UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION
SHARENA KING,
Plaintiff, No. 21 CV 2774 v. Judge Manish S. Shah PEOPLENET CORPORATION,
Defendant.
MEMORANDUM OPINION AND ORDER
Plaintiff Sharena King’s employer required her to clock in and out of work each day using a face scanner. That scanner was part of biometric technology and services that defendant PeopleNet Corporation provided to King’s employer, along with other clients in Illinois. PeopleNet’s scanner collected King’s biometric data and sent it to PeopleNet, which stored and used the information. King sued PeopleNet in state court, alleging violations of § 15(a), (b), and (c) of the Illinois Biometric Information Privacy Act. PeopleNet removed the case to federal court and moves to dismiss for lack of personal jurisdiction and failure to state a claim. King moves to remand two of her three claims. For the reasons discussed below, plaintiff’s motion is granted, and defendant’s motion is denied. I. Legal Standards A defendant can remove a lawsuit filed in state court to federal court if the federal court has original jurisdiction over the dispute. 28 U.S.C. § 1441(a). Federal district courts have original jurisdiction over any class action where at least one plaintiff is diverse from at least one defendant, the amount in controversy exceeds $5 million in the aggregate, and there are 100 or more class members. 28 U.S.C. § 1332(d); Sabrina Travelers Com. Ins. Co., 869 F.3d 568, 578 (7th Cir. 2017)
(citations omitted). The party invoking federal jurisdiction must also prove that Article III standing existed at the time of removal. See Collier v. SP Plus Corp., 889 F.3d 894, 896 (7th Cir. 2018) (citing Lujan v. Def. of Wildlife, 504 U.S. 555, 561 (1992)). If it appears that the court lacks subject-matter jurisdiction over a claim before final judgment, that claim shall be remanded. 28 U.S.C. §§ 1441(c)(2), 1447(c); see Bergquist v. Mann Bracken, LLP, 592 F.3d 816, 819 (7th Cir. 2010) (citations
omitted). Federal Rule of Civil Procedure 12(b)(2) governs dismissals based on lack of personal jurisdiction. A plaintiff need not include facts alleging personal jurisdiction in the complaint, but once a defendant moves to dismiss for lack of personal jurisdiction, the plaintiff bears the burden of establishing it. Curry v. Revolution Lab’ys, LLC, 949 F.3d 385, 392 (7th Cir. 2020) (quoting Purdue Rsch. Found. v. Sanofi-Synthelabo, S.A., 338 F.3d 773, 782 (7th Cir. 2003)). Where the determination
is made solely on the basis of written materials and not an evidentiary hearing, the plaintiff only needs to make a prima facie showing of personal jurisdiction. Matlin v. Spin Master Corp., 921 F.3d 701, 705 (7th Cir. 2019) (citation omitted). I take plaintiff’s asserted facts as true and resolve any factual disputes in her favor. See uBID, Inc. v. GoDaddy Grp., Inc., 623 F.3d 421, 423–24 (7th Cir. 2010) (citations omitted). To survive a motion to dismiss under Rule 12(b)(6), a complaint must state a claim upon which relief may be granted. Fed. R. Civ. P. 12(b)(6). The complaint must contain “sufficient factual matter, accepted as true, to ‘state a claim to relief that is
plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). In reviewing a motion to dismiss, I construe all factual allegations as true and draw all reasonable inferences in plaintiff’s favor. Calderone v. City of Chicago, 979 F.3d 1156, 1161 (7th Cir. 2020) (citing Shipley v. Chicago Bd. Of Election Comm’rs, 947 F.3d 1056, 1060 (7th Cir. 2020)).
II. Background PeopleNet, a Delaware corporation with its principal place of business in Massachusetts, sold time and attendance solutions to Illinois employers. [18-1] ¶¶ 4, 15, 22.1 To perform workforce management services (including timekeeping and work scheduling), PeopleNet supplied its clients with biometric-enabled hardware such as fingerprint and facial recognition scanners. Id. ¶¶ 4–5, 19. The devices captured employee data and transmitted it to defendant’s cloud-based time and attendance
systems, hosted on PeopleNet’s servers. Id. ¶¶ 4–5, 19–20, 25. PeopleNet marketed its devices and software as superior to traditional time clocks, and gained a competitive advantage and made profits from the use of biometric data. Id. ¶ 45.
1 Bracketed numbers refer to entries on the district court docket. Referenced page numbers are taken from the CM/ECF header placed at the top of filings. Facts are taken from the complaint. [18-1]. Beginning in 2006, PeopleNet provided technology and services to Paramount Staffing, an Illinois corporation based in Northbrook, Illinois. [18-1] ¶ 21. Sharena King worked for Paramount in Chicago. Id. ¶ 23. As part of her job, King was required
to clock in and out of shifts using PeopleNet’s face scanner, or timeclock. Id. ¶¶ 24– 25. During each scan, PeopleNet’s device collected King’s biometric identifiers, converted them into an electronic format, and transmitted that information to PeopleNet. Id. ¶ 25. PeopleNet didn’t tell King that her biometrics were being collected and stored, id. ¶ 43, didn’t get informed written consent from King before using her biometrics, id. ¶¶ 26, 43, didn’t provide written disclosures describing why
it was using King’s biometrics or how long the use would last, id., and failed to make a biometric retention or destruction policy publicly available. Id. ¶¶ 26, 41. In addition to King, thousands of other people in Illinois were scanned by PeopleNet’s systems, and defendant collected, stored, transmitted, and disseminated their biometric data. Id. ¶¶ 28, 30. III. Analysis A. Standing: Motion to Remand
Federal courts may resolve only “cases” or “controversies.” U.S. Const. art. III, § 2, cl. 1. Standing doctrine “limits the category of litigants empowered to maintain a lawsuit in federal court” so as to “ensure that federal courts do not exceed their authority” under Article III. Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (citations omitted). The requirements of standing guarantee that the plaintiff has a “personal stake” in the litigation. TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2203 (2021) (quoting Raines v. Byrd, 521 U.S. 811, 819 (1997)). Without that, there’s no Article III case or controversy, and federal courts lack jurisdiction. See id. To establish Article III standing, the party who wants the federal forum must
show “(1) that [the plaintiff] suffered an injury-in-fact that is concrete, particularized, and actual or imminent, (2) that the injury was caused by the defendant, and (3) that the injury would likely be redressed by the requested judicial relief.” Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1244 (7th Cir. 2021) (quoting Thole v. U.S. Bank N.A., 140 S. Ct. 1615, 1618 (2020)). While PeopleNet bears the burden of showing standing in this case, see [1], the court also has an independent obligation to confirm
that it has subject-matter jurisdiction before proceeding to the merits. See Carroll v. Stryker Corp., 658 F.3d 675, 680 (7th Cir. 2011) (citations omitted). King argues that she hasn’t suffered an injury in fact that will support her claims under § 15(a) and (c) of BIPA, 740 ILCS 14/15(a), (c). [18]. An injury in fact that satisfies the requirements of Article III “must be both concrete and particularized.” Thornley, 984 F.3d at 1245–46 (citing Spokeo, 578 U.S. at 340). A legislature can “elevat[e] to the status of legally cognizable injuries concrete, de facto
injuries that were previously inadequate in law,” Spokeo, 578 U.S. at 341 (quoting Lujan v. Def. of Wildlife, 504 U.S. 555, 578 (1992)), but violations of duties “owed to the public generally, not to particular persons,” are not particularized injuries, and cannot be the basis for standing. Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020), as amended on denial of reh’g and reh’g en banc (June 30, 2020); see Thornley, 984 F.3d at 1247. 1. 15(a) Section 15(a) of BIPA requires covered private entities to do two things. 740 ILCS 14/15(a); see Fox v. Dakkota Integrated Sys., 980 F.3d 1146, 1154–55 (7th Cir.
2020). First, they must “develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information.” 740 ILCS 14/15(a). Second, covered private entities must comply with that policy: retain and destroy biometric information in accordance with the law. Id. Because the first of these duties— publishing the policy—is “owed to the public generally, not to particular persons
whose biometric information the entity collects,” a violation of just that part of § 15(a) is not an injury in fact under Article III because the resulting harm is not particularized. Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020); Fox, 980 F.3d at 1154–56. Where a plaintiff has been injured by a defendant’s failure to comply with a policy, however, the resulting “unlawful retention of biometric data inflicts a privacy injury” sufficient to support a plaintiff’s § 15(a) claim in federal court. Fox, 980 F.3d at 1154–56.
The issue here is the precise claim alleged. King argues that she is not suing on the basis of PeopleNet’s unlawful retention of her biometrics, but only alleging that PeopleNet violated § 15(a)’s publication requirement. [18] at 3–6. According to PeopleNet, the complaint alleges violations of all of § 15’s duties. [20] at 7. King is right. She has alleged that PeopleNet violated its duty to publish a policy, and also that defendant retained her biometric information. [18-1]. But plaintiff hasn’t alleged that PeopleNet’s retention of her data was unlawful. See id. The complaint has a conclusory allegation that PeopleNet “[violated King’s] biometric privacy rights under BIPA.” Id. ¶ 10. But the specific claim is that defendant collected
and stored King’s biometrics, id. ¶¶ 4–5, 19–25, but “failed to make publicly available any biometric retention or destruction policy.” Id. ¶ 26. That is only alleging a violation of BIPA’s publication requirement. In order to show injury in fact, at the pleading stage a “plaintiff must ‘clearly ... allege facts demonstrating’ each element.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (quoting Warth v. Seldin, 422 U.S. 490, 518 (1975)). “In other words,
allegations matter.” Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1246 (7th Cir. 2021). King’s general allegations that PeopleNet violated her privacy rights under BIPA, [18-1] ¶¶ 10, 27, and that she was injured by defendant’s conduct, id. at 1, are not allegations that the defendant unlawfully retained her information.2 And an allegation of retention of biometric information, even coupled with a defendant’s failure to publish a policy, is insufficient to state an injury in fact. See Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 619 (7th Cir. 2020) (defendant “was collecting
and storing” plaintiff’s biometric information but plaintiff nonetheless lacked standing for her § 15(a) claim where she only alleged a violation of the duty to publish a policy).3
2 Similarly, just because the complaint recites the full scope of § 15(a)’s requirements, [18-1] ¶ 38, that doesn’t mean King alleged a violation of all parts of the law. 3 The absence of an allegation that PeopleNet’s retention was unlawful distinguishes King’s case from the ones that defendant cites. The plaintiffs in Wordlaw, Kalb, and Marsh had standing for their § 15(a) claims because they alleged that their biometrics were collected by Nothing about how PeopleNet used King’s information was an injury to her rights under § 15(a)’s retention and deletion requirements. King alleged that PeopleNet still maintains control of her biometric information, [18-1] ¶ 40, but she
didn’t claim that defendant had no biometric information policy, that PeopleNet’s purpose for collection had been satisfied, or that she no longer interacted with defendant, and so she hasn’t alleged that defendant violated the retention and deletion requirements of § 15(a). See [18-1]; 740 ILCS 14/15(a). It’s not clear that PeopleNet disseminated King’s information and, even if it did, § 15(a) doesn’t make all dissemination or disclosure unlawful, or in other words, injurious. See 740 ILCS
14/15(a).4 Bryant isn’t distinguishable, either.5 Like this case, Bryant involved a
defendants that had no policy at all, public or private. Wordlaw v. Enter. Leasing Co. of Chicago, LLC, No. 20 CV 3200, 2020 WL 7490414, at *4 (N.D. Ill. Dec. 21, 2020); Kalb v. GardaWorld CashLink LLC, Case No. 1:21-cv-01092, 2021 WL 1668036, at *3–4 (C.D. Ill. April 28, 2021); Marsh v. CSL Plasma Inc., 503 F.Supp.3d 677, 682–83 (N.D. Ill. 2020). Collection or retention without a policy is a particularized harm to a plaintiff. See Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1155 (7th Cir. 2020). King hasn’t alleged that PeopleNet lacked a policy altogether, just that defendant didn’t publish one. See [18-1]. The plaintiffs in Neals, Wilcosky, and Fernandez had standing to bring their § 15(a) claims because they alleged that defendants unlawfully retained their information. Neals v. ParTech, Inc., No. 19-cv-05660, 2021 WL 463100, at *5 (N.D. Ill. Feb. 9, 2021); Wilcosky v. Amazon.com, Inc., 517 F.Supp.3d 751, 761–62 (N.D. Ill. 2021); Fernandez v. Kerry, Inc., No. 17-cv-08971, 2020 WL 7027587, at *7–8 (N.D. Ill. Nov. 30, 2020). King hasn’t done that here. 4 PeopleNet cites Chuluunbat for the proposition that an allegation that information is disseminated supports standing for plaintiff’s BIPA claims, [20] at 11, but that case didn’t involve BIPA and doesn’t support the idea that injuries related to dissemination establish standing for violations of § 15(a). See Chuluunbat v. Experian Info. Sols., Inc., 4 F.4th 562, 566 n.3 (7th Cir. 2021). 5 Defendant says that an injury related to the failure to publish a § 15(a) policy is particularized when the violation occurs in the context of employment, [20] at 11–12, but neither Fox nor Bryant support a special rule for employment cases. See Bryant v. Compass Grp. USA, Inc., 958 F.3d 617 (7th Cir. 2020); Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146 (7th Cir. 2020). And none of the district court cases PeopleNet cites for such an exception found standing based solely on injuries related to a failure to publish a policy. See Cothron v. White Castle Sys., Inc., 467 F.Supp.3d 604, 612 (N.D. Ill. 2020); Figueroa v. Kronos Inc., 454 vendor (rather than an employer) gathering biometric information in a “workplace.” Bryant, 958 F.3d at 619. PeopleNet’s duty to publish a biometric retention policy was owed to the public, not just to employees of the company’s clients. Id. at 626. And a
mere violation of that duty, as alleged here, is not enough to bring a § 15(a) claim in federal court. 2. 15(c) Section 15(c) of BIPA makes it illegal for a corporation in possession of biometric information to “sell, lease, trade, or otherwise profit from” that information. 740 ILCS 14/15(c). As is the case for § 15(a) claims, to show an injury in fact under
§ 15(c), a plaintiff must allege a concrete and particularized injury. See Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1247 (7th Cir. 2021). Standing may exist, for instance, (1) where a collector of biometric data has deprived a plaintiff of the opportunity to profit from her own information; (2) where the sale and dissemination of a plaintiff’s data “amplified the invasion of her privacy that occurred when the data was first collected;” or (3) if a defendant profiting from a plaintiff’s biometric information raises her costs. Id. Where these or other concrete and particularized
harms aren’t shown, however, and a plaintiff alleges “only a general, regulatory violation,” a § 15(c) claim fails in federal court for lack of standing. Id. at 1248–49. According to PeopleNet, the complaint alleges that defendant’s dissemination of King’s data amplified the invasion of her privacy. [20] at 14. But that’s not what
F.Supp.3d 772, 783 (N.D. Ill. 2020); Stauffer v. Innovative Heights Fairview Heights, LLC, 480 F.Supp.3d 888, 899–900 (S.D. Ill. 2020). the complaint says. True, King claims that PeopleNet violated her rights to biometric privacy, [18-1] ¶¶ 10, 27, and that defendant transmitted her biometric information from its devices back to PeopleNet or its servers in order to provide services for King’s
employer. Id. ¶¶ 25, 40. The complaint may also allege some level of dissemination of King’s information from PeopleNet to plaintiff’s employer. See [18-1]. But King nowhere alleges that PeopleNet sold her data or that the transmission or dissemination of her biometric information amplified the invasion of her privacy. Id. What the complaint does say is that PeopleNet profits through the use of King’s biometrics because it “markets its biometric time clocks and associated software to
employers as superior options” and thereby gains “a competitive advantage over other timekeeping vendors and secures profits from its use of biometric data.” [18-1] ¶ 45. That King alleged actual (not just statutory) injury, id. at 1, where the Thornley plaintiff did not, doesn’t change the analysis. See Collier v. SP Plus Corp., 889 F.3d 894, 896 (7th Cir. 2018) (citations omitted) (“actual damages” are not magic words that automatically allege an injury in fact). A broad allegation of injury or a violation of privacy isn’t enough under Article III. The question here is whether King
has alleged a concrete and particularized harm caused by PeopleNet’s profiting off her biometric information. See Thornley, 984 F.3d at 1247. She hasn’t. PeopleNet’s competitive advantage in the biometric timekeeping marketplace isn’t an injury particular to King. The complaint doesn’t allege an injury in fact stemming from PeopleNet’s profiting off of King’s biometric data, and so her claim under § 15(c) of BIPA doesn’t belong in this court, either. Plaintiff’s motion to remand, [18], is granted. King’s claims under BIPA § 15(a) and (c) are severed and remanded. See Bergquist v. Mann Bracken, LLP, 592 F.3d 816, 819 (7th Cir. 2010) (“If some parts of a single suit are within federal jurisdiction,
while others are not, then the federal court must resolve the elements within federal jurisdiction and remand the rest.”). B. Personal Jurisdiction One of plaintiff’s three claims remains: this one for a violation of § 15(b) of BIPA.6 By challenging this court’s personal jurisdiction, PeopleNet argues that it shouldn’t have to defend that claim in Illinois.
When a federal court sits in diversity, the court exercises personal jurisdiction to the same extent as a state court. Philos Techs., Inc. v. Philos & D, Inc., 645 F.3d 851, 855 n.2 (7th Cir. 2011). The Illinois long-arm statute permits jurisdiction to the same limits as the Due Process Clause. See Curry v. Revolution Lab’ys, LLC, 949 F.3d 385, 393 (7th Cir. 2020); 735 ILCS 5/2-209(c). The Due Process Clause allows personal jurisdiction over an out-of-state defendant if the defendant has “certain minimum contacts with [the state] such that the maintenance of the suit does not offend
‘traditional notions of fair play and substantial justice.’” Kipp v. Ski Enter. Corp. of
6 The court has subject-matter jurisdiction over King’s § 15(b) claim. King has asserted a violation of her own rights—her biometrics, her private information—which is enough to demonstrate injury in fact under § 15(b). See Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 624 (7th Cir. 2020). The complaint indicates that PeopleNet caused that injury, which could be adequately remedied by this court. See [18-1]. King therefore has Article III standing to bring this claim. PeopleNet has shown that diversity jurisdiction exists under the Class Action Fairness Act because King is a citizen of Illinois, PeopleNet is a citizen of Delaware and Massachusetts, the amount in controversy exceeds $5 million, and plaintiff seeks to represent a class in excess of 100 members. [1] ¶¶ 11, 14–15, 19; 28 U.S.C. § 1332(d). Wisconsin, 783 F.3d 695, 697 (7th Cir. 2015) (quoting Int’l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945)). “There are two types of personal jurisdiction: general and specific.” J.S.T. Corp. v. Foxconn Interconnect Tech. Ltd., 965 F.3d 571, 575 (7th Cir.
2020). King argues that this court has specific jurisdiction over PeopleNet. [21] at 5– 9.7 Specific jurisdiction is about “the relationship among the defendant, the forum, and the litigation.” Walden v. Fiore, 571 U.S. 277, 284 (2014) (quoting Keeton v. Hustler Mag., Inc., 465 U.S. 770, 775 (1984)). The defendant’s contacts with the forum state must “directly relate to the challenged conduct or transaction.” Matlin v. Spin
Master Corp., 921 F.3d 701, 705 (7th Cir. 2019) (quoting Tamburo v. Dworkin, 601 F.3d 693, 702 (7th Cir. 2010)). For this court to exercise specific personal jurisdiction over PeopleNet, the corporation’s contacts with Illinois must show that PeopleNet purposefully availed itself of the privilege of conducting business here; King’s injury must have arisen out of defendant’s forum-related activities; and any exercise of jurisdiction must comport with traditional notions of fair play and substantial justice. See Curry, 949 F.3d at 398 (quoting Lexington Ins. v. Hotai Ins. Co., Ltd., 938 F.3d
874, 878 (7th Cir. 2019)).8 PeopleNet has provided products and services to King’s employer, Illinois- based Paramount Staffing, since 2006. [18-1] ¶ 21. Defendant does similar business
7 King has waived argument that this court has general jurisdiction over PeopleNet. See [21]. 8 PeopleNet was not required to submit evidence establishing a lack of personal jurisdiction. See Curry v. Revolution Lab’ys, LLC, 949 F.3d 385, 392 (7th Cir. 2020) (when challenged under Rule 12(b)(2) a plaintiff bears the burden of establishing a prima facie showing of personal jurisdiction). with other clients here. Id. ¶¶ 4–5, 22, 40. As a result of that commerce, King scanned into her job in Chicago using PeopleNet’s devices, which transmitted her biometric information to defendant’s servers. Id. ¶¶ 24–25. Besides King, the complaint alleges
that thousands of other people in Illinois have had their information “collected, captured, stored, transmitted, disseminated, or otherwise used” by PeopleNet, and that the company maintains custody and control of that information. Id. ¶¶ 28, 30, 40. PeopleNet argues that it was just a vendor for King’s employer, Paramount, and that any contacts it had with Illinois were attenuated: the result of Paramount’s
conduct, not PeopleNet’s. [15] at 5–7. It’s true that some of PeopleNet’s contacts with Illinois were indirect, through its relationship with its clients, including Paramount. Defendant sold products and services to Illinois businesses; those businesses required their employees to use PeopleNet’s biometric technology. See [18-1] ¶ 24. But in contrast to other cases involving biometric technology vendors,9 PeopleNet had direct
9 Defendant cites a host of cases for the proposition that this court lacks personal jurisdiction over an out-of-state vendor of biometric-enabled devices, [15] at 4–7; [22] at 1–6, but none of them involved the level of forum-state contacts at issue here. In Bray, a defendant vendor sold and shipped devices to a company in Arkansas, and had “nothing to do with how the devices got to Illinois.” Bray v. Lathem Time Co., Case No. 19-3157, 2020 WL 1492742, at *3 (C.D. Ill. Mar. 27, 2020). The Illinois plaintiffs in McGoveran made calls that were intercepted by an out-of-state defendant, but “[n]othing about this process occurred in Illinois except for the initial dialing of the phone by Plaintiffs.” McGoveran v. Amazon Web Servs., Inc., 488 F.Supp.3d 714, 721–22 (S.D. Ill. 2020). The only evidence of contact between a vendor- defendant and Illinois in Salkauskaite was an article the defendant re-posted about the use of its technology at an Illinois store. Salkauskaite v. Sephora USA, Inc., No. 18-cv-08507, 2020 WL 2796122, at *5 (N.D. Ill. May 30, 2020). Finally, in Stein, the court lacked personal jurisdiction over an out-of-state company that dealt in biometric information where the defendant made a “small amount of sales to two [Illinois] customers” resulting in just “seven cents in revenue.” Stein v. Clarifai, Inc., No. 20 C 1937, 2021 WL 1020997, at *4–5 (N.D. Ill. Mar. 16, 2021). Here, no third party brought PeopleNet’s products to this state: defendant contacts with the forum state that weren’t enabled or created by a third party. For instance, defendant did business with Paramount and other Illinois employers, presumably by entering into contracts with them. [18-1] ¶¶ 4–5, 15, 19, 21–22.
Putting that business into context, see Purdue Rsch. Found. v. Sanofi-Synthelabo, S.A., 338 F.3d 773, 781 (7th Cir. 2003) (citing Burger King Corp. v. Rudzewicz, 471 U.S. 462, 479 (1985)), PeopleNet wasn’t engaged in a one-off transaction. See [18-1]. PeopleNet shipped devices to this state and has provided services to King’s employer for at least fifteen years. Id. ¶¶ 4, 21. While PeopleNet may have also served a nationwide market, defendant’s business here centered on scanning Illinois
employees’ biometric information and handling the resulting data. Id. ¶¶ 4–5, 15, 19, 21–22. Given the length of PeopleNet’s relationship with Paramount, defendant’s business with other Illinois customers, and the “thousands” of Illinois residents whose information PeopleNet processed, id. ¶¶ 28, 30, it’s reasonable to infer that PeopleNet knew that its technology was being used in this state, and that the company intended to exploit the Illinois market for biometric workforce management services.
In other words, PeopleNet reached out “beyond one state and create[d] continuing relationships and obligations with citizens of” Illinois, and is “subject to
shipped its devices directly into Illinois. See [18-1]. PeopleNet entered into business relationships with companies located here and the devices, scans, and timekeeping services at issue all occurred here. PeopleNet handled data from thousands of Illinois residents, did business with at least one Illinois company for years, and it is reasonable to infer that defendant generated significant revenue from its biometric services in Illinois. These cases are factually distinct. And insofar as they were decided on a theory of but-for causation, the Supreme Court has undermined that rationale. See Ford Motor Co. v. Montana Eighth Jud. Dist. Ct., 141 S. Ct. 1017, 1026–30 (2021). regulation and sanctions” here “for the consequences of [its] activities.” Burger King Corp. v. Rudzewicz, 471 U.S. 462, 473 (1985) (citations omitted). That non-party employers (including Paramount) played a role in creating some contacts between
PeopleNet’s technology and Illinois doesn’t necessarily make those contacts independent or attenuated, either. See Ford Motor Co. v. Montana Eighth Jud. Dist. Ct., 141 S. Ct. 1017, 1026–30 (2021) (rejecting the proposition that a showing of minimal contacts requires “a strict causal relationship between the defendant’s in- state activity and the litigation”). While Paramount and other Illinois employers made decisions that led to contacts between PeopleNet’s devices and this state, those
decisions weren’t unilateral. PeopleNet “itself set the system up this way,” uBID, Inc. v. GoDaddy Grp., Inc., 623 F.3d 421, 428 (7th Cir. 2010), doing business in this state that depended on employers requiring their employees to use PeopleNet’s technology.10 Defendant sought out the Illinois biometric timekeeping market. It did business with companies here, shipped in devices, and handled a large quantity of biometric data from Illinois over a period of years. PeopleNet purposefully availed itself of the privilege of conducting business in Illinois. See Illinois v. Hemi Grp. LLC,
622 F.3d 754, 757–59 (7th Cir. 2010); Curry v. Revolution Lab’ys, LLC, 949 F.3d 385, 398–99 (7th Cir. 2020).
10 The nature and extent of PeopleNet’s contacts with Illinois distinguish this case from those where the court must exercise caution to ensure “that a defendant is not haled into court” on the basis of “[an interactive] website that is accessible in the forum state.” Matlin v. Spin Master Corp., 921 F.3d 701, 706 (7th Cir. 2019) (citations omitted). While King’s complaint involves PeopleNet’s website—in the sense that defendant’s servers host the biometric data at issue—PeopleNet’s contacts with this state include business relationships with Illinois employers, sales and shipments of products, and long-running services. See [18-1]. King’s claims relate to PeopleNet’s contacts with Illinois because there is “a connection between the forum and the specific claims at issue.” Curry, 949 F.3d at 400 (quoting Bristol-Myers Squibb v. Superior Ct. of California, 137 S. Ct. 1773, 1781
(2017)). PeopleNet’s conduct in the Illinois biometric information market led to it capturing King’s biometric data in Chicago. That PeopleNet relied on third parties like Paramount to deploy its technology does not sever the relationship between King’s claims and PeopleNet’s contacts with the forum. See id. at 401 (sales to Illinois consumers through third-party websites constituted related contacts); Ford Motor Co., 141 S. Ct. at 1028–29 (personal jurisdiction existed where a defendant had
systematic contacts with the forum state related to the claims at issue even though there were intervening actions by third parties). King’s BIPA claims arise directly out of PeopleNet’s biometric information business in Illinois, and it was foreseeable that defendant would need to defend itself here. See Curry, 949 F.3d at 401 (finding claim-related contacts where a defendant made direct sales of a product that “[form] the very basis of this action”). King has shown purposeful availment and claim-related contacts. Because
plaintiff has made “a threshold showing of minimum contacts,” PeopleNet must present compelling reasons why haling it into court here offends traditional notions of fair play and substantial justice. Curry, 949 F.3d at 402 (quoting Burger King Corp. v. Rudzewicz, 471 U.S. 462, 477 (1985)). Defendant has not pointed to any reason why litigating these claims in Illinois would be unreasonable or unfair. See [15]. Defendant’s motion to dismiss for lack of personal jurisdiction is denied. The complaint makes out a prima facie case for personal jurisdiction. But PeopleNet may preserve its objection by asserting the lack of personal jurisdiction in its answer, see
Fed. R. Civ. P. 12(h)(1)(B)(ii), and may renew its motion if the facts reveal that PeopleNet’s contacts with Illinois are not suit-related. See Rice v. Nova Biomedical Corp., 38 F.3d 909, 914–15 (7th Cir. 1994) (“[T]he denial of a preliminary challenge to personal jurisdiction ... is not an automatic bar to the renewal of the motion after evidence bearing on it has been obtained by pretrial discovery or presented at trial.”). C. Failure to State a Claim
Section 15(b) of BIPA prohibits a private entity from obtaining a person’s biometric information unless it first (1) tells the person in writing that the information is being obtained; (2) tells the person in writing why the information is being used and for how long; and (3) receives a written release. 740 ILSC 14/15(b); Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1245 (7th Cir. 2021). A written release is “informed written consent or, in the context of employment, a release executed by an employee as a condition of employment.” 740 ILCS 14/10.
PeopleNet argues that the requirements of § 15(b) don’t apply to companies in its position. [15] at 8. That’s because this case arises in the context of employment, and third-party vendors (selling products to an employer) can’t impose conditions of employment on their clients’ employees in order to secure the required written release. Id. Defendant also argues that § 15(b) doesn’t apply to it because, unlike related subsections, § 15(b) doesn’t penalize an entity merely for being “in possession” of biometric data. Id. at 8–9. In order to impose liability under § 15(b), defendant seeks a requirement that an entity take an “active step” to obtain biometric data, and says it didn’t in King’s case. Id. at 10 (quoting Heard v. Becton, Dickinson & Co., 440
F.Supp.3d 960, 966 (N.D. Ill. 2020)); [22] at 7 (citing Jacobs v. Hanwha Techwin Am., Inc., No. 21 C 866, 2021 WL 3172967, at *1 (N.D. Ill. July 27, 2021)). PeopleNet is right that § 15(b) doesn’t penalize mere possession of biometric information. Compare 740 ILCS 14/15(b) with 740 ILCS 14/15(a), (c), (d).11 But that doesn’t help PeopleNet because the complaint alleges that defendant did more than possess King’s biometric information: it says that PeopleNet collected and obtained
it. [18-1] ¶ 22 (“Defendant collects, stores, and otherwise uses information and data generated from the timekeeping systems it provided to [King’s employer].”). I accept that factual allegation as true, see Calderone v. City of Chicago, 979 F.3d 1156, 1161 (7th Cir. 2020) (citation omitted), and it’s reasonable to infer that PeopleNet, not its client-employers, was doing the capturing and obtaining of King’s biometric information. Even if the statute requires a showing that PeopleNet took an “active step” towards collection of biometric information, plaintiff’s claim survives that test
11 I agree with Bernal, Namuwonge, and Cameron insofar as they read § 15(b) as requiring something more than possession. See Cameron v. Polar Tech Indus., No. 2019-CH-000013 (Ill. Cir. Ct. Dekalb Cnty. Aug. 23, 2019); Bernal v. ADP, LLC, No. 2017-CH-12364, 2019 WL 5028609, at *2–5 (Ill. Cir. Ct. Cook Cnty. Aug. 23, 2019); Namuwonge v. Kronos, Inc., 418 F.Supp.3d 279, 286 (N.D. Ill. 2019). But I decline to follow an interpretation of § 15(b) under which third parties in employment situations (parties other than the employer) owe no duties to employees whose information they obtain. because the complaint spells out how PeopleNet obtained King’s information. See [18- 1].12 PeopleNet’s argument about the definition of “written release” in the
employment context doesn’t carry the day, either. Since the release is just one of the requirements imposed by § 15(b), the employment context of King’s case doesn’t excuse PeopleNet from informing King that it was collecting her biometrics, explaining why it was using her information, and for how long. See 740 ILCS 14/10, 14/15; Figueroa v. Kronos Inc., 454 F.Supp.3d 772, 783 (N.D. Ill. 2020). And while it’s probably true that PeopleNet wasn’t in a position to impose a condition of
employment on its clients’ employees, the statutory definition of a written waiver doesn’t excuse vendors like PeopleNet from securing their own waivers before obtaining a person’s data. See 740 ILCS 14/10; Figueroa, 454 F.Supp.3d at 783; Neals v. PAR Tech. Corp., 419 F.Supp.3d 1088, 1092 (N.D. Ill. 2019). It’s not absurd to read § 15(b) as applicable to vendors as well as employers. A waiver imposes a minor compliance cost and does not threaten BIPA’s underlying purposes. See 740 ILCS 14/5(g) (“The public welfare, security, and safety will be served by regulating the
12 The courts in Jacobs and Heard found that §15(b) only applied to entities that took an “active step” in obtaining biometric data. See Heard v. Becton, Dickinson & Co., 440 F.Supp.3d 960, 966 (N.D. Ill. 2020); Jacobs v. Hanwha Techwin America, Inc., No. 21 C 866, 2021 WL 3172967, at *2 (N.D. Ill. July 27, 2021). In contrast to those cases, where no active step was alleged, here plaintiff claims that PeopleNet, not her employer, collected her biometric information and describes how collection happened. See [18-1] ¶ 40 (“Defendant obtains and stores biometrics on behalf of its clients.”); id. ¶ 5 (“Defendant’s technology captures the biometric identifiers of its clients’ employees and transmits information and data derived from those biometric identifiers directly to Defendant’s cloud-based time and attendance systems.”). collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.”). The bottom line is this: PeopleNet was a private entity that allegedly obtained King’s biometric information. Defendant didn’t tell King about the collection, spell out why it was collecting the information or for how long, and didn’t get a written release before-hand. King has stated a claim under § 15(b). IV. Conclusion King’s motion to remand, [18], is granted. The claims under BIPA § 15(a) and (c) are severed and remanded to the Circuit Court of Cook County. PeopleNet’s motion to dismiss, [14], is denied. The complaint states a claim under BIPA § 15(b). Defendant’s answer to the complaint is due November 18, 2021 and the parties shall file a joint status report on November 29, 2021 with a proposed discovery schedule.
ENTER: hA SHA. Manish 8. Shah United States District Judge Date: October 28, 2021