Kalb v. Gardaworld Cashlink LLC

UNITED STATES DISTRICT COURT

CENTRAL DISTRICT OF ILLINOIS

PEORIA DIVISION

CHRIS KALB, on behalf of himself and )

all others similarly situated, )

)

Plaintiff, )

) Case No. 1:21-cv-01092

v. )

)

GARDAWORLD CASHLINK LLC, )

)

Defendant. )

ORDER & OPINION

This matter is before the Court on Plaintiff Chris Kalb’s Motion to sever and

partially remand. (Doc. 10). Defendant has responded (doc. 11), so this matter is ripe

for review. For the following reasons, the Motion is denied.

DISCUSSION

Plaintiff filed this putative class action alleging violations of the Illinois

Biometric Information Privacy Act (BIPA), 740 ILCS 14/1, et seq., in the Eleventh

Judicial Circuit Court in McLean County, Illinois. Defendant1 timely removed the

case to this Court on March 16, 2021. The Complaint raises claims under sections

15(a) and (b) of BIPA. (Doc. 1-1 at 9–10). Section 15(b) requires informed consent to

“collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a

1 Defendant reports Plaintiff has incorrectly sued GardaWorld CashLink LLC, and

the proper defendant in this matter is Garda CL Great Lakes, Inc. (Doc. 1 at 1). The

two are seemingly related entities, and all filings from the defense thus far have been

made on both entities’ behalf.

customer’s biometric identifier or biometric information.” 740 ILCS 14/15(b). Section

15(a) states:

A private entity in possession of biometric identifiers or biometric

information must develop a written policy, made available to the public,

establishing a retention schedule and guidelines for permanently

destroying biometric identifiers and biometric information when the

initial purpose for collecting or obtaining such identifiers or information

has been satisfied or within 3 years of the individual’s last interaction

with the private entity, whichever occurs first. Absent a valid warrant

or subpoena issued by a court of competent jurisdiction, a private entity

in possession of biometric identifiers or biometric information must

comply with its established retention schedule and destruction

guidelines.

740 ILCS 14/15(a). Presently before the Court is the unusual circumstance in which

Defendant bears the burden of proving standing lies while Plaintiff argues he lacks

standing to raise his claim under section 15(a), which he maintains must be severed

and remanded.2 (Docs. 10, 11).

Every case proceeding in federal court must satisfy the familiar elements of

standing; “[t]he plaintiff must have (1) suffered an injury in fact, (2) that is fairly

traceable to the challenged conduct of the defendant, and (3) that is likely to be

redressed by a favorable judicial decision.” Fox, 980 F.3d at 1151 (quoting Spokeo,

Inc. v. Robins, 136 S. Ct. 1540, 1547). The instant Motion challenges the injury-in-

fact element, and a smattering of recent BIPA cases speak to this question: Bryant v.

Compass Group. USA, Inc., 958 F.3d 617 (7th Cir. 2020), as amended on denial of

reh’g and reh’g en banc (June 30, 2020), Miller v. Southwest Airlines Co., 926 F.3d

2 “Where, as here, a case is removed from state court, the roles are reversed and the

burden flips: [i]n this procedural posture, the defendant, as the proponent of federal

jurisdiction, must establish the plaintiff’s Article III standing.” Fox v. Dakkota

Integrated Sys., LLC, 980 F.3d 1146, 1151 (7th Cir. 2020) (citation omitted).

898 (7th Cir. 2019), Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019), cert. denied,

140 S. Ct. 937 (2020), and Fox, 980 F.3d 1146.

Miller involved “unionized airline employees who were required to clock in and

out of work by scanning their fingerprints.” Id. (citing Miller, 926 F.3d at 901). “[T]he

employees alleged that the airlines violated sections 15(a) and (b) of BIPA by failing

to obtain informed consent before collecting and using their fingerprints in the

biometric timekeeping systems, and by failing to maintain and publish data-retention

protocols.” Id. The Seventh Circuit concluded the plaintiffs had demonstrated an

injury in fact “sufficiently concrete to confer Article III standing because the collection

and use of biometrics for timekeeping is a subject of collective bargaining between

unions and management[,]” reasoning:

[T]he stakes . . . include whether the air carriers can use fingerprint

identification. If the unions have not consented, or if the carriers have

not provided unions with required information, a court or adjustment

board may order a change in how workers clock in and out. The prospect

of a material change in workers’ terms and conditions of employment

gives these suits a concrete dimension that Spokeo . . . lacked. Either the

discontinuation of the practice, or the need for the air carriers to agree

to higher wages to induce unions to consent, presents more than a bare

procedural dispute.

Id. at 1152–53 (quoting Miller, 926 F.3d at 902).

In Patel, the plaintiffs “sued Facebook for [violations of sections 15(a) and (b)

of BIPA] stemming from its ‘Tag Suggestions’ feature, which uses facial-recognition

technology to identify whether a user’s Facebook friends are depicted in an uploaded

photo.” Id. at 1153 (citing Patel, 932 F.3d at 1268). The plaintiffs argued Facebook

failed “to maintain and publicly disclose a data-retention schedule and data-

destruction guidelines” and “to obtain written informed consent before collecting and

using biometrics.” Id. (citing Patel, 932 F.3d at 1274). Analogizing the injury at issue

to that suffered in a tort claim for invasion of privacy, the Ninth Circuit concluded:

The Facebook users necessarily suffered a concrete and particularized

injury when Facebook did not obtain their informed consent before

collecting their biometric data and failed to maintain data retention and

destruction protocols to keep their biometric data private. The court

concluded that because BIPA protects concrete privacy interests and the

alleged violations of the statute actually harm[ed] or pose a material

risk of harm to those privacy interests, the plaintiffs had alleged an

injury in fact sufficient to confer Article III standing.

Id. (citing Patel, 932 F.3d at 1274–75) (internal quotation marks omitted).

Plaintiff’s Motion here is premised on Bryant. Bryant involved a vending

machine that did not accept cash; instead, customers had to create and maintain an

electronic payment account, which was accessed at the vending machine via a

fingerprint scanner. Bryant, 958 F.3d at 619. The plaintiff, a customer of the vending

machine, filed a putative class action alleging the owner and operator of the vending

machine committed two BIPA violations: “it ‘never made publicly available’ a data-

retention schedule and data-destruction guidelines, violating section 15(a), and it

never obtained her informed consent in writing, violating section 15(b).” Fox, 980 F.3d

at 1153–54 (citing Bryant, 958 F.3d at 619). Similar to the Ninth Circuit in Patel, the

Seventh Circuit likened some BIPA claims to tortious invasion of privacy. Id. at 1154.

It thus concluded the plaintiff’s claim under section 15(b) involved a concrete,

particularized injury in fact because the plaintiff asserted “a violation of her own

rights—her fingerprints, her private information, which was an invasion of her

private domain, much like an act of trespass would be.” Id. (quoting Bryant, 958 F.3d

at 624). The defendant’s “failure to comply with the informed-consent requirements

of section 15(b) deprived [the plaintiff] of her right to make informed choices about

the use of and control over her inherently sensitive biometric data.” Id. (citing Bryant,

958 F.3d at 626).

However, the Seventh Circuit reached a different conclusion with respect to

her section 15(a) claim, which merely alleged the defendant failed to “make data-

retention and data-destruction policies publicly available.” Id. (citing Bryant, 958

F.3d at 626). “That violation . . . was insufficiently particularized to support [the

plaintiff’s] standing . . . [because] the duty to disclose [data-retention policies] under

section 15(a) is owed to the public generally, not to particular persons whose biometric

information the entity collects.” Id. (quoting Bryant, 958 F.3d at 626). So, because the

plaintiff “allege[d] no particularized harm that resulted from [the defendant’s]

violation of section 15(a),” she lacked standing to assert the section 15(a) claim. Id.

(quoting Bryant, 958 F.3d at 626). However, the plaintiff’s claim in Bryant “was

extremely narrow, alleging only a violation of the section 15(a) duty to publicly

disclose data retention and destruction protocols.” Id. (emphasis in original). The

Seventh Circuit emphasized that its “analysis was limited to the theory the plaintiff

invoked and did not address other provisions in section 15(a).” Id. (quoting Bryant,

958 F.3d at 626).

At first blush, Bryant appears to suggest Plaintiff lacks standing to assert the

claim under section 15(a). Like in Bryant, Plaintiff and the putative class members

(current and former unionized employees of Defendant’s3) challenge Defendant’s

failure to publish—publicly or even to Plaintiff and the putative class members

privately—“a retention schedule or guidelines for permanently destroying the

biometric identifiers and/or biometric information” obtained from Plaintiff and the

putative class members. (Doc. 1-1 at 11). However, unlike in Bryant, Plaintiff further

alleges: “In direct violation of § 15(a) of BIPA, Defendant does not have written,

publicly available policies identifying their retention schedules, or guidelines for

permanently destroying any of these biometric identifiers or biometric information,”

thereby reasonably suggesting Defendant has unlawfully retained this data. (Doc. 1-

1 at 5). This allegation renders Plaintiff’s claim much broader than that alleged in

Bryant, an important distinction emphasized in Fox:

Fox’s section 15(a) claim is much broader than Bryant’s. She does not

allege a mere failure to publicly disclose a data-retention policy. She

accuses [the defendant] of violating the full range of its section 15(a)

duties by failing to develop, publicly disclose, and comply with a data-

retention schedule and guidelines for the permanent destruction of

biometric data when the initial purpose for collection ends.

Fox, 980 F.3d at 1154. Thus, on closer inspection, Plaintiff’s section 15(a) claim is less

like that alleged in Bryant and more like those alleged in Fox and Miller. The Fox

court concluded the plaintiff had standing to assert the section 15(a) claim there

because “an unlawful retention of a person’s biometric data is as concrete and

3 Though the Complaint does not indicate Plaintiff and the putative class members

were unionized with respect to their employment by Defendant, Defendant has

submitted documentation establishing as much. (Doc. 6-3). The Court is permitted to

consider this documentation in deciding whether standing lies. Apex Digital, Inc. v.

Sears, Roebuck & Co., 572 F.3d 440, 444 (7th Cir. 2009).

particularized an injury as an unlawful collection of a person’s biometric data.” Id. at

1155. The same reasoning applies here.

Furthermore, the Miller court emphasized the role of union negotiations in this

context. The plaintiffs there had standing to assert their claim under section 15(a)

“because they faced the prospect of a material change in [their] terms and conditions

of employment, if the employer, in light of [BIPA], had to bargain with the employee

union to obtain . . . consent or change how the employees clocked in.” Fox, 980 F.3d

at 1154 (internal quotation marks omitted and alterations in original). This is a

further distinction from Bryant in that the plaintiff there was not a unionized

employee and had not sued her employer, id.; the only stake she had with regard to

the disclosure requirement in section 15(a) was that belonging to the general public.

Conversely, in Miller, the unionized employees had a greater, particularized interest

in the disclosure requirement because it directly impacted their ability to collectively

bargain. See 926 F.3d at 902; see also Fox, 980 F.3d at 1152 (“[T]he [plaintiffs in

Miller] alleged an injury that was sufficiently concrete to confer Article III standing

because the collection and use of biometrics for timekeeping is a subject of collective

bargaining between unions and management[.]”). The same is true here.

For these reasons, the Court finds the Complaint sufficiently establishes an

injury in fact and Article III standing therefore lies.

CONCLUSION

IT IS THEREFORE ORDERED that Plaintiff’s Motion to sever and partially

remand (doc. 10) is DENIED. Plaintiff shall respond to Defendant’s Motion to Dismiss

(doc. 5) and Motion to Stay (doc. 7) within twenty-one (21) days.

SO ORDERED.

Entered this 28th day of April 2021.

s/ Joe B. McDade

JOE BILLY McDADE

United States Senior District Judge