even when the parties do not raise the issue of subject-matter jurisdiction, the Court must “satisfy [itself] that jurisdiction is secure.” See Carroll v. Stryker Corp., 658 F.3d 675, 680 (7th Cir. 2011). In light of the Seventh Circuit’s recent holding in Bryant v. Compass Group USA, Inc., the jurisdictional prerequisite in question is Article III standing. 958 F.3d 617 (7th Cir. 2020). For
Cothron to have Article III standing to advance each of her BIPA claims, three requirements must be satisfied as to each: “(1) she must have suffered an actual or imminent, concrete and particularized injury-in-fact; (2) there must be a causal connection between her injury and the conduct complained of; and (3) there must be a likelihood that this injury will be redressed by a favorable decision.” Id. at 620-21 (citing Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-61 (1992)). “Only the first of those criteria is at issue here: any injury [Cothron] suffered was caused directly by [White Castle’s] failure to comply with BIPA, and the prospect of statutory damages shows that such an injury is redressable.” Id. at 621. To be particularized, the injury “must affect the plaintiff in a personal and individual way.” Lujan, 504 U.S. at 561 n.1. To be concrete, the injury
“must actually exist but need not be tangible.” Bryant, 958 F.3d at 621. A legislature may “elevate to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law.” Spokeo, Inc. v. Robins, ––– U.S. ––––, 136 S. Ct. 1540, 1549, 194 L.Ed.2d 635 (2016). But this legislative power is not without limits: even if contrary to statute, “a bare procedural violation, divorced from any concrete harm” will not “satisfy the injury-in-fact requirement.” Id. “Instead, the plaintiff must show that the statutory violation presented an ‘appreciable risk of harm’ to the underlying concrete interest that [the legislature] sought to protect by enacting the statute.” Groshek v. Time Warner Cable, Inc., 865 F.3d 884, 887 (7th Cir. 2017).
4 As relevant here, many statutes create a right to receive information and therefore give rise to “informational injuries” potentially cognizable under Article III. Bryant, 958 F.3d at 624. The Seventh Circuit has distinguished between concrete informational injuries—where the alleged violation deprives a person of substantive information that could plausibly alter future decision- making, see Robertson v. Allied Solutions, LLC, 902 F.3d 690 (7th Cir. 2018)—and bare
procedural ones—where the alleged violation goes only to the form of the information provided, Groshek 865 F.3d 884, or where the information would not impact future decision-making, Casillas v. Madison Avenue Associates, 926 F.3d 329 (7th Cir. 2019). See also Bryant, 956 F.3d at 625-26 (discussing these cases and drawing this distinction). In Bryant, the Seventh Circuit found that the alleged violations of Section 15(b) satisfied the injury-in-fact requirement, but the alleged violations of Section 15(a) were insufficiently particularized. See id. at 626. In that case, the biometric data collector was a workplace cafeteria vending machine that “did not accept cash; instead, a user had to establish an account using her fingerprint.” Id. at 619. In assessing the Section 15(b) claim, the court reasoned that “the informed-
consent regime laid out in section 15(b) is the heart of BIPA” and that “its purpose is to ensure that consumers understand, before providing their biometric data, how that information will be used, who will have access to it, and for how long it will be retained.” Id. at 626. A failure to adhere to that regime inflicted a concrete injury because the relevant information was “substantive and personal” and, “[e]quipped with the missing information,” a person might opt to forgo use of the relevant information-collecting device. Id. By contrast, the claim under Section 15(a) was “a separate matter” because Section 15(a) is not part of the informed-consent regime: “the duty to disclose under section 15(a) is owed to the public generally, not to particular persons whose biometric information the entity collects.” Id. As a result, even if the missing information were 5 substantive and could have informed future action, Bryant had not alleged a “particularized harm that resulted from [ ] violation of section 15(a).” Id.2 The facts of the present case differ from those at issue in Bryant, but the bottom-line standing analysis does not. The assessment of Ms. Cothron’s standing to pursue her Section 15(b) claim follows most directly from Bryant. Ms. Cothron’s alleged Section 15(b) injury is concrete
and particularized for the reasons summarized above: White Castle failed to provide her with substantive, personal information about the collection, storage, and use of her fingerprint data and, armed with this information, Ms. Cothron may well have chosen to forgo the automated system. The Section 15(a) analysis, on the other hand, requires traversing some new ground. As in Bryant, the failure to make available a written retention and destruction policy was a harm to the public, not a harm particular to Ms. Cothron.3 Unlike Bryant, Ms. Cothron also alleges a violation of Section 15(a)’s second requirement—that an entity in possession of biometric data delete that data as soon as the purpose of collection is satisfied or within three years after the last interaction with
2 The Ninth Circuit held that violations of Section 15(a) were sufficiently concrete to satisfy the injury-in-fact requirement and found Article III standing on that basis. See Patel v. Facebook, Inc., 932 F.3d 1264, 1274 (9th Cir. 2019), cert. denied, 140 S. Ct. 937 (2020) (“Accordingly, we conclude that the plaintiffs have alleged a concrete injury-in-fact sufficient to confer Article III standing.”) In reaching that conclusion, however, the court explicitly did not consider whether the injury was insufficiently particularized. Id. n.5 (“Facebook does not argue that the plaintiffs' alleged injury-in-fact is insufficiently particularized.”). 3 Admittedly, Ms. Cothron was, more than other members of the public, in a position to make use of the missing Section 15(a) information. See Figueroa v. Kronos Inc., No. 19 C 1306, 2020 WL 1848206, at *4 (N.D. Ill. Apr. 13, 2020) (“Had Kronos timely published its retention schedule and guidelines, Plaintiffs might have become aware sooner that Kronos was collecting their biometric data and sending it to outside data hosts, and thus could have taken quicker action to ensure that their data was being properly handled.”). This was the case in Bryant as well, however, and any particularized need for the Section 15(a) information is properly traced to the concomitant Section 15(b) violation: a Section 15(b) disclosure would have provided Ms. Cothron with the information she needed and rendered the Section 15(a) information duplicative. 6 the relevant person. Although the provision of a publicly available retention and destruction policy is a collective right, the second requirement arguably creates an individual right to have personal data deleted. Nonetheless, the Court need not address this novel issue because Ms. Cothron has pleaded facts indicating that no violation occurred. According to Ms. Cothron, she continues to work as a manager at White Castle and the purpose of the collection—facilitating management
and access to paystubs—remains in effect. See id. ¶¶ 39-40. Neither of Section 15(a)’s conditions requiring destruction of biometric data is met and therefore Ms. Cothron has not alleged a violation of, or suffered an injury under, that provision of BIPA. The last standing question concerns Ms. Cothron’s Section 15(d) claim. Although Bryant did not address claims under Section 15(d), the analysis provided therein, and summarized above, suggests that Ms. Cothron’s alleged injuries satisfy Article III’s injury-in-fact requirement. Except for limited circumstances—such as when disclosure is mandated by state or federal law—Section 15(d) requires entities to obtain a person’s consent when disclosing or disseminating an individual’s biometric data. Framed this way, Section 15(d) forms a piece of the “informed-consent
regime” at the heart of BIPA. Just as with her Section 15(b) claim, the informational injury suffered by Ms. Cothron was concrete: the relevant information—that White Castle planned to disseminate Ms. Cothron’s data to third parties—is personal and substantive and would have provided Ms. Cothron an opportunity to object to the way her data was being handled or to opt out of the system entirely. See Crabtree v. Experian Info. Sols., Inc., 948 F.3d 872, 878 (7th Cir. 2020) (A “statutory violation that le[ads] to the deprivation of an opportunity, even if futile as a practical matter, can be enough to establish a concrete injury.”); see also Figueroa v. Kronos Inc., No. 19 C 1306, 2020 WL 1848206, at *4 (N.D. Ill. Apr. 13, 2020) (“With both [Section 15(b) and Section 15(d)] claims, Plaintiffs were denied an opportunity to withhold their consent to the collection or dissemination 7 of their data. . . . Under Crabtree, the denial of that opportunity is sufficiently concrete to confer standing.”). In sum, Ms. Cothron has Article III standing to pursue her claims under Section 15(b) and Section 15(d) but lacks standing to pursue her Section 15(a) claim. The Section 15(a) claim is dismissed without prejudice—the Court has “no authority and no occasion to address her state-
court standing to bring this claim.” Bryant, 958 F.3d at 626. II. White Castle’s Motion to Dismiss To survive a motion to dismiss under Rule 12(b)(6) for failure to state a claim upon which relief can be granted, a complaint must “contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). A claim is facially plausible if the plaintiff has pled “factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. A plaintiff does not need “detailed factual allegations,” but must plead more than “labels and conclusions” and “a formulaic recitation of the elements of
a cause of action.” Twombly, 550 U.S. at 555. Determining whether a complaint plausibly states a claim for relief is a “context-specific task that requires the reviewing court to draw on its judicial experience and common sense.” Iqbal, 556 U.S. at 679. White Castle provides three grounds for dismissing all of Ms. Cothron’s claims—that she waived her rights, that she failed to plead White Castle’s mental state, and that the claims are preempted by the Illinois Workers’ Compensation Act—as well as additional grounds targeting only the Section 15(d) claim.4 The Court first
4 White Castle’s motion includes a separate header and paragraph dedicated to the Section 15(b) claim but it essentially re-states the waiver argument. 8 addresses White Castle’s more general arguments before proceeding to the Section 15(d) argument. A. Waiver and Equitable Estoppel First, White Castle argues that Ms. Cothron waived her rights under BIPA and is therefore equitably estopped from asserting them in this action. As support for this argument, White Castle
provides two “consent forms” that Ms. Cothron purportedly signed—one from 2004 and another from 2018. As a threshold matter, only one of these documents is admissible on the pleadings— the 2004 form is not referenced in or central to Ms. Cothron’s complaint and is not subject to judicial notice. See Phillips v. Prudential Ins. Co. of Am., 714 F.3d 1017, 1020 (7th Cir. 2013). The question then is whether this second form—which Cothron acknowledges signing in 2018, Sec. Am. Compl ¶ 45—suffices to establish waiver or equitable estoppel. Both waiver and estoppel are affirmative defenses, Fed. R. Civ. P. 8(c), and affirmative defenses are generally not proper grounds for granting a Rule 12(b)(6) motion. See Brownmark Films, LLC v. Comedy Partners, 682 F.3d 687, 690 (7th Cir. 2012) (“[C]ourts should usually refrain from granting Rule 12(b)(6)
motions on affirmative defenses.”). The reason being that “these defenses typically turn on facts not before the court at [this] stage in the proceedings.” Id. And the general rule holds here for that reason. A valid waiver of statutory rights must be “knowing, voluntary, and intentional.” See In re Estate of Ferguson, 313 Ill. App. 3d 931, 937, 730 N.E.2d 1205, 1210 (Ill. App. Ct. 2000). Nothing in Ms. Cothron’s complaint or in the 2018 form indicates that Ms. Cothron knew she was waiving her right to bring suit against White Castle for past violations of BIPA. The 2018 form indicates that Ms. Cothron consented to the use of her fingerprint in conformance with BIPA, but absent additional evidence of intent, consenting to current or future use does not amount to a waiver of the right to sue for past violations. Ex. B, ECF No. 48-2. The facts under review cannot support a 9 defense of waiver. Similarly, Ms. Cothron has not pleaded facts capable of supporting equitable estoppel. Under Illinois law, a party is equitably estopped “from asserting rights that might otherwise have existed against the other party who, in good faith, relied upon such conduct and has been thereby led to change his or her position for the worse.” See Geddes v. Mill Creek Country Club, Inc., 196 Ill. 2d 302, 313, 751 N.E.2d 1150, 1157 (Ill. 2001). White Castle could not have
relied on Ms. Cothron’s 2018 consent form in implementing its 2007 fingerprint-based computer system or in failing to update its policies after the 2008 passage of BIPA. As a result, these grounds for dismissing Ms. Cothron’s complaint are unavailing. B. State of Mind White Castle’s second argument—that Ms. Cothron failed to plead that White Castle acted with the mental state required for statutory damages—is a common one in BIPA cases. As relevant here, Section 20 of BIPA sets out the recovery available to parties aggrieved by a violation of the statute: “for each violation” a party may receive: (1) “liquidated damages of $1,000 or actual damages, whichever is greater,” for negligent violations; (2) “liquidated damages of $5,000 or
actual damages, whichever is greater,” for reckless or intentional violations; (3) “reasonable attorneys’ fees and costs, including expert witness fees and other litigation expenses;” and (4) “other relief, including an injunction, as the State or federal court may deem appropriate.” 740 ILCS 14/20. Courts assessing arguments like White Castle’s have split into three camps. First, some courts have held that mental states need not be alleged for the purpose of making out a claim under BIPA—mental states go only to the damages recoverable for a given claim and may be proven later. See Woodard v. Dylan’s Candybar LLC, No. 19-CH-05158, slip op. at 7 (Ill. Cir. Nov. 20, 2019), ECF No. 95 (“The Illinois Supreme Court has made it clear that a plaintiff need not plead facts or elements showing negligence, or recklessness or intentional acts in violation of 10 BIPA to be entitled to seek . . . liquidated damages.”). Other courts have held that mental states are required elements of a claim and a failure to plead the mental state required for a given level of statutory damages requires the dismissal of that portion of the complaint. See Namuwonge v. Kronos, Inc., 418 F. Supp. 3d 279, 286 (N.D. Ill. 2019) (finding that allegations were sufficient to plausibly infer negligent conduct but were insufficient to infer reckless or intentional conduct and
holding that the “claim for damages based on intentional and reckless conduct is dismissed”). At least one court has attempted to strike a compromise position: pleading negligence is sufficient to forestall dismissal of all requests for liquidated damages because “BIPA provides that recklessness offers a basis for greater liquidated damages, not for a separate claim.” Figueroa, 2020 WL 1848206, at *8. In this Court’s view, the reasoning behind the Figueroa court’s compromise position—that separate remedies under Section 20 can attach to the same claim—leads, in the end, to the position articulated by the Woodard court. Ms. Cothron has requested various forms of relief for each alleged violation, not only statutory damages but also declaratory relief and injunctive relief. For
each violation, these requests for relief stem from the same claim. A “claim is the aggregate of operative facts which give rise to a right enforceable in the courts. One claim supported by multiple theories does not somehow become multiple claims.” Sojka v. Bovis Lend Lease, Inc., 686 F.3d 394, 399 (7th Cir. 2012) (internal citations omitted). “A motion to dismiss under Rule 12(b)(6) doesn’t permit piecemeal dismissals of parts of claims; the question at this stage is simply whether the complaint includes factual allegations that state a plausible claim for relief.” BBL, Inc. v. City of Angola, 809 F.3d 317, 325 (7th Cir. 2015). Here, if the complaint plausibly pleads violations of Section 15(b) and Section 15(d)—which the Court finds that it does—then, even absent specific allegations about White Castle’s mental state with respect to each of those claims, it has stated a 11 claim entitling Ms. Cothron to litigation expenses and injunctive relief under Section 20, whether or not she proves an entitlement to damages based on negligent, reckless, or intentional conduct. 740 ILCS 14/20(3)-(4). In short, allegations of scienter or no, Ms. Cothron’s complaint states a plausible claim for relief under sections 15(b) and 15(d); Rule 12(b)(6) does not require her to plead the facts that will determine the amount of actual damages she may be entitled to recover.5
C. Illinois Workers’ Compensation Act White Castle also maintains that Ms. Cothron’s BIPA claims are preempted by the Illinois Workers’ Compensation Act (IWCA).6 Like the above, this is a frequent argument in BIPA cases. Unlike the above, courts have unanimously rejected it—and for good reason. The IWCA provides the exclusive remedy for many injuries sustained by employees in the course of their employment. 820 ILCS 305/5(a); Meerbrey v. Marshall Field & Co., 139 Ill. 2d 455, 462, 564 N.E.2d 1222, 1225 (Ill. 1990). IWCA preemption does not apply, however, where the plaintiff establishes that: “(1) that the injury was not accidental; (2) that the injury did not arise from . . . her employment; (3) that the injury was not received during the course of employment; or (4) that the injury was not
compensable under the [IWCA].” Id. at 463. Here, Ms. Cothron focuses on the fourth exception, compensability, and the Court does the same.
5 “Summary judgment is different. The Federal Rules of Civil Procedure explicitly allow for ‘[p]artial [s]ummary [j]udgment’ and require parties to ‘identif[y] each claim or defense—or the part of each claim or defense—on which summary judgment is sought.’” BBL, Inc. v. City of Angola, 809 F.3d at 325 (quoting Fed. R. Civ. P. 56(a)). 6 Although preemption is an affirmative defense, Baylay v. Etihad Airways P.J.S.C., 881 F.3d 1032, 1039 (7th Cir. 2018), Ms. Cothron has pleaded facts sufficient to warrant resolution of the issue at this stage. 12 White Castle argues that injuries, like Ms. Cothron’s, that are “suffered in the line of duty” during “the course of employment” are compensable under the IWCA and therefore preempted. See Reply Br. 16, ECF No. 75 (quoting Folta v. Ferro Eng’g, 43 N.E.3d 108, 114 (Ill. 2015)). But in Folta the Supreme Court of Illinois noted the incompleteness of the “line of duty” test and articulated a further constraint pertaining to the character of the injury: “whether an injury is
compensable is related to whether the type of injury categorically fits within the purview of the Act.” Folta, 43 N.E.3d at 114-15. Although the IWCA can cover psychological injuries, not just physical ones, courts have generally required that the psychological injury stem from “a sudden, severe emotional shock traceable to a definite time, place and cause.” Pathfinder Co. v. Indus. Comm’n, 62 Ill. 2d 556, 563, 343 N.E.2d 913, 917 (Ill. 1976). See also Jones v. UPS Ground Freight, Inc., No. 15 C 7991, 2016 WL 826403, at *3 (N.D. Ill. Mar. 3, 2016) (finding no IWCA preemption where plaintiff alleged “emotional distress and humiliation stemming from his malicious prosecution” but his injuries were not “linked to any physical trauma or traceable to any sudden, severe emotional shock”). In reaching its decision in Pathfinder, the Supreme Court of
Illinois suggested a more general “test for whether an employee suffered a compensable injury”— “‘whether there was a harmful change in the human organism—not just its bones and muscles, but its brain and nerves as well.’” Treadwell v. Power Sols. Int’l, Inc., 2019 WL 6838940 (N.D. Ill. Dec. 16, 2019) (emphasis in original) (quoting Pathfinder, 343 N.E.2d at 918). Under this test, multiple courts in this district have found that the IWCA does not preempt BIPA injuries—even if those injuries happen in the workplace. See id. (“Under this test, Treadwell’s injuries would not be compensable.”); Peatry v. Bimbo Barkeries USA, Inc., 2020 WL 919202 at *6 (N.D. Ill. Feb. 26, 2020) (adopting the reasoning from Treadwell). See also Mintun v. Kenco Logistics Servs. LLC, No. 19-2348, 2020 WL 1700328, at *2 (C.D. Ill. Apr. 7, 2020) (adopting Treadwell’s 13 reasoning and declining to stay proceedings because “it is unlikely that a state appellate court would rule that the IWCA preempts BIPA”). Similarly, numerous trial courts in Illinois have found that privacy injuries are distinct from those preempted by the IWCA. See, e.g., Woodard, No. 19- CH-05158, slip op. at 8, ECF No. 95; Mims v. Freedman Seating Co., No. 18-CH-09806, slip op. at 6-7 (Ill. Cir. Aug. 22, 2019), ECF No. 83 (“[A] violation of privacy is not the type of injury
covered under the IWCA, which only covers physical or psychological injuries. . . . And although there may be psychological injury as a result of a breach of privacy, that does not mean those harms are one and the same.”). Consistent with the many courts to previously consider the issue, this Court concludes that Ms. Cothron’s injuries stemming from alleged BIPA violations are not preempted by the IWCA. D. Section 15(d) White Castle provides three arguments as to why Ms. Cothron has not pleaded a Section 15(d) violation. First, White Castle contends that Section 15(d) requires consent, but that it does not require “advance consent.” Colloquially, however, consent implies permission given in
advance and that understanding would seem to apply here given the difficulty of “un-disclosing” biometric information—a dynamic that motivated BIPA’s enactment. See 740 ILCS 14/5(g) (“Biometrics, however, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.”). Even if consent could be obtained after the fact, there is no basis to infer, at this juncture, that it ever was—not even the 2018 form sought consent to transfer biometric information to third parties. See Ex. B, ECF No. 48-2. As a result, no matter the time at which consent is statutorily required, Ms. Cothron has pleaded a violation.
14 Second, White Castle argues that the complaint describes only “actions (transmission for storage) authorized by BIPA.” Mot. Dismiss 13-14, ECF No. 48. According to White Castle, certain transmissions—those where data is transferred to another entity using reasonable care rather than disclosed to the public at large—are permitted by Section 15(e) and therefore do not violate Section 15(d). As relevant here, Section 15(e) provides that private entities must “store,
transmit, and protect from disclosure all biometric identifiers and biometric information using the reasonable standard of care.” 740 ILCS 14/15(e). This text must authorize non-disclosing transmissions, White Castle maintains, if Section 15(e) is to be internally consistent. See Mot. Dismiss 13-14, ECF No. 48. (“If every transmission were also a disclosure, moreover, entities could never ‘transmit’ biometric data while also ‘protect[ing it] from disclosure.’”). But this mistakes the role of Section 15(e) in the statutory scheme. Section 15(e) does not “affirmatively authorize” any action, rather it sets out the requisite standard of care when taking actions authorized or required by other sections of BIPA. See Figueroa, 2020 WL 1848206, at *7 (“Section 15(e) does not affirmatively authorize the dissemination of biometric data outside the four
circumstances set forth in subsections (d)(1)-(4); rather, Section 15(e) only sets forth the means by which an entity must transmit biometric data when such transmission is otherwise allowed.”). According to Section 15(d), an entity may “disclose” or “otherwise disseminate” biometric information in limited circumstances—the rest of the time, however, it must protect the information from disclosure. Section 15(e) simply requires that when an entity in possession of biometric data takes either of the actions provided for under Section 15(d), it exhibits reasonable care. As noted above, White Castle did not receive Ms. Cothron’s consent to transmit the data, and none of the other Section 15(d) exceptions apply; therefore, White Castle’s dissemination of “biometric data to other firms” is a “textbook violation” of Section 15(d). See id. at *7. 15 In a notice of supplemental authority filed after its reply brief, White Castle raised a third argument as to the deficiency of Ms. Cothron’s Section 15(d) claim. Although arguments not timely raised in the initial motion are generally waived, because Ms. Cothron had the opportunity to respond in a subsequent filing, the Court will consider the argument on the merits. See Pl.’s Resp. Suppl. Authority 3-6, ECF No. 115. According to White Castle, Ms. Cothron’s allegations
of dissemination are inadequate because they are either alleged “upon information and belief” or they “merely parrot” BIPA’s statutory language. See White Castle’s Notice of Suppl. Authority 3, ECF No. 109. White Castle relies heavily on a recent BIPA case from this district—Heard v. Becton, Dickinson & Co.—but the comparison is unconvincing and, as a result, so is the argument. 2020 WL 887460 (N.D. Ill. Feb. 24, 2020). In Heard, the plaintiff pleaded upon “information and belief” that defendant disclosed biometric data “to other, currently unknown, third parties, including but not limited to third parties that host biometric data in their data center(s).” Id. at *1. The problem in Heard was not simply that the plaintiff proceeded upon information and belief— as the court noted, “[t]he Twombly plausibility standard . . . does not prevent a plaintiff from
pleading facts alleged upon information and belief where the facts are peculiarly within the possession and control of the defendant.” Id. at *6 (quoting Arista Records, LLC v. Doe 3, 604 F.3d 110, 120 (2d Cir. 2010)). Rather, the plaintiff failed to plead any information that “triggered his suspicion,” which, the court observed, “would not be within [defendant’s] exclusive possession.” Id. As a result, the court found that the complaint “contain[ed] no allegations of fact which, if true, suggest there is any basis to even suspect that [defendant] disseminated the biometric data at issue.” Id. In the present case, Ms. Cothron’s complaint includes multiple allegations of dissemination, only one of which is explicitly “upon information and belief.” Sec Am. Compl. ¶¶ 31, 57. Even assuming that both of Ms. Cothron’s allegations of dissemination are 16 premised upon information and belief, however, her pleadings are sufficient. Unlike in Heard, Ms. Cothron pleaded information that triggered her suspicion. For example, immediately prior to alleging that White Castle disseminated information to Cross Match, the complaint alleges that “White Castle uses an employee authentication software system supplied by Cross Match that requires employees to use their fingerprints as a means of authentication.” Sec. Am. Compl. ¶ 30,
ECF No. 44. The known involvement of a specific third party in the fingerprint-based system provides a basis to suspect “that [White Castle] disseminated the biometric data at issue.” Heard, 2020 WL 887460, at *6. Furthermore, these allegations do not “merely parrot” BIPA’s statutory language—rather they describe the circumstances of a specific, plausible dissemination. As a result, Ms. Cothron has adequately pleaded a Section 15(d) violation. Dismissal of her other allegations that may be lacking under the Heard standard—for example, that White Castle also disseminated data to unspecified data centers, Sec. Am. Compl. ¶ 55—is not warranted, or even permitted, under Rule 12(b)(6). See BBL, Inc., 809 F.3d at 325 (“A motion to dismiss under Rule 12(b)(6) doesn’t permit piecemeal dismissals of parts of claims; the question at this stage is simply
whether the complaint includes factual allegations that state a plausible claim for relief.”).
* * * For the reasons stated above, Ms. Cothron lacks standing to pursue her Section 15(a) claim and that claim is dismissed without prejudice. The defendant’s motion to dismiss the remaining claims pursuant to Rule 12(b)(6) is denied.
17 Date: June 16, 2020 John J. Tharp, Jr. United States District Judge