Fluery v. Union Pacific Railroad Company

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION DAVID FLEURY, individually and on ) behalf of similarly situated individuals, ) ) Plaintiff, ) No. 20 C 390 ) v. ) Magistrate Judge Jeffrey Cole ) UNION PACIFIC RAILROAD COMPANY, ) a Delaware corporation, ) ) Defendant. ) MEMORANDUM OPINION AND ORDER On October 3, 2023, the plaintiff filed a Motion to Compel Production of Damages Data to demonstrate how many times the defendant scanned the fingerprints of about 42,000 truckers who passed through its gates in Illinois. For the following reasons, the plaintiff’s motion [Dkt. #201] is granted. This is getting to be a pretty old case, dating back to before the pandemic.1 It’s been 1 To make a really long story a really long footnote, the plaintiffs filed this case in Cook County Circuit Court on December 11, 2019, and the defendant removed it to federal court on January 17, 2020. The defendant filed its first motion to dismiss – based on pre-emption – on March 6, 2020 [Dkt. #17], and the court stayed discovery while it was pending, on the defendant’s motion. [Dkt. #21]. That motion to dismiss was denied as moot on June 23, 2020 [Dkt. #32] as plaintiff was allowed to filed a First Amended Complaint on June 16, 2023. [Dkt. #29]. Defendant filed a second motion to dismiss on July 21, 2020, based on pre- emption, and Mr. Fluery consented to have his fingerprint scanned. [Dkt. #36]. That motion was denied on March 24, 2021, with the court noting that six months after the plaintiffs filed suit, the defendant, provided Mr. Fleury with written notice that it would collect, store, and share his biometric information, and Mr. Fleury provided his written consent. The problem was, as the court explained, that he didn’t provide written consent before the defendant first collected his biometric information. The court allowed that the June 2020 consent might limit damages or bar Mr. Fleury’s claim altogether assuming BIPA allows for retroactive consent. [Dkt. #47, at 15-16]. The court then lifted the stay that had been in place for over a year on April 9, 2021. [Dkt. ##21, 52]. But that was short-lived as the defendant asked for and received another stay to await rulings in three cases as of June 23, 2021 [Dkt. #63]. After another year, the court finally lifted that second stay on June 2, 2022. (continued...) dragging along ever since it was filed back in December of 2019. Both sides share blame for that, between asking for lengthy stays and amending and re-amending already amended Amended Complaints. When a case goes on and on, discovery goes on and on, generally with unfortunate complications. And quite often, a lengthy case with a lengthy discovery period means rancorous

discovery disputes as attorneys seek to fill the vacuum of time with activity – inevitable fees – and, hopefully, accomplishment. The length of this case seems to have had that effect here, as the teams of lawyers for both sides have fought tooth and nail over a lot of hills of discovery. Presently, we are circling back to an old battle ground: the plaintiff’s Motion to Compel Production of Damages

1(...continued) [Dkt. #89]. One of the rulings the defendant wanted to wait for was in a case called Cothron v. White Castle Sys., which was then pending before the Seventh Circuit. There will be more on Cothron later. On February 15, 2023, the court allowed the defendant to file Amended Affirmative Defenses and gave the parties 30 days to file any other amended pleadings.[Dkt. #132]. Plaintiff filed a Second Amended Complaint on March 20, 2023 [Dkt. #136], arguably five days late, and defendant got a month-long extension to file an Answer to this new Complaint, plaintiffs’ third. [Dkt. #142]. At 9:30 the night of the extended deadline, the defendant filed a motion to strike and dismiss the Second Amended Complaint. [Dkt. #145]. The defendant argued that plaintiffs had missed the March 15th deadline, re-raised pre-emption, and contended that the plaintiffs’ new class representative – recall the issues with the first one’s consent – had never accessed one of defendant’s Illinois facilities. [Dkt. #146]. After obtaining an extension, the plaintiffs had two months to file a response to the defendant’s motion. [Dkt. ##153, 161]. Instead, at 8 p.m. on the deadline day, the plaintiff filed a motion for leave to file a Third Amended Complaint. [Dkt. #167]. The new Complaint had a new named plaintiff to replace Mr. Nunnery, who had apparently been named as a result of the first named plaintiff – Mr. Fluery – consenting to his fingerprint scan after the fact. Judge Hunt, who had only recently been reassigned this case [Dkt. #162], determined that she would address the plaintiffs’ motion first and suspended briefing on the defendant’s motion. [Dkt. #168]. The plaintiffs’ motion for leave to file a Third Amended Complaint was fully briefed on July 28, 2023. [Dkt. #178]. After a hearing on October 12, 2023, Judge Hunt allowed the plaintiffs to file a fourth version of their Complaint with a third named plaintiff and a new subclass. [Dkt. #207]. The defendant promptly filed another motion before Judge Hunt attacking that version of the Complaint, focusing on the what we’ll call the “per- scan-damages issue.” [Dkt. #209]. Judge Hunt denied that motion on November 15, 2023, and set a briefing schedule on the defendant’s forthcoming motion to dismiss the plaintiff’s Third Amended Complaint. [Dkt. #221]. Defendant filed that motion on December 8, 2023. [Dkt. #226]. With that, the case begins its fifth year. 2 Data [Dkt. #201], one of a trio of motions to compel that the parties filed near what had been –mercifully, at the time – the close of discovery on October 30, 2023. [Dkt. #183]. The plaintiff wants to know how many times each trucker entered one of the defendant’s gates in Illinois and put their finger in the scanner, because each time could be worth between $1000 and $5000. The

defendant doesn’t want to give up that information and argues that it isn’t even relevant to damages. I. Recall that the defendant had this case stayed twice for a total of about two years. One of the rulings the defendant wanted to wait for was in a case called Cothron v. White Castle Sys., which was then pending before the Seventh Circuit. [Dkt. #50, at 2]. The issue was when BIPA claims accrued, and the defendant was hoping the court would rule that claims occur on the first scan because then the statute of limitations would bar the plaintiffs’ claims. [Dkt. #50]. Cothron v. White Castle Sys., Inc., 20 F.4th 1156, 1165–66 (7th Cir. 2021). That didn’t work as well as the defendant

hoped because the Illinois Supreme Court eventually decided that “a separate claim accrues under the Act each time a private entity scans or transmits an individual's biometric identifier or information in violation of section 15(b) or 15(d)” of the Act. Cothron v. White Castle Sys., Inc., 466 Ill.Dec. 85, 87, 216 N.E.3d 918, 920 (Ill. Feb. 17, 2023); Cothron v. White Castle Sys., Inc., 79 F. 4th 894, 895–96 (7th Cir. 2023). Not only did that scuttle a statute of limitations argument, but it raised the specter of a potentially massive amount of damages. See Cothron v. White Castle Sys., Inc., 20 F.4th 1156, 1165 (7th Cir. 2021).2 A plaintiff may recover $1,000 for each negligent violation of the Act, and $5,000 for each intentional violation of the Act. 740 ILCS 14/20. That’s

2 The ruling had a bit of a chum-in-the-water effect as “cases alleging violations of the Act reportedly jumped 65% in Illinois circuit courts in the two months” following the Illinois Supreme Court’s opinion. Cothron v. White Castle Sys., Inc., 466 Ill.Dec. 85, 105-06, 216 N.E.3d 918, 938-39 (2023)(Overstreet, J., dissenting in Separate Opinion upon Denial of Rehearing). 3 a lot. According to the defendant, the original plaintiff, David Fluery3, purportedly scanned his finger 45 times between November 2018, and January 2020. [Dkt. #1-2, Par. 3].4 That’s potentially $45,000 to $225,000 in damages. Multiply those figures by 42,000 and the spread is $1.89 billion and $9.45 billion!

Those jaw-dropping figures make the defendant’s undeviating position on damages throughout this litigation understandable. But, when one looks at the bigger picture, in terms of employee identification scans – or truck drivers delivering and picking up from the defendant’s facilities here – the statute doesn’t ask much. All a company has to do is obtain consent first. That doesn’t seem much to ask in exchange for the most personal of all identification information in an era where we read about companies and governments that collect and store such information being hacked on a seemingly regular basis. https://en.wikipedia.org/wiki/Office_of_Personnel_ Management_data_breach; https://www.reuters.com/world/us/data-237000-us-government- employees-breached-2023-05-12/; https://www.digitalguardian.com/blog/top-10-biggest-us-

government-data-breaches-all-time; https://en.wikipedia.org/wiki/2017_ Equifax_data_breach; https://www.wired.com/story/23andme-breach-sec-update/. Identity theft is undeniably deadly serious when it involves Social Security numbers, bank and investment account numbers, passwords, or the like. But when it involves fingerprints or other biometric data, the stakes are higher.

3 Plaintiff’s attorneys have alternately spelled their lead plaintiff’s name “Fluery” [Dkt. ##1-1, 20] and “Fleury.” [Dkt. ##29, 58, 135]. 4 This assertion, made by the defendant’s Senior Manager of Intermodal Operations, tends to undermine the defendant’s apparent stance at the oral argument on this motion that there are no records of fingerprint scans. (Rough Hearing Tr., at 25 (“What the records actually show is the tag on the side of the truck and what bill of lading it was and what CDL entered. That’s all the records show. There’s not a checkmark that says Melissa used a finger sensor attachment today.”), at 26-27 (“I wouldn’t be able to tell [whether a finger scan was used] because that’s not what the records show.”)). 4 Against such a serious threat, the statute isn’t as draconian as defendants might argue; it’s arguably closer to toothless.5 If a driver – or employee – doesn’t consent, one might assume they don’t work.6 Compared to recovering one’s life after identity theft, obtaining consent should be easy for the data collector, meaning avoiding damages, however massive, shouldn’t be terribly difficult.

See Cothron v. White Castle Sys., Inc., 466 Ill.Dec. 85, 96, 216 N.E.3d 918, 928 (Ill. Feb. 17, 2023) (“This court explained that the legislature intended to subject private entities [which] fail to follow the statute's requirements to substantial potential liability. The purpose in doing so was to give private entities the strongest possible incentive to conform to the law and prevent problems before they occur.” (citations omitted)). Moreover, the massive damages aren’t even a done deal. In Cothron, the Illinois Supreme Court pointed out that the Illinois “General Assembly chose to make damages discretionary rather than mandatory” under BIPA, and noted that “[a] trial court presiding over a class action—a creature of equity—would certainly possess the discretion to fashion a damage award that (1) fairly

compensated claiming class members and (2) included an amount designed to deter future violations, without destroying defendant's business.” 466 Ill.Dec. at 96, 216 N.E.3d at 929 (citations and quotations omitted). Of course, the fashioning of damage awards might be years away if the history of this case – it’s still at the pleading stage with the plaintiffs on their fourth try at an operative

5 In this regard, it’s worth noting, for example, that the Illinois General Assembly exempted some of the largest collectors of biometric data from the statute’s reach as it applies only to “private entities.” Cothron v. White Castle Sys., Inc., 20 F.4th 1156, 1159 (7th Cir. 2021)(“. . . the Act regulates how private entities may collect and handle biometric data . . . .”); Stauffer v. Innovative Heights Fairview Heights, LLC, No. 3:20-CV-00046-MAB, 2020 WL 4815960 (S.D. Ill. Aug. 19, 2020). 6Or one might not. After about four years, it appears that some drivers – the plaintiffs’ new named plaintiff, for example – use their CDL to get through the gates and don’t scan their fingers for access. [Dkt. #230-1]. 5 Complaint [Dkt. #221]– thus far is any guide. But, if and when the case gets to that point, Judge Hunt will have to have something to work with. She is not going to want to restart discovery at the end of the case – especially one that might be six or seven years old – to make rulings on damages. District court judges don’t like surprises in their cases, see, e.g., Rogers v. BNSF Ry. Co., No. 19 C

3083, 2023 WL 4297654, at *11 (N.D. Ill. June 30, 2023)(rejecting a tardy per-scan damages theory that would have resulted in the case go[ing] from . . . a case of 44,000 ... times a thousand or times 5,000, which, to be clear, is a very, very significant number to begin with, to being something that's literally 25 times greater than that.”), unless the surprise is an unexpected settlement in a contentious case like this one. True, the defendant wanted a prospective ruling that it would not end up being subjected to per-scan damages and filed a Motion to Amend Class Allegations before Judge Hunt. [Dkt. #209]. It’s not clear that such a motion was the best tool to hammer out a ruling on a substantive issue, and Judge Hunt rejected the defendant’s entreaty. [Dkt. #221]. And, she specifically said that she

thought “the request seeking discovery on per-scan damages is certainly appropriate. It's relevant because that's what the Cothron case suggests. It is relevant.” (November 15, 2023 Hearing Tr. 26). That means per-scan damages are in the picture for now, and that there’s not much of an issue left regarding the plaintiff’s Motion to Compel Production of Damages Data. [Dkt. #201].

II. But, brushing aside Judge Hunt’s statements at the hearing on the Motion to Amend Class

Allegations, the defendant continues to contend that per-scan data is not relevant. Indeed, the 6 defendant’s response to the plaintiff’s motion [Dkt. #218] essentially just reboots the arguments it brought before Judge Hunt. [Dkt. # 219]. Those arguments focus on the deposition testimony of Lynda Parilla, who was deposed On October 25, 2023, as Nascent Technology’s Rule 30(b)(6) witness. According to the defendant’s interpretation of that testimony, a truck driver’s fingerprint

is scanned only once, the first time the driver goes through the gate to establish their fingerprint in the system. [Dkt. #223, at 4 (“. . . there is only a single collection of finger-sensor data at the time a driver registers to use the system . . . .”), at 5 (“That testimony does not support multiple violations of BIPA, because there is only a single instance of “collection” of anything and no dissemination . . . .”), at 7 (“There is no more than one “collection” . . . .”), at 8 (“Because there is only one collection, and because each subsequent visit to an intermodal facility where a drive[r] “utilized” (Dkt. 201 at 1) a Nascent-provided sensor does not result in a subsequent collection, . . . .”), at 12 (“In the end, there is at most a single “collection” . . . .”)]. According to the defendant, it is never scanned – or “collected” – again, even though the drivers must put their fingers into the gate

scanners each time they enter the facilities. That seems a stretch, and the deposition testimony that the defendant relies on certainly doesn’t show it to be the case. In fact, the deposition testimony the defendant finds so conclusive and dispositive of this per-scan damages issue raises more questions than it answers. The first thing that’s curious about the defendant’s argument, made in a case dating back to December 2019, is where has it been? One supposes we are to believe that through it all, the defendant did not know how its fingerprint scanner system worked; not even rudimentarily, the way most of us might “understand” how computer technology works. We are to believe that despite this

per-scan damages issue ramping up in earnest back at the beginning of March 2023, right after the 7 Cothron decision. [Dkt. #201, at 10]. Surely, someone on the defendant’s side, in the midst of this case, must have been a bit curious about how the scanning worked long before October 25th. After all, a good deal of money hinged on the answer to that question. It is unimaginable to say that the issue was not at the forefront of everyone’s mind. Apparently not.7

In any event, the defendant says that there’s a difference between a fingerprint “scan” and a fingerprint “collection.” Section 15(b) of BIPA provides that a private entity may not “collect, capture, purchase, receive through trade, or otherwise obtain” a person's biometric data without first providing notice to and receiving consent from the person. 740 ILCS 14/15(b); Cothron v. White Castle Sys., Inc., 466 Ill.Dec. 85, 89, 216 N.E.3d 918, 922 (2023); Cothron v. White Castle Sys., Inc., 20 F.4th 1156, 1159 (7th Cir. 2021). The defendant says the system it uses only “collects” or “captures” once, the first time a trucker puts their finger in the scanner at the gate. Thereafter, when a driver uses the scanner at the gate, there is, the defendant insists, no collection or capture. That’s counterintuitive because somehow, the driver’s fingerprint has to be compared to the fingerprint “on

file” from the first scan. So, what does the defendant think happens when a driver puts his finger in the scanner?8 It is unclear from the defendant’s response brief, just as it is unclear from the deposition testimony the defendant is relying upon. One is reminded of Justice Holmes’ timeless warning – applicable in all cases – “[w]e must think things, not words, or at least we must constantly

7 Again, it was a bit more than four years into the case before the defendant seemed to have learned that its fingerprint scanning entry system wasn’t universally applied. [Dkt. #230-1]. 8 The dissenting opinion in Cothron took a somewhat different tack. Rather than posited that nothing is collected in subsequent scans, Justice Overstreet seemed to argue that nothing new was collected. He asserted that “[w]ith subsequent authentication scans, the private entity is not obtaining anything it does not already have. . . . The subsequent scans did not collect any new information from plaintiff, and she suffered no additional loss of control over her biometric information.” 216 N.E.3d at 930-31, 466 Ill.Dec. at 97-98 (emphasis added). 8 translate our words into facts for which they stand, if we are to keep to the real and the true.” Holmes, Law and Science and Science and Law, 12 Harv.L.Rev. 443, 460 (1889). There are some number of leaps of faith the defendant wants us to take in going from Parilla’s deposition testimony to the conclusion that “finger scans are irrelevant.” First, the

defendant calls Nascent “the provider of the finger-sensor technology at issue in this lawsuit,” although, from the testimony, it seems that another company – Lumidigm, which apparently makes the scanners and attendant technology we’re talking about and – has at least as much or more to do with it. [Dkt. #223-2, Tr., at 55, 169, 188, 191, 193, 253, 255]. The fact that Lumidigm, not Nascent, made the scanners is important because, as we shall see, the Nascent witness doesn’t know how the scanner works. And how the scanner works is what this particular discovery squabble is all about. Next, the defendant asserts that: The Template BIN field consists of a BLOB (Binary Large Object) of hex data (numbers and letters); it is not a fingerprint, and it cannot be rendered into a fingerprint. (Id. at 189:12-24; 191:1-24.). [Dkt. #223, at 4]. That’s wrong, or at least is has nothing to do with Parilla’s deposition testimony. All she said was: That field is a BLOB and it looks like a bunch of hex. . . . We have seen that, yes, that there is something in that field which would have been what comes from the Lumidigm, but we never use it so I don't know why it's there. . . . Both pieces of data come from the original registration event and . . . are sent to the database. After that, the only thing that happens with what's in the database is for when a driver comes to the lane we bring back -- because they tell us their CDL, we -- is the only way we can find what record to bring back and send to the Lumidigm device for it to do its live comparison. [Dkt. #223-2, Tr., at 189, 191]. There is absolutely nothing in that testimony about whether the “BLOB” can be “rendered into a fingerprint.” In fact, since there is code that can convert the 9 fingerprint image into what “looks like a bunch of hex” but is readable by a computer, there is very likely code that can convert that hex back to a fingerprint image useful to a human eye, if anyone wanted to do that. As already indicated, the “bunch of hex” from the initial scan has to somehow be compared

to each subsequent scan. The defendant is rather vague about how that happens, perhaps necessarily so: When a registered driver is subsequently accessing a Union Pacific intermodal facility, they enter their CDL number, and the Template BIN data is sent from Union Pacific’s AGS database to the sensor device, “so that it can do an active comparison while the driver has the finger on the scanner that’s on the kiosk.” (Id. at 193:13-15). The subsequent comparison is an instantaneous live match – no new finger-sensor data is created, and no new data is retained. There is “no new [finger-scan] data generated and sent to the system.” (Id. at 193:21-23; 194:7-10). [Dkt. #223, at 6]. But, again, the key is how is that “active comparison” or “live match” done? Surely, the subsequent scan has to be converted into something the computer can use to compare to the “bunch of hex” it already has. How that happens will likely be an issue for summary judgment or trial, but what we do know now is that neither the defendant nor the witness the defendant is relying on knows how the comparison is made. Importantly, for our purposes here, Parilla never claimed to know how the scanning and comparing worked. In fact, at the October 25th deposition, Parilla testified again and again that she had no idea how the scanning and comparison worked: [Scoring is] the activity that's done inside the Lumidigm device where it is comparing what is -- was, you know, the -- the previous data that it provided to us and we're giving it back, and it's comparing that to the person who's actively at the scanner and seeing if that's reasonably the same person. As to how it does that comparison, I don't have the details of that. That's done on the device inside of their proprietary software, and I could not speak to how that logic works or that algorithm works. [Dkt. #219-1, Tr. 169(emphasis added)]. 10 * * * That's the finger scanner. So it's telling them to put their finger there until they see the light turn and then that will tell them that it's done. So the driver or the user, whoever it is, puts their finger on the scanner. The device does whatever it does behind the scenes . . . . [Dkt. #219-1, Tr. 187-88(emphasis added)]. * * *

So they -- they enter their CDL and then we tell -- the kiosk says, okay, now place your finger on the scanner. And they enter their CDL and then we tell -- the kiosk says, okay, now place your finger on the scanner. And they're leaving their finger there until they are told, yeah, you're good, or, no, please wait for assistance, because then we got to get somebody involved. . . . Whatever algorithms they're doing behind the scenes we are not privy to. I don't understand or know or we don't know. There's just a score that's provided to us. [Dkt. #219-1, Tr. 193-94(emphasis added)]. . . . the algorithm inside the device generates a piece of data that is then fed back to the same device to do a comparison. And the fact that there is nothing we can do with that data outside of the use of the device and it doesn't look like anything to us, it's -- I don't understand it. It's to be code used by Lumidigm. [Dkt. #219-1, Tr. 255 (emphasis added)]. So, just like Parilla, we don’t know how the comparison is made each time. We can’t rule out that subsequent scans “collect” the fingerprint, for however long, to convert it into something to be compared to the “bunch of hex” already on file. At bottom, given Parilla’s repeated testimony that she didn’t know how the scanning and comparison worked, what the Illinois Supreme court said in Cothron applies here, at least for the time being and at least in the context of a discovery motion as opposed to a substantive motion: “Defendant fails to explain how such a system could work without collecting or capturing the fingerprint every time the [trucker] needs to access [defendant’s facilities].” 466 Ill.Dec. at 89, 216 N.E.3d at 922. III. Accordingly, the plaintiff’s motion is granted, and the defendant shall produce data as to each time a trucker used a scanner at one of the defendant’s Illinois gates. The pertinent data are 11 scans, not “visits” as the plaintiff seems to suggest. [Dkt. #201, at 6]. The data shall be produced by February 5, 2024. And while an award of legal fees under Rule 37(a)(5) is intended to discourage captious objections to discovery, an award of legal fees is not always mandatory. See Rule 37(a)(5)(i) and (iit). “Fee shifting when the judge must rule on discovery disputes encourages their voluntary resolution and curtails the ability of litigants to use legal processes to heap detriments on adversaries (or third parties) without regard to the merits of the claims." (Parenthesis in original). Rickels v. City of South Bend, Indiana, 33 F.3d 785, 786-87 (7th Cir. 1994). However, Rule 37(a)(5) does not deprive a judge of discretion in adjudicating requests for fees under Rule 37. Moreover, I exercise my broad discretion in deciding whether fees are appropriate in a particular case. See Am. Kitchen Delights, Inc. v. City of Harvey, No. 22 CV 3549, 2023 WL 5431350, at *5 (N.D. Ill. Aug. 23, 2023)(“Courts are afforded broad discretion in deciding if fees are warranted under Rule 37(a)(5).”); Belcastro v. United Airlines, Inc., No. 17 C 1682, 2019 WL 1651709, at *15 (N.D. IIL. Apr. 17, 2019)(“Like their authority in supervising discovery, courts have broad discretion in deciding if fees are warranted under Rule 37(a)(5).”); Trustees of Chicago Reg'l Council of Carpenters Pension Fund v. Drive Constr., Inc., No. 1:19-CV-2965, 2022 WL 16635553, at *5 (N.D. Ill. Nov. 2, 2022)(“Whether the imposition of sanctions would be “unjust” is determined within the broad discretion of the district court.”). The technology involved in the discovery issues in this case involves a developing area of law, and the defendant was substantially justified in opposing the nares and in seeking a definitive ruling on the per-scan damages question fyom she cist, Zou, Fed.R.Civ.P. 37(a)(5)(A)(ii), (11). :

ENTERED: UNITED STATES MAGISTRATE JUDGE DATE: 12/13/23