Garner v. Buzz Finco LLC

• Court: District Court, N.D. Illinois
• Decided: April 11, 2022
• Docket: 3:21-cv-50457
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS WESTERN DIVISION

Timothy Garner, individually and on behalf of similarly situated individuals,

Plaintiff, Case No. 3:21-cv-50457

v. Honorable Iain D. Johnston

Buzz Finco LLC, and Buzz Bidco LLC,

Defendants.

MEMORANDUM OPINION AND ORDER Plaintiff Timothy Garner brings this action under the Illinois Biometric Information Privacy Act (BIPA) individually and on behalf of a putative class. He originally filed this action in the Circuit Court of the Seventeenth Judicial Circuit, Winnebago County, Illinois. Dkt. 1-1. Defendants Buzz Finco LLC and Buzz Bidco LLC removed the case to this Court invoking federal jurisdiction under the Class Action Fairness Act, 28 U.S.C. § 1332(d). Dkt. 1. Garner now moves the Court to remand pursuant to 28 U.S.C. § 1447(c). In support, he argues that he lacks standing to bring one of his claims in federal court, and so the Court must sever that claim and remand it for lack of subject-matter jurisdiction. For the reasons explained below, the Court holds that Garner’s complaint does not allege an injury in fact in connection with Defendants’ alleged violation of Section 15(a) of the Illinois Biometric Information Privacy Act. Thus, the Court must sever and remand that claim. Article III confines federal courts to adjudicating only cases and controversies in which a plaintiff alleges a personal stake in the outcome of the case. TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2203 (2021). To that end, plaintiffs must allege

that they have standing to bring each individual claim in federal court. Id. at 2208 (explaining that “plaintiffs must demonstrate standing for each claim that they press and for each form of relief that they seek”). To determine whether a plaintiff’s allegations confer Article III standing, federal courts determine whether the plaintiff has alleged an injury in fact, that is fairly traceable to the defendant’s allegedly wrongful conduct, and that the relief sought is likely to redress the harm

the defendant allegedly caused. Lujan v. Def’s of Wildlife, 504 U.S. 555, 560–61 (1992). The question presented in this case is whether Garner has sufficiently alleged an injury in fact. An injury in fact is “an invasion of a legally protected interest” that is both concrete and particularized, as well as “actual or imminent, not conjectural or hypothetical.” Spokeo, Inc. v. Robins, 578 U.S. 330, 339 (2016). For an injury to be particularized, it “must affect the plaintiff in a personal and individual way.” Id.

Two types of challenges to Article III standing exist. First, a facial attack “tests whether the allegations, taken as true, support an inference that the elements of standing exist.” Prairie Rivers Network v. Dynegy Midwest Generation, LLC, 2 F.4th 1002, 1007 (7th Cir. 2021) (quoting Apex Digital, Inc. v. Sears, Roebuck & Co., 572 F.3d 440, 443 (7th Cir. 2009)). Second, a factual attack tests the actual existence of standing in fact, which may involve a limited evidentiary hearing. Id.; Gaetano v. United States, 994 F.3d 501, 505 (6th Cir. 2021 (discussing that factual attacks may involve affidavits and documents, as well as limited evidentiary hearings). In this case, Garner brings only a facial challenge to his own

standing. Indeed, his motion to remand repeatedly refers to his allegations, rather than to evidence. Dkt. 11. Thus, because Garner brings a facial challenge, the Court must accept the allegations in his state court complaint as true and determine whether those allegations plausibly allege that he has Article III standing to sue in federal court. Spuhler v. State Collection Servs., 983 F.3d 282, 285 (7th Cir. 2020). Defendants have a statutory right to remove cases from state to federal court

if that case could have originally been filed in federal court. 28 U.S.C. § 1441(a). Still, doubts about the propriety of removal should be resolved in favor of the plaintiff’s chosen forum. Morris v. Nuzzo, 718 F.3d 660, 668 (7th Cir. 2013). Because the defendants in a removed action chose to invoke federal jurisdiction, they bear the burden of establishing the federal court’s jurisdiction, including the plaintiff’s Article III standing to sue in federal court. Collier v. SP Plus Corp., 889 F.3d 894, 896 (7th Cir. 2018) (“As the party invoking federal jurisdiction, SP Plus had to

establish that all elements of jurisdiction—including Article III standing—existed at the time of removal.”). If the defendant fails to meet its burden, then the Court must remand the action to the appropriate state court. 28 U.S.C. § 1447(c). Though the Court is most often presented with plaintiffs attempting to establish their own standing, the Court is now faced with a role reversal “with the defendant[s] insisting that Article III standing is solid, and the plaintiff casting doubt on it.” Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 620 (7th Cir. 2020). Because Garner alleges that Defendants invaded his rights established under BIPA, the Court begins with an introduction to that statute.

The State of Illinois enacted BIPA, 740 ILCS 14/1 et seq., in part because of its concern that once biometric data are compromised, the affected individual lacks recourse because the data are unique to the person and cannot be changed. Id. § 14/5(c). Thus, Illinois believes the misuse of that data presents a “heightened risk for identity theft” that could cause Illinois consumers to be more “likely to withdraw from biometric-facilitated transactions.” Id. Section 15(a) of BIPA requires that

private entities develop and publish to the public a written policy “establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining [it] has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever occurs first.” Section 15(b) prevents private entities from collecting or otherwise receiving biometric identifiers or information unless they first inform the subject in writing that the subject’s data is being collected or stored,

section 15(b)(1); inform the subject in writing of “the specific purpose and the length of term for which” the data are being collect, stored, and used, section 15(b)(2); and receive the subject’s written informed consent to proceed, section 15(b)(3). Garner alleges that Defendants own and operate a dating service known as Badoo that, during the relevant time, offered a lookalike feature that used facial recognition technology.1 Users would upload photos, which could contain images of themselves as well as other people. Those photos were then scanned with Badoo’s facial recognition software. The data collected was then allegedly used to allow

users to find other people on the dating app that looked like people in the uploaded photos. Garner alleges that he signed up with Badoo and uploaded his photo before the company deployed the lookalike feature. Notwithstanding the timing of his decision to join the app, he alleges that Defendants later scanned all his uploaded images for his facial geometry once they implemented the lookalike feature. He contends that Defendants never obtained his written consent to scan his biometric

facial geometry. He further alleges that Defendants failed to inform him of the purpose of their use of his facial geometry, that they failed to inform him how long they would keep the information, and (most relevant to this motion) that they failed to make a data retention schedule publicly available, as required by BIPA. In his motion to remand, Garner contends that his claim under section 15(a) only alleges a violation of a duty to the public at large—that Defendants failed to develop a retention policy and publish it to the public. Thus, Garner concludes, his

section 15(a) claim must be severed from his section 15(b) claim and remanded to state court. Dkt. 11, at 2. Defendants respond that Garner’s complaint alleges more than a mere failure to publish a retention policy to the public. Defendants contend that Garner’s allegations claim a failure to comply with a data retention policy because Garner seeks an order requiring Defendants to delete retained data.

1 The allegations recited here are taken from Garner’s state court complaint. Dkt. 1-1. Because Garner seeks that deletion, he necessarily alleges that Defendants kept data past its usefulness because the lookalike feature was discontinued in 2020. If true, Defendants contend, such retention would amount to an injury in fact. Dkt. 23,

at 8. The Seventh Circuit has addressed Article III standing in the BIPA context on several occasions recently. Two of those cases are particularly important here. First, in Bryant v. Compass Group USA, Inc., the court held that Bryant, the plaintiff, had suffered an injury in fact under section 15(b), but she had not suffered an injury in fact under section 15(a). 958 F.3d 617, 626 (7th Cir. 2020). The court

explained that unlike the duty explained in section 15(b), the duty in section 15(a) to disclose a retention schedule is owed to the public at large, instead of “to particular persons whose biometric information the entity collects.” Id. Because Bryant had not alleged any harm particularized to her stemming from the alleged failure to publicly disclose a retention schedule, she had suffered no injury in fact. Id. Then, in Fox v. Dakkota Integrated Systems, LLC, the Seventh Circuit explained that its holding in Bryant was narrow and did not address the full scope of section

15(a). 980 F.3d 1146, 1154 (7th Cir. 2020). The court distinguished Fox’s alleged injury with that of Bryant and explained that Fox accused Dakkota of “violating the full range of its section 15(a) duties by failing to develop, publicly disclose, and comply with a data-retention schedule and guidelines for the permanent destruction of biometric data when the initial purpose for collections ends.” Id. (emphasis in original). In making this distinction, the court clarified that section 15(a) protects against alleged “unlawful retention” of biometric identifiers and information, whereas section 15(b) implements an “informed-consent regime” that protects against “unlawful collection.” Id. at 1154–55.

In this case, Garner has not alleged an injury in fact under section 15(a). Importantly, he brings this action individually and on behalf of a putative class. Furthermore, he undisputedly has alleged an injury in fact under section 15(b), only his section 15(a) claim is at issue. Garner alleges that “[d]espite possessing Plaintiff’s and Class members’ biometric identifiers in the form of scans of their facial geometries, Defendants have never made publicly available any biometric

retention and destruction schedule.” Dkt. 1-1, ¶ 44. In the section of Garner’s complaint that lists the allegations specific to him, he alleges only that “Badoo has never made publicly available a written retention schedule specifying the period for which it would retain Plaintiff’s faceprint.” Id. ¶ 34. Unlike the allegations in Fox, Garner never alleges that Defendants failed to comply with a data retention schedule. In response, Defendants attempt to locate an inference that they failed to

comply with a data retention schedule by pointing to the relief Garner’s complaint seeks. They point to paragraph nine of the complaint, which in part asks the Court to require Defendants to “destroy the biometric data it unlawfully collected.” Id. ¶ 9. In essence, Defendants contend that Garner’s requested relief means that he alleges not only that Defendants violated the informed-consent regime under section 15(b) but that they also unlawfully retained that collected data in violation of section 15(a). In support, Defendants point to other allegations in the complaint that allege they possessed and stored Garner’s biometric data. Dkt. 23, at 9 (quoting Dkt. 1-1, ¶¶ 43–44, 48). But those allegations are not surprising. They had to have possessed

and stored Garner’s biometric data at some point if they collected it in violation of the informed-consent regime. If that level of possession and storage also amounted to an injury in fact under section 15(a), then plaintiffs would always have an injury in fact under section 15(a) any time they also bring a section 15(b) claim. That can’t be true after Bryant, which addressed allegations under both sections. Bryant, 958 F.3d at 626.

Furthermore, Garner’s requested relief (which he requests on behalf of the putative class) undermines Defendants’ standing argument. The requested relief certainly alleges that Defendants have data in their possession that must be deleted. Defendants ask the Court to recognize that the lookalike feature is no longer in use, and thus any continued retention of that data would necessarily constitute an injury in fact as described in Fox. As they see it, once the feature was discontinued, any retention of the biometric data would have outlived its initial

purpose. 740 ILCS 14/15(a) (providing that private entities must permanently destroy the biometric data at least “when the initial purpose for collecting or obtaining” it has concluded). So, Defendants argue, taking that reasonable inferences as true, the Court must hold that Garner has alleged the unlawful retention of his biometric data because it must have been kept beyond the initial purpose for its collection if it is still in need of permanent destruction. Dkt. 23, at 8. That argument, however, fails to recognize an important rule when addressing standing in class actions. “Standing cannot be acquired through the back door of a class action.” Payton v. County of Kane, 308 F.3d 673, 682 (7th Cir.

2002) (quoting Allee v. Medrano, 416 U.S. 802, 828–29 (1974)). When determining whether a plaintiff in a class action has Article III standing to sue, federal courts must remember that “a named plaintiff cannot acquire standing to sue by bringing his action on behalf of others who suffered injury which would have afforded them standing had they been named plaintiffs; it bears repeating that a person cannot predicate standing on [an] injury which he does not share.” Id.; see also Kohen v.

Pac. Inv. Mgmt. Co. LLC & PIMCO Funds, 571 F.3d 672, 676 (7th Cir. 2009) (“Before a class is certified, it is true, the named plaintiff must have standing, because at that stage no one else has a legally protected interest in maintaining the suit.”) (emphasis in original). In seeking injunctive relief requiring Defendants to delete unlawfully collected data, Garner reasonably implies that Defendants have unlawfully retained the biometric data of some class members. He has not, however, alleged anything to suggest that he is among those aggrieved class members. His

section 15(a) allegations do not allege a particularized injury. Because a putative class representative cannot base Article III standing on injuries that he did not also suffer, Garner’s allegations are insufficient to plausibly allege an injury in fact sufficient to bring his section 15(a) claim in federal court. Thus, because Garner does not have standing to bring his section 15(a) claim in federal court, and because he must have standing for each claim, the Court must sever Garner’s section 15(a) claim and remand it to the Circuit Court for the Seventeenth Judicial Circuit, Winnebago County, Illinois. Garner’s motion for partial remand [11] is granted. Woods v. Fleetpride, Inc., No. 1:21-cv-01093, 2022 U.S. Dist. LEXIS 54763, at *14 (N.D. Ill. March 27, 2022) (severing and remanding a section 15(a) claim for the same reason). Garner’s section 15(b) claims, however, will proceed in this Court.

Date: April 11, 2022 SS. Honorable Iain D. Johnston United States District Judge