Fluery v. Union Pacific Railroad Company

• Court: District Court, N.D. Illinois
• Decided: June 2, 2022
• Docket: 1:20-cv-00390
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION

DAVID FLEURY, individually and ) on behalf of a class of similarly situated ) individuals, ) ) Case No. 20-cv-00390 Plaintiff, ) v. ) Judge Jorge L. Alonso ) UNION PACIFIC RAILROAD COMPANY, ) a Delaware corporation, ) ) Defendant. )

Memorandum Opinion and Order

Plaintiff David Fleury filed this case alleging that Union Pacific violated various provisions of the Illinois Biometric Information Privacy Act, 745 ILCS 14/15 (“BIPA”). This order addresses two motions filed by Fleury: (1) a motion to sever and remand his section 15(a) BIPA claim back to the Circuit Court of Cook County; and (2) a motion to lift the stay imposed by the Court on June 23, 2021. For the reasons below, the Court denies the motion to remand [68] and grants the motion to lift the stay [78]. Background Fleury filed this putative class action against Defendant Union Pacific alleging that it violated various provisions under BIPA. Throughout 2019, Fleury worked as a truck driver which required him to visit various railyards in Illinois, including those owned by Union Pacific. To enter its facilities, Union Pacific required Fleury and others to provide biometric information through “identity verification kiosks.” Fleury alleges that Union Pacific failed to provide him or others with written disclosures describing the specific purpose and length of time that it would collect and store their biometric data. In addition, Fleury alleges that Union Pacific failed to develop retention or destruction policies governing the stored biometric data. Fleury originally filed this case in the Circuit Court of Cook County. On January 17, 2020, Union Pacific removed the case to the Northern District of Illinois. Fleury filed an amended complaint on June 16, 2020, that contains one general count for “Violations of the

Illinois Biometric Information Privacy Act, 740 ILCS 14/1, et seq,” although he specifies at various points throughout the complaint that Union Pacific violated sections 15(a), (b), (c), and (d) of BIPA. The Court previously entered an order staying discovery in this case pending certain state and federal appellate BIPA cases that would affect the scope of this case, both individually and on a proposed class basis. See [63]. Discussion

Fleury seeks to sever and remand his section 15(a) claim back to the Circuit Court of Cook County based on a lack of standing. He also asks the Court to lift the stay on proceedings. The Court addresses each motion in turn. I. Motion to Remand Fleury argues that he lacks Article III standing to pursue his section 15(a) claim in federal court because he only alleges a procedural violation. Section 15(a) imposes on an entity

collecting biometric information a duty to develop and publicly disclose retention schedules and guidelines for destroying the biometric data. This section further compels those entities to comply with their retention and destruction policies. The Court reproduces section 15(a) below: A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever occurs first. Absent a valid warrant or subpoena issued by a court of competent jurisdiction, a private entity in possession of biometric identifiers or biometric information must comply with its established retention schedule and destruction guidelines. 740 ILCS 14/15(a).

The party invoking federal jurisdiction, which in this case is Union Pacific as the removing party, bears the burden of establishing Article III standing. Collier v. SP Plus Corp., 889 F.3d 894, 896 (7th Cir. 2018). To establish Article III standing, three requirements must be met: (1) the plaintiff must have suffered a concrete and particularized injury-in-fact; (2) there must be a causal connection between the plaintiff’s injury and the defendant’s conduct; and (3) the injury is likely to be redressed by a favorable judicial decision. Fox v. Dakkota Integrated Systems, LLC, 980 F.3d 1146, 1153 (7th Cir. 2020). Fleury challenges only the concrete and particularized injury factor. Before discussing it, however, the Court recaps three BIPA cases that inform the Court’s analysis. The first is Bryant v. Compass Group, USA, Inc., 958 F.3d 617 (7th Cir. 2020). In Bryant, the plaintiff’s employer installed “Smart Market” vending machines in its cafeteria. Id. at 619. To use these machines, a patron had to create an account using his or her fingerprint. Id. The plaintiff alleged that the defendant violated, among other provisions, section 15(a) by failing to publicly disclose its retention and destruction schedules. Id. The Seventh Circuit held that an entity owes the duty to disclose under section 15(a) to the public generally and not to specific persons whose biometric data it collects. Id. at 626. As a result, the court found that the plaintiff lacked Article III standing to bring a section 15(a) claim because she alleged only a procedural violation owed to the public and thus did not suffer a particularized injury. Id. Importantly, the Seventh Circuit understood the plaintiff to assert only that the defendant failed to make its retention and destruction policies publicly available. Id. With respect to her section 15(b) claim, however, Bryant found that the plaintiff did allege a concrete and particularized injury because the failure to comply with the informed- consent provision in section 15(b) denied the plaintiff, and others like her, the “opportunity to consider whether the terms of that collection and usage were acceptable given the attendant

risk.” Id. The court highlighted the Illinois General Assembly’s judgment that biometric information presents a particularly heightened risk of identity theft or other privacy or economic harm that can result from dissemination, such that people should be made aware of to whom and for what purpose they are giving up control of their biometric information. Id. The second case is Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019). In Patel, the plaintiffs sued Facebook for BIPA violations based on its “Tag Suggestions” feature, which uses facial-recognition technology to detect whether an uploaded photo depicts a user’s Facebook friend. Id. at 1268. The plaintiffs alleged that Facebook failed to obtain their consent prior to collecting their biometric data and failed to maintain retention or destruction guidelines, thereby violating BIPA sections 15(a) and 15(b). Id. at 1274. The Ninth Circuit held that the users

suffered a concrete and particularized injury based on these acts. Id. Patel reasoned that “[b]ecause the privacy right protected by BIPA is the right not to be subject to the collection and use of such biometric data, Facebook’s alleged violation of these statutory requirements would necessarily violate the plaintiffs’ substantive privacy interests.” Id. Like Bryant, Patel relied on the Illinois General Assembly’s judgment that “[t]he public welfare, security, and safety [would][] be served by regulating the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” Id. at 1273 (citing 740 Ill. Comp. Stat. 14/5(g)). Thus, the Ninth Circuit ruled that the plaintiffs had Article III standing to sue under sections 15(a) and (b) of BIPA. Id. at 1274. Though Patel is a nonprecedential decision from another circuit, the Seventh Circuit has cited it multiple times in its BIPA cases. See Bryant, 958 F.3d at 622; Fox, 980 F.3d at 1153. Last is Fox v. Dakkota Integrated Systems, LLC, 980 F.3d 1146 (7th Cir. 2020). In that case, the plaintiff alleged that her former employer violated section 15(a) by failing to comply

with its own retention and destruction policies. Id. at 1150. The Seventh Circuit held that the plaintiff had standing to bring her section 15(a) claim because she alleged that the defendant violated the full panoply of duties in section 15(a), not just the duty to publicly disclose. Id. at 1154-55. Notably, when distinguishing Fox from Bryant, the court recognized that section 15(a) places three independent duties upon entities collecting biometric data: a duty to develop, duty to publicly disclose, and duty to comply with its data retention and destruction policies. Id. at 1154. The court further explained that “unlawful retention of biometric data inflicts a privacy injury in the same sense as an unlawful collection does.” Id. The court noted that Bryant carefully narrowed its holding to the duty to publicly disclose. Id. But the Fox court reached the duty to comply, analogizing a violation of this duty to the privacy injury resulting from unlawful

collection under section 15(b). Id. at 1155. In this case, Fleury argues that his section 15(a) claim should be severed and remanded because he alleges only a procedural violation—i.e., the duty to publicly disclose biometric data retention and destruction policies. Union Pacific, on the other hand, argues that Fleury alleges that it failed to develop these policies in addition to unlawfully retaining his biometric data, thereby satisfying the particularized injury component. The Court finds that the allegations in the First Amended Complaint rise to the level of a concrete and particularized injury for purposes of Article III standing. Unlike Bryant, Fleury alleges that Union Pacific failed to develop any data-retention or destruction policies whatsoever—not just that it failed to publish them. The Court likens this to the particularized injury the Seventh Circuit found in Fox. To be sure, Fox addressed compliance with data retention and destruction policies, not the mere requirement to establish those policies. But Fox also noted that “[t]he BIPA requirement to implement data retention and destruction protocols

protects a person’s biometric privacy just as concretely as the statute’s informed-consent regime.” Id. at 1155. Flipping that around, the failure to develop retention and destruction policies once (or before) an entity begins retaining a person’s biometric data inflicts a privacy injury in the same way that unlawful collection does. Consequently, once an entity collects a person’s biometric data, the duty to develop retention and destruction policies becomes one that adheres to the person whose identifiers were collected—much the same way the duty to comply with retention/destruction policies does. This makes the duty to develop particularized in a way that the duty to publicly disclose is not. The Court finds that this approach best reflects the Seventh Circuit’s holdings in Fox and Bryant and aligns with the way other judges in this circuit view the issue. See Kalb v. GardaWorld Cashlink

LLC, Case No. 21-cv-1092, 2021 WL 1668036, at *3-4 (C.D. Ill. April 28, 2021); Marsh v. CLS Plasma, Inc., 503 F. Supp. 3d 677, 681-83 (N.D. Ill. 2020); but cf. Cottingham v. The Ultimate Software Group, Inc., 20-cv-1172, Dkt. 26, at pg. 6 (C.D. Ill. May 25, 2021) (noting minor distinction in how Bryant and Fox frame the section 15(a) duties). And in this case, Fleury alleges that Union Pacific failed to develop retention/destruction policies while still retaining his and others’ biometric data. The Court finds these allegations sufficient to establish Article III standing. Fleury also argues that he does not have Article III standing to pursue his section 15(a) claim in federal court because he continues to access Union Pacific’s railyards and, therefore, the continued retention of his biometric data is not unlawful given that the initial purpose for collecting his identifiers has not been satisfied, nor has 3 years elapsed since his last interaction with Union Pacific.1 0F The Court does not read the statute this way. Indeed, it makes little sense to read BIPA this way because such a reading would contradict the proactive approach to biometric data collection and retention that the General Assembly sought when it enacted BIPA. Rather, the Court reads the phrase “…when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever occurs first” to explain what the policies must describe—not to create a time frame within which these policies must be developed. Put differently, BIPA requires that the policies describe what happens to an individual’s biometric data after the initial purpose is completed or three years after the last interaction, but it does not say when those policies must be created. See also Namuwonge v. Kronos, Inc., 418 F. Supp. 3d 279, 284 (N.D. Ill. 2019) (recognizing that the BIPA statute does not explicitly address timing for when the written policy

should be formulated). At minimum, the statute imposes the duty to develop these policies as soon as the entity possesses the biometric data. See 740 ILCS 14/15(a) (“A private entity in possession of biometric identifiers or biometric information must develop a written policy…”) (emphasis added). Based on the allegations, Union Pacific owed Fleury this duty to develop as soon as it possessed his biometric information. For those reasons, the Court denies the motion to remand.

1 Fleury’s interpretation appears to concede that Union Pacific does not owe him a current duty to develop or publish retention and destruction policies. If the duty to develop arises only after the initial purpose is satisfied or three years after the last contact, then Union Pacific owes Fleury no duty and he would not be able to win on the merits of his claim. See, e.g., Hazlitt v. Apple Inc., 543 F.Supp.3d 643, 649-50 (S.D. Ill. 2021) (addressing similar argument). In any event, the Court need not reach that merits issue to resolve the motion to remand. II. Motion to Lift Stay

Next, the Court addresses the motion to stay. Fleury asks the Court to lift the stay arguing that it is no longer needed. For its part, Union Pacific argues that a stay is still appropriate for the same reasons articulated in its prior briefing. A court has the “inherent power to stay proceedings and ‘to control the disposition of the causes on its docket with economy of time and effort for itself, for counsel, and for litigants.’” Stone v. I.N.S., 514 U.S. 386, 411 (1995) (quoting Landis v. N. Am. Co., 299 U.S. 248, 254 (1936)). Orders staying proceedings must both be “[]moderate” and within “reasonable limits.” Landis, 299 U.S. at 257. In evaluating a motion to stay, courts consider whether the stay will: (1) simplify the issues in question and streamline the trial, (2) reduce the burden of litigation on the parties and on the court, and (3) unduly prejudice or tactically disadvantage the nonmoving party. Burnett. Ocwen Loan Servicing, LLC, Case No. 17-cv-3474, 2017 WL 5171226, at *2 (N.D. Ill. Nov. 8, 2017) “The proponent of a stay bears the burden of establishing its need.”

Clinton v. Jones, 520 U.S. 681, 708 (1997). The Court previously stayed discovery in this case pending appellate decisions in Tims v. Black Horse Carriers, Inc., No. 1-28-0563 (Ill. App. Ct., 1st Dist.); Marion v. Ring Container Technologies, LLC, No. 3-20-0184 (Ill. App. Ct., 3rd Dist.); and Cothron v. White Castle Sys., Inc., Case No. 20-3202 (7th Cir.). See [63]. Tims and Marion, Illinois Appellate Court cases, considered whether a one-year, two-year, or five-year statute of limitations applies to BIPA claims. See Tims v. Black Horse Carriers, Inc., No. 1-20-0562; Marion v. Ring Container Techs., LLC, No. 3-20-0184; see also Herron v. Gold Standard Banking, Inc., No. 20-cv-07469, 2021 WL 1340804, at *2 (N.D. Ill. April 9, 2021). Relatedly, Cothron, a Seventh Circuit case, addresses when a BIPA claim accrues and, more precisely, if a private entity violates BIPA only when it first collects or discloses an individual’s biometric data without making the required disclosures, or if a violation occurs each time the entity collects or discloses the data. See Cothron v. White Castle Sys., Inc., No. 19-cv-00382, Dkt. 141 (N.D. Ill. Oct. 1, 2020). On September 17, 2021, the First District issued a decision in Tims, holding that a five-

year statute of limitations applies to section 15(a) and 15(b) claims. But the Illinois Supreme Court allowed leave to appeal in Tims. See [81-2]. On March 19, 2021, the Illinois Third District Appellate Court stayed Marion pending the Illinois Supreme Court’s decision in McDonald v. Symphony Bronzeville Park LLC, No. 126511. The Illinois Supreme Court issued a decision in McDonald on February 3, 2022. On December 20, 2021, the Seventh Circuit certified the claim accrual question in Cothron to the Illinois Supreme Court. Looking to the factors, the Court finds that a stay is no longer necessary. While the simplicity factor weighs in favor of continuing the stay, the remaining factors weigh in the opposite direction and outweigh that factor. The First District has issued a decision in Tims, which gives enough guidance for this case. Moreover, the Court agrees with Fleury that the

prejudice to plaintiff continues to grow the longer this case sits. No doubt, the law as it relates to BIPA cases will continue to evolve. But that is not, in the Court’s view, a sufficient reason to continue staying this case. It is time for this case to move forward. Moreover, at this point, the Illinois Appellate Court and Illinois Supreme Court are likely to issue decisions in Tims, Marion, and Cothron before any dispositive motions or class certification motions arise in this case. Accordingly, the Court grants Fleury’s motion to lift the stay. Conclusion

The motion to remand [68] is denied. The motion to lift the stay on proceedings [78] is granted. Fact discovery shall be completed by September 30, 2022. The Court previously entered a referral to the Magistrate Judge for discovery supervision and settlement (if requested). The Court will continue to monitor the docket and set further hearing dates as necessary.

SO ORDERED. ENTERED: June 2, 2022

HON. JORGE ALONSO United States District Judge