McGinnis v. United States Cold Storage, Inc.

Opinion

UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION

RICHARD MCGINNIS, individually and on ) behalf of all others similarly situated, ) ) Plaintiff, ) No. 19 C 00845 ) v. ) ) Judge Edmond E. Chang UNITED STATES COLD STORAGE, INC., ) ) Defendant. )

MEMORANDUM OPINION AND ORDER

Back in 2017, Richard McGinnis filed a class-action complaint in this Court against his employer, United States Cold Storage, Inc., under the Illinois Biometric Information Privacy Act, 740 ILCS 14/1, et seq. See Case No. 17 C 00854, R. 1. Early on in that case, this Court directed the parties to file position papers on whether McGinnis had Article III standing to bring the case. U.S. Cold Storage filed a position paper contending that McGinnis had not sufficiently alleged a concrete harm; meanwhile, McGinnis (unsurprisingly, at least at that time) took the opposite position. This Court agreed with U.S. Cold Storage and dismissed that case for lack of subject matter jurisdiction. R. 4, Notice of Removal ¶ 3; McGinnis v. United States Cold Storage, Inc., 382 F. Supp. 3d 813, 820 (N.D. Ill. 2019). The next day, McGinnis filed a new complaint, this time in Will County Circuit Court. Notice of Removal, Exh. B, Will County Compl. McGinnis’s claims again arise out of U.S. Cold Storage’s requirement that employees scan their fingerprints or handprints1 in U.S. Cold Storage’s time-tracking system. Id. His allegations are virtually the same as the ones in the prior federal complaint, with one exception: McGinnis now also alleges that U.S. Cold Storage disclosed McGinnis’ fingerprints to

a non-party payroll vendor without his consent. Id. ¶ 21; see also Notice of Removal, ¶ 3. U.S. Cold Storage then filed a notice of removal, bringing the Will County complaint back to this Court on the basis of diversity jurisdiction, 28 U.S.C. § 1332. Notice of Removal ¶ 11.2 So now the parties are back in this Court, and the standing issue that was once put in a deep freeze has been revived in light of the payroll-vendor disclosure allegation. This time around, the parties have switched places on the standing issue.

U.S. Cold Storage now argues that the Article III standing is satisfied because the alleged disclosure is a sufficiently concrete harm. Notice of Removal ¶¶ 3-4. And McGinnis contends that there is no concrete harm under Article III. R. 27-1, Pl.’s Resp. Br.3 For the reasons stated below, the case is dismissed for lack of Article III standing, and remanded back to Will County Circuit Court.

1For brevity’s sake, the Opinion will refer just to the collection of fingerprints, although that is meant to include handprints as well as fingerprints. 2McGinnis contends that diversity jurisdiction is not met here because his damages cannot reach the amount-in-controversy requirement. See R.27-1, Pl.’s Resp. Br. at 8. Whether diversity jurisdiction applies is certainly a close call, but the Court need not decide this issue because, as detailed below, McGinnis’s claims do not belong in this Court for lack of Article III standing. 3McGinnis previously filed a motion to remand this case back to Will County. R. 13. The Court terminated that motion pending U.S. Cold Storage’s responsive pleading. R. 18. U.S. Cold Storage then filed a Rule 12(b)(6) motion to dismiss on the merits. R. 21, Mot. Dismiss. In response, McGinnis renewed his motion to remand. See R. 27-1. McGinnis also requested that the Court vacate the briefing schedule set for U.S. Cold Storage’s motion to dismiss, and grant him jurisdictional discovery. Id. The Court denied without prejudice McGinnis’ request for discovery and paused the briefing on U.S. Cold Storage’s Rule 12(b)(6) I. Background B. Factual Background For purposes of evaluating the dismissal motion, the Court must accept as true

the allegations in the Complaint, Erickson v. Pardus, 551 U.S. 89, 94 (2007), although if a factual dispute arises over subject matter jurisdiction, the Court may engage in jurisdictional fact-finding. The Court assumes familiarity with the facts of the dispute between the parties as described more fully in the opinion that dismissed McGinnis’ prior federal complaint. See McGinnis, 382 F. Supp. 3d at 816. In addition to the notice-and-consent violations alleged in the federal complaint, McGinnis now also alleges that U.S. Cold Storage disclosed McGinnis’ fingerprint data (without his

consent) to a non-party payroll4 vendor that maintains U.S. Cold Storage’s time- keeping system. Will County Compl. ¶¶ 20-22. McGinnis again alleges that U.S. Cold Storage violated his privacy interests, and that he has experienced mental anguish as a result. Id. ¶¶ 24-25. Specifically, McGinnis alleges that he experiences mental anguish when he thinks about the possibility of U.S. Cold Storage’s database being hacked and his biometric information being stolen. Id. The question before this Court

motion to dismiss, R. 21. R. 30, 3/27/19 Minute Entry. So all that remains to be decided for now is the renewed motion to remand. 4McGinnis’s Will County complaint does not specifically allege the non-party vendor is a “payroll” vendor, but in its previous position paper, U.S. Cold Storage suggested that the non-party to whom it disclosed McGinnis’s information might be a payroll vendor. See McGinnis, 382 F. Supp. 3d at 819. McGinnis has picked up on the suggestion, see Pl.’s Resp. Br. at 12, and U.S. Cold Storage does not dispute it. See R. 29, Def.’s Reply Br.; R. 36, Def.’s Surreply. So the Court assumes that the disclosure was made to a non-party payroll vendor. is whether these new disclosure allegations are sufficient to establish Article III standing.5 II. Legal Standard

“Subject-matter jurisdiction is the first issue in any case.” Miller v. Southwest Airlines Co., 926 F.3d 898, 902 (7th Cir. 2019). If, after removal, “it appears that the district court lacks subject matter jurisdiction, the case shall be remanded.” 28 U.S.C. 1447(c); see also Collier v. SP Plus Corporation, 889 F.3d 894, 895 (7th Cir. 2018) (per curium) (explaining that remand is required when jurisdiction is lacking). “[T]he party seeking removal … bears the burden of establishing federal jurisdiction.” Tri- State Water Treatment, Inc. v. Bauer, 845 F.3d 350, 352 (7th Cir. 2017). So in removal

cases such as this, the defendant bears the burden of showing that the plaintiff had Article III standing at the time of removal. Miller v. Southwest Airlines Co., 2018 WL 4030590, *3 (N.D. Ill. August 23, 2018) aff’d 926 F.3d 898 (7th Cir. 2019); see also Collier, 889 F.3d at 896. Finally, “federal courts should interpret the removal statute narrowly, resolving any doubt in favor of the plaintiff’s choice of forum in state court.” Schur v. L.A. Weight Loss Centers, Inc., 577 F.3d 752, 758 (7th Cir. 2009).

III. Analysis To have standing to bring a federal case, a “plaintiff must have (1) suffered an injury in fact (2) that is fairly traceable to the challenged conduct of the defendant and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v.

5The Court need not revisit whether the other allegations contained in McGinnis’s complaint are sufficient. As previously held, they are not. See McGinnis, 382 F. Supp. 3d at 816. Robins, 136 S. Ct. 1540, 1547 (2016). The question here is whether McGinnis suffered an injury in fact from the alleged unauthorized disclosure. An injury in fact occurs when a plaintiff “suffered an invasion of a legally protected interest that is concrete

and particularized.” Id. at 1548 (emphasis added) (cleaned up)6. In Spokeo, the Supreme Court explained that “[a]lthough tangible injuries are perhaps easier to recognize, we have confirmed in many of our previous cases that intangible injuries can nevertheless be concrete.”7 Id. at 1549 (emphasis added). In determining which intangible injuries are sufficient to confer standing and which are not, Spokeo set out a basic principle: a “bare procedural violation” of a statute is not automatically enough to satisfy Article III’s concreteness requirement. 136 S. Ct. at 1549. A

legislature’s judgment in creating a legally protected interest protected by a statute is an important consideration, but to be concrete, the interest must still be accompanied by “an appreciable risk of harm to the underlying concrete interest that [the legislature] sought to protect by enacting the statute.” Groshek v. Time Warner Cable, Inc., 865 F.3d 884, 887 (7th Cir. 2017) (cleaned up); see also Scanlan v. Eisenberg, 669 F.3d 838, 845 (7th Cir. 2012) (recognizing the importance of state

legislative judgments).

6This Opinion uses (cleaned up) to indicate that internal quotation marks, alterations, and citations have been omitted from quotations. See Jack Metzler, Cleaning Up Quotations, 18 Journal of Appellate Practice and Process 143 (2017). 7At the same time, concreteness is indeed a requirement that is separate and apart from the Article III requirement that the injury be “particularized” to the individual plaintiff. Spokeo, 136 S. Ct. at 1548. Specifically, “[t]o establish injury in fact, a plaintiff must show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized.’” Id. at 1548 (emphasis added) (quoting Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992)). In passing the Biometric Information Privacy Act (BIPA), the Illinois legislature found that (1) biometrics are uniquely sensitive and when compromised, put individuals at a heightened risk for identity theft; (2) biometric technology is

cutting edge, and “[t]he full ramifications of biometric technology are not fully known”; (3) the public is “weary” of using biometrics when tied to personal information; and (4) regulating biometric collection, use, and storage serves the public interest. 740 ILCS 14/5(c)-(g). To those ends, the Act prohibits any private entity in possession of biometric information from “disclos[ing], redisclos[ing], or otherwise disseminat[ing] a person’s … biometric identifier or biometric information” unless the person consents to the disclosure or redisclosure. 740 ILCS 14/15(d). McGinnis alleges

that he never consented to disclosure and that U.S. Cold Storage nevertheless disclosed his fingerprints to an outside payroll vendor. Will County Compl. ¶ 50. That is no doubt a violation of the statute. As the Court previously explained, though, absent an allegation of disclosure beyond the employer or a risk of disclosure beyond the employer, the retention of personally identifying information obtained without the employee’s consent is not a sufficiently concrete harm under Article III. 382 F.

Supp. 3d at 819. The key question here is whether the alleged disclosure to U.S. Cold Storage’s payroll vendor is enough to satisfy the concrete-harm requirement. As far as the allegations and record go, there is an insufficient risk of future harm to the privacy interests that BIPA seeks to protect, that is, the risk of identity theft.8 740 ILCS

8U.S. Cold Storage actually concedes that Article III standing in this case does not depend on an allegation of a risk of future harm, see R. 36, Def.’s Surreply at 11. Instead, 14/5(c)-(g). Risk of future harm might be enough to satisfy Article III standing, but the risk still must be concrete. See, e.g., Clapper v. Amnesty Int’l USA, 568 U.S. 398, 414 n.5 (2013); see also Lewert v. P.F. Chang’s China Bistro, Inc., 819 F.3d 963, 968-

69 (7th Cir. 2016). McGinnis has not alleged, for instance, that the disclosure subjected his biometric information to a heightened risk of identity theft now that it has been disclosed to the payroll vendor, nor does U.S. Cold Storage offer any evidence of that risk. Indeed, last time around, U.S. Cold Storage argued that disclosure to a non-party payroll vendor would not pose a substantial risk of injury because “[p]ayroll vendors typically are privy to all kinds of confidential information … and have strong protocols and practices in place to protect such data.” See McGinnis, 382 F. Supp. 3d

at 819. And this time, McGinnis takes U.S. Cold Storage’s previous argument one step further by presenting an example of the extensive data security policies and procedures that payroll vendors implement. See R. 31, Pl.’s Surreply at 4 n.2. That is not to say that an unauthorized disclosure to a non-party payroll vendor could never be sufficient to satisfy the concrete-harm requirement. Indeed, an unauthorized disclosure might very well present “an appreciable risk of harm” to a

person’s right to privacy in some instances. For instance, if U.S. Cold Storage disclosed McGinnis’s biometric information to a payroll vendor that did not have any data-security controls in place, then disclosure to that party might put McGinnis’s biometric information at a heightened risk of breach. But U.S. Cold Storage has not offered any reason to think that that might be the case here, nor does it refute

according to U.S. Cold Storage, the unauthorized disclosures to the payroll vendor is a “current harm.” Id. (emphasis added). McGinnis’s contention. Ultimately, the complaint alleges nothing more than a bare procedural violation without an Article III concrete harm. To defend the removal, U.S. Cold Storage primarily relies on Dixon v.

Washington & Jane Smith Cmty.-Beverly, 2018 WL 2445292, at *9-10 (N.D. Ill. May 31, 2018).9 Like this case, the employer in Dixon allegedly disclosed the employee’s fingerprint data to an outside fingerprint-scanner vendor without the employee’s consent. Dixon, 2018 WL 2445292, at *1. Pointing to the disclosure, the district court there distinguished the case from those in which plaintiffs alleged notice and consent violations without disclosure. See id. at *9-10 (“Dixon has alleged what the plaintiffs in McCollough, Vigil, and Gubala did not. Specifically, she has alleged that [the

defendant] disclosed her fingerprint scan to [a non-party] without informing her or obtaining her consent to do so.”). The court noted that the alleged disclosure “violated [the plaintiff’s] right to privacy in her biometric information—the very right that the drafters of BIPA sought to protect” and concluded that such a violation, although intangible, was sufficiently concrete for standing purposes. Id., at *9. In explaining its decision, Dixon relied on the Seventh Circuit’s decision in

Gubala v. Time Warner Cable, Inc., 846 F.3d 909, 912 (7th Cir. 2017). 2018 WL 2445292, at *10. In Gubala, the Seventh Circuit held that the mere unlawful retention

9U.S. Cold Storage argues that this Court previously “noted the absence of a [disclosure] allegation … as the rationale for dismissing the federal complaint for lack of Article III standing.” Notice of Removal ¶ 4. But that was not the holding of the Court’s prior opinion. Rather, this Court noted that cases involving non-party disclosures might be enough to satisfy standing, but McGinnis’s federal compliant did not allege a disclosure like that. So the Court expressly declined to decide what the result would be if there had been an allegation of disclosure. See McGinnis, 382 F. Supp. 3d at 818 (citing Dixon, 2018 WL 2445292, at *9). of personal information, without more, was a bare procedural violation of the Cable Communications Policy Act, 47 U.S.C. § 551(e), and insufficient for Article III concrete harm. 846 F.3d at 910. Gubala noted—though not in its holding—that the

court was mindful of the plaintiff’s contention that retention of personal information amounts to a violation of privacy and explained that if the plaintiff had any reason to believe that the defendant intended to release his information or could not be trusted to retain it, “he would have grounds for obtaining injunctive relief.” Id. But the plaintiff did not make disclosure allegations in Gubala, so the Seventh Circuit left unanswered whether the disclosure of personal information to a non-party is a sufficiently concrete injury. 846 F.3d at 913. Nor did Gubala answer the even more

specific question presented here: whether disclosure of biometric information to a payroll vendor is a sufficiently concrete harm. Absent any reason to think that there is a risk of further disclosure, as explained earlier, the Court concludes that the answer is no. In addition to Dixon, U.S. Cold Storage cites to Miller v. Sw. Airlines Co., 2018 WL 4030590, at *3 (N.D. Ill. Aug. 23, 2018), another BIPA case. Relying on Dixon,

the district court in Miller held that the dissemination of biometric information without consent to unknown non-parties, including payroll and timekeeping vendors, was a concrete injury. See Miller 2018 WL 4030590, at *3 (citing Dixon, 2018 WL 1445292, at *10). Like the court in Dixon, the district court in Miller pointed to the “violation of plaintiffs’ right to privacy in their biometric data” as the concrete injury. Id. Again, this Court likewise respectfully declines here to follow Miller, because there is no reason to think, in this case, that there is a concrete risk of further disclosure. To be sure, this issue of disclosure to non-parties presents a close legal question, but the Illinois legislature’s emphasis on protecting against identity theft

tips the scale, in this Court’s view, to the conclusion that the harm is insufficiently concrete. It is worth noting, however, that on appeal the Seventh Circuit held that the employees in Miller had standing, but on a different ground than the one relied on by the district court. See Miller v. Sw. Airlines Co., 926 F.3d 898, 902 (7th Cir. 2019). The Seventh Circuit noted that if the alleged disclosure violations occurred, “a court or adjustment board may order a change in how workers clock in and out,” and so the

Court concluded that “[t]he prospect of a material change in workers’ terms and conditions of employment gives these suits a concrete dimension.” Miller, 926 F.3d at 902. The Seventh Circuit went on to note that the employees might also have standing under the district court’s rationale, but declined to answer that question because the first ground was sufficient to confer standing. Id. at 903. It is true that an argument can be made in support of standing here based on

the Seventh Circuit’s line of reasoning in Miller. If U.S. Cold Storage wanted to make that argument, then it should have brought the Seventh Circuit’s decision to this Court’s attention and offered its rationale.10 But it did not. So the argument is forfeited. And it appears that McGinnis’s case is different from Miller in at least two ways. First, McGinnis left U.S. Cold Storage in 2015, Will County Compl. ¶ 2, so he

10Miller was decided after the parties had filed final briefs, but neither side sought to file supplemental authority to discuss the opinion. would be unable to seek injunctive relief in his workplace conditions, as relied on by the Seventh Circuit in Miller. Second, the employees in Miller were represented by a union, so the employer there had a legal duty, under the National Labor Relations

Act, see 29 U.S.C. § 158(d), to bargain in good faith with the employees’ union for material workplace changes. McGinnis does not allege that he and his coworkers were unionized. In any event, U.S. Cold Storage has forfeited any reliance on Miller. IV. Conclusion The Court lacks subject matter jurisdiction because McGinnis has not alleged a concrete injury sufficient to satisfy Article III. The case is dismissed for lack of federal subject matter jurisdiction and remanded forthwith back to the Will County

Circuit Court. The status hearing of January 23, 2020 is vacated.

ENTERED:

s/Edmond E. Chang Honorable Edmond E. Chang United States District Judge

DATE: December 23, 2019