Rowe v. Papa John's International, Inc., a Delaware corporation

CourtDistrict Court, N.D. Illinois
DecidedAugust 23, 2024
Docket1:23-cv-02082
StatusUnknown

This text of Rowe v. Papa John's International, Inc., a Delaware corporation (Rowe v. Papa John's International, Inc., a Delaware corporation) is published on Counsel Stack Legal Research, covering District Court, N.D. Illinois primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
Rowe v. Papa John's International, Inc., a Delaware corporation, (N.D. Ill. 2024).

Opinion

UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION

SHENIQUA ROWE and ) TAHESHA STREETER, ) ) Plaintiffs, ) Case No. 23-cv-2082 ) v. ) Hon. Steven C. Seeger ) PAPA JOHN’S INTERNATIONAL, INC., ) ) Defendant. ) ____________________________________)

MEMORANDUM OPINION & ORDER

This case is another drop in the tidal wave of cases under the Illinois Biometric Information Privacy Act that has crashed down and flooded courthouses across the state. Sheniqua Rowe and Tahesha Streeter worked at Ozark Pizza Company, a franchisee of Papa John’s. They used a fingerprint scanner to perform a number of tasks, including clocking in and out of work and inputting delivery information. Rowe and Streeter contend that they scanned their fingerprints thousands of times. And they believe that Papa John’s used, kept, and disseminated their biometric data without their consent. So, they sued. Papa John’s, in turn, moved to dismiss. For the reasons explained below, the motion to dismiss is granted in part and denied in part. Background At the motion to dismiss stage, the Court must accept as true the complaint’s well- pleaded allegations. See Lett v. City of Chicago, 946 F.3d 398, 399 (7th Cir. 2020). The Court “offer[s] no opinion on the ultimate merits because further development of the record may cast the facts in a light different from the complaint.” Savory v. Cannon, 947 F.3d 409, 412 (7th Cir. 2020). This case is about two former Papa John’s employees who scanned their fingerprints as part of their duties while working at the company’s restaurants. See Am. Cplt., at ¶¶ 10–12, 20 (Dckt. No. 16).

Defendant Papa John’s International, Inc. is one of the largest pizza chains in the United States. It has over 5,500 pizza shops, located domestically and abroad. Id. at ¶ 5. More than 5,000 of Papa John’s restaurants are franchised, and the rest are owned by the company. Id. Plaintiffs Sheniqua Rowe and Tahesha Streeter worked at Papa John’s restaurants in Illinois. Id. at ¶¶ 11–13. The restaurants were owned and operated by nonparty Ozark Pizza Company, a franchisee with dozens of restaurants in Illinois and other states. Id. at ¶ 10. Rowe worked for Ozark from 2014 through 2017, and Streeter worked for Ozark from 2015 through 2020. Id. at ¶ 15. Both Rowe and Streeter worked as Ozark’s “shift leaders,” meaning that they regularly

worked at multiple Papa John’s franchises run by Ozark. Id. at ¶ 13. Streeter also served as an Ozark general manager. Id. at ¶ 14. Papa John’s has developed a proprietary point of sale system, called FOCUS, which is used across its company-owned stores and its franchised locations. Id. at ¶¶ 16–17. Ozark uses the FOCUS system under its franchise agreement with Papa John’s. Id. at ¶ 16. The FOCUS system has a built-in fingerprint scanner. Id. at ¶ 18. Papa John’s requires franchisees like Ozark to use the fingerprint scanner “whenever possible” for employees to perform certain tasks. Id. at ¶ 19. Ozark required workers to use FOCUS to clock in and out, and to unlock the system for transactions. Id. at ¶¶ 23–24. Rowe and Streeter used the scanner for at least three purposes, including clocking in and out of work, inputting delivery routing, and authenticating themselves for FOCUS access. Id. at ¶ 20. In their roles as shift leaders – and in Streeter’s position as general manager – Rowe and Streeter used FOCUS to scan other employees in and out, and to perform other tasks associated with their positions. Id. at ¶ 25.

Rowe’s fingerprints were scanned no fewer than 10,000 times while she worked for Ozark. Id. at ¶ 41. And Streeter’s fingerprints were scanned no fewer than 15,000 times. Id. at ¶ 42. Papa John’s could remotely download and collect data from FOCUS, plus monitor fingerprint-scanner use. Id. at ¶ 22. The company used FOCUS to remotely access Ozark’s point of sale system. Id. at ¶ 29. Daily, Papa John’s would collect information from Ozark’s point of sale system. Id. at ¶ 30. The system used by Ozark “captured Plaintiffs’ biometrics and transmitted that information to Defendant.” Id. Papa John’s prepares and circulates reports that identify the franchisees and workers who

do not use FOCUS’s fingerprint scanner and instead use passwords for authentication. Id. at ¶ 32. Papa John’s used FOCUS to collect and maintain something called “reference templates” from workers’ fingerprints. Id. at ¶ 27. By the sound of things, a reference template is an image of the fingerprints, akin to a model. The company uses that image as the point of comparison each time an employee puts his or her fingers on the scanner. When an Ozark employee scanned her fingerprint, FOCUS compared the fingerprint to the reference fingerprint template of the employee. Id. at ¶ 21. Through its remote access, Papa John’s could monitor fingerprint-scanner usage, including Plaintiffs’ access and usage. Id. at ¶ 31. Papa John’s and Ozark never asked Rowe and Streeter for consent before collecting fingerprint templates and data through FOCUS. Id. at ¶ 36. Papa John’s and Ozark did not inform Plaintiffs about “how each would use the fingerprint data, how long each would store the

data, or provide a publicly available retention policy regarding retention and storage of biometric data.” Id. at ¶ 37. Papa John’s never gave Rowe and Streeter a written heads-up about their biometrics being stored, collected, and used, either. Id. at ¶ 39. And Plaintiffs never consented to Papa John’s disclosing their fingerprint data collected through FOCUS. Id. at ¶ 40. Papa John’s did not destroy Plaintiffs’ “biometric identifiers of information,” even though BIPA required it to do so no later than three years after their employment ended. Id. at ¶ 38. The pizza chain had no post-employment retention and destruction policy on the books during Plaintiffs’ employment. Id. Biometric data can be a target for hackers and identity thieves. Id. at ¶ 45. Because

fingerprints are unique and permanent, privacy concerns for fingerprint data can exceed concerns about other identifiers (such as key cards). Id. at ¶ 43. If a key card is stolen, the card can be deactivated, and a new one can be made. If a password is stolen, it can be changed. Even a Social Security Number can be replaced. But once a fingerprint is stolen, there’s not much an employee can do. Id. After all, a fingerprint is permanent, and each of us gets only one set. Rowe sued Papa John’s on April 3, 2023. See Cplt. (Dckt. No. 1). She filed a first amended complaint (the operative complaint) on June 13, 2023, adding Streeter as a plaintiff. See Am. Cplt. (Dckt. No. 16). The amended complaint has six counts, all under the Illinois Biometric Information Privacy Act (“BIPA”), 740 ILCS 14 et seq. Id. at ¶ 1. Counts I, III, and V are brought by Rowe, while Counts II, IV, and VI are brought by Streeter. Id. at 13–25. Basically, each plaintiff brings three claims. Each claim is based on a different provision of BIPA. Counts I and II involve section 15(a), Counts III and IV involve section 15(b), and

Counts V and VI involve section 15(d). Counts I and II allege a failure to institute, maintain, and adhere to a publicly available retention schedule in violation of section 15(a) of BIPA. Id. at ¶¶ 71–94. Counts III and IV allege a failure to obtain informed written consent and release before obtaining biometric identifiers or information in violation of section 15(b) of BIPA. Id. at ¶¶ 95–126. Finally, Counts V and VI allege that Papa John’s disclosed Plaintiffs’ biometric identifiers and information without obtaining consent, in violation of section 15(d) of BIPA. Id. at ¶¶ 127–48. Plaintiffs seek statutory damages of $5,000 for each willful or reckless violation of BIPA, or in the alternative, statutory damages of $1,000 for each negligent violation. Id. Plaintiffs also

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Dexia Credit Local v. Rogan
602 F.3d 879 (Seventh Circuit, 2010)
American Pipe & Construction Co. v. Utah
414 U.S. 538 (Supreme Court, 1974)
United Airlines, Inc. v. McDonald
432 U.S. 385 (Supreme Court, 1977)
Davis v. Passman
442 U.S. 228 (Supreme Court, 1979)
BMW of North America, Inc. v. Gore
517 U.S. 559 (Supreme Court, 1996)
DaimlerChrysler Corp. v. Cuno
547 U.S. 332 (Supreme Court, 2006)
Bell Atlantic Corp. v. Twombly
550 U.S. 544 (Supreme Court, 2007)
Ashcroft v. Iqbal
556 U.S. 662 (Supreme Court, 2009)
Smith v. Bayer Corp.
131 S. Ct. 2368 (Supreme Court, 2011)
ANCHORBANK, FSB v. Hofer
649 F.3d 610 (Seventh Circuit, 2011)
Cathy Ann Glater v. Eli Lilly & Co.
712 F.2d 735 (First Circuit, 1983)
Centerline Equipment Corp. v. Banner Personnel Service, Inc.
545 F. Supp. 2d 768 (N.D. Illinois, 2008)
In Re WorldCom Securities Litigation
496 F.3d 245 (Second Circuit, 2007)

Cite This Page — Counsel Stack

Bluebook (online)
Rowe v. Papa John's International, Inc., a Delaware corporation, Counsel Stack Legal Research, https://law.counselstack.com/opinion/rowe-v-papa-johns-international-inc-a-delaware-corporation-ilnd-2024.