BU RSPR FISHER
1330 AVE. OF THE AMERICAS MAX S. ROBERTS 32ND FLOOR "Fel: 646.837.7408 NEW YORK, NY 10019 Fax: 212.989.9163 www.bursor.com mroberts@bursor.com October 25, 2023 Via ECF The Honorable Kenneth M. Karas The Hon. Charles L. Brieant Jr. Federal Building and United States Courthouse 300 Quarropas Street, Courtroom 521 White Plains, NY 10601 Re: Hoskin v. PepsiCo, Inc., Case No. 7:23-cv-06413 Dear Judge Karas: We represent Plaintiff William Hoskin (“Plaintiff”) in the above matter. Pursuant to Rule I.A. of the Court’s Individual Rules, we write to respond to Defendant PepsiCo, Inc.’s (“Pepsi” or “Defendant”) October 23, 2023 pre-motion letter regarding Defendant’s anticipated motion to dismiss (ECF No. 19) (the “PML”). Plaintiff does not intend to amend his Complaint and Defendant’s anticipated motion to dismiss should be denied. First, Defendant argues Plaintiff lacks standing under Article III because “Hoskin alleges only bare violations of his statutorily protected right to privacy in his biometrics.” PML at 2 (cleaned up). Not so. Plaintiff alleges Defendant collected his biometrics without consent in violation of Section 15(b) of Iinois’ Biometric Information Privacy Act, 740 ILCS 14/15 (the “BIPA”), and that Defendant failed to create a retention schedule and delete Plaintiffs’ biometrics following the end of his employment in violation of Section 15(a) of the BIPA. See, e.g., Compl. 51-54. Courts have consistently held that such violations meet the requirements for Article III standing. See, e.g., Bryant v. Compass Group USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020) (failure to procure consent “is a concrete injury-in-fact that is particularized to Bryant” and “meets the requirements for Article III standing on her section 15(b) claim”); Fox v. Dakkota Integrated Systems, LLC, 980 F.3d 1146, 1155 (7th Cir. 2020) (finding Article II] standing for Section 15(a) claim because “an unlawful retention of a person’s biometric data is as concrete and particularized an injury as an unlawful collection of a person’s biometric data”) (emphasis in original); Patel v. Facebook Inc., 932 F.3d 1264, 1274 (9th Cir. 2019) (violation of BIPA §§ 15(a) and 15(b) is “a concrete injury-in-fact sufficient to confer Article III standing”). Defendant principally relies on a non-binding opinion, Santana v. Take-Two Interactive Software, Inc., 717 F. App’x 12 (2d Cir. 2017). However, unlike here, the plaintiff in Santana “had already given as much consent as one could imagine,” including “by agreeing to the scan of his face.” Bryant, 958 F.3d at 623 (emphasis added) (distinguishing Santana). Thus, unlike here, there was no violation of the consent requirements of BIPA § 15(b). Further, Santana predates the Illinois Supreme Court’s decision in Rosenbach v. Six Flags Entertainment Corp., 129 N.E.3d 1197 (ll. 2019), which crystallized that “when a private entity fails to adhere to the statutory
BURSOR&XFISHER Pace 2
procedures ... the right of the individual to maintain his or her biometric privacy vanishes into thin air. ... The injury is real and significant.” Jd at 1206 (cleaned up). Defendant’s citation to TransUnion LLC v. Ramirez, 141 S. Ct. 2190 (2021) is inapposite, as that case dealt with violations of the Fair Credit Reporting Act, which is akin to the tort of defamation. By contrast, BIPA is analogous to the tort of invasion of privacy or intrusion upon seclusion, the violation of which confers Article III standing. See, e.g., Mastel vy. Miniclip SA, 549 F. Supp. 3d 1129, 1139 (E.D. Cal. 2021) (distinguishing TransUnion). Defendant also relies on Biener v. Credit Control Servs., Inc., 2023 WL 2504733 (S.D.N.Y. Mar. 14, 2023). However, that case involved the risk of future harm under the Fair Debt Collection Practices Act. Jd, at *7. Here, Plaintiff’s harm has already materialized—his privacy has been invaded. Further, the Second Circuit recently held that “the risk of future harm occasioned by the exposure of [] PII” was sufficient for Article III standing. Bohnak v. Marsh & McLennan Cos., 79 F.4th 276, 286 (2d Cir. 2023). Second, Defendant contends Plaintiff's BIPA claims are preempted by the Labor Management Relates Act. Specifically, Defendant argues “Hoskin’s employment was governed by a collective bargaining agreement. The agreement includes a broad management-rights provision and exclusive grievance and arbitration procedures.” PML at 3. But as the party invoking preemption, Defendant bears the burden of proof. See Jackson-Mau v. Walgreen Co., 2022 WL 2541091, at *1 (E.D.N.Y. July 7, 2022). And Defendant failed to attach the Collective Bargaining Agreement to the PML, let alone a copy of the agreement signed by Plaintiff or facts suggesting Plaintiff saw or was subject to the agreement. Without presenting evidence that Plaintiff actually signed, saw, or was subject to any sort of Collective Bargaining Agreement, Defendant cannot make use of the defense. Cf Jackson v. Amazon.com, Inc., 65 F.4th 1093, 1099 (9th Cir. 2023) (denying motion to compel arbitration where defendant failed to “provide the court with a copy or description of any such notice” allegedly sent to the plaintiff). It is also not surprising Defendant has no evidence Plaintiff signed any sort of Collective Bargaining Agreement. This is because Plaintiff was not even a member of any union at Pepsi. Plaintiff was not subject to the Collective Bargaining Agreement Defendant references in the PML, and his claims cannot be preempted by the Labor Management Relates Act as such. Third, Defendant contends Plaintiff has not stated a violation of BIPA because “Hoskin’s complaint ... does not plausibly allege that what is collected by the Vocollect system is a voiceprint or information [] based on a voiceprint used to identify him.” PML at 3 (cleaned up). This is wrong. BIPA defines “biometric identifier” as, among other things, a “voiceprint.” 740 ILCS 14/10. A “voiceprint” is “an individually distinct pattern of certain voice characteristics spectrographically produced.” VOICEPRINT, MERRIAM WEBSTER.’ However, as several courts have held, there is no requirement that a biometric identifier actually identify a person. Colombo v. YouTube, LLC, 2023 WL 4240226, at *3 (N.D. Cal. June 28, 2023) (“In YouTube’s view, biometric identifiers must identify a person and biometric information must actually be used to identify a person. ... This point is not well taken.”); Melzer v. Johnson & Johnson Consumer □□□□ □ 2023 WL 3098633, at *3 (D.N.J. Apr. 26, 2023) (“[T]he plain meaning of ‘biometric identifiers’ : https://www.merriam-webster.com/dictionary/voiceprint.
BURSOR&XFISHER PaGE 3
under BIPA does not require that they be used to identify an individual.”); Lewis v. Maverick Transportation LLC, 2023 WL 4181242, at *2 (S.D. Ill. June 26, 2023) (“[T]he Court finds that BIPA does not require Lewis to plead that the data collected by Lytx is used to identify him.”). And here, Plaintiff alleges Pepsi possessed and collected his voiceprint (a biometric identifier) because it collected an individually distinct pattern of his voice characteristics. Compl. ff 24-30, 46-47. Further, Plaintiff also alleges his voiceprint was used to identify him. Compl. §{ 47, 49. Thus, his voiceprint also constitutes “biometric information,” which unlike a biometric identifier, does require the information be used to identify Plaintiff. 740 ILCS 14/10. Finally, Defendant argues Plaintiff's BIPA claims are “untimely” because “Hoskin alleges that he was asked to create a voiceprint ... in July 2010,” and bringing suit in 2023 is beyond the five-year statute of limitations for BIPA claims. PML at 3.
Free access — add to your briefcase to read the full text and ask questions with AI
BU RSPR FISHER
1330 AVE. OF THE AMERICAS MAX S. ROBERTS 32ND FLOOR "Fel: 646.837.7408 NEW YORK, NY 10019 Fax: 212.989.9163 www.bursor.com mroberts@bursor.com October 25, 2023 Via ECF The Honorable Kenneth M. Karas The Hon. Charles L. Brieant Jr. Federal Building and United States Courthouse 300 Quarropas Street, Courtroom 521 White Plains, NY 10601 Re: Hoskin v. PepsiCo, Inc., Case No. 7:23-cv-06413 Dear Judge Karas: We represent Plaintiff William Hoskin (“Plaintiff”) in the above matter. Pursuant to Rule I.A. of the Court’s Individual Rules, we write to respond to Defendant PepsiCo, Inc.’s (“Pepsi” or “Defendant”) October 23, 2023 pre-motion letter regarding Defendant’s anticipated motion to dismiss (ECF No. 19) (the “PML”). Plaintiff does not intend to amend his Complaint and Defendant’s anticipated motion to dismiss should be denied. First, Defendant argues Plaintiff lacks standing under Article III because “Hoskin alleges only bare violations of his statutorily protected right to privacy in his biometrics.” PML at 2 (cleaned up). Not so. Plaintiff alleges Defendant collected his biometrics without consent in violation of Section 15(b) of Iinois’ Biometric Information Privacy Act, 740 ILCS 14/15 (the “BIPA”), and that Defendant failed to create a retention schedule and delete Plaintiffs’ biometrics following the end of his employment in violation of Section 15(a) of the BIPA. See, e.g., Compl. 51-54. Courts have consistently held that such violations meet the requirements for Article III standing. See, e.g., Bryant v. Compass Group USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020) (failure to procure consent “is a concrete injury-in-fact that is particularized to Bryant” and “meets the requirements for Article III standing on her section 15(b) claim”); Fox v. Dakkota Integrated Systems, LLC, 980 F.3d 1146, 1155 (7th Cir. 2020) (finding Article II] standing for Section 15(a) claim because “an unlawful retention of a person’s biometric data is as concrete and particularized an injury as an unlawful collection of a person’s biometric data”) (emphasis in original); Patel v. Facebook Inc., 932 F.3d 1264, 1274 (9th Cir. 2019) (violation of BIPA §§ 15(a) and 15(b) is “a concrete injury-in-fact sufficient to confer Article III standing”). Defendant principally relies on a non-binding opinion, Santana v. Take-Two Interactive Software, Inc., 717 F. App’x 12 (2d Cir. 2017). However, unlike here, the plaintiff in Santana “had already given as much consent as one could imagine,” including “by agreeing to the scan of his face.” Bryant, 958 F.3d at 623 (emphasis added) (distinguishing Santana). Thus, unlike here, there was no violation of the consent requirements of BIPA § 15(b). Further, Santana predates the Illinois Supreme Court’s decision in Rosenbach v. Six Flags Entertainment Corp., 129 N.E.3d 1197 (ll. 2019), which crystallized that “when a private entity fails to adhere to the statutory
BURSOR&XFISHER Pace 2
procedures ... the right of the individual to maintain his or her biometric privacy vanishes into thin air. ... The injury is real and significant.” Jd at 1206 (cleaned up). Defendant’s citation to TransUnion LLC v. Ramirez, 141 S. Ct. 2190 (2021) is inapposite, as that case dealt with violations of the Fair Credit Reporting Act, which is akin to the tort of defamation. By contrast, BIPA is analogous to the tort of invasion of privacy or intrusion upon seclusion, the violation of which confers Article III standing. See, e.g., Mastel vy. Miniclip SA, 549 F. Supp. 3d 1129, 1139 (E.D. Cal. 2021) (distinguishing TransUnion). Defendant also relies on Biener v. Credit Control Servs., Inc., 2023 WL 2504733 (S.D.N.Y. Mar. 14, 2023). However, that case involved the risk of future harm under the Fair Debt Collection Practices Act. Jd, at *7. Here, Plaintiff’s harm has already materialized—his privacy has been invaded. Further, the Second Circuit recently held that “the risk of future harm occasioned by the exposure of [] PII” was sufficient for Article III standing. Bohnak v. Marsh & McLennan Cos., 79 F.4th 276, 286 (2d Cir. 2023). Second, Defendant contends Plaintiff's BIPA claims are preempted by the Labor Management Relates Act. Specifically, Defendant argues “Hoskin’s employment was governed by a collective bargaining agreement. The agreement includes a broad management-rights provision and exclusive grievance and arbitration procedures.” PML at 3. But as the party invoking preemption, Defendant bears the burden of proof. See Jackson-Mau v. Walgreen Co., 2022 WL 2541091, at *1 (E.D.N.Y. July 7, 2022). And Defendant failed to attach the Collective Bargaining Agreement to the PML, let alone a copy of the agreement signed by Plaintiff or facts suggesting Plaintiff saw or was subject to the agreement. Without presenting evidence that Plaintiff actually signed, saw, or was subject to any sort of Collective Bargaining Agreement, Defendant cannot make use of the defense. Cf Jackson v. Amazon.com, Inc., 65 F.4th 1093, 1099 (9th Cir. 2023) (denying motion to compel arbitration where defendant failed to “provide the court with a copy or description of any such notice” allegedly sent to the plaintiff). It is also not surprising Defendant has no evidence Plaintiff signed any sort of Collective Bargaining Agreement. This is because Plaintiff was not even a member of any union at Pepsi. Plaintiff was not subject to the Collective Bargaining Agreement Defendant references in the PML, and his claims cannot be preempted by the Labor Management Relates Act as such. Third, Defendant contends Plaintiff has not stated a violation of BIPA because “Hoskin’s complaint ... does not plausibly allege that what is collected by the Vocollect system is a voiceprint or information [] based on a voiceprint used to identify him.” PML at 3 (cleaned up). This is wrong. BIPA defines “biometric identifier” as, among other things, a “voiceprint.” 740 ILCS 14/10. A “voiceprint” is “an individually distinct pattern of certain voice characteristics spectrographically produced.” VOICEPRINT, MERRIAM WEBSTER.’ However, as several courts have held, there is no requirement that a biometric identifier actually identify a person. Colombo v. YouTube, LLC, 2023 WL 4240226, at *3 (N.D. Cal. June 28, 2023) (“In YouTube’s view, biometric identifiers must identify a person and biometric information must actually be used to identify a person. ... This point is not well taken.”); Melzer v. Johnson & Johnson Consumer □□□□ □ 2023 WL 3098633, at *3 (D.N.J. Apr. 26, 2023) (“[T]he plain meaning of ‘biometric identifiers’ : https://www.merriam-webster.com/dictionary/voiceprint.
BURSOR&XFISHER PaGE 3
under BIPA does not require that they be used to identify an individual.”); Lewis v. Maverick Transportation LLC, 2023 WL 4181242, at *2 (S.D. Ill. June 26, 2023) (“[T]he Court finds that BIPA does not require Lewis to plead that the data collected by Lytx is used to identify him.”). And here, Plaintiff alleges Pepsi possessed and collected his voiceprint (a biometric identifier) because it collected an individually distinct pattern of his voice characteristics. Compl. ff 24-30, 46-47. Further, Plaintiff also alleges his voiceprint was used to identify him. Compl. §{ 47, 49. Thus, his voiceprint also constitutes “biometric information,” which unlike a biometric identifier, does require the information be used to identify Plaintiff. 740 ILCS 14/10. Finally, Defendant argues Plaintiff's BIPA claims are “untimely” because “Hoskin alleges that he was asked to create a voiceprint ... in July 2010,” and bringing suit in 2023 is beyond the five-year statute of limitations for BIPA claims. PML at 3. Defendant’s argument is meritless. Essentially, Defendant is arguing that Plaintiff's BIPA § 15(b) claim accrued only once at the beginning of his employment. The Illinois Supreme Court rejected that interpretation of BIPA § 15(b) earlier this year, finding “a claim accrues under [Section 15(b) of] the Act with every scan or transmission of biometric identifiers or biometric information without prior informed consent.” Cothron v. White Castle System, Inc., 216 N.E.3d 918, 926 (Ill. 2023) (emphasis added). Here, Plaintiff alleges he “was required to use his voiceprint to check in and out of work each day, as well as to receive and conduct assignments.” Compl. 50. In other words, Defendant violated BIPA § 15(b) each and every day through August 2018 by having Plaintiff clock into work using his voiceprint. Cothron, 216 N.E.3d at 925 (“[T]he plain language of section 15(b) establishes that it applies to each and every capture and use of plaintiff's fingerprint or hand scan.”) (cleaned up). Thus, the last violation of BIPA § 15(b) occurred in August 2018, and Plaintiff's claim was brought within five years of that violation. Plaintiffs BIPA § 15(a) claim is also timely. Defendant continued to violate BIPA § 15(a) by possessing Plaintiff's biometrics without a retention and deletion schedule in place, and Plaintiff brought suit within five years of the end of his employment. Further, Plaintiff's 15(a) claim concerning Defendant’s failure to delete his biometrics after his employment ended could not even accrue until at least August 2018 (when Plaintiff's employment ended), because Defendant would not have an obligation to comply with any sort of deletion schedule until “the initial purpose for collecting or obtaining such identifiers or information” was satisfied (i.e., the end of Plaintiff's employment). 740 ILCS 14/15(a); contra Horn v. Method Prods., PBC, 2022 WL 1090887, at *4 (N.D. Ill. Apr. 12, 2022) (“[U]ntil those three years pass, any argument that Method did not comply with § 15(a)’s destruction requirement is not ripe.”). The Court will convert the 11/2/23 Rule 26 Respectfully submitted, conference into a pre-motion conference to discuss the merits (or lack thereof) of IBM’s 0 putative Motion to Dismiss. iikeS, Rabere o Ordered. Attorney for Plaintiff 10/26/23 CC: All Counsel of Record (via ECF)