Kislov v. American Airlines, Inc.

• Court: District Court, N.D. Illinois
• Decided: October 8, 2021
• Docket: 1:17-cv-09080
• Status: Unknown

Opinion

17-90UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION

ALEX KISLOV and NIKO HEARN, ) individually and on behalf of similarly ) situated individuals, ) ) Plaintiffs, ) ) No. 17 C 9080 v. ) ) Judge Rebecca R. Pallmeyer AMERICAN AIRLINES, INC., ) a Delaware corporation, ) ) ) Defendant. )

MEMORANDUM OPINION AND ORDER Alex Kislov and Niko Hearn (collectively, “Plaintiffs”) allege that Defendant American Airlines, Inc. (“American”) has violated various provisions of the Illinois Biometric Information Privacy Act, 740 ILCS 14/1, et seq. (“BIPA”). This case was filed initially in state court in 2017 by a different named plaintiff, Edward Kowalski, who was an employee of American. Defendant removed the case to federal court under the Class Action Fairness Act. See 28 U.S.C. §§ 1332(d), 1453. After protracted settlement negotiations and developments in BIPA litigation, American moved to dismiss for lack of subject matter jurisdiction—effectively a motion seeking judgment on the grounds that Plaintiff Kowalski’s claim was subject to mandatory arbitration under the Railway Labor Act. The court then granted Kowalski leave to file an amended complaint to remedy the defects American had identified. In June 2021, Plaintiffs filed a Third Amended Complaint, replacing the original named plaintiff with Kislov and Hearn and asserting a new theory of BIPA liability. American has moved to dismiss for failure to state a claim [95], and Plaintiffs responded with a partial motion to remand [98] and a motion to stay [99] pending resolution of the motion to remand. The court grants the motion to remand and strikes the motion to stay as moot. BACKGROUND At this stage of the proceedings, the court accepts the allegations in the Third Amended Complaint (“TAC”) as true. American is a Delaware corporation doing business in Illinois.1 (TAC [93] ¶ 5.) It operates a global fleet of aircraft making thousands of flights per day and provides a 24-hour customer service hotline. (Id. ¶¶ 22–23.) Beginning in approximately July 2011, Defendant integrated “Interactive Voice Response” (“IVR”) software into its customer service hotline in order to “better achieve customer service goals and reduce call agent volumes.” (Id. ¶ 24.) Defendant uses a cloud-based IVR software that “saves all of the data obtained during the phone call in a cloud based server” managed by a third-party software provider. (Id. ¶ 25; see id. ¶ 75.) Defendant’s IVR software “collects and analyzes callers’ actual voiceprints to understand the caller’s request and to automatically respond with a personalized response,” rather than a menu of options. (Id. ¶ 25.) Defendant’s own IVR software vendor has publicly stated that the software uses “voice biometrics.” (Id. ¶ 26.) Plaintiffs further allege that the software collects and stores individuals’ unique voiceprints to track whether an individual has previously interacted with the company. (Id. ¶ 27.) Plaintiffs Alex Kislov and Niko Hearn are residents and citizens of Illinois. (Id. ¶ 4.) Kislov called American’s customer service hotline in December 2019 from within the state of Illinois. (Id. ¶ 34.) According to Kislov, he was greeted by a recorded voice stating that the call may be recorded for quality control purposes. (Id. ¶ 34.) An automated voice then asked how it could assist him. (Id.) Plaintiff alleges that when he vocally interacted with the IVR software, “it captured and stored the unique biometric signatures of his voice, i.e., his voiceprint.” (Id.) Plaintiff Hearn has called American’s customer service hotline multiple times since December 2020 while in the state of Illinois. (Id. ¶ 35.) The purpose of these calls was to resolve issues pertaining to flights

1 Although the parties have not commented otherwise on American’s citizenship, the court notes that American’s principal place of business is apparently in Fort Worth, Texas. See American Airlines, Annual Report (Form 10-K) (Feb. 17, 2021), https://americanairlines.gcs- web.com/static-files/8e328305-2df2-4726-910c-a7e44f091913. departing from Illinois. (Id.) Hearn alleges that when he vocally interacted with American’s IVR software, it captured and stored his voiceprint. (Id.) Both Plaintiffs allege they were unaware that American’s software collected, analyzed, and stored their unique voiceprints. (Id. ¶¶ 36, 38.) Despite coming into possession of Plaintiffs’ biometric information, Plaintiffs allege, Defendant “failed to establish a publicly-available biometric retention and destruction policy as required by law.” (Id. ¶ 38.) American also failed to obtain Plaintiffs’ informed written consent to collect, capture, or store their biometric data. (Id. ¶ 39.) Finally, Defendant disclosed or disseminated Plaintiffs’ voice biometrics to the IVR software vendor, again without their consent. (Id. ¶ 40.) Enacted in 2008, the BIPA protects Illinois residents’ privacy interests in their biometric information. See Rosenbach v. Six Flags Ent. Corp., 2019 IL 123186, ¶ 33, 129 N.E.3d 1197, 1206 (Ill. 2019). The Act defines “biometric information” as “any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual.” 740 ILCS 14/10. In turn, “biometric identifier” means “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” Id. (emphasis added).2 By its nature, a biometric identifier cannot be changed: “once compromised, the individual has no recourse [and] is at heightened risk for identity theft.” 740 ILCS 14/5(c). Section 15 of the Act regulates the possession, collection, retention, disclosure, and dissemination of biometric information and biometric identifiers by private entities. See 740 ILCS 14/15(a)–(e). The Act defines “private entity” broadly to include “any individual, partnership, corporation, limited liability company, association, or other group, however organized.” 740 ILCS 14/10. Section 20 provides a private right of action for persons aggrieved by a violation of the Act, who may receive statutory damages, attorneys’ fees, and injunctive relief. Plaintiffs allege that American is a “private entity” within the meaning of BIPA (TAC ¶ 51), and that Defendant violated BIPA “by collecting, possessing, and disclosing their voiceprint

2 This opinion refers to “biometric information” and “biometric identifiers” collectively as “biometric data.” identifiers without complying with BIPA’s mandates.” (Id. ¶ 1.) They bring three counts against American for various BIPA violations, on behalf of themselves and a class of similarly situated individuals. The proposed class, subject to exclusions not relevant here, is defined as: All individuals whose biometric identifiers and/or biometric information were captured, collected, obtained, stored, or used by Defendant within the state of Illinois any time within the applicable limitations period.

(Id. ¶ 42.) Count I alleges that Defendant “failed to make publicly available any policy addressing its biometric retention and destruction practices,” in violation of Section 15(a). (Id. ¶ 54.) That provision requires private entities in possession of biometric data to “develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever comes first.” (Id. ¶ 53 (quoting 740 ILCS 14/15(a)).) Count II alleges violations of Section 15(b), which prohibits a private entity from collecting or otherwise obtaining biometric data unless it first “(1) informs the subject or the subject's legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored; (2) informs the subject or the subject's legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and (3) receives a written release executed by the subject of the biometric identifier or biometric information or the subject's legally authorized representative.” (Id. ¶ 63 (quoting 740 ILCS 14/15(b); see TAC ¶¶ 64–66.) Count III alleges that Defendant disclosed or otherwise disseminated Plaintiffs’ biometric data to third parties without their consent, in violation of Section 15(d). (Id. ¶¶ 75–77.) DISCUSSION In a diversity case, an out-of-state defendant may remove from state court any action filed there that could properly have been filed in federal court. See 28 U.S.C. § 1441(a), (b)(2). “The party seeking removal has the burden of establishing federal jurisdiction.” Schur v. L.A. Weight Loss Ctrs., 577 F.3d 752, 758 (7th Cir. 2009). The Seventh Circuit has cautioned that “federal courts should interpret the removal statute narrowly, resolving any doubt in favor of the plaintiff's choice of forum in state court.” Id. A plaintiff opposing removal may move to remand the case to state court. See 28 U.S.C. § 1447(c). “If at any time before final judgment it appears that the district court lacks subject matter jurisdiction, the case shall be remanded.” Id. (emphasis added); see GE Betz, Inc. v. Zee Co., 718 F.3d 615, 625–26 (7th Cir. 2013). Plaintiffs in this case are not requesting remand of the entire action to state court. Instead, they have moved to sever and remand Count I, citing authority holding that they lack Article III standing to pursue that claim in federal court. Second, Plaintiffs move to stay briefing on Defendant’s Rule 12(b)(6) motion to dismiss pending resolution of their motion to remand.3 I. Motion to Remand In Count I, Plaintiffs allege that American violated Section 15(a) of BIPA by failing to “make publicly available any policy addressing its biometric retention and destruction policies.” (TAC ¶ 54; Pl.’s Mot. to Remand [98] at 2.) Though Plaintiffs presumably believe they are entitled to pursue this claim, they ask the court to sever and remand this single Count because this claim does not satisfy Article III standing. Playing against type in this case, Defendant urges that Plaintiffs have indeed alleged a concrete and particularized injury such that Count I can remain in federal court along with Counts II and III. (Def.’s Opp’n [101] at 8–11.) Article III standing is a threshold requirement of federal subject-matter jurisdiction. See Collier v. SP Plus Corp., 889 F.3d 894, 896 (7th Cir. 2018). To establish standing, “[t]he plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016); see U.S. Const. art. III, § 2. “If some parts of a single suit

3 Defendant has also moved to dismiss the TAC, arguing that the Airline Deregulation Act, 49 U.S.C. § 41713 (“ADA”), preempts all three of Plaintiffs’ BIPA claims. (See generally Def.’s Mem. [96].) That motion is not fully briefed, and the court declines to address it here. are within federal jurisdiction, while others are not, then the federal court must resolve the elements within federal jurisdiction and remand the rest—unless the balance can be handled under the supplemental jurisdiction [statute].”4 Bergquist v. Mann Bracken, LLP, 592 F.3d 816, 819 (7th Cir. 2010)); see 28 U.S.C. §§ 1367(c), 1441(c). The Seventh Circuit’s recent decisions in Bryant v. Compass Group USA, Inc., 958 F.3d 617 (7th Cir. 2020) and Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146 (7th Cir. 2020) address whether and when a Section 15(a) BIPA claim satisfies Article III standing. In Bryant, the court held that a plaintiff lacked standing to bring a Section 15(a) claim for failure to publicly disclose a retention policy and schedule for the destruction of biometric data. 958 F.3d at 626. The plaintiff had not alleged a “concrete and particularized injury” from defendant's statutory violation because “the duty to disclose under section 15(a) is owed to the public generally, not to particular persons whose biometric information the entity collects.” Id. The court cautioned, however, that its “analysis [was] limited to the theory [the plaintiff] invoked,” so it did not address “the provision requiring compliance with the established retention schedule and destruction guidelines.” Id. Subsequently, in Fox v. Dakkota Integrated Sys., LLC, the Seventh Circuit clarified that some Section 15(a) claims may satisfy Article III standing. 980 F.3d 1146, 1149 (7th Cir. 2020). In that case, filed by plaintiff against her former employer, the court held that plaintiff had standing to bring a Section 15(a) claim alleging that the employer had failed to “develop, publicly disclose, and comply with data retention and destruction policies.” Id. (emphasis in original). This made her Section 15(a) claim “much broader than Bryant's.” Id. at 1154. The plaintiff in Fox further alleged that her former employer had unlawfully retained her biometric data after she left. Id. at 1150. The court observed that “an unlawful retention of a person's biometric

4 The parties did not brief whether supplemental jurisdiction is available for Plaintiffs’ Section 15(a) claim. The court nonetheless concludes that Article III standing is a prerequisite to exercising federal subject-matter jurisdiction over state-law claims, even where a state supreme court has rejected federal standing principles. Cf. Lebron v. Gottlieb Mem’l Hosp., 237 Ill.2d 217, 254 n.4, 930 N.E.2d 895, 917 n.4 (Ill. 2010) (noting that Illinois courts are “not required to follow federal law on issues of standing, and ha[ve] expressly rejected federal principles of standing”). data is as concrete and particularized an injury as an unlawful collection of a person's biometric data” in violation of Section 15(b). Id. at 1155 (emphasis in original). Read together, Bryant and Fox demonstrate that these Plaintiffs lack standing to pursue their Section 15(a) claim in federal court. The TAC alleges merely that American “failed to make publicly available any policy addressing its biometric retention and destruction policies.” (TAC ¶ 54.) Unlike the plaintiff in Fox, Plaintiffs here have not alleged that American failed to comply with any such policies. See Fox, 980 F.3d at 1149. Nor have Plaintiffs alleged that American unlawfully retained their biometrics. See id. at 1150. Plaintiffs are more like the plaintiff in Bryant, whose Section 15(a) claim—for failure to publish a biometric retention policy and destruction schedule—asserted a general duty owed to the public, rather than a concrete and particularized injury. See Bryant, 958 F.3d at 626. Indeed, Plaintiffs’ allegations mirror the allegations in the Bryant complaint, which alleged unlawful possession of fingerprint biometrics “without creating a written policy, made available to the public, establishing a retention schedule and destruction guidelines for [defendant’s] possession of biometric identifiers and information.” (See Compl., Bryant v. Compass Group, Inc., No. 19-cv-06622, Ex. A to Mot. to Remand [98-1] ¶ 52.) American’s arguments to the contrary are not persuasive. Defendant latches onto language in the TAC’s first paragraph, which states that American “possess[ed] . . . [Plaintiffs’] biometric identifiers without complying with BIPA mandates.” (TAC ¶ 1 (emphasis added).) But that paragraph, which does not cite a specific BIPA provision, is plainly an introductory paragraph. The court does not read the words “complying with BIPA mandates” as referring specifically to Section 15(a)’s requirement that a private entity “must comply with its established retention schedule and destruction guidelines.” 740 ILCS 14/15(a). Defendant also argues that the allegations, read as a whole, “effectively claim that American stores biometrics in perpetuity” (Def.’s Opp’n at 9), meaning that Plaintiffs are challenging Defendant’s “unlawful retention” of their biometric data as in Fox. (Id. at 10.) Again, the court disagrees. In their reply brief, Plaintiffs note that the alleged collection of their voice biometrics occurred in December 2019 and December 2020 (see TAC ¶¶ 34–35), meaning that Defendant cannot have retained their biometrics for more than three years. (Pl.’s Reply [103] at 4 n.1 (citing 740 ILCS 14/15(a).) Any claim for unlawful retention of biometric data is likely not yet ripe; regardless, Plaintiffs have unambiguously stated that they are not pursuing such a claim here. (See Pl.’s Reply at 7.) Accord Colon v. Dynacast, LLC, No. 20-cv-3317, 2021 WL 492870, at *4–5 (N.D. Ill. Feb. 10, 2021) (remanding Section 15(a) claim based on plain reading of the complaint, and crediting plaintiff’s assurance in her briefs “that she bases her section 15(a) claim on only a failure to publicly provide a data policy”); Marquez v. Google LLC, No. 20-cv-4454, 2020 WL 6287408, at *2 (N.D. Ill. Oct. 27, 2020) (same). With that understanding, the cases Defendant cites as examples of district courts denying motions to remand Section 15(a) claims are readily distinguishable.5 Defendant comes closest with Kalb v. GardaWorld CashLink LLC, 2021 WL 1668036 (C.D. Ill. Apr. 28, 2021), where plaintiff alleged that defendant “does not have written, publicly available policies identifying their retention schedules, or guidelines for permanently destroying any of these biometric identifiers or biometric information.” Id. at *3. The court construed those allegations as “reasonably suggesting” that defendant had “unlawfully retained [biometric] data.” Id. Whatever the strength of that conclusion, this court does not read Plaintiffs’ allegations as making such a suggestion in this case. See also Roberson v. Maestro Consulting Servs. LLC, 507 F. Supp. 3d 998, 1008 (S.D. Ill. 2020) (denying motion to remand Section 15(a) claim where plaintiff alleged that defendant failed to comply with its retention schedule and destruction guidelines); Marsh v. CSL Plasma Inc., 503 F. Supp. 3d 677, 682–83 (N.D. Ill. 2020) (same); Neals v. ParTech, Inc., No. 19-cv-05660, 2021 WL 463100,

5 Defendant correctly notes that the following district court cases predated Fox, which was decided on November 17, 2020. Marquez, 2020 WL 6287408, at *2 (remanding Section 15(a) claim under Bryant); Burlinski v. Top Golf USA Inc., No. 19-cv-06700, 2020 WL 5253150, at *4 (N.D. Ill. Sept. 3, 2020) (same); Stauffer v. Innovative Heights Fairview Heights LLC, 480 F. Supp. 3d 888, 899–900 (S.D. Ill. Aug. 19, 2020) (same); Kloss v. Acuant, Inc., 462 F. Supp. 3d 873, 876 (N.D. Ill. 2020) (same). That does not necessarily mean, however, that these cases are inconsistent with Fox. Compare Marquez, 2020 WL 6287408, at *2 (noting that “[plaintiff] does not allege that [defendant] failed to comply with BIPA § 15(a)’s deletion requirements”), with Kloss,462 F. Supp. 3d at 876 (interpreting Bryant as broadly holding that Section 15(a) violations do not constitute concrete and particularized injuries). at *5 (N.D. Ill. Feb. 9, 2021) (same); Heard v. Becton, Dickinson&Co., _—~«~F. Supp.3d___—, 2021 WL 872963, at *3—4 (N.D. Ill. Mar. 9, 2021) (same); Wilcosky v. Amazon.com, Inc., 517 F. Supp. 3d 751, 761-62 (N.D. Ill. 2021) (same); Hazlittv. Apple Inc., □□ □□□ Supp. 2021 WL 2414669, at *4—5 (S.D. Ill. June 14, 2021) (same); Fernandez v. Kerry, Inc., No. 17-cv-08971, 2020 WL 7027587, at *7—8 (N.D. Ill. Nov. 30, 2020) (concluding that plaintiffs had standing to bring Section 15(a) claims against their employer not only because they alleged unlawful retention of their biometric data, but also because union members have a concrete interest in collective bargaining over biometric data usage) (citing Miller v. Southwest Airlines Co., 926 F.3d 898, 902 (7th Cir. 2019)).§ The court concludes Plaintiffs do not have Article Ill standing to pursue their Section 15(a) claim in this court and therefore grants Plaintiffs’ motion to remand that claim to state court. ll. Motion to Stay Because the court has granted Plaintiffs’ motion to remand, the motion to stay briefing on Defendant’s motion to dismiss is terminated as moot. CONCLUSION Plaintiffs’ motion to remand [98] is granted, and their motion to stay [99] is terminated as moot. Countl is severed and remanded to state court, but Counts II and Ill remain before this court. Plaintiffs shall respond to Defendant’s Rule 12(b)(6) motion to dismiss by October 29, 2021; American’s reply shall be filed on November 12, 2021. ENTER:

Dated: October 8, 2021 ber HE A 4 REBECCA R. PALLMEYER United States District Judge 6 Defendant also cites Wordlaw v. Enter. Leasing Co. of Chicago, LLC, No. 20 CV 3200, 2020 WL 7490414 (N.D. Ill. Dec. 2020). (See Def.’s Opp’n at 9.) But that case involved a Rule 12(b)(6) motion, and the court did not discuss standing at all. See Wordlaw, 2020 WL 7490414, at *4 (concluding that plaintiff had adequately alleged unlawful retention of biometric data in violation of Section 15(a).)