Taylor v. 48forty Solutions, LLC

• Court: District Court, N.D. Illinois
• Decided: April 9, 2024
• Docket: 1:23-cv-14400
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION

BARRY TAYLOR, individually and on ) behalf of all others similarly situated, ) ) Plaintiff, ) ) v. ) 23 C 14400 ) 48FORTY SOLUTIONS, LLC, ) ) Defendant. )

MEMORANDUM OPINION

CHARLES P. KOCORAS, District Judge:

Plaintiff Barry Taylor brings this putative class action against his former employer, 48forty Solutions, Inc. (“Defendant” or “48forty”), which contracted with a technology company to install a driver-facing camera within the cab of its trucks to conduct continuous, real-time surveillance of him and other drivers. Plaintiff alleges that in doing so, Defendant violated multiple sections of Illinois’s Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/1, et seq. Before the Court is Defendant’s Motion to Dismiss Plaintiff’s Complaint. For the reasons that follow, Defendant’s Motion is denied. BACKGROUND The following facts come from the complaint and are assumed true for the purpose of this motion. Alam v. Miller Brewing Co., 709 F.3d 662, 665–66 (7th Cir. 2013). All reasonable inferences are drawn in Plaintiff’s favor. League of Women Voters of Chi. v. City of Chicago, 757 F.3d 722, 724 (7th Cir. 2014).

From November 2022 through June 2023, Defendant employed Plaintiff as a truck driver. Defendant contracted with the technology company, Lytx, Inc. (“Lytx”), to outfit its fleet with “Machine Vision + Artificial Intelligence” (“MV+AI”) driver- surveillance technology, including driver-facing cameras (called “DriveCam”). As a

result, drivers of vehicles equipped with DriveCams, like Plaintiff, were required to submit to repeated scans of their face geometry as part of their employment. DriveCam sends still-frames from a video feed for analysis by its MV+AI algorithm which collects unique biometric data points (or “landmarks”) from a driver’s

facial features. It then compares the data points across multiple images to determine whether the driver is engaging in risky behavior, such as smoking, eating, or drinking; using a handheld device; or being inattentive. In other words, DriveCam collects video of a driver’s face and sends the images to the MV+AI algorithm, which collects and compares scans of facial geometry, determines from the scans whether the face data

suggests a driver is engaging in risky driving behavior, and, if so, provides a real-time alert. Defendant did not notify Plaintiff or putative class members it was collecting their biometrics, nor did Defendant obtain written consent before doing so. Defendant

also did not inform Plaintiff and the putative class members how it would use the biometrics it collected or how long the data would be stored. Based on the above, Plaintiff filed his complaint on August 15, 2023, in the Circuit Court of Cook County, Illinois. He alleges Defendant violated Sections 15(a),

15(b), and 15(d) of BIPA. Defendant removed the action to this Court on the basis of diversity jurisdiction and the Class Action Fairness Act (“CAFA”), 28 U.S.C. § 1332(d), and now moves to dismiss Plaintiff’s complaint in its entirety under Federal Rule of Civil Procedure 12(b)(6). Defendant also argues that Plaintiff lacks standing to

pursue his Section 15(a) claims, and therefore we construe the motion as also brought under Rule 12(b)(1). LEGAL STANDARD “[A]s always, ‘subject-matter jurisdiction is the first issue in any case.’” Woods

v. FleetPride, Inc., 2022 WL 900163, at *3 (N.D. Ill. 2022) (quoting Miller v. Sw. Airlines Co., 926 F.3d 898, 902 (7th Cir. 2019)). If, after removal of a case from a state court, it “appears that the district court lacks subject matter jurisdiction, the case shall be remanded.” Id. (quoting 28 U.S.C. § 1447(c)) (cleaned up). It is the party seeking removal that “bears the burden of establishing federal jurisdiction.” Id. (quoting Tri-

State Water Treatment, Inc. v. Bauer, 845 F.3d 350, 352 (7th Cir. 2017)). “For there to be a case or controversy under Article III, the plaintiff must have a personal stake in the case—in other words, standing.” TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2203 (2021) (cleaned up). To establish standing under Article III, a

plaintiff must show: “(i) that he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief.” Id. (cleaned up). To be concrete, an injury must be a “harm that is real, not abstract, but not necessarily

tangible.” Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1555–56 (2016). A motion to dismiss under Rule 12(b)(6) “tests the sufficiency of the complaint, not the merits of the case.” McReynolds v. Merrill Lynch & Co., 694 F.3d 873, 878 (7th Cir. 2012). The Court accepts as true well-pleaded facts in the complaint and draws all

reasonable inferences in favor of the plaintiff. AnchorBank, FSB v. Hofer, 649 F.3d 610, 614 (7th Cir. 2011). The allegations in the complaint must set forth a “short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). A plaintiff need not provide detailed factual allegations, but it must provide

enough factual support to “raise a right to relief above the speculative level.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). The claim must be described “in sufficient detail to give the defendant ‘fair notice of what the . . . claim is and the grounds upon which it rests.’” E.E.O.C. v. Concentra Health Servs., Inc., 496 F.3d 773, 776 (7th Cir. 2007) (quoting Twombly, 550 U.S. at 555). “Threadbare recitals of the

elements of a cause of action, supported by mere conclusory statements,” are insufficient to withstand a Rule 12(b)(6) motion to dismiss. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). A claim is facially plausible if the complaint contains sufficient alleged facts that allow the court “to draw the reasonable inference that the defendant

is liable for the misconduct alleged.” Id. DISCUSSION First, a few key definitions. BIPA contemplates two types of biometric data:

“biometric identifiers” and “biometric information.” A “biometric identifier” is “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILCS 14/10. “Biometric information” is “any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to

identify an individual.” Id. Any person “aggrieved” by a violation of BIPA “shall have a right of action against an offending party,” 740 ILCS 14/20, and Plaintiff claims he was aggrieved by Defendant’s violations of three distinct sections of BIPA: Sections 15(a), 15(b), and

15(d). 740 ILCS 14/15(a)–(b), (d). Section 15(a) requires that entities “in possession of” biometric data develop a publicly available retention schedule and destruction deadline for that data. 740 ILCS 14/15(a). Section 15(b) requires that entities collecting biometric data first inform the subject in writing that they are doing so, as well as state the specific purpose for its collection, storage, and use, and the length of time that they

will store it. 740 ILCS 14/15(b)(1)–(2). Section 15(b) also requires that entities collecting biometric data receive written authorization. 740 ILCS 14/15(b)(3). And Section 15(d) prohibits the disclosure or dissemination of a person’s biometric identifier or information unless certain conditions are met. 740 ILCS 14/15(d). I. Section 15(a) Section 15(a) provides, in part:

A private entity in possession of biometric identifiers or information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the private entity, whichever occurs first.

740 ILCS 14/15(a). Additionally, a private entity in possession of biometric identifiers or information “must comply” with its established data-retention schedule and destruction guidelines “[a]bsent a valid warrant or subpoena” to the contrary. Id. Thus, Section 15(a) imposes two separate requirements. First, a private entity must develop and make available to the public a written retention and destruction policy, and second, it must comply with that policy. At the outset, the Court makes the following observations regarding Defendant’s litigation tactics. After Defendant removed this case from state court, and in so doing affirmatively acknowledged this Court’s subject matter jurisdiction1, Defendant nonetheless immediately moved to dismiss Plaintiff’s Section 15(a) claim contending an absence of subject matter jurisdiction. Specifically, Defendant argues Plaintiff lacks standing to pursue a Section 15(a) claim because Plaintiff did not suffer a concrete injury as a result of the alleged violation of this Section. The Seventh Circuit has

1 In the Notice of Removal, Defendant claimed this Court has both diversity jurisdiction and jurisdiction under CAFA. Dkt. # 1. admonished that this is a “dubious strategy” that results “in a significant waste of federal judicial resources, much of which [is] avoidable.” Collier v. SP Plus Corp., 889 F.3d

894, 897 (7th Cir. 2018); see also Zachary D. Clopton & Alexandra D. Lahav, Fraudulent Removal, 135 Harv. L. Rev. F. 87, 103 (2021) (naming this practice “fraudulent removal” and noting it “is an example of a litigation practice that abuses the civil justice system, increases costs for both parties, and drains judicial resources”).

Nevertheless, because it is the responsibility of a court to make an independent evaluation of whether subject matter jurisdiction exists in every case, Foster v. Hill, 497 F.3d 695, 696–97 (7th Cir. 2007), we will proceed with the analysis. The Seventh Circuit’s decisions in Bryant v. Compass Group USA, Inc., 958 F.3d

617 (7th Cir. 2020), and Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146 (7th Cir. 2020), address whether and when a Section 15(a) BIPA claim satisfies Article III standing. In Bryant, the court held that a plaintiff lacked standing to bring a Section 15(a) claim for failure to publicly disclose a retention policy and schedule for the destruction of biometric data. 958 F.3d at 626. The plaintiff had not alleged a

“concrete and particularized injury” from the defendant’s statutory violation because “the duty to disclose under section 15(a) is owed to the public generally, not to particular persons whose biometric information the entity collects.” Id. This is the position Defendant takes in this case.

However, in Fox—which Defendant does not even mention—the Seventh Circuit clarified that some Section 15(a) claims may satisfy Article III standing. 980 F.3d at 1149. In that case, the court held that the plaintiff had standing to bring a Section 15(a) claim alleging that her former employer had failed to “develop, publicly disclose,

and comply with data retention and destruction policies.” Id. (emphasis in original). This made her Section 15(a) claim “much broader than Bryant’s.” Id. at 1154. The plaintiff in Fox further alleged that her former employer had unlawfully retained her biometric data after she left. Id. at 1150. The court observed that “an unlawful retention

of a person’s biometric data is as concrete and particularized an injury as an unlawful collection of a person’s biometric data” in violation of Section 15(b). Id. at 1155 (emphasis in original). So, the question is whether Plaintiff merely alleges Defendant’s failure to

develop and disclose a retention and destruction policy or alleges more—like unlawful retention. Plaintiff argues his allegations are more akin to Fox, but this argument is not supported by the complaint; the complaint mainly focuses on Defendant’s lack of written policy.2 The sole allegation in the complaint relating to unlawful retention is that Defendant “did not delete its workers[’] biometric identifiers or biometric

information within three years of its last interaction with those workers as required by BIPA.”3 Dkt. # 1-1, ¶ 31 (emphasis added). Considering that Plaintiff’s employment

2 Plaintiff argues in his response that Defendant failed to comply with a policy that adhered to Section 15(a), but that is not quite what is alleged in the complaint.

3 The complaint also states that a common class question is “[w]hether Defendant published a written policy establishing a retention schedule and biometric-destruction guidelines.” Dkt. # 1-1, ¶ 40(b). There is nothing regarding unlawful retention. with Defendant just ended in June 2023, this allegation alone is insufficient to establish Article III standing. Without more allegations regarding retention of Plaintiff’s

biometrics after the initial purpose for collection had ended, any Section 15(a) claim for unlawful retention is likely unripe. Horn v. Method Prods., PBC, 2022 WL 1090887, at *4 (N.D. Ill. 2022); see also Kislov v. Am. Airlines, Inc., 566 F. Supp. 3d 909, 914 (N.D. Ill. 2021) (where collection of biometrics did not occur more than three years

prior to the filing of the complaint, “[a]ny claim for unlawful retention of biometric data is likely not yet ripe”). While Plaintiff’s claim for failure to develop and disclose a retention policy is ripe, Plaintiff does not have standing to pursue such a claim in federal court without also adequately contending that Defendant unlawfully retained his

biometric information. See Fox, 980 F.3d at 1154–55. Plaintiff asks the Court to sever and remand his Section 15(a) claim to state court in the event the Court finds a lack of standing, as we have just concluded. Defendant does not address this possibility in its reply, and we agree with Plaintiff that remand of the claim would be the proper course of action. See 28 U.S.C. § 1447(c) (“If at any

time before final judgment it appears that the district court lacks subject matter jurisdiction, the case shall be remanded” to the state court); Bergquist v. Mann Bracken, LLP, 592 F.3d 816, 819 (7th Cir. 2010) (if some parts of the case lie within federal jurisdiction but others do not, “the federal court must resolve the elements within

federal jurisdiction and remand the rest—unless the balance can be handled under the supplemental jurisdiction” statutes) (citing 28 U.S.C. §§ 1367(c)(3), 1441(c)). However, given that Plaintiff attempts to argue he does have standing to bring this claim in federal court, the Court will permit him to file an amended complaint, if

he wishes to do so, that contains sufficient allegations which establish Article III standing. If Plaintiff declines to amend the complaint, the Court will sever Plaintiff’s Section 15(a) claim and remand it to state court. II. Section 15(b)

Defendant moves to dismiss Plaintiff’s Section 15(b) claims because Plaintiff failed to allege that (1) Defendant used facial scans to identify drivers, and (2) Defendant’s software was even capable of doing so. Defendant’s first argument is a nonstarter. Courts have concluded that “a

biometric identifier is a unique personal feature that can be used to identify a person.” Carpenter v. McDonald’s Corp., 580 F. Supp. 3d 512, 515 (N.D. Ill. 2022) (citing Rivera v. Google, Inc., 238 F. Supp. 3d 1088, 1096 (N.D. Ill. 2017)). “Importantly, under this understanding a defendant may violate BIPA even without using technology for the purpose of identifying an individual; instead, BIPA bars the collection of

biometric data that ‘merely could be used to identify a plaintiff.’” Konow v. Brink’s, Inc., 2024 WL 942553, at *2 (N.D. Ill. 2024) (quoting Carpenter, 580 F. Supp. 3d at 518 n.2) (emphasis in original). “Given that the purpose of the facial scan need not be to identify, the allegation that [Defendant] scanned and collected Plaintiff’s facial

geometry plausibly states a BIPA claim.” Id. at *3 (internal citation omitted). As for Defendant’s second argument, that Plaintiff has not alleged the technology is capable of identifying the individual drivers, recent cases in this District have

concluded that, to allege the collection of biometric identifiers, a plaintiff must show that the collected data could be used, “whether alone or in conjunction with other methods or sources of information available,” to identify them. Castelaz v. Estée Lauder Cos., Inc., 2024 WL 136872, at *7 (N.D. Ill. 2024); see also Clark v. Aveda

Corp., 2023 WL 9119927, at *2 (N.D. Ill. 2023). Plaintiff’s complaint plausibly pleads such a connection. In Konow, a case with nearly identical facts and allegations, the court reasoned: Plaintiff alleges that “Defendant used the SmartSense technology to collect scans of Plaintiff’s facial geometry to analyze his driving behavior.” If Brink’s collected Plaintiff’s facial scans to “analyze his driving behavior,” the obvious inference is that Brink’s could (and did) tie the scans to Konow’s identity. How else would they use the scans to assess his performance? True, Konow does not explicitly describe how, exactly, Defendant tied (or could have tied) SmartDrive’s facial scans to Konow’s identity, and a more detailed Complaint could have been helpful. But Konow was Brink’s employee and he was driving their truck, which creates the natural inference that Brink’s had the means to connect whatever facial scans they took to the individual truck driver’s identity.

2024 WL 942553, at *5.

Similarly, here, Plaintiff alleges that the DriveCam was utilized to monitor the drivers “for the purpose of evaluating their work quality.” Dkt. # 1-1, ¶ 22. The obvious inference from this is that Defendant could (and did) tie the scans to Plaintiff’s identity. Thus, Plaintiff has pleaded sufficient facts that Defendant had access to other personal data of his that, in conjunction with the facial scans, could have been used to identify him. Defendant’s motion to dismiss is denied with respect to Plaintiff’s Section 15(b) claims.

III. Section 15(d) Section 15(d) generally prohibits private entities from disclosing, redisclosing, or otherwise disseminating BIPA information without consent. 740 ILCS 14/15(d). Defendant argues Plaintiff’s Section 15(d) claim should be dismissed because Plaintiff

has not sufficiently pleaded any “disclosure.” Instead, Defendant maintains that Plaintiff has merely parroted BIPA’s language regarding disclosure or dissemination, which does not suffice. See Carpenter, 580 F. Supp. 3d at 519 (dismissing Section 15(d) claim where “all of Plaintiff’s allegations regarding disclosure,

redisclosure, or dissemination are conclusions that parrot BIPA’s language”). Plaintiff alleges Defendant uses the DriveCam technology to harness his biometrics and then shares this data with Lytx for storage and analysis. These allegations are quite thin, but the allegation that Lytx stores the data on its servers makes it at least plausible that Defendant discloses data to Lytx in violation of BIPA and

potentially to other unknown parties because Lytx’s servers could be backed up in third- party data centers. See, e.g., Heard v. Becton, Dickinson & Co. (“Heard II”), 524 F. Supp. 3d 831, 843 (N.D. Ill. 2021) (amended complaint suggested dissemination through affirmative allegations that the employer disseminated biometric information

to third-party data centers); Naughton v. Amazon.com, Inc., 2022 WL 19324, at *4 (N.D. Ill. 2022) (finding sufficient the allegations that Amazon had collected the plaintiff’s facial geometry, disclosed that data to “other Amazon entities” and to “third- party biometric device and software vendor(s)” and other possible third parties);

Cothron v. White Castle Sys., Inc., 467 F. Supp. 3d 604, 618 (N.D. Ill. 2020) (the plaintiff stated a Section 15(d) claim where she pleaded that her employer used a software system provided by a specific third party, which suggested dissemination). Defendant’s motion to dismiss is denied as to Plaintiff’s Section 15(d) claim.

IV. Pleading Recklessness or Intent Finally, BIPA provides that a plaintiff may recover statutory damages of $1,000 for each negligent violation and $5,000 for each reckless or intentional violation. See 740 ILCS 14/20(1)–(2). Plaintiff’s request for relief seeks both, in the alternative,

depending on which state of mind each Defendant is found to have had. BIPA also provides other forms of relief—declaratory, injunctive, and reasonable attorneys’ fees and costs—which Plaintiff also seeks. Defendant contends Plaintiff has not pleaded sufficient facts supporting a plausible inference that Defendant’s conduct was reckless or intentional and asks the Court to dismiss or strike Plaintiff’s request for $5,000 for

“each and every intentional and reckless violation of BIPA.” Dkt. # 1-1, at 9. But the remedies Plaintiff seeks are distinct from Plaintiff’s underlying BIPA claim. Defendant’s state of mind “has no bearing on the plausibility of Plaintiff’s alleged BIPA claims themselves but will merely determine what damages Plaintiff may

recover for any BIPA violation.” Kyles v. Hoosier Papa LLC, 2023 WL 2711608, at *7 (N.D. Ill. 2023). In other words, Defendant’s state of mind relates only to what relief Plaintiff may seek if he establishes a BIPA violation. /d. Plaintiff, therefore, is not required to plead facts showing negligence, recklessness, or intentional conduct to state

a BIPA claim. See Sosa v. Onfido, Inc., 600 F. Supp. 3d 859, 875 (N.D. Ill. 2022) (collecting cases). CONCLUSION For the foregoing reasons, Defendant’s Motion to Dismiss [17] is denied. Telephonic status hearing is set for 4/25/2024 at 9:50 a.m. at which time Plaintiff should be prepared to inform the Court how he wishes to proceed with his Section 15(a) claim. For the telephonic status hearing, parties are to use the following call-in number: (888) 684-8852, conference code 8819984. It is so ordered.

Charles P. Kocoras United States District Judge

Date: April 9, 2024