IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION DAVID FLEURY and CHRISTOPHER ) NUNNERY, individually and on ) behalf of similarly situated individuals, ) ) Plaintiffs, ) No. 20 C 390 ) v. ) Magistrate Judge Jeffrey Cole ) UNION PACIFIC RAILROAD COMPANY, ) a Delaware corporation, ) ) Defendant. ) MEMORANDUM OPINION AND ORDER INTRODUCTION The plaintiffs have brought suit against the Union Pacific Railroad Company, individually and on behalf of “similarly situated individuals” for claimed violations of the Illinois Biometric Information Privacy Act, 740 ILCS 14. [Dkt. ##1, 29, 135]. The suit alleges that the defendant illegally collected in Illinois and retained in Illinois truck drivers’ biometric identifiers and related information, including their fingerprints and other identifying information, such as the names of the drivers, scans of their licenses, and biometrics, along with other categories of information relating to their visits to defendant’s Illinois facilities.1 This information is allegedly stored in six databases. [Dkt. #156 at 2]. Discovery being the bane of modern litigation, Rossetto v. Pabst Brewing Co., Inc., 217 F.3d 539, 542 (7th Cir. 2000)(Posner, J.), perhaps not surprisingly, a spirited dispute has arisen 1 The plaintiffs concede that the class definition limits the class to those who had their biometrics collected and stored in Illinois, and that they do not seek to apply BIPA extra-territorially. See Dkt. #164 at 9-10: “Of course, those individuals who only had their biometrics captured outside Illinois would not be class members, and can easily be filtered out of the data by Plaintiffs’ Expert...Plaintiffs are alleging collection and storage of biometrics in Illinois.” (Emphasis supplied). It would also seem then that this non-discoverable information could be easily filtered out of the data by the defendant. regarding the permissible range of discovery sought by the plaintiffs, who insist that the information they are seeking is relevant to both liability and class certification and is subsumed in plaintiffs’ Requests for Production 4, 5 and 8, which seek production of certain Databases maintained by the defendant. (Plaintiffs’ Motion to Compel [Dkt. # 156 at 2 ]).
Union Pacific concedes that the information being sought by the plaintiffs is available, but it insists that the plaintiffs’ demands are improper and thus it has refused to comply with the requests as made, notwithstanding, according to the plaintiffs, a narrow set of data purportedly promised in writing. [Dkt. #156 at 3-4]. The defendant has a very different view of things. [Dkt. #162]. While it is true that, as a general matter, the Federal Rules of Civil Procedure envision broad discovery, it is also true that general propositions do not decide concrete cases. Lochner v. New York, 198 U.S. 45, 76 (1905)(Holmes, J., dissenting). See also Daubert v. Merrell Dow, 509 U.S. 579, 598 (1993)(Rehnquist, C.J., concurring in part and dissenting in part). Thus, the present controversy is not to be resolved by invocation of the rubric that litigation generally favors broad based discovery.
It appears to be uncontested that the defendant requires truck drivers operating in Illinois in connection with the defendant’s Illinois facilities to register with defendant’s Automatic Gate System (“AGS” or “Auto-Gate System”) so that defendant can identify the driver by his fingerprints in the event of a subsequent visit to an Illinois facility owned and operated by the defendant. In the registration process, the defendant allegedly collects, captures, or otherwise obtains the putative class members’ personal identifying information (“PII”) in the form of their full names, scans of their drivers’ licenses, and their biometrics, along with other categories of information related to their visits to Union Pacific’s Illinois facilities. Defendant apparently stores this information in six
databases. 2 Plaintiffs requested production of this information – which is contended to be relevant to both liability and class certification – more than two years ago, on April 5, 2021.2 Document Request No. 4: All Documents which Identify all individuals whose Biometric Identifiers or Biometric Information was collected, captured, stored, and/or used by You or on Your behalf during the Relevant Time Period. Document Request No. 5: All Documents Related To any written consent Related To the capture, collection, storage, use, or dissemination of biometrics by You or on Your behalf. Document Request No 8: Any Documents, Communications, and Correspondence Related to Biometrics. Defendant does not deny that it is in possession of the above referenced information, and that it is stored in six databases owned and controlled by Union Pacific. Each of Union Pacific’s four facilities in Illinois apparently has its own local driver registration database that is stored on-site at the facility. It is these Illinois facilities to which the Second Amended Class Action Complaint (the “Complaint”) refers. The Complaint is brought on behalf of all persons who after December 14, 2014 had their fingerprints registered or scanned by Union Pacific’s Automatic Gate System “in Illinois without first providing written consent to defendant.” (Second Amended Class Action Complaint, 135 ¶ 28)(emphasis supplied). Union Pacific also apparently maintains a “central” driver database related to putative Class Members’ use of Union Pacific’s Illinois Auto-Gate Systems. These five databases are, it is claimed,
2 See Plaintiff Fleury’s First Requests for Production and Defendant’s Responses thereto, all of which are attached as Exhibit A, at Request Nos. 4, 5, and 8. See Plaintiffs’ Requests for Production Nos. 4, 5 and 8. The plaintiffs’ definition of “Documents” includes “data or data compilations, including ESI—stored in any medium from which information can be obtained.” Id. ¶ 15. These Requests were propounded prior to any discovery occurring in this case, and, as explained in Plaintiffs’ Rule 37 certification have been narrowed through the meet-and-confer process and further written discovery to the point that the Parties understand that Plaintiffs seek production of the Databases under these Requests. 3 linked to Union Pacific’s “UP Driver Master File,” which contains additional PII and data points related to whether UP has obtained a driver’s purported consent to collect his biometrics and whether the defendant has deleted the biometrics of inactive truck drivers. It is alleged by the plaintiffs that defendant is withholding discoverable information and is
attempting to artificially narrow the size and scope of the plaintiffs’ Class to drivers who possessed and presented an Illinois Commercial Drivers License (“CDL”) to an Illinois facility run by the defendant. The parties apparently have unsuccessfully attempted to resolve their dispute. It is further contended by the plaintiffs that the information sought is relevant to the merits of plaintiffs’ claims and to class certification, and that there is no legitimate basis for defendant to withhold the sought- after information.3 Thus, plaintiffs apparently ask the Court to order the production of the six Databases maintained by defendant – even though those Databases involve, perhaps to a large extent, the biometric data obtained outside of Illinois and reflecting data relating to non-Illinois citizens.
GENERAL PRINCIPLES GOVERNING DISCOVERY DISPUTES Rule 26 of the Federal Rules of Civil Procedure generally permits parties in litigation to obtain discovery regarding “any nonprivileged matter that is relevant to any party's claim or defense” and is “proportional to the needs of the case, considering the importance of the issues at stake in the action, the amount in controversy, the parties’ relative access to relevant information, the parties resources, the importance of the discovery in resolving the issues and whether the burden
3 The plaintiffs contend that in light of the “comprehensive Confidentiality Order entered by the Court” the objection raised by the defendant is captious and unpersuasive. A Confidentiality Order does not determine the permissibility of a discovery request. It merely dictates the treatment that is to be accorded information that is being properly disclosed in discovery. [See Dkts. ##125-126]. 4 or expense of the proposed discovery outweighs its likely benefit.” Fed. R. Civ. P. 26(b)(1).4 Courts have vast discretion in ruling on discovery issues. Discretion means that the result is within a permissible range and is not merely a point in the spectrum. Indeed, in matters of discretion, two decision-makers—on virtually identical facts—can arrive at opposite conclusions, both of which can
constitute appropriate exercises of discretion. Compare United States v. Boyd, 55 F.3d 239 (7th Cir. 1995) with United States v. Williams, 81 F.3d 1434 (7th Cir. 1996). An abuse of discretion occurs when no reasonable person could take the view of the district court. Mejia v. Cook County, Ill., 650 F.3d 631, 635 (7th Cir. 2011); United States v. Banks, 546 F.3d 507, 508 (7th Cir. 2008); U.S. v. Re, 401 F.3d 828, 832 (7th Cir. 2005). Cf. United States v. Bullion, 466 F.3d 574, 577 (7th Cir. 2006)(Posner, J.)(“The striking of a balance of uncertainties can rarely be deemed unreasonable....”). This is equally true in the class action context. Jones v. Nat’l Council of Young Men's Christian Assocs. of U.S., 2011 WL 1312162, at *2 (N.D. Ill. 2011).
ARGUMENT The present discovery dispute began at least as far back as October 21, 2022, when the plaintiffs filed a Motion to Compel. [Dkt. #103]. Given the submissions from the parties at that time, it was clear that there had not been compliance with Local Rule 37.2's requirement that counsel
4 The concept of proportionality did not make its first appearance in the Federal Rules of Civil Procedure with the 2015 Amendments. It originally appeared as part of Rule 26(b)(2)(C)(iii). Henry v. Morgan's Hotel Grp., Inc., 2016 WL 303114 (S.D.N.Y. 2016); Certain Underwriters at Lloyds v. Nat'l RR Passenger Corp., 318 F.R.D. 9, 14 (E.D.N.Y. 2016). Renumbering the proportionality requirement and placing it in Rule 26(b)(1) was designed to put a greater emphasis on the need to achieve proportionality than was thought to previously have existed given its placement in the structure of Rule 26. Eramo v. Rolling Stone LLC, 314 F.R.D. 205, 209 (W.D. Va. 2016). The renumbering of the proportionality requirement was thought to restore and emphasize the extraordinary degree of discretion courts possess in overseeing discovery disputes. Boehringer Ingelheim Pharma GMBH & Co. KG v. Teva Pharm. USA, Inc., 2016 WL 11220848, at *3 (D.N.J. 2016). See the lengthy and informative discussion in Linda Simard, Seeking Proportional Discovery: The Beginning of the End of Procedural Uniformity in Civil Rules, 71 Vanderbilt L.Rev., 1919 (2018). 5 meet and confer in good faith over discovery related disputes before seeking court intervention. On November 22, 2022, I denied that Motion and asked the parties to redouble their efforts. [Dkt. #114]. While my hope was that the parties would resolve their differences, the more realistic expectation was that they might narrow them. Unfortunately, in the six months between the November 22nd
Order and the plaintiffs’ May 23, 2023 updated Motion to Compel, the parties met and conferred four times without any appreciable success. Things initially went well: immediately following my November 18, 2022 Order, the parties met and conferred by telephone on November 22, and December 2, 2022, regarding the data the defendant would be producing. On December 12, 2022, according to the plaintiffs, the defendant made a proposal to produce class size numbers according to various potential limitations periods, including Personally Identifiable Information (PII) associated with such drivers, consisting of: Driver names, CDL Numbers, and CDL Issuing State, contingent upon plaintiffs accepting that information as a full compromise of the parties’ disputes. [Dkt. #157, at 12]. While that appears to
have been a good faith offer – if one that leaves out a fair amount of information as will be discussed later – plaintiffs seem to have taken umbrage at the contingency and demanded to know the full extent of all the data the defendant possessed. [Dkt. #157, at 12]. But taken literally, that would seem overbroad if the intent was to ascertain whether the defendant’s database contained information about biometric gathering that occurred outside of Illinois. There is no indication that the Illinois statute involved in this case was intended to have extra-territorial application. See e.g. Wilk v. Brainsharp, Inc., 2022 WL 4482842, *2 (N.D.Ill. 2022). The plaintiff does not argue to the contrary, and, indeed, the class members are defined in the Second Amended Class Action Complaint as those
individuals who were subjected to certain allegedly prohibited treatment at defendant’s Illinois 6 locations. [See, e.g., Dkt. #135 at 3, 13, 14, 17, 19, 21, 23, 26, 28, 38, 41-42, 46-47, 53, 58, 63, 65]. See also [Dkt. #164 at 9]. According to the plaintiffs, two demand letters to the defendant: one on December 16, 2022 and the other on January 20, 2023, were ignored by the defendant. But, letters are not considered
compliant with Local Rule 37.2. See Vera Bradley Designs, Inc. v. Aixin Li, No. 20 C 2550, 2021 WL 780718, at *2 (N.D. Ill. Mar. 1, 2021)(collecting cases). They “are easily and unfortunately too often ignored.” Jackson-El v. City of Markham, 332 F.R.D. 583, 584 (N.D. Ill. 2019). While the written word has its place, Local Rule 37.2's requirement of personal consultation is deemed preferable and may not be ignored. With the parties’ first two telephone conversations having resulted in an offer of compromise, there ought to have been more phone conferences in December and January. In any event, on February 9, 2023, the defendant indicated it was willing to expand its previous offer and produce the following information for each potential class member: CDL
Number, CDL State, Driver Name, Driver Consent Value, Consent Timestamp, First Illinois Scan Date, First Illinois Scan Ramp, Last Illinois Scan Date, Last Illinois Scan Ramp, and Last Active Timestamp. [Dkt. #157-2]. In response a month later, on March 10, 2023, plaintiff refused to budge without defendant producing a full catalog of all the information the defendant stored. And, plaintiff added a number of stipulations to that, including defendant waiving a number of its arguments. [Dkt. #157-3]. Plaintiffs’ counsel asked for a meeting the week of March 13, 2023. [Dkt. #157-3]. In the interim, they also submitted a second set of interrogatories that included asking defendant to “[i]dentify all categories or types of data in Defendant's possession or control that Relate to the
putative Class Members . . . .” Defendant responded April 14, 2023, with a nine-page list of data 7 points. [Dkt. #157-6, at 6-15]. The parties had two more telephone conferences on April 25 and 27, 2023, with no results. It would appear to be around this time that the plaintiffs began demanding that the defendant produce entire “databases” of information. [Dkt. #157, at 13]. In a May 5, 2023 letter, the
defendant rejected plaintiffs’ demand for all information it stored and the plaintiffs’ stipulations. The defendant did, however, agree to provide class data information that included names and CDLs of all drivers with Illinois CDLs with first access at defendant’s facility in Illinois and last date of access, the status of the driver having provided consent, and when that consent was provided. [Dkt. #157-5]. The plaintiffs wrote back on May 8, 2023, saying – correctly– that defendant’s offer artificially narrowed the class plaintiffs expressly alleged in their Second Amended Complaint, namely “[a]ll persons who, after December 13, 2014, had their fingerprints registered or scanned by Union Pacific’s Automatic Gate Systems in Illinois without first providing written consent to Union Pacific” [Doc. #135 ¶ 28](emphasis supplied).
The plaintiffs’ argument was that BIPA was not limited to Illinois residents, but rather by its unambiguous terms included anyone who had been subjected to certain prohibited conduct so long as it occurred in Illinois. In other words, the locus of the claimed harm that was done in violation of the Illinois statute was, it was argued, outcome determinative; the citizenship or state of residence of a particular plaintiff, was not. The plaintiffs added that defendant’s refusal to agree to their laundry list of stipulations meant that broader categories of data had to be produced, including biometric identifiers and biometric information. [Dkt. #157-5]. And so, on May 23, 2023, plaintiffs filed their Motion to Compel production of six entire
databases. As the plaintiffs explain, from defendant’s discovery responses, each of the defendant’s 8 four facilities in Illinois has its own local driver registration database that is stored on-site at the facility. Then there is a “central” driver database related to use of defendant’s Illinois Auto-Gate Systems. Those five databases are then linked to defendant’s “UP Driver Master File,” which contains additional PII and data points related to whether UP has obtained truck drivers’ purported
consent to collect their biometrics and whether UP has purged (deleted) the biometrics of inactive truck drivers. [Dkt. #157, at 2-3]. On May 26, 2023, the defendant produced a class list of over 23,000 drivers that showed the following information for all drivers with an Illinois Commercial Driver’s License (“CDL”) who registered at one of Union Pacific’s Auto-Gate Systems in Illinois: Driver Name, CDL Number, First Illinois Scan Date, First Illinois Scan Carrier, First Illinois Scan Ramp, Last Illinois Scan Date, Last Illinois Scan Carrier, Last Illinois Scan Ramp, Driver Consent Value, and Consent Timestamp. [Dkt. #162, at 2]. The defendant’s list, however, did not include those who did not have an Illinois Commercial Drivers License even though they may have registered at one of the defendant’s facilities in Illinois.
It is argued by the plaintiffs that limiting discovery to exclude this group is improper and is underinclusive in that it ignores the purpose and thrust of the Illinois statute and impermissibly narrows the proper scope of discovery. Phrased differently, according to the plaintiffs, the defendant’s attempt to limit discovery in this way is inconsistent with the plain language of the Illinois statute. Under the defendant’s interpretation of BIPA, anyone not having an Illinois Commercial Drivers License would be excluded from the Act’s coverage, even if he or she was subjected to statutorily prohibited conduct in Illinois. But under the governing Illinois statute, it is behavior by a defendant within the state, not the residence or citizenship of the individual affected
by the charged behavior, that is determinative. Justice Frankfurter’s three-fold imperative to law 9 students should not be forgotten: “read the statute, read the statute, read the statute.” See Henry J. Friendly, Mr. Justice Frankfurter and the Reading of Statutes, Benchmarks 196, 202 (1967). In sum, it is behavior by a defendant within Illinois, not the citizenship or residence of the putative plaintiff, or the type of license held by a particular driver that is critical. While courts that
have considered the issue have concluded that BIPA does not apply extraterritorially, Davis v. Jumio Corp., No. 22-CV-00776, 2023 WL 2019048, at *6 (N.D. Ill. Feb. 14, 2023); Mahmood v. Berbix, Inc., No. 22 C 2456, 2022 WL 3684636, at *1 (N.D. Ill. Aug. 25, 2022); Ronquillo v. Dr.’s Assocs., LLC, 597 F. Supp. 3d 1227, 1233 (N.D. Ill. 2022); Monroy v. Shutterfly, Inc., No. 16 C 10984, 2017 WL 4099846, at *5 (N.D. Ill. Sept. 15, 2017), that does not mean the Act does not apply to non- residents of Illinois even though they have actually been subjected in Illinois to the very conduct the Act was designed to prohibit. None of the cases cited by the defendant is to the contrary. There appear to be a number of relevant factors used in determining BIPA’s reach, including the residency of the plaintiff, the location of harm, communications between parties (where sent and
where received), and where a company policy is carried out. See Rivera v. Google Inc., 238 F. Supp. 3d 1088 (N.D. Ill. 2017); Davis, 2023 WL 2019048, at *6. As Rivera – a case the defendant cites – explained, parties have to have a chance to develop facts in discovery, “[f]or example, where did the alleged scans actually take place?” Rivera, 238 F. Supp. 3d at 1102. Simply put, the fact of non- residency in Illinois or that one has a driver’s license from a state other than Illinois does not mean that he or she is outside the reach of the statute and is an improper plaintiff, or that discovery is improper. The court’s observation in Ronquillo v. Doctor's Assocs., LLC, 597 F. Supp. 3d 1227, 1234 (N.D. Ill. 2022) bears repeating: “Here, although HP is a non-resident defendant, Ronquillo
alleges that she scanned her fingerprints at a Subway restaurant in Illinois, which leased HP's 10 hardware, and that this hardware, located on site in Illinois, stored her fingerprints. These allegations suffice to suggest that the alleged BIPA violations took place “‘primarily and substantially in Illinois.’” See also Smith v. Signature Sys., Inc., No. 2021-CV-02025, 2022 WL 595707, at *3 (N.D. Ill. Feb. 28, 2022)(fingerprint scans occurred in Illinois, were collected in Illinois, and were stored
on a database in Illinois). In sum, discovery is not improper simply because information collected in Illinois may have been stored on the Central Drive Database and Driver Master File outside of Illinois. The law and the plain language doctrine do not condone the kind of facile avoidance of a statutory command that has been attempted here. The Ninth Circuit’s discussion in Patel v. Facebook, Inc., 932 F.3d 1264, 1275-76 (9th Cir. 2019) is instructive. There, Facebook argued that because its servers were located outside Illinois, the necessary elements of a BIPA violation occurred extraterritorially. The court disagreed, explaining: The statute does not clarify whether a private entity's collection, use, and storage of face templates without first obtaining a release, or a private entity's failure to implement a compliant retention policy, is deemed to occur where the person whose privacy rights are impacted uses Facebook, where Facebook scans photographs and stores the face templates, or in some other place or combination of places. Given the General Assembly's finding that “[m]ajor national corporations have selected the City of Chicago and other locations in this State as pilot testing sites for new applications of biometric-facilitated financial transactions,” 740 Ill. Comp. Stat. 14/5, it is reasonable to infer that the General Assembly contemplated BIPA's application to individuals who are located in Illinois, even if some relevant activities occur outside the state. Id. That brings us to what has to be produced. Six entire databases seems excessive, and potentially irrelevant unless the database contains information relating to a driver’s visit to one of defendant’s Illinois facilities and reflects conduct occurring in Illinois prohibited by the Illinois statute. In that event, all that is relevant would be the names of individuals who were subjected to 11 conduct in Illinois prohibited by the statute. Conduct occurring at someplace outside Illinois would not be “relevant” even if stored on a database maintained in Illinois. It bears repeating that it is the site of the conduct prohibited by BIPA that is relevant, not merely the physical situs of the database, itself. In other words, relevance and discoverability are, in this case, a function of where the conduct
occurred not merely where the information happens to be stored. No claim of undue burden has been made in this case. Nevertheless, judging by the list of data the defendant submitted in its interrogatory response, a lot is going to be irrelevant. The defendant should have the opportunity, for example, to cull all the data relating to scans occurring outside Illinois. But other than that, it is difficult to say definitively based on what we have – how much of the remainder of the data has to be produced. For example, while the defendant’s “UP Driver Master File” may be stored outside Illinois [Dkt. #162, at 8], that alone is not a sufficient basis to restrict apparently limited discovery, if the discovery sought is otherwise proper. (i.e. involves conduct in Illinois prohibited by BIPA).There are other factors to consider, and if there is
relevant information it must be produced regardless of its present location – unless, in the unlikely event that location is somehow a legitimate bar to discovery. [Dkt. #157, at 2-3]. Finally, I do not share the plaintiffs’ interpretation of its discovery requests and the parties’ interchanges having always been about the production of entire “databases.” The plaintiffs, themselves, claim that the defendant’s offer in December 2022 is what first spurred them to ask the defendant for a catalog of all the information it possessed. [Dkt. #157, at 12]. If plaintiffs all along truly thought its discovery requests for “documents” included “entire databases” then, I suspect, the exchanges between counsel would have been quite different than they were, and there would have
been some specific references to or discussions about “databases.” Moreover, plaintiffs’ document 12 requests indicated that “[w]here structured data (e.g., data from a database) is requested, appropriate queries will be used to extract relevant data from any such database ....” [Dkt. #157-1, at 13]. It would appear this dispute did not become about the production of entire databases until very recently. In any event, production of six entire databases is a bit much to ask for or expect in this case. Finally, the plaintiffs contend that the databases will contain information irrelevant to this case, but that any irrelevant information can be culled out and suggest that that be done by their expert. But, we think that task should be for the defendant’s not the plaintiffs’ expert, as plaintiffs have suggested. See n. 3. CONCLUSION Judge Moran’s observation that “[p]arties are entitled to a reasonable opportunity to investigate the facts-and no more” is as true today as when it was first announced. Vakharia v. Swedish Covenant Hosp., 1994 WL 75055, at *2 (N.D. Ill. 1994)(Moran, J.). Plaintiffs’ Motion to Compel Production of Data in Discovery [Dkt. ## 156, 157] is granted in part and denied in part as explained above. The plaintiffs’ request for fees is denied. A, ENTERED: ITEDSTATES MAGISTRATE JUDGE
DATE: 7/14/23