UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION
MARY CRUMPTON, individually and on ) behalf of all others similarly situated, ) ) Plaintiff, ) ) v. ) No. 21 C 1402 ) HAEMONETICS CORPORATION, a ) Judge Rebecca R. Pallmeyer Massachusetts corporation, ) ) Defendant. )
MEMORANDUM OPINION AND ORDER
Between June 2017 and August 2018, Plaintiff Mary Crumpton, a citizen and resident of Illinois, donated plasma at a plasma donation center in Illinois. The donation center used donor management software provided by Defendant Haemonetics Corporation—meaning that whenever she donated plasma, Plaintiff was required to scan her fingerprints; then, Haemonetics’ software collected her biometric data and sent it to be stored on Haemonetics-owned servers outside Illinois. In February 2021, Plaintiff filed a proposed class action in state court, alleging that Haemonetics violated two provisions of the Illinois Biometric Information Privacy Act (“BIPA”). See 740 ILCS 14/15(a), (b). Haemonetics, a Massachusetts corporation, then removed to this court [1], on the basis of diversity jurisdiction. See 28 U.S.C. § 1332(d)(2).1 Haemonetics has moved to dismiss for lack of personal jurisdiction [10] and for failure to state a claim [13], and in
1 The Class Action Fairness Act provides subject-matter jurisdiction over class actions where at least one plaintiff is diverse from at least one defendant, the aggregate amount in controversy exceeds $5,000,000, and there are at least 100 class members. See 28 U.S.C. § 1332(d). Here, minimal diversity is satisfied, because Plaintiff Crumpton is a citizen of Illinois, and Haemonetics appears to be a citizen of Massachusetts, where it is incorporated and maintains its corporate headquarters. (Compl., Ex. A to Not. of Removal [1-1] ¶¶ 7–8; Steffan Removal Decl., Ex. B to Not. of Removal [1-2] ¶ 3); see Hertz Corp. v. Friend, 559 U.S. 77, 80– 81 (2010) (a corporation is a citizen of its place of incorporation and principal place of business, which will typically be its headquarters). The remaining jurisdictional requirements are met as well. According to Haemonetics, its records reflect that there are more than 1,001 potential class members (Steffan Removal Decl. ¶ 5), and Plaintiff seeks damages of $5,000 for each violation of BIPA (Compl. at 14.) Plaintiff does not dispute that the court has subject-matter jurisdiction. addition seeks a stay pending several Illinois state court decisions [12]. The parties agreed to conduct limited discovery on personal jurisdiction and to stay briefing on the other motions [16], meaning only the issue of personal jurisdiction is ripe for the court’s consideration. For the following reasons, the court denies Haemonetics’ motion to dismiss [10] on this basis. BACKGROUND I. General Background Defendant Haemonetics is a blood and plasma management company incorporated and headquartered in Massachusetts. (Steffan Decl., Ex. 1 to Def.’s Mot [10-1] (hereinafter “Steffan Decl.”), at ¶ 3; Compl., Ex. A to Not. of Removal [1-1] (hereinafter “Compl.”), at ¶ 1.) According to Alexander Steffan (who has worked for Haemonetics for some twelve years, now as Vice- President of Plasma Business Development), Haemonetics has three business units: (1) a plasma division, which provides “equipment, supplies, and software” to plasma donation centers; (2) a blood center division, which provides the same to blood collection centers; and (3) a hospital division, which provides “a variety of blood management products” to hospitals. (Steffan Decl. ¶ 2; Steffan Dep., Ex. 1 to Pls.’ Resp. [26-1], Ex. 1 to Def.’s Reply [32-1] (hereinafter “Steffan Dep.”), at 10:12–11:24.) One of Haemonetics’ plasma customers is Octapharma Plasma, Inc., which is incorporated in Delaware and headquartered in North Carolina, and which operates more than 150 plasma donation centers across the United States, including in Illinois. (Id. at 12:1–3; Steffan Decl. ¶ 7); see https://octapharmaplasma.com/about (last visited March 30, 2022). Haemonetics has an “exclusive arrangement” with Octapharma, under which Haemonetics provides these facilities with “software,” “devices,” and “consumables.” (Steffan Dep. 62:3–16). Included among the products and services that Haemonetics provides Octapharma is “donor management software,” which “helps plasma collection companies keep track of donors and manage the donation process.” (Id. at 10:19–24.) From December 14, 2009 until July 30, 2019, Octapharma used Haemonetics’ donor management system called eQue. (Octapharma Answers to Interrogs., Ex. 6 to Pls.’ Resp. [27-6] (hereinafter “Interrogs.”), at 7–8.) Starting no later than 2016, Octapharma operated five plasma donation centers in Illinois, all of which used eQue.2 (Octapharma Illinois Locations, Ex. 9 to Pls.’ Resp. [26-6] at 2; Steffan Dep. 66:4–68:9.) Between June 2017 and August 2018, Plaintiff Mary Crumpton donated plasma an unidentified number of times at an Octapharma facility in Aurora, Illinois. (Compl. ¶ 28; Crumpton Decl., Ex. 2 to Pl.’s Resp. [27-2] (hereinafter “Crumpton Decl.”), at ¶ 2.) Crumpton also worked as a phlebotomist at this Octapharma center from April 2018 to August 2018, though she does not bring any BIPA claims related to her employment. (Crumpton Decl. ¶ 2.) Rather, Crumpton’s allegations all relate to the “eQue donor management software,” used by “Octapharma to identify donors.” (Compl. ¶ 29.) When Crumpton first visited Octapharma, Octapharma required her to scan her fingerprint on a finger scanner for this identification purpose. (Id. ¶ 30.) Each time Crumpton donated plasma at Octapharma, she was again required to scan her fingerprint. (Id. ¶ 32.) And whenever she scanned her fingerprint, “the Haemonetics’ eQue system automatically sent her biometric identifier and/or biometric information to a Haemonetics-owned server to be collected and stored in Haemonetics' fingerprint database.” (Id. ¶ 31.) Based on these allegations, Crumpton brought a proposed class action in state court, alleging two violations of BIPA: a Section 15(a) claim for failure to make publicly available a data retention and destruction policy and to timely delete her biometric data; and a Section 15(b) claim for failure to obtain written informed consent before collecting her biometric data. (Id. ¶¶ 47–48, 55–57); see 740 ILCS
2 The record references three plasma donor management products developed by Haemonetics: eQue, DMS (which stands for donor management system), and NexLynk DMS. (Steffan Dep. 16:7–21.) On August 1, 2019, Octapharma transitioned entirely to NexLynk DMS, which is a “next generation” product that integrates the functionality of the prior two products (eQue and DMS). (Id. at 15:17–16:17; Interrogs. at 8.) Sometime after this transition, Octapharma began operating three additional locations in Illinois, bringing the total number of Illinois centers to eight. (Steffan Dep. at 61:6–22.) It appears that, before this transition, Octapharma used both eQue and DMS; the record does not make clear what functionalities these different products performed, and so the court refers to the products interchangeably. The court also notes that Plaintiff has limited her claims to the eQue donor management system. (See Pl.’s Resp. [26] at 10 (NexLynk DMS “is not at issue here”), 11 n.1 (NexLynk DMS “is not relevant to this case”).) 14/15(a), (b). Haemonetics removed to federal court [1] and filed a motion to dismiss for lack of personal jurisdiction [10]. After a period of discovery, the parties have presented evidence in support of their competing positions concerning Haemonetics’ connections to Illinois. II. Personal Jurisdiction Evidence A. Haemonetics’ Data Collection and Storage Plaintiff first notes that, based on the way the eQue donor management system operated, Haemonetics received and stored the biometric data of Illinois residents, collected in Illinois. The eQue system functioned in the following way: Octapharma’s donation centers contained kiosks and computer terminals, with attached finger scanners. (Interrogs. at 9.) When donors first donated plasma at an Octapharma facility, they were “required to have their fingerprints scanned in order to enroll them in the facility’s Haemonetics donor management system.”3 (Compl. ¶ 22.) Specifically, donors used a kiosk to answer the “[eQue] questionnaire” (this appears to be a series of health history questions) and were prompted to scan their fingerprints. (Steffan Dep. 63:14– 64:5; Interrogs. at 7.) Whenever donors visited an Octapharma center after this first visit, they were again required to scan their fingerprints, and the eQue donor management system compared that scan to the information obtained from the earlier fingerprint scan. (Interrogs. at 10; Compl. ¶ 32.) Every time a donor scans fingerprints on a facility’s finger scanner, “the Haemonetics donor management system automatically sends the donor’s fingerprint to Haemonetics’ servers, as a daily upload, to be collected and stored in Haemonetics’ fingerprint database.” (Compl. ¶ 23.) Octapharma’s interrogatory answers (submitted in another BIPA class action lawsuit that Plaintiff Crumpton filed against Octapharma, based on the same underlying facts of this case) provides more details on how this data transfer occurred: the eQue software operated from a “local
3 According to Octapharma, the donor’s fingerprint scan was then converted into a “numerical value or [t]emplate.” (Interrogs. at 17.) Besides Octapharma’s interrogatory answers, the record provides no information on this “value or template,” and Plaintiff’s complaint alleges that Haemonetics collected fingerprints and/or biometric identifiers. installation” on one dedicated computer at each donation center, which served as eQue’s “server” within that center. 4 (Interrogs. at 9.) The data collected from the kiosks and finger scanners was first “temporarily cached on the local eQue server housed at each Octapharma Donation Center”; then, the eQue system electronically transmitted the data as a daily upload to Haemonetics’ data storage servers in Edmonton, Canada. (Interrogs. at 12; Compl. ¶ 23.) Steffan confirmed that, when the Illinois Octapharma centers used eQue, Haemonetics “hosted” the data collected in Illinois on its own servers in Canada. (Steffan Dep. at 65:3–68:9, 75:23–76:5.) According to Steffan, Haemonetics has never used servers located in Illinois to store this data. (Id. at 74:14– 18.) It is not clear whether this statement includes the temporary caching on each Octapharma facility’s local eQue server. B. Haemonetics’ Physical Presence in Illinois Plaintiff next points to evidence of Haemonetics’ physical presence in Illinois (not all of which appears to relate to the eQue system). First, at some point prior to the filing of this lawsuit (though apparently not on the date when Plaintiff filed this suit), Haemonetics maintained a registered agent in Illinois; as of some date later in 2021, Haemonetics once again maintains a registered agent in Illinois. (Ex. 11 to Pl.’s Resp. [26-7] at 2; Steffan Dep. 85:2–87:12.) Additionally, Haemonetics hosts “maintenance technician trainings” in the Chicagoland area for “Haemonetics products within the Haemonetics plasma business”; employees or representatives of Octapharma have attended these trainings. (Steffan Dep. 111:5–112:7.) The record does not make clear whether these “products” included the eQue donor management system. Prior to the filing of this lawsuit, Haemonetics maintained two offices in Illinois: in Niles (from November 2007 to July 2017) and in Rosemont (from November 2012 to July 2019). (Haemonetics’ Illinois Offices, Ex. 8 to Pl.’s Resp. [26-5] (hereinafter “Illinois Offices”), at 2.) Collectively, these offices employed around 100 Haemonetics employees from 2016 to 2019.
4 Crumpton and Octapharma have since settled this lawsuit. See [92] in No. 19 CV 8402, Northern District of Illinois. (Steffan Dep. 77:22–78:14.) The Niles office housed a Haemonetics subsidiary called TEG, and dealt solely with TEG’s hemostasis analyzer technology, which is not a plasma donor management software product. (Illinois Offices at 2; Steffan Dep. 78:15–22); see https://www.biospace.com/article/releases/haemonetics-corporation-completes-acquisition-of- teg-r-hemostasis-analyzer-business-/ (last visited March 30, 2022). The Rosemont office also dealt with TEG operations, in addition to the operations of another Haemonetics subsidiary, called Information Data Management, Inc. (“IDM”). (Illinois Offices at 2) The parties disagree about whether Haemonetics’ IDM operations in Rosemont, Illinois performed work related to the eQue donor management system. In 2007, IDM and another Haemonetics subsidiary called 5D Information Management, Inc. (located in Edmonton, Alberta, in Canada) merged to form “Haemonetics Software Solutions.” (Subsidiary Announcement, Ex. 10 to Pl.’s Resp. [27-10] (hereinafter “Subsidiary Announcement”), at 2–4.) This merger was the result of Haemonetics’ decision to bring its software businesses together in a single division, rather than keeping them segregated by Haemonetics’ three units (hospital, blood center, and plasma); at an unidentified time, Haemonetics reversed course, and spun the software businesses back into separate units. (Steffan Dep. 17:22–18:8, 79:19–80:9.) 5D was part of the plasma unit and made plasma donation software (including, presumably, eQue), whereas IDM was part of the blood unit and made blood donor management software that does not use finger scanning technology. (Id. at 18:16–24, 117:10–118:14.) According to Steffan, even during the period when the subsidiaries were merged, 5D continued to operate in Edmonton (where it still operates today), and IDM operated out of its Rosemont office; the merged software division never “relocated” or “moved operations to Illinois to create some sort of new division”—“[t]hey were all separately . . . run out of different places.” (Id. at 19:19–20:9.) Haemonetics eventually sold IDM in July 2019, and no longer has any offices in Illinois. (Id. at 117:16–21; Illinois Locations at 2; Steffan Decl. ¶ 11.) Though 17 of Haemonetics’ 2,700 employees reside in Illinois (working from home or at a remote location), none work on the donor management software team. (Steffan Decl. ¶¶ 11–12.) C. eQue Master Agreement Plaintiff also points to the contract governing eQue as evidence of Haemonetics’ connection to Illinois. In May 2008, Haemonetics and Octapharma’s “Master Software Licensing [and] Hosting Agreement” became effective. (eQue Master Agreement, Ex. 3 to Pl.’s Resp. [26- 2] (hereinafter “eQue Master Agreement”), at 1.) This Agreement, along with its amendments, governed the provision of licensing and hosting services related to eQue. (Steffan Dep. 43:17– 20.) The eQue Master Agreement was amended a number of times after 2008, and eventually replaced with a new agreement relating to NexLynk (Haemonetics’ new donor management system) in 2018. (Nexlynk Master Agreement, Ex. 5 to Pl.’s Resp. [26-3], at 1.) The new NexLynk agreement stipulated, however, that so long as an Octapharma center used eQue “under the terms” of the eQue Master Agreement as amended, Octapharma would pay license and hosting fees under that Agreement. (Id. at 26.) Octapharma fully transitioned to NexLynk on August 1, 2019 (Interrogs. at 8), meaning the eQue Master Agreement, as amended, was in force from May 2008 to July 2019. 1. Execution in Illinois By its terms, the eQue Master Agreement states that it was entered into by the Software Solutions Division of Haemonetics (discussed above), with a place of business in Rosemont, Illinois. (eQue Master Agreement at 1.) The Agreement was executed by then-Vice President & General Manager of Haemonetics, Janet Conneely, who (according to her LinkedIn profile) worked in Chicago, Illinois at the time.5 (Id. at 4; Conneely LinkedIn Profile, Ex. 4 to Pl.’s Resp. [27-4] at 2.) Conneely’s LinkedIn profile also describes her role at Haemonetics from September
5 The LinkedIn profile does not clarify where in Chicago she worked. Though Plaintiff suggests that she worked at a Haemonetics Chicago office, the parties have not provided evidence suggesting that Haemonetics had Illinois offices besides those in Rosemont and Niles. 2007 to November 2011 as “[g]eneral management responsibilities . . . for Chicago based businesses including . . . Haemonetics Software Services (development and marketing of software to blood bank and plasma industries).” (LinkedIn Profile at 2 (emphasis added).) According to Plaintiff, this description means that the Rosemont location of Haemonetics’ Software Solutions Division must have worked on the eQue donor management system, which is why the Software Solutions Division entered into the eQue agreement in Rosemont. (Pl.’s Resp. [26] 12–13.) 2. Contractual Provisions Relating to Illinois Plaintiff relies on specific contractual provisions relating to Illinois, as well. The eQue Master Agreement states that “[a]ll notices and other communications under this [eQue] Agreement shall be sent” to Haemonetics’ office in Rosemont, Illinois. (eQue Master Agreement at 70.) (Whether any eQue communications actually were sent to Illinois is not clear from the record.) The Agreement also states that Octapharma “shall provide Haemonetics with a list of Sites where the Licensed Software is to be used.” (Id. at 16.) And an early amendment to the eQue Master Agreement, effective as of December 2009, identifies by location three Illinois Octapharma facilities where the eQue donor management system would be used. (First Amendment, Ex. 7 to Pl.’s Resp. [26-4] at 4–5.) The parties have not provided the court all subsequent amendments; the only other amendment provided (the fifth amendment, effective as of January 2016) did not identify any Octapharma facilities, in Illinois or otherwise—but it stated that the eQue Master Agreement, as amended, “shall continue in full force and effect.” (Ex. D to Def.’s Reply [32-4] at 2–3.) Plaintiff also emphasizes that under the Master Agreement, Haemonetics earned licensing and hosting “fees” from Octapharma (and no other financial compensation) on a “per procedure basis.” (eQue Master Agreement at 16, 51; see Steffan Dep. 103:4–23.) Steffan confirmed that Haemonetics charged Octapharma for licensing and hosting fees per procedure, meaning the more “procedures” or “assessments”—that is, the more instances of a donor initiating a screening interview on the eQue software—the more fees Haemonetics received. (Steffen Dep. at 93:3– 96:13.) As Plaintiff reads the contract, this provision confirms Haemonetics’ connection to Illinois, in that it means Haemonetics earned more revenue as the Octapharma facilities, identified by the amendment as located in Illinois, collected more fingerprints. (Pl.’s Resp. at 8.) 3. Site Visits Lastly, Plaintiff points to language in the Master Agreement providing that Haemonetics personnel would visit Octapharma’s donation centers: Haemonetics shall conduct a site visit of [Octapharma’s] site to determine the number and location of sites and the placement and potential re-use of existing equipment. Licensee will provide Haemonetics with a detailed tour of the facilities and an overview of the SOPs applicable to eQue. At the conclusion of the site visit the project plan and schedule will be agreed upon by Haemonetics and the Licensee.
(eQue Master Agreement at 20.) The Agreement also stated that Haemonetics “shall provide the minimum required and mutually agreed upon training” prior to implementation. (Id. at 18.) This required training, as outlined in the Agreement, included “Onsite User Orientation,” “Site Administrator Training,” and “Corporate Administrator Training.” (Id. at 23.) In his declaration, Steffan stated that “Haemonetics does not offer any installation, setup-related services, or technical support services for its donor management software products onsite in Illinois.” (Steffan Decl. ¶ 8.) At his deposition, however, Steffan admitted that he did not know whether Haemonetics ever conducted a site visit to the Octapharma donation centers in Illinois. (Steffan Dep. 48:4–49:3.) He testified that Haemonetics “generally . . . honored[ed] contracts as written,” but that “parties could change the way they executed as [they got] into the project”; again, however, Steffan did not know how “the project went forward here in terms of a site visit.” (Id. at 49:14–24.) Steffan also did not know whether Octapharma received the three implementation trainings listed in the eQue Master Agreement, or what any of these trainings involved. (Id. at 54:6–22.) Steffan explained that “[t]ypically [Haemonetics’] implementation process is managed through the [customer’s] corporate headquarters,” which “[i]n Octapharma’s case [ ] would be North Carolina.” (Id. at 119:1–3.) For this process, Haemonetics puts together an “implementation team” of its customers’ employees and trains those employees on the software; the trained customer employees then train others at the individual donation center. (Id. at 119:4– 17.) The record does not make clear whether Steffan had any personal knowledge about the eQue implementation training at Octapharma. As mentioned, Crumpton briefly worked at the Octapharma Aurora location as a phlebotomist; she stated that during this time, she was personally trained by Haemonetics’ field service employees—but this training was for a new Haemonetics-branded plasmapheresis machine, not any donor management software. (Crumpton Decl. ¶¶ 3–4.) D. Dealings with Illinois Centers Haemonetics had extensive dealings with Octapharma’s Illinois plasma donation centers, only some related to eQue. As Steffan noted in his testimony, Haemonetics had an exclusive arrangement to provide equipment, consumables, and software (including eQue) to Octapharma.6 (Seffan Dep. 62:3–16, 63:5–13.) Steffan characterized the services Haemonetics performs for Octapharma as “quite a broad business,” the “vast majority” of which is providing equipment and consumable supplies (id. at 30:20–31:2)—specifically, Haemonetics is “constantly shipping” disposable supplies such as centrifuges, tubing, and collection containers to the Illinois Octapharma locations. (Id. at 69:3–70:8.) Haemonetics employees are thus “in regular contact with [Octapharma] folks about that [side of the business].” (Id. at 31:2–31:6.) But, according to Steffan, the software business between Haemonetics and Octapharma “is much more concentrated in talking with [Octapharma’s] [ ] group in North Carolina, where [their] headquarters
6 The parties have not provided any contracts regarding this arrangement, nor pointed to any provisions in the eQue Master Agreement stipulating that Octapharma would use Haemonetics’ software exclusively. are, because the software [is] essentially managed and run [and] installed with . . . their data center” there. (Id. at 31:7–13.) E. Haemonetics’ eQue Activities in Illinois Haemonetics, for its part, has provided evidence that minimizes its eQue activities in Illinois. Though Haemonetics “does business” in all 50 states (presumably meaning it ships products and software to donation centers and hospitals all over the country), Steffan explained that all of Haemonetics’ customers for the eQue software are incorporated and headquartered outside Illinois. (Steffan Decl. ¶ 7; Steffan Dep. at 11:5–10.) This includes Octapharma, which, as mentioned, is incorporated in Delaware and headquartered in North Carolina. (Steffan Decl. ¶ 7.) Haemonetics donor management software is available for sale throughout the United States, wherever Haemonetics’ customers do business; Haemonetics does not employ salespeople in Illinois for the software and “does not direct to Illinois its sales activity” for the product. (Steffan Decl. ¶ 8.) Haemonetics does not choose where its donor management software is deployed by its customers, and does not require its customer “to use any specific form of verification for donor eligibility.” (Id. ¶¶ 8–9.) Rather, according to Steffan, each customer chooses how to verify donors, and Haemonetics “cannot dictate to its customers how or in what form the customers obtain consent from Illinois donors.” (Id. ¶¶ 9–10.) Haemonetics does “understand[ ]” that its customers have processes for obtaining consent from plasma donors. (Id. ¶ 10.) Specifically, Steffan confirmed that “Haemonetics has an understanding that [Octapharma] has facilities in Illinois that use the [donor management system] and finger scanners.” (Steffan Dep. 61:6–22.) Haemonetics knows which Octapharma facility uses which software because of its exclusive arrangement with Octapharma: “any Octapharma facility in the United States is going to use [Haemonetics’] software,” and Haemonetics knows the location of Octapharma’s centers to ship products there. (Id. at 61:23– 62:16.) At least as of the time of his deposition, Steffan himself knew certain details about how donors’ fingerprints are scanned at kiosks and how the information from those fingerprints is transmitted to Haemonetics’ servers for hosting. (Id. at 63:14–65:13.) Steffan further confirmed that “Haemonetics hosted donor data obtained through the [donor management system] from plasma donors who donated at . . . Octapharma facilities in Illinois.” (Id. at 75:22–76:3.) DISCUSSION I. Legal Standards Once a defendant moves to dismiss under Federal Rule of Civil Procedure 12(b)(2) for lack of personal jurisdiction, “the plaintiff bears the burden of demonstrating the existence of jurisdiction.” Purdue Rsch. Found. v. Sanofi-Synthelabo, S.A., 338 F.3d 773, 782 (7th Cir. 2003). Where, as here, the court rules on the defendant’s motion based only on the submission of written materials (and not an evidentiary hearing), the plaintiff need only make a prima facie showing of personal jurisdiction. Id. If the defendant submits evidence opposing jurisdiction, the plaintiff must similarly submit affirmative evidence supporting such jurisdiction. Matlin v. Spin Master Corp., 921 F.3d 701, 705 (7th Cir. 2019). In considering the record, the court takes as true all well-pleaded facts in the complaint and resolves any factual disputes in favor of the plaintiff. Id. A federal court sitting in diversity may exercise personal jurisdiction over a defendant only if authorized by the forum state’s long-arm statute and the United States Constitution. Felland v. Clifton, 682 F.3d 665, 672 (7th Cir. 2012). Under Illinois’s statute, 735 ILCS 5/2-209, personal jurisdiction exists to the extent permitted by the due process provisions of the Illinois and federal constitutions. Matlin, 921 F.3d at 705. Because Illinois courts have not held that the Illinois constitution affords greater due process protection than the federal constitution, see id., the only question is whether federal due process permits this court to exercise jurisdiction over Haemonetics. To satisfy the Fourteenth Amendment's Due Process Clause, the defendant must have “certain minimum contacts” with the forum state, such that maintenance of the suit does not offend “traditional notions of fair play and substantial justice.” Walden v. Fiore, 571 U.S. 277, 283 (2014) (quoting International Shoe Co. v. Washington, 326 U.S. 310, 316 (1945)). There are two types of personal jurisdiction: general and specific. Id. at 283 n.6. Plaintiff relies only on specific jurisdiction. (Pl.’s Resp. at 2.) This type of jurisdiction focuses on “the relationship among the defendant, the forum, and the litigation.” Walden, 571 U.S. at 284 (quoting Keeton v. Hustler Mag., Inc., 465 U.S. 770, 775 (1984)). Specifically, the plaintiff’s claims must “arise out of or relate to” the defendant’s contacts with the forum state. Ford Motor Co. v. Mont. Eighth Jud. Dist. Ct., 141 S. Ct. 1017, 1025 (2021) (quoting Bristol-Myers Squibb Co. v. Superior Ct. of Cal., San Francisco Cty., 137 S. Ct. 1773, 1780 (2017)). This does not require “a strict causal relationship between the defendant's in-state activity and the litigation,” id. at 1026—rather, it is enough if there is “an affiliation between the forum and the underlying controversy,” based on an activity or occurrence involving the defendant and taking place in the state. Id. at 1025 (quoting Bristol- Myers Squibb, 137 S. Ct. at 1780). These suit-related contacts must be created by the defendant’s activity, not the unilateral activity of the plaintiff or a third party. Burger King Corp. v. Rudzewicz, 471 U.S. 462, 475 (1985). In other words, the defendant must have deliberately reached into the forum state—that is, purposefully directed his activities at the state or purposefully availed himself of the privilege of conducting business in the state. Rogers v. City of Hobart, 996 F.3d 812, 819 (7th Cir. 2021). Finally, even if the defendant has sufficient contacts with the state and the plaintiff’s claims arise out of those contacts, the court may not exercise jurisdiction if doing so would be fundamentally unfair. See id. at 815, 819. II. Personal Jurisdiction over Haemonetics The parties focus their attention on several BIPA cases from district courts in Illinois, which have considered when personal jurisdiction over an out-of-state vendor of biometric-enabled technology is appropriate. On one hand, several courts have concluded there is no personal jurisdiction where the vendor simply provides technology to its corporate customers outside of Illinois, with limited or no knowledge on how the technology eventually winds up in Illinois or is used by Illinois residents. McGoveran v. Amazon Web Servs., Inc., 488 F. Supp. 3d 714, 722 (S.D. Ill. 2020) (defendant-vendor intercepted plaintiffs’ customer calls once connected to a call center, sent the audio to a company to be processed, and stored the data on its servers; “[n]othing about this process occurred in Illinois except for the initial dialing of the phone by Plaintiffs”); Bray v. Lathem Time Co., No. 19-3157, 2020 WL 1492742, at *3 (C.D. Ill. Mar. 27, 2020) (the defendant-vendor sold and shipped employee timekeeping devices to Arkansas, not to plaintiff’s employer in Illinois, and “had nothing to do with how the devices got to Illinois”); Salkauskaite v. Sephora USA, Inc., No. 18-CV-08507, 2020 WL 2796122, at *4–5 (N.D. Ill. May 30, 2020) (the defendant-vendor “never met or developed a business relationship [with the customer] in Illinois,” and never discussed or entered into an agreement about using the technology in Illinois; the only evidence of minimum contacts was defendant’s reposting of an article about the use of its technology at a Chicago customer store); see also Stein v. Clarifai, Inc., 526 F. Supp. 3d 339, 344–45 (N.D. Ill. 2021) (technology company used OKCupid profiles to create a facial recognition algorithm, which it sold to two Illinois customers through an interactive, non-targeted website; defendant had “no knowledge of where the OKCupid users whose information it used reside”); Gullen v. Facebook.com, Inc., No. 15 C 7681, 2016 WL 245910, at *2 (N.D. Ill. Jan. 21, 2016) (the fact that Facebook’s site is accessible to Illinois residents was the only connection between Facebook’s use of facial recognition technology and Illinois). But on the other hand, where a biometric technology vendor has “direct contacts with the forum state [not] enabled or created by a third party,” those contacts may support the exercise of personal jurisdiction. King v. PeopleNet Corp., No. 21 CV 2774, 2021 WL 5006692, *6 (N.D. Ill. Oct. 28, 2021). In King, the defendant-vendor provided biometric timekeeping devices to the plaintiff’s Illinois-based employer; the devices then transmitted plaintiff’s biometric information to defendant’s servers. Id. at *2. In finding personal jurisdiction, the court noted that the defendant had a 15-year relationship with the plaintiff’s employer, shipped the devices to Illinois, did business with (and presumably had contracts with) multiple Illinois customers, and “handled a large quantity of biometric data from Illinois over a period of years.” Id. at *6–7. The court concludes that Haemonetics, too, had direct contacts with Illinois, not just contacts created by the unilateral actions of Octapharma or Octapharma’s customers. Specifically, Haemonetics deliberately entered into contractual and business arrangements to ensure that its software collected data in Illinois and that Haemonetics itself hosted Illinois resident’s data on its servers. Beginning in 2008, Haemonetics’ provision of the eQue donor management system to Octapharma and its facilities, as well as Haemonetics’ hosting of data collected at those facilities, was governed by the eQue Master Agreement, which was amended in 2010 to specifically identify three Illinois facilities that would use eQue.7 (eQue Master Agreement at 1; First Amendment at 4–5.) Haemonetics was also aware that the two additional Illinois facilities Octapharma obtained by 2016 similarly used its eQue system—an unsurprising conclusion, as Haemonetics had an exclusive arrangement to provide Octapharma’s facilities with donor management software, and directly shipped equipment and consumable supplies to those facilities. (Steffan Dep. 61:6–62:16, 63:5–13, 66:4–68:9.) Even if Haemonetics did not directly send the software to Illinois (an issue not clarified by the parties), its own actions in obtaining the exclusive arrangement ensured that Illinois donation centers—of which Haemonetics was well aware—deployed that software. Cf. Burger King, 471
7 Haemonetics broadly asserts that Plaintiff’s claims bear “no relation” to the eQue Master Agreement. (Def.’s Reply at 5–9.) Though the court agrees that Plaintiff’s emphasis on the execution of the Agreement is misplaced (as discussed below), the Agreement itself is still relevant to Plaintiff’s BIPA claims: it governed Haemonetics’ handling of the eQue software as related to Octapharma’s donation centers and the data obtained at those centers. Haemonetics provides no support for its contention that the Agreement is irrelevant just because this is not a breach-of-contract case. Nor can Haemonetics argue that the contract is too old to be relevant. As Plaintiff asserts, the eQue Master Agreement as amended remained in force so long as Octapharma used eQue software. (NexLynk Master Agreement at 26.) The court is also unmoved by Haemonetics’ argument that because BIPA was enacted in October 2008, it did not have “fair notice” of Plaintiff’s specific claims when it entered into the contract in May 2008. Haemonetics points to no caselaw holding that the “fair notice” principle operates this specifically. See, e.g., World-Wide Volkswagen Corp. v. Woodson, 444 U.S. 286, 297 (1980) (“[T]he defendant’s conduct and connection with the forum State [must be] such that he should reasonably anticipate being haled into court there.”) (emphasis added). In any event, Haemonetics presumably could have taken steps to amend the contract or ensure BIPA compliance well before June 2017. U.S. at 479–80 (finding personal jurisdiction where defendant “entered into a carefully structured 20-year relationship that envisioned continuing and wide-reaching contacts with [plaintiff] in [the forum state]”). Given how the eQue system functioned, this inherently meant that Haemonetics collected and stored Illinois residents’ data: after donors scanned their fingerprints at an Octapharma center in Illinois, Haemonetics’ eQue software collected that data, temporarily cached the data on a local eQue server at that same Illinois location, and then “automatically” sent Illinois residents’ data to Haemonetics’ server in Canada, where it was stored in Haemonetics’ “fingerprint database.” Cf. uBID, Inc. v. GoDaddy Grp., Inc., 623 F.3d 421, 428 (7th Cir. 2010) (rejecting an online company’s argument that “sales to Illinois residents are automated transactions unilaterally initiated by those residents” because “[defendant] itself set the system up this way”). Other aspects of Haemonetics’ business dealings with Octapharma confirm its deliberate effort to exploit the Illinois biometric data market. Haemonetics knowingly and exclusively provided software to Octapharma facilities (including those in Illinois), and earned licensing and hosting “fees” based on the number of donors who used the eQue system and the amount of data that Haemonetics stored. (eQue Master Agreement at 16, 51; Steffen Dep. at 93:3–96:13, 103:4– 23.) So not only did Haemonetics deliberately deploy its technology at Illinois donation centers, it knowingly stored Illinois residents’ data, obtained at those Illinois locations, for financial gain and allegedly in violation of BIPA’s disclosure requirements. Cf. Greene v. Mizuho Bank, Ltd., 169 F. Supp. 3d 855, 862–63 (N.D. Ill. 2016) (finding that the defendant-bank, which fraudulently concealed its withdrawal policy, “created the necessary relationship with California by accepting [plaintiff’s] deposit, knowing that it arrived from a California branch and a California resident, and profiting from the associated fees”).8 The fact that Haemonetics used this revenue structure and exclusive arrangement outside of Illinois does not mean that the exercise of jurisdiction within Illinois is inappropriate.9 See Illinois v. Hemi Grp. LLC, 622 F.3d 754, 758 (7th Cir. 2010) (where defendant’s website stated that it would ship to any state besides New York, “listing all forty-nine states by name would have made a stronger case for jurisdiction,” but “the net result is the same— [defendant] stood ready and willing to do business with Illinois residents”). In response, Haemonetics argues that there is no “direct connection” between Haemonetics’ suit-related conduct and Illinois. (Def.’s Sur-Reply [40] at 1–2.) Haemonetics first notes that in several cases finding jurisdiction, including King, 2021 WL 5006692, the defendant did interact directly with Illinois-based companies or residents, whereas Haemonetics’ contractual agreements were with Octapharma, which is incorporated and headquartered outside of Illinois. Though contracting with a company domiciled in the forum-state may, along with other evidence, establish the required minimum contacts in that state, see Burger King, 471 U.S. at 478–79, Haemonetics points to no caselaw holding that it is necessary. Rather, the Supreme Court has long eschewed the notion that specific personal jurisdiction turns on any bright-line rule, such as citizenship of the contracting party or customer. See id. (explaining that a contract with an out- of-state party does not “alone [ ] automatically establish sufficient minimum contacts,” but must
8 Haemonetics urges that, based on Greene, the court should in fact decline to exercise personal jurisdiction. In Greene, 169 F. Supp. 3d at 865, the court found there was no personal jurisdiction over the bank in Illinois, because a second plaintiff (an Illinois resident) did not send any wire transfers to the bank and the bank did not receive any transaction fees from him. Haemonetics suggests that it also lacks a direct connection to Illinois residents, because Octapharma facilitated the transactions in this case. For reasons discussed later in this opinion, see infra, the court is not persuaded that Octapharma’s intermediary role defeats a claim of jurisdiction over Haemonetics.
9 The court therefore rejects Haemonetics’ contention that its revenue structure is “wholly irrelevant” to the jurisdictional analysis because it earns fees on a per-procedure basis regardless where the data is collected. (Def.’s Reply at 9–10.) And, contrary to Haemonetics’ contention, even if the revenue structure was not “unlawful” or dependent on the type of information hosted, it is still relevant to Plaintiff’s BIPA claims, because it clarifies how Haemonetics financially profits from the collection and storage of biometric data. be evaluated along with “prior negotiations and contemplated future consequences,” “the terms of the contract,” and “the parties’ actual course of dealing”). Regardless where Octapharma was domiciled, it operated five plasma donation centers in Illinois, and, under Haemonetics’ purposeful business arrangements, those Illinois-based centers exclusively used Haemonetics’ donor management system to collect and store Illinois residents’ data. Relatedly, Haemonetics suggests that because it does not directly interact with Illinois residents, its suit-related contacts in Illinois are solely through third parties—that is, Octapharma. (See Def.’s Sur-Reply at 2; Def.’s Reply at 6.) But this is not a case where Octapharma “unilaterally” collected Illinois residents’ data, and Haemonetics’ involvement was only “random” or “fortuitous.” Burger King, 471 U.S. at 475 (citations omitted). Rather, Haemonetics deliberately took action to ensure the collection and storage of Illinois residents’ data, with Octapharma acting as an intermediary to deploy Haemonetics’ technology. This intervening step does not alter the fact that Haemonetics deliberately exploited the biometric collection market in Illinois. See Ford, 141 S. Ct. at 1026 (explaining that establishing minimal contacts for specific personal jurisdiction does not require “a strict causal relationship between the defendant’s in-state activity and the litigation”); see also id. at 1029 (finding specific jurisdiction where Ford sold the specific cars involved in the litigated car crashes outside the forum state, with the buyers later selling them in the forum); King, 2021 WL 5006692, at *7 (“That [defendant] relied on third parties like [the plaintiff’s employer] to deploy its technology does not sever the relationship between [plaintiff’s] claims and [defendant’s] contacts with the forum.”). The court’s conclusion—that these contacts are sufficient to establish a prima facie showing of personal jurisdiction—is bolstered by evidence that Haemonetics may have conducted eQue-related site visits to Octapharma’s Illinois locations. See Liqui-Box Corp. v. Scholle IPN Corp., No. 19 C 4069, 2020 WL 5593755, at *6 (N.D. Ill. Sept. 18, 2020) (finding that nonresident defendant’s trips to Illinois supported personal jurisdiction). Haemonetics disputes this assertion, pointing to Steffan’s declaration, which stated that Haemonetics does not offer “any installation, setup-related services, or technical support services” for donor management software products onsite in Illinois (Steffan Decl. ¶ 8), and his deposition, where he testified that the donor software implementation process generally occurs at the customer’s headquarters. (Steffan Dep. 119:1– 3.). In fact, as Plaintiff points out, Steffan did not actually know whether Haemonetics conducted eQue-related site visits or implementation trainings at Octapharma’s Illinois locations (id. at 48:4– 49:24, 54:6–22), and there are several contractual provisions in the eQue Master Agreement that appear to require these visits. (eQue Master Agreement at 18, 20, 23.) Regardless whether these contractual agreements alone create a factual dispute about whether the site visits occurred (see Pl.’s Resp. at 11), at the least they demonstrate that Haemonetics created business arrangements anticipating physical contact with Octapharma’s facilities. Other contacts cited by Plaintiff are less significant. Plaintiff points to Haemonetics’ conduct relating to its non-software products, including Haemonetics’ “constant” shipping of consumables to Illinois, the training Plaintiff received for a plasmapheresis machine at Octapharma’s Aurora location, and the seminars for unidentified products that Haemonetics conducted near Chicago. These cannot support personal jurisdiction for BIPA claims related to the eQue software, except to the extent these other business dealings are intertwined with Haemonetics’ software dealings in Illinois. See Bristol-Myers Squibb, 137 S. Ct. at 1781 (“Nor is it sufficient—or even relevant—that [defendant] conducted research in [the forum] on matters unrelated to [the drug product at issue].”); Goodyear Dunlop Tires Operations, SA v. Brown, 564 U.S. 915, 930 n.6 (2011) (“[E]ven regularly occurring sales of a product in a State do not justify the exercise of jurisdiction over a claim unrelated to those sales”). Plaintiff was allegedly injured by Haemonetics’ software, and none of her cited cases support sweeping Haemonetics’ equipment and consumables into the personal jurisdiction inquiry. See, e.g., Russell v. SNFA, 2013 IL 113909, ¶ 84, 987 N.E.2d 778, 797 (where plaintiff was injured by a defective bearing on a helicopter, defendant’s activities regarding “custom-made aerospace bearings” for helicopters and aircrafts were relevant); uBID, 623 F.3d at 429 (explaining that courts “cannot simply aggregate all of a defendant’s contacts with a state—no matter how dissimilar in terms of geography, time, or substance”) (citation omitted). And Ford, 141 S. Ct. at 1026, rejected a strict causal test for determining when a defendant’s activity relates to the plaintiff’s claims—it did not hold that any forum-related activity, regardless of substance, is significant. Similarly, though Plaintiff notes that Haemonetics operated two offices in Illinois, neither related to the eQue software or biometric-enabled software. The parties do not dispute that the Niles location, which was shut down only a month after Plaintiff began donating plasma, did not conduct business relating to donor management software. Although Haemonetics’ Software Solutions Division operated out of the Rosemont location, Steffan testified that this office only handled a blood donor management software, which did not use finger-scanning devices; the team working on the litigated plasma software, according to Steffan, has always operated out of Edmonton. (Steffan Dep. at 18:16–20:9, 117:10–118:14.) Plaintiff offers no evidence that the blood donor product also used biometric-enabled technology or was similar to eQue in any way meaningful to this litigation. See Russell, 2013 IL 113909, ¶ 84. Rather, the only rebuttal evidence offered by Plaintiff is the eQue Master Agreement, which was executed in 2008 by Haemonetics’ Software Division in Rosemont, through Haemonetics’ former Vice President & General Manager, whose LinkedIn profile described her as an Illinois resident and the Division as a Chicago-based business developing software for blood and plasma industries. (eQue Master Agreement at 1; LinkedIn Profile at 2.) But even if there is some indication that some of Haemonetics’ plasma software work occurred in Illinois in 2008, there is no basis for assuming that this work continued for almost a decade, when Plaintiff’s claims accrued. Plaintiff’s emphasis on the execution of the eQue Master Agreement—namely, that it was executed by an Illinois resident and in Illinois—is also misplaced. Again, besides the LinkedIn profile, she provides no evidence suggesting that Haemonetics’ employees developed or worked on the eQue software between the execution of the contract in 2008 and the time she first donated plasma in 2017. So while the performance of the eQue Master Agreement, in Illinois and when Plaintiff's data was collected, is highly relevant to this case, the execution of that Agreement— without further information about the surrounding circumstances—may not be sufficient by itself to support the exercise of personal jurisdiction. See Nat’? Tech., Inc. v. Repcentric Sols., No. 13 C 1819, 2013 WL 3755052, at *3 (N.D. Ill. July 16, 2013) (explaining that where the parties executed the contract is just one factor when deciding personal jurisdiction); Triad Cap. Mgmt, LLC v. Priv. Equity Cap. Corp., No. 07 C 3641, 2008 WL 4104357, at *3 (N.D. Ill. Aug. 25, 2008) (same). In sum, though not all of Plaintiffs evidence is compelling, she has made “a threshold showing of minimum contacts.” See Curry v. Revolution Lab'ys, LLC, 949 F.3d 385, 402 (7th Cir. 2020). This showing is defeated only where the defendant presents “a compelling case that the presence of some other considerations would render jurisdiction unreasonable.” /d. (quoting Burger King, 471 U.S. at 477). Haemonetics has offered no reason why litigating these claims in Illinois would be unfair. Plaintiff has therefore satisfied her burden to establish a prima facie case for personal jurisdiction. CONCLUSION Haemonetics’ motion to dismiss [10] for lack of personal jurisdiction is denied. As case law concerning BIPA is rapidly evolving, the court recognizes that Defendant may wish to present additional authority in support of its challenge to the adequacy of the complaint or may wish to withdraw or amend its motion for stay. Those motions [12, 13] are stricken without prejudice to reinstatement. The parties are encouraged to discuss settlement and are directed to submit a joint written status report on or before April 26, 2022. ENTER:
Dated: March 30, 2022 Rebecca REBECCA R. PALLMEYER United States District Judge