Smith v. Signature Systems, Inc.

• Court: District Court, N.D. Illinois
• Decided: February 28, 2022
• Docket: 1:21-cv-02025
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION

RONESHA SMITH, on behalf of herself and all others similarly situated, Case No. 2021-CV-02025 Plaintiff, Judge Mary M. Rowland v.

SIGNATURE SYSTEMS, INC.,

Defendant.

MEMORANDUM OPINION AND ORDER Ronesha Smith alleges that Signature Systems, Inc. scanned and collected her fingerprints on its point-of-sale system. Smith, on behalf of herself and other putative class members, claims that Signature Systems took and retained this data in violation of the Illinois Biometric Information Privacy Act (BIPA). Signature Systems moves to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(6). For reasons stated herein, the Motion to Dismiss [12] is denied. I. Background The following factual allegations are taken from the Complaint (Dkt. 1-1 (“Compl.”)) and are accepted as true for the purposes of the motion to dismiss. See W. Bend Mut. Ins. Co. v. Schumacher, 844 F.3d 670, 675 (7th Cir. 2016). Plaintiff Ronesha Smith (“Smith”) was employed from approximately July 2019 to September 2019 by a restaurant in Evergreen Park, Illinois franchised by the nation- wide fast-food franchisor Jimmy John’s, Inc. (“Jimmy John’s”). Compl., ¶¶ 17–18. Jimmy John’s requires its franchisee restaurants to use point-of-sale (“POS”) systems from Defendant Signature Systems, Inc. (“Signature”). Id. at ¶ 17. Signature is the owner, operator, and vendor of POS systems for commercial enterprises, including

restaurants, casinos, and other hospitality venues. Id. at ¶ 8. After Smith began her employment with the Jimmy John’s restaurant at Evergreen Park (“Evergreen Park Facility”), Signature scanned and collected Smith’s fingerprints. Id. at ¶ 19. During her employment, the Evergreen Park Facility required her to use her fingerprint at the POS system to clock in and clock out of work on a daily basis. Id. at ¶ 20. Copies of the fingerprints were stored in Signature’s

electronic fingerprint database. Id. at ¶¶ 19–20. Signature’s fingerprint matching technology compared Smith’s scanned fingerprint against the fingerprints previously stored in Signature’s database. Id. Because Smith’s fingerprint matched those previously stored in the database, she was able to clock in and out of work. Id. at ¶ 20. Smith says she did not consent, agree, or give permission to Signature to collect or store her biometric information or identifiers. Id. at ¶ 21. Signature never

presented Smith with a written release allowing Signature to collect or store her fingerprints, and Smith never signed one. Id. at ¶ 22. Signature never presented Smith with a statutory disclosure or an opportunity to prohibit or prevent the collection, storage, or use of her fingerprints, and never presented her with a retention schedule or guidelines for permanently destroying her fingerprints. Id. at ¶¶ 23–24. Signature also does not publicly provide a retention schedule or guidelines for permanently destroying the biometric identifiers and/or biometric information of Smith or the proposed class members. Id. at ¶¶ 25, 38. Smith brings claims on behalf of herself and a proposed class of individuals defined as “all individuals who had their

fingerprints collected, captured, received, or otherwise obtained, and/or stored, by Defendant in Illinois.” Id. at ¶ 26. II. Standard A motion to dismiss tests the sufficiency of a complaint, not the merits of the case. Gibson v. City of Chi., 910 F.2d 1510, 1520 (7th Cir. 1990). “To survive a motion to dismiss under Rule 12(b)(6), the complaint must provide enough factual information

to state a claim to relief that is plausible on its face and raise a right to relief above the speculative level.” Haywood v. Massage Envy Franchising, LLC, 887 F.3d 329, 333 (7th Cir. 2018) (quotations and citation omitted); see also Fed. R. Civ. P. 8(a)(2) (requiring a complaint to contain a “short and plain statement of the claim showing that the pleader is entitled to relief.”). A court deciding a Rule 12(b)(6) motion accepts plaintiff’s well-pleaded factual allegations as true and draws all permissible inferences in plaintiff’s favor. Fortres Grand Corp. v. Warner Bros. Entm't Inc., 763

F.3d 696, 700 (7th Cir. 2014). A plaintiff need not plead “detailed factual allegations”, but “still must provide more than mere labels and conclusions or a formulaic recitation of the elements of a cause of action for her complaint to be considered adequate under Federal Rule of Civil Procedure 8.” Bell v. City of Chi., 835 F.3d 736, 738 (7th Cir. 2016) (citation and internal quotation marks omitted). Dismissal for failure to state a claim is proper “when the allegations in a complaint, however true, could not raise a claim of entitlement to relief.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 558, 127 S. Ct. 1955, 1966 (2007). Deciding the

plausibility of the claim is “‘a context-specific task that requires the reviewing court to draw on its judicial experience and common sense.’” McCauley v. City of Chi., 671 F.3d 611, 616 (7th Cir. 2011) (quoting Ashcroft v. Iqbal, 556 U.S. 662, 679, 129 S. Ct. 1937, 1950 (2009)). III. Analysis A. BIPA

The Illinois General Assembly adopted the Biometric Information Privacy Act (“BIPA”), 740 Ill. Comp. Stat. Ann. 14/1 et seq., in 2008 in response to increased commercial use of biometric data. Cothron v. White Castle Sys., Inc., 20 F.4th 1156, 1159 (7th Cir. 2021). The Act protects a person’s privacy interests in his or her biometric identifiers, including fingerprints, retina and iris scans, hand scans, and facial geometry, by regulating the collection, use, retention, disclosure, and dissemination of biometric identifiers, providing a cause of action for persons

“aggrieved” by a statutory violation. Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1148 (7th Cir. 2020); see also Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 620 (7th Cir. 2020), as amended on denial of reh’g and reh’g en banc (June 30, 2020). Under BIPA, a plaintiff can recover the greater of actual damages or statutory damages of $1,000 for each negligent violation and $5,000 for each reckless or willful violation. See Cothron, 20 F.4th at 1159. Smith’s complaint implicates two BIPA sections. Section 15(a) requires private entities “in possession of biometric identifiers or biometric information” to “develop a written policy, made available to the public, establishing a retention schedule and

guidelines for permanently destroying biometric identifiers and biometric information.” 740 ILCS 14/15(a). Under Section 15(b), a private entity may not “collect, capture, purchase, receive through trade, or otherwise obtain” a person’s biometric data without first providing notice to and receiving consent from the person. Id. § 14/15(b). B. Extraterritoriality Doctrine

Signature argues that Smith’s complaint is barred by the “extraterritoriality doctrine.” Under Illinois law, a “statute is without extraterritorial effect unless a clear intent in this respect appears from the express provisions of the statute.” Avery v. State Farm Mut. Auto. Ins. Co., 216 Ill. 2d 100, 184–85 (2005) (cleaned up). In the absence of such an intent, a plaintiff may only maintain a cause of action under an Illinois statute if “the circumstances that relate to the disputed transaction occur[red] primarily and substantially in Illinois.” Id. at 187; see also Morrison v. YTB Int'l, Inc.,

649 F.3d 533, 536 (7th Cir. 2011). Because “none of BIPA’s express provisions indicates that the statute was intended to have extraterritorial effect…BIPA does not apply extraterritorially.” Marsh v. CSL Plasma Inc., 503 F. Supp. 3d 677, 686 (N.D. Ill. 2020) (quoting Monroy v. Shutterfly, Inc., 2017 WL 4099846, at *5 (N.D. Ill. Sept. 15, 2017)). Smith does not dispute that this means that the relevant events in this case must have occurred primarily and substantially in Illinois. The Court finds that the complaint contains sufficient allegations from which it can infer that the alleged BIPA violations occurred primarily and substantially in Illinois. Smith alleges that Signature “scans and collects, and then indefinitely stores

in an electronic database, digital copies of its client’s employees’ fingerprints … in its databases of fingerprints in Illinois, as well as whenever employees clock in and out of work and/or attempt to access a point-of-sale system at one of Defendant’s clients’ Illinois-based locations where Defendant’s biometrics technology is used…” Compl., ¶ 14 (emphases added). Smith alleges that, during her employment at the restaurant in Evergreen Park, Illinois, Signature, through its POS system, “scanned and

collected, and stored in an electronic database, digital copies of [Smith’s] fingerprints.” Id. at ¶¶ 18, 19. She alleges that the fingerprints were and are collected and stored by Signature at a facility in Cook County, Illinois, and used by Signature at facilities in Cook County, Illinois. Id. at ¶ 9. Further, during her employment Smith used her fingerprints to clock in and out of work at the Evergreen Park Facility on a daily basis. Id. at ¶¶ 18, 20. “The fingerprint scanner … scanned, collected and stored her fingerprint each time she attempted to clock in and out of work.” Id. at ¶

20. Signature’s “sophisticated fingerprint matching technology then compared [Smith’s] scanned fingerprint against the fingerprints previously stored in [Signature’s] fingerprint database.” Id. Accepting these allegations as true at this stage, as the Court must, the Court can infer that Smith scanned her fingerprints into Signature’s system in Illinois, that Signature collected the biometric information in Illinois, and that Signature stores the biometric information on its database in Illinois. Indeed, “there is no single formula or bright-line test for determining whether a transaction occurs within [Illinois]” and “each case must be decided on its own facts.” Vance v. Int'l Bus.

Machines Corp., 2020 WL 5530134, at *3 (N.D. Ill. Sept. 15, 2020) (quoting Avery, 216 Ill. 2d at 187). Courts in this district acknowledge that such a determination is “generally inappropriate for the motion to dismiss stage” and requires discovery. Id.; see also Rivera v. Google, Inc., 238 F. Supp. 3d 1088, 1101–02 (N.D. Ill. 2017); Monroy, 2017 WL 4099846, at *6. Signature relies on Vulcan Golf, LLC v. Google, Inc., 552 F. Supp. 2d 752 (N.D. Ill.

2008), but in that case the court found that plaintiff failed to plausibly allege a statutory violation (under the Illinois Consumer Fraud Act) that occurred “primarily and substantially” in Illinois. Smith has done so here. Likewise, in Neals v. PAR Tech. Corp., the court explained that, while plaintiff need only present “a story that holds together,” the plaintiff did not allege that she scanned her fingerprints into defendant’s system in Illinois, nor did she specify the location of the restaurant where she worked. 419 F. Supp. 3d 1088, 1091 (N.D. Ill. 2019). Smith makes those

allegations here. See Compl., ¶¶ 14, 18–20.1

1 In Marsh, 503 F. Supp. 3d at 686, the Court found BIPA could extend to plaintiff’s proposed class claims because “the proposed classes are limited to persons who enrolled in the biometric system at Illinois facilities.” Similarly, Smith’s proposed class is defined as those “who had their fingerprints collected, captured, received, or otherwise obtained and/or stored, by Defendant in Illinois.” Compl., ¶ 26. For these reasons the Court does not agree that the extraterritoriality doctrine bars Smith’s complaint.2 C. Section 15(a)

Smith claims that Signature violated Section 15(a) of BIPA. Signature contends that Smith has failed to allege that Signature has “possession” of her fingerprints because she has failed to show that Signature has or has taken control over her fingerprints or holds them at its disposal. [13] at 7. BIPA does not define “possession.” See 740 ILCS 14/10. Where the statute does not define a term, the court “assumes the legislature intended for [the term] to have

its popularly understood meaning,” or its “settled legal meaning” if one exists. Heard v. Becton, Dickinson & Co. (Heard I), 440 F. Supp. 3d. 960, 968 (N.D. Ill. 2020) (cleaned up). The Illinois Supreme Court has held that “possession, as ordinarily understood, occurs when a person has or takes control of the subject property or holds the property at his or her disposal.” Id. (quoting People v. Ward, 215 Ill. 2d 317, 325 (2005)) (internal quotation marks omitted). The Heard court also noted that possession requires some dominion or control over the data but does not require

exclusive control. Id.; see also Namuwonge v. Kronos, Inc., 418 F. Supp. 3d 279, 283 (N.D. Ill. 2019). Smith has alleged that Signature “indefinitely stores in an electronic database, digital copies of its client’s employees’ fingerprints … in its databases of fingerprints in Illinois.” Compl., ¶ 14. In addition, Smith alleges that Signature, through its POS

2 If facts are revealed in discovery showing that the complaint is barred by this doctrine, Signature may seek relief through an appropriate motion at that time. system, “scanned and collected, and stored in an electronic database, digital copies of [her] fingerprints.” Id. at ¶¶ 18, 19. She alleges that the fingerprints were and are collected, stored, and used by Defendant at facilities in Cook County, Illinois. Id. at ¶

9. And she alleges that, each time she used her fingerprints to clock in and out of work at the Evergreen Park Facility on a daily basis during her employment, Signature “sophisticated fingerprint matching technology then compared [her] scanned fingerprint against the fingerprints previously stored in [Signature’s] fingerprint database.” Id. at ¶¶ 18, 20. Smith’s allegations, viewed as a whole and in her favor, plausibly allege that

Signature was in possession of users’ biometric data and that Signature exercises “some form of control” over the data. See Heard v. Becton, Dickinson & Co. (Heard II), 524 F. Supp. 3d 831, 840 (N.D. Ill. 2021). See also Namuwonge, 418 F. Supp. 3d at 284 (“possession” sufficiently alleged); Naughton v. Amazon.com, Inc., 2022 WL 19324, at *4 (N.D. Ill. Jan. 3, 2022) (same). At this pleading stage, “[p]laintiff need not show in granular detail the precise means by which users’ biometric data travelled from [the] devices to [defendant’s] servers...” Heard II, 524 F. Supp. 3d at

840. Smith has stated a claim under Section 15(a). D. Section 15(b) Signature argues that Smith fails to plausibly state that Signature obtained her biometric data under section 15(b), which makes it unlawful to “collect, capture, purchase, receive through trade, or otherwise obtain” a person’s biometric data without his or her consent. 740 ILCS 14/15(b). Signature emphasizes that courts in this district have interpreted section 15(b) to impose liability only if an entity takes, at a minimum, “an active step to collect, capture, purchase or otherwise obtain biometric data.” Jacobs v. Hanwha Techwin Am., Inc., 2021 WL 3172967, at *2 (N.D.

Ill. July 27, 2021) (emphasis added). In Heard II, where defendant collected and then stored fingerprints on its servers, the court found it “fair to conclude that [defendant] collected or otherwise obtained the data for purposes of Section 15(b).” 524 F. Supp. 3d at 841. This Court agrees with that analysis and that in King v. PeopleNet Corp.: “Even if the statute requires a showing that PeopleNet took an ‘active step’ towards collection of biometric

information, plaintiff's claim survives that test because the complaint spells out how PeopleNet obtained King's information.” 2021 WL 5006692, at *8 (N.D. Ill. Oct. 28, 2021).3 Smith has alleged sufficient facts for the Court to infer that Signature did “collect, capture, … or otherwise obtain” her fingerprints. 740 ILCS 14/15(b). Smith alleged that Signature, through its POS system, “scans and collects, and then indefinitely stores in an electronic database, digital copies of its client’s employees’ fingerprints”

both during employees’ enrollment and when they clock in and out of work. Compl., ¶¶ 14, 18, 19. She alleges that “the fingerprint scanner … scanned, collected and stored her fingerprint each time she attempted to clock in and out of work.” Id. at ¶ 20. Since Signature provides Jimmy John’s franchisee restaurants with its POS

3 As the court observed in Figueroa v. Kronos, the two sections, 15(a) and (b) have independent purposes and coverage, and Section 15(a) imposes “different obligations” than Section 15(b). 454 F. Supp. 3d 772, 784 (N.D. Ill. 2020). systems, the Court can infer that Signature obtained Smith’s fingerprints. Not only that, if Signature then compared newly scanned fingerprints to those already stored in its database, it is likely it “obtained” the data from the POS system it supplied to

the Evergreen Park Facility. Id.; see Figueroa, 454 F. Supp. 3d at 784 (finding that if defendant “stored,” “used,” and “disclosed” plaintiffs’ biometric data, it necessarily first had to “obtain” the data). Signature contends that “her employer, not Signature Systems, collected her biometric data.” [13] at 10. However, Smith specified that Signature collects the biometric data and the data is stored in Signature’s electronic database. Compl., ¶¶

14, 19, 20. While a defendant “may ultimately prevail” through discovery or trial on the point that it is the employer, not the defendant, that stores users’ biometric information on their own systems and servers, the plaintiff “is not required to prove the merits of his claims at the pleading stage.” Heard II, 524 F. Supp. 3d at 841. In addition, Signature maintains that Smith’s allegations “merely parrot[]” the statutory language in Section 15(b). [13] at 10. Smith has done more. See Compl., ¶¶ 9, 14, 18—20. See Heard II, 524 F.Supp.3d at 841 (plaintiff’s allegation that

defendant’s device stores users’ biometric information both on the device and in defendant’s servers suggests that the defendant “plays an active role in collecting or otherwise obtaining users’ biometric information from [defendant’s] devices”). Smith’s allegations are more specific than other Section 15(b) claims which have been dismissed by other courts. See Heard I, 440 F. Supp. 3d at 967 (finding the complaint deficient because plaintiff “does not allege how the data made it to [defendant’s] systems”); Jacobs, 2021 WL 3172967, at *3 (plaintiff’s 15(b) claim merely made “some passing reference to a server” without an allegation that “defendant allegedly stor[es] any biometric data on a server”); Bernal v. ADP, LLC,

2019 WL 5028609 (Ill. Cir. Ct. Aug. 23, 2019) (plaintiff failed to allege facts beyond asserting that defendant supplied employer with the biometric scanning technology). Here, Smith has stated a claim under Section 15(b). E. Negligence, Recklessness, or Intent Signature argues that Smith fails to state a claim because she does not plead negligence, recklessness, or intent. This Court disagrees, and instead agrees with the

analysis in Cothron v. White Castle Sys., Inc., addressing the same argument: “allegations of scienter or no, [the] complaint states a plausible claim for relief under sections 15(b) and 15(d); Rule 12(b)(6) does not require her to plead the facts that will determine the amount of actual damages she may be entitled to recover.” 467 F. Supp. 3d 604, 615 (N.D. Ill. 2020). See also Bradenberg v. Meridian Senior Living, LLC, 2021 WL 4494275, at *6 (C.D. Ill. Sept. 30, 2021) (BIPA plaintiffs need not plead negligence, intentionality, or recklessness); Rivera, 238 F. Supp. 3d at 1104 (denying

defendant’s motion to dismiss BIPA suit and reasoning that further discovery would be needed about whether defendant took reasonable steps to comply); Neals, 419 F. Supp. 3d at 1092 (rejecting argument that plaintiff failed to sufficiently allege a negligent, reckless, or intentional violation of the BIPA); Hedick v. The Kraft Heinz Co., 2021 WL 3566602, at *3 (N.D. Ill. Aug. 11, 2021) (noting the Seventh Circuit’s cautioning against piecemeal dismissals of parts of claims under Rule 12(b)(6)). IV. Conclusion For the stated reasons, Signature Systems’ Motion to Dismiss [12] is denied.

ENTER:

Dated: February 28, 2022 Marg [Vi bo L/ MARY M. ROWLAND United States District Judge