Stauffer v. Innovative Heights Fairview Heights, LLC

IN THE UNITED STATES DISTRICT COURT

FOR THE SOUTHERN DISTRICT OF ILLINOIS

MADISYN STAUFFER, on behalf of )

herself an all others similarly situated, )

)

)

Plaintiff, )

)

) Case No. 3:20 -CV-00046 -MAB

vs. )

)

)

INNOVATIVE HEIGHTS FAIRVIEW )

HEIGHTS, LLC, AND PATHFINDER )

SOFTWARE, LLC D/B/A PATHFINDER )

SOFTWARE, LLC, )

)

)

)

Defendants.

)

MEMORANDUM AND ORDER

BEATTY, Magistrate Judge:

Presently before the Court is Plaintiff Madisyn Stauffer’s Motion to Remand (Doc.

27) and Defendant Pathfinder Software, LLC’s Motion to Dismiss (Doc. 21). For the

reasons set forth below, Plaintiff’s Motion to Remand is GRANTED in part and DENIED

in part. Defendant Pathfinder’s Motion to Dismiss is DENIED.

FACTUAL AND PROCEDURAL BACKGROUND

In her Amended Complaint (Doc. 1-1, pp. 89-109), Plaintiff alleges, on behalf of

herself and a class of similarly situated individuals, that both Defendants Innovative

Heights, Fairview Heights, LLC (“Innovative Heights”) and Pathfinder Software, LLC,

d/b/a/ CenterEdge Software, LLC (“Pathfinder”) collected her biometric information,

specifically her fingerprints, in violation of The Illinois Biometric Information Privacy

Act, 740 ILCS 14/1, et seq. (“BIPA”) (Doc. 1-1, p. 91).

I. The Illinois Biometric Information Privacy Act

Illinois passed BIPA in 2008 to address concerns about the growing collection and

use of biometrics by private entities (Id. at 96). The Illinois General Assembly found that

while the use of biometrics has been growing, “[b]iometrics are unlike other unique

identifiers that are used to access finances or other sensitive information” in that unlike

social security numbers or other identifiers that can be changed when compromised,

biometrics are “biologically unique to the individual; therefore, once compromised, the

individual has no recourse…” (Id. at 96-97). See 740 ILCS 14/5(a)-(c). Under BIPA, a

biometric identifier includes an individual’s fingerprints (Doc. 1-1, p. 97). As the

ramifications of this emerging area of technology are unknown, the Illinois General

Assembly enacted BIPA to regulate the collection, use, handling, storage, retention, and

destruction of these identifiers and biometric information. Id. See 740 ILCS 14/5(f)-(g).

To regulate the use of these biometric identifiers, BIPA provides that a private

entity in possession of biometric information “must develop a written policy, made

available to the public, establishing a retention schedule and guidelines for permanently

destroying biometric identifiers and biometric information when the initial purpose for

collecting or obtaining such identifiers or information has been satisfied or within three

years of the individual’s last interaction with the private entity, whichever occurs first”

(Doc. 1-1, p. 97). See 740 ILCS 14/15(a) (“Section 15(a)”). BIPA also outlines that a private

entity may not “collect, capture, purchase, receive through trade, or otherwise obtain a

person’s or a customer’s biometric identifier or information” unless it first informs that

person, in writing, that such an identifier or information is being collected or stored and

informs that person, in writing, of the purpose and length for which a biometric identifier

or information is being used, collected, and stored (Doc. 1-1, p. 97). See 740 ILCS

14/15(b)(1) Additionally, BIPA provides that a private entity must receive a written

release executed by the person who is the subject of the biometric identifier or

information. Id. See 740 ILCS 14/15(b)(1)-(3) (“Section 15(b)”). Written release is defined

as “informed written consent or, in the context of employment, a release executed by an

employee as a condition of employment.” 740 ILCS 14/10.

II. Plaintiff’s Complaint and Procedural Background

On April 29, 2019, Plaintiff filed her Complaint in the Twentieth Judicial Circuit,

St. Clair County, Illinois (Doc. 1-1, p. 2). She brings this action individually and on behalf

of a class of similarly situated individuals who were employed by Defendant Innovative

Heights and worked at its “Sky Zone” facility in Fairview Heights, Illinois for alleged

violations of BIPA (Id at 15, 96).

Originally, Plaintiff brought this action solely against her employer, Defendant

Innovative Heights (Doc. 1, p. 1). Sky Zone is a recreational facility with indoor

trampolines that offers a variety of different activities, including, but not limited to,

Ultimate Dodgeball, SkyHoops, SkyJoust, and Laser Tag (Doc. 1-1, p. 4). As part of their

employment, employees are required to give their fingerprints to Defendant Innovative

Heights at the beginning of their employment and then scan their fingerprints for

timekeeping1 and other employment purposes (Id). Plaintiff alleges that she was never

informed by Defendant Innovative Heights, in writing, of the purpose and the period for

which her fingerprints were being collected, stored, or used (Id. at 98-99).

While still in state court, Plaintiff sought leave to amend her complaint on

November 19, 2019 after learning of Defendant Pathfinder’s relationship with her

employer through the first stages of discovery (Id. at 85, 93-94). Plaintiff alleges that

Defendant Pathfinder controls and operates the system and database in which Defendant

Innovative Heights’ employees’ fingerprints were stored (Id. at 94). Like Defendant

Innovative Heights, Plaintiff alleges that Defendant Pathfinder never informed her, in

writing, of the specific purpose of and the period for which her fingerprints were being

collected, stored, or used (Id. at 98-99). Plaintiff received leave on November 25, 2019 to

amend her complaint (Doc. 1, p. 2). Plaintiff filed her amended complaint on November

27, 2019 in which she named Defendant Pathfinder, for the first time, as a co-defendant

along with Defendant Innovative Heights (Id). In adding Defendant Pathfinder, Plaintiff

also alleges two separate classes of individuals—those that were employed by Defendant

Innovative Heights and worked at its SkyZone facility in Fairview Heights, Illinois and

those individuals who had their fingerprints collected, captured, purchased, received

through trade, or otherwise obtained by Defendant Pathfinder (Doc. 1-1, p. 91).

1 Employees use their fingerprints to “clock in” and “clock out” of their shifts throughout their

employment with Defendant Innovative Heights (Doc. 1-1, p. 5). In addition, they sometimes have to scan

their fingerprints during the day if they are locked out of the cash register. Id.

Plaintiff alleges that both Defendants Innovative Heights and Pathfinder have

violated Sections 15(a) and 15(b) of BIPA while scanning and storing her and other class

members’ fingerprints for timekeeping and other purposes (Doc. 1, p. 2). More

specifically, Plaintiff contends that Defendant Innovative Heights collected, captured,

obtained, and possessed Plaintiff’s fingerprints, but did not make available to the public

a written policy establishing a retention schedule and guidelines for permanently

destroying its employees’ fingerprints when the initial purpose for collecting such

fingerprints had been satisfied, which means that when Plaintiff or other employees leave

employment with Defendant Innovative Heights, they are unaware if and when their

biometric identifiers would be destroyed (Doc. 1-1, p. 99). According to Plaintiff, if

Defendant Innovative Heights were to be sold or go out of business, Plaintiff and the

putative class members would be left unaware as to who is in possession of their private

biometric identifiers, which Plaintiff argues is a violation of Section 15(a) of BIPA. Id.

Plaintiff alleges Defendant Innovative Heights violated Section 15(b) of BIPA because it

failed to notify Plaintiff and the putative class, in writing, that their fingerprints were

being collected, stored, and used before collecting this biometric information.

Additionally, Plaintiff notes Defendant Innovative Heights failed to obtain a written

release from herself and the other putative class members before collecting their

fingerprints (Id. at 99-100).

Defendant Pathfinder also violated Sections 15(a) of BIPA, according to Plaintiff,

by not making available, to the public, a written policy establishing a retention schedule

and guidelines for permanently destroying the biometric information once the initial

purpose for collecting had been satisfied (Id. at 100). Plaintiff alleges Defendant

Pathfinder violated Section 15(b) of BIPA by not first informing the class members, in

writing, of the purpose for which their fingerprints were being collected, stored, and

used, and for how long these fingerprints were being collected, stored, and used. Finally,

Plaintiff contends Defendant Pathfinder did not obtain a written release from Plaintiff or

the class members before collecting, capturing, or receiving their fingerprints (Id. at 100-

101).

After filing her amended complaint, Defendant Pathfinder removed this case on

January 10, 2020 to the Southern District of Illinois pursuant to the Class Action Fairness

Act (“CAFA”), which grants United States District Courts original jurisdiction over any

civil action in which, to summarize, the matter in controversy exceeds $5,000,000 and the

class of plaintiffs has any member that is a citizen of another state different from any

defendant (Doc. 1). See 28 U.S.C. § 1332(d)(2).

Soon after removal, Defendant Pathfinder filed a motion to dismiss on February 5,

2020 (Doc. 21). Plaintiff then filed a motion to remand this matter to state court on March

12, 2020 (Doc. 27). Both pending motions, and the responses and replies, are currently

before the Court.

PLAINTIFF’S MOTION TO REMAND

In her motion to remand, Plaintiff does not argue this case lacks the elements

necessary to satisfy removal under CAFA (28 U.S.C. § 1332(d)(2)). Rather, Plaintiff’s

motion to remand hinges on whether Plaintiff has alleged an actual injury to sustain

Article III standing. Plaintiff argues that Defendant Pathfinder based its motion to dismiss

(Doc. 21) on the argument that Plaintiff has failed to appropriately plead that she suffered

an injury; therefore, she cannot sustain Article III standing and the case must be

remanded because a crucial element of subject matter jurisdiction is absent. Defendant

Pathfinder, confusingly, seems to partially agree, and argues that while Plaintiff has

failed to allege an actual injury under BIPA aside from a statutory violation, Plaintiff

claims her privacy rights were violated when Defendant Innovative Heights

disseminated her biometric information to Defendant Pathfinder, which creates an injury

for Article III standing purposes (Doc. 32, p. 1-2). Plaintiff contends that Defendant’s

reiteration that she has not pled an actual injury, which Defendant argues in both the

motion to dismiss (Doc. 21) and its response to Plaintiff’s motion to remand (Doc. 32), is

a binding judicial admission and the Court’s analysis should end there (Doc. 33). In

addition, Plaintiff argues that she is bringing BIPA violation claims against both

Defendants Innovative Heights and Pathfinder that are not dependent on the

transmission of information from Defendant Innovative Heights to Defendant

Pathfinder; rather, her claims against both Defendants stand on their own. Id.

Subsequently, Defendant Pathfinder sought leave from the Court to supplement

its response in opposition to Plaintiff’s motion to remand to include a recent case from

the Seventh Circuit on the issue of Article III standing in BIPA cases (Doc. 39). As this is

an emerging area of the law, the Court granted Defendant Pathfinder’s motion and

allowed additional briefing on the issue of Article III standing from both Plaintiff and

Defendant Pathfinder (Docs. 39, 40). Defendant Pathfinder argued that a recent case,

Bryant v. Compass Group USA, Inc., 958 F.3d 617 (7th Cir. 2020),2 “moots all of Plaintiff’s

arguments in her Motion for Remand” (Doc. 39, p. 1). In her response, Plaintiff argues

that Bryant is instructive for determining whether Article III standing exists for a Plaintiff

bringing a BIPA Section 15(b) claim, but not a Section 15(a) claim (Doc. 40, p. 1).

LEGAL STANDARD

Before a court can adjudicate the merits of a case, it must first satisfy itself that it

has jurisdiction over the claims and parties that appear before it. Ruhrgas AG v. Marathon

Oil Co., 526 U.S. 574, 577 (1999). A federal court has subject matter jurisdiction only if the

plaintiff has Article III standing. MAO-MSO Recovery II, LLC v. State Farm Mut. Auto. Ins.

Co., 935 F.3d 573, 581 (7th Cir. 2019). Article III standing is a crucial element for District

Courts as it ensures the Court does not exceed its authority over cases and controversies

that the federal court cannot hear. Spokeo, Inc. v. Robins, 136 S.Ct. 1540, 1547 (2016).3 As

the party seeking to invoke federal jurisdiction, Defendant Pathfinder must establish that

Article III standing exists; however, the Court also has an independent responsibility to

ensure that it has subject matter jurisdiction. Collier v. SP Plus Corp., 889 F.3d 894, 896 (7th

2 The plaintiff in Bryant worked for a call center in Illinois. At that call center, in the workplace cafeteria,

employees had to establish an account using their fingerprints to operate the vending machines as they

would not accept cash. Bryant, 958 F.3d at 619. Plaintiff brought suit against the operator of this vending

machine fingerprint collection system, Compass, arguing that Compass violated Sections 15(a) and 15(b)

of BIPA.

3 The standing doctrine limits “the category of litigants empowered to maintain a lawsuit in federal court

to seek redress for a legal wrong” to ensure the that the federal courts maintain an appropriate role in

relation to the other branches of the government. Id., (citing Valley Forge Christian College v. Americans United

for Separation of Church and State, Inc., 454 U.S. 464, 473 (1982)); Warth v. Seldin, 422 U.S. 490, 498-99 (1975).

Cir. 2018); Lujan v. Def. of Wildlife, 504 U.S. 555, 560 (1992). See also Carroll v. Stryker Corp.,

658 F.3d 675, 680 (7th Cir. 2011)

To establish that a plaintiff has Article III standing, a defendant must demonstrate

that plaintiff has alleged an injury-in-fact that was caused by defendant and is redressable

by the court. Groshek v. Time Warner Cable, Inc., 865 F.3d 884, 886 (7th Cir. 2017). To qualify

as an injury-in-fact, the alleged injury must be “concrete and particularized” and “actual

and imminent and not conjectural or hypothetical.” Spokeo, 136 S.Ct. at 1548. To be

concrete, the injury must be de facto, or actually exist. Id. A “bare procedural violation

divorced from any concrete harm” does not qualify as an injury in fact. Id. at 1549. A

procedural statutory violation may constitute an injury-in-fact on its own if the

legislature has elevated a de facto injury that “was previously inadequate in law” to the

“status of illegally cognizable injury.” Id. But a statutory violation causes a concrete injury

for Article III standing only if it presents an “appreciable risk of harm to the underlying

interest the [legislature] sought to protect by enacting the statute.” Groshek, 865 F.3d at

887.

Until Bryant, BIPA cases removed to federal court were frequently remanded for

lack of Article III standing when the plaintiff alleged violations of Sections 15(a) and (b)

without alleging further harm.4 The courts found, in those cases, that the plaintiffs had

4 See Bryant, 958 F.3d at 623, citing cases including, but not limited to, Hunter v. Automated Health Sys.,

Inc., No: 19C2529, 2020 WL 833180 (N.D. Ill. Fed. 20, 2020); McGinnis v. United States Cold Storage, Inc., 382

F.Supp. 3d 813 (N.D. Ill. 2019); and Aguilar v. Rexnord LLC, No: 17CV9019, 2018 WL 3239715 (N.D. Ill. July

3, 2018). Many of these cases were also cited to by Plaintiff in her motion to remand. See generally Doc. 27.

not pleaded a particularized, concrete harm and had simply alleged a procedural

violation; therefore, they could not meet the Article III standing test. Bryant outlined that

if the plaintiff could show that the statutory violation demonstrated an “appreciative risk

of harm” to the statute’s underlying interest, as determined by the legislature, then

Article III standing exists.5 Bryant, 958 F.3d at 621, citing Groshek, 865 F.3d at 887.

Since the Bryant plaintiff brought both Section 15(a) and Section 15(b) claims, the

Seventh Circuit analyzed both for Article III standing.

Article III Standing under Section 15(b) of BIPA

In its analysis of the Bryant plaintiff’s Section 15(b) BIPA claims, the Seventh

Circuit found that “the injury inflicted by nondisclosure is concrete if the plaintiff

establishes that the withholding impaired her ability to use the information in a way the

statute envisioned.” Bryant, 958 F.3d at 624. By not abiding by the requirements of Section

15(b) before it collected the plaintiff’s biometric information, the Seventh Circuit found

that the defendant deprived her of the ability to give the informed consent Section 15(b)

5 Federal courts must defer to a state supreme court's interpretation of its own statutes. Guaranty Bank v.

Chubb Corp., 538 F.3d 587, 590 (7th Cir. 2008). The Illinois Supreme Court has held that BIPA “codified that

individuals possess a right to privacy in and control over their biometric identifiers and biometric

information.” Rosenbach v. Six Flags Entm't Corp., 129 N.E.3d 1197, 1206 (Ill. 2019)(emphasis added). Thus,

allegations of collection and possession of purported biometric information in violation of the requirements

of Sections 15(a) and (b) of BIPA, combined with an allegation of a loss of the right to control that

information, constitute allegations of harm to the particular interests the statute was intended to protect -

control over one’s biometric identifiers or biometric information. Even so, Bryant highlights that Article III

standing is not a “perfect overlap,” as standing requirements in Illinois courts are more lenient than those

in federal courts. Bryant, 958 F.3d at 622. See also Greer v. Illinois Hous. Dev. Auth., 524 N.E.2d 561 (Ill. 1988)

(citations omitted).

of BIPA mandates and envisioned by the legislature. Id. at 626. The Seventh Circuit held

that these types of violations of Section 15(b) of BIPA meet the Article III standing test.

To support its decision, the court examines how the Bryant plaintiff’s claims are

similar to those brought in another case, Robertson v. Allied Solutions, 902 F.3d 690 (7th Cir.

2018), in which a company failed to provide a prospective employee with a copy of her

background report, in violation of the Fair Credit Reporting Act, before rescinding her

employment offer on the basis of information contained in that report. The Seventh

Circuit held this omission constituted an injury-in-fact for Article III standing because she

was wholly deprived of the information necessary to respond in the way FCRA

contemplated. Bryant, 958 F.3d at 625-26. The Seventh Circuit contrasted this scenario

with another case—Casillas v. Madison Avenue Associates, 926 F.3d 329 (7th Cir. 2019). Id.

In Casillas, the court found there was purely a procedural flaw because no amount of notice

or information would have changed the plaintiff’s behavior. Id. When applied to Bryant, the

Seventh Circuit held that had the plaintiff known her information was being stored and

had the defendant appropriately received her written consent ahead of storing her

biometric information, she may have opted to not use the vending machine or bring her

own snacks. Her behavior may have been changed by the defendant appropriately

following Section 15(b); therefore, the harm was concrete for purposes of Article III

standing. Id.

Article III Standing under 15(a) of BIPA

Alleged violations of Section 15(a) are different, however, because this section of

BIPA does not outline an entity’s duty to an individual; rather, this section outlines a duty

to the public generally. In Bryant, the Seventh Circuit emphasizes that 15(a) requires the

holder of the biometric information to develop a written policy about the retention

schedule and guidelines to destroying the information that is made available to the

public. Bryant, 958 F.3d at 626. Because the plaintiff did not advance a particularized harm

under Section 15(a), and because this provision is not part of the informed-consent regime

analyzed above, the Seventh Circuit determined plaintiff lacked Article III standing for

her Section 15(a) claims and those claims had to be remanded to state court. Id. It

appears, though, that the Seventh Circuit left the door open for potential Section 15(a)

Article III standing if the plaintiff advances a particularized harm under 15(a). Id. at 626-

627.

In fact, courts prior to and after Bryant have found Article III standing for

violations of Section 15(a), which requires a fact-specific analysis, focusing on the

relationship of the parties and the nature of the pleadings. The Northern District of

Illinois found that Section 15(a) creates an arguable individual right in the language that

requires entities to destroy the biometric data once the purpose of the collection is

satisfied or within three years after the last interaction with the relevant person. See

Cothron v. White Castle System, Inc., No: 19 CV00382, 2020 WL 3250706 *3 (N.D. Ill. June

16, 2020). The Cothron Court did not examine this theory beyond this statement, though.

Miller v. Southwest Airlines Co., a 2019 pre-Bryant case, makes it clear that there is

Article III standing for both Section 15(a) and Section 15(b) BIPA claims when a plaintiff

class brings a lawsuit against an employer and the company with control over the

technology that collects and manages the biometric data when the plaintiffs are part of a

union. 926 F.3d 898 (7th Cir. 2019). The rationale, here, is that not being able to negotiate

workplace terms and issues related to Sections 15(a) and (b) is an injury for purposes of

Article III standing. It is worth noting the Miller Court relied on the Railway Labor Act in

addition to BIPA. Id. “The prospect of a material change in workers’ terms and conditions

of employment gives these suits a concrete dimension that Spokeo…[and other cases]

lacked.” Id. at 903.

Article III Standing for Plaintiff Stauffer’s Claims

Plaintiff brings both Section 15(a) and Section 15(b) claims against both Defendants

Innovative Heights and Pathfinder. Although Defendant Innovative Heights has not filed

anything in response to Plaintiff’s motion to remand, the Court must ensure that all

parties and claims have standing before proceeding.

Bryant makes fairly easy work of the analysis for Section 15(b) claims for the matter

presently before the Court. Section 15(b) outlines that private entities must make certain

disclosures to and receive informed consent from consumers before obtaining and storing

their biometric information. Like in Bryant, Plaintiff alleges that both Defendants,

essentially, “deprived her of the ability to give the informed consent section 15(b)

mandates.” Bryant, 958 F.3d at 626. Plaintiff pleads that both Defendants never requested

or received her consent before collecting her fingerprints and never informed her of the

purpose of and circumstances surrounding the collection of her biometric information.

Accordingly, like in Bryant, Plaintiff has Article III standing for both of her Section 15(b)

claims against both Defendants .

Analysis for standing under Section 15(a) is not as straight forward. When viewed

in totality, the analysis for Article III standing under Section 15(a) seems to hinge more

on the relationship of the parties since Section 15(a) covers a duty to the public as opposed

to the individual. Section 15(a) dictates that private entities that collect biometric

information must make available a data retention schedule and guidelines for

permanently destroying collected biometric identifiers and information. While Bryant did

not find that the plaintiff had Article III standing for her Section 15(a) claims, the court in

Miller did. The court in Cothron entertained the idea of Article III standing for Section

15(a), but declined to address it further because plaintiff had pleaded facts demonstrating

that no violation occurred. Here, the question is whether Plaintiff’s Section 15(a)

pleadings against both Defendants describe more than a simple procedural violation.

For Defendant Pathfinder, Plaintiff alleges that “[Pathfinder] did not make

available to the public a written policy establishing a retention schedule and guidelines

for permanently destroying any such fingerprints when the initial purpose for collecting

such fingerprints has been satisfied” (Doc. 1-1, p. 100). Plaintiff has not included

additional facts about how Defendant Pathfinder’s alleged violation of Section 15(a)

injured her. Plaintiff has not enumerated how Defendant Pathfinder’s alleged Section

15(a) violation impacted her thinking or potentially changed her behavior. Her

allegations seem to mirror the sparse allegations in Bryant; therefore, Plaintiff has not

articulated an additional injury, beyond a violation of the statute, to satisfy the

requirements for Article III standing of her Section 15(a) claims against Defendant

Pathfinder.

Plaintiff pleaded that Defendant Innovative Heights violated Section 15(a) by not

having a published written policy for the retention of this biometric information.

Defendant Innovative Heights’ failure to publish such a policy means that when “Plaintiff

and Innovative Heights Class Members left or leave the employment of Innovative

Heights, they were or are left unaware if and when their biometric identifiers would be

destroyed” (Doc. 1-1, p. 99). Furthermore, if Innovative Heights were to be sold or go

out of business, Plaintiff and Innovative Heights Class Members would be left unaware

as to who is in possession of their biometric identifiers (Doc. 1-1, p.99).

Bryant held that the defendant’s Section 15(a) requirement to make available a

written retention and destruction policy was a harm to the public and not a particular

harm to the plaintiff because of the plaintiff’s theory she invoked. Bryant, 958 F.3d at 626.

In that case, the plaintiff was a consumer, as opposed to an employee of the entity she

sued. After Bryant, in Cothron v. White Castle, an employee of White Castle brought suit

against her employer for violations of Sections 15(a), 15(b), and 15(d) of BIPA after her

employer collected her biometric information, specifically fingerprints, as part of their

“clock-in, clock-out” timekeeping system. The court held that the second requirement of

15(a) “arguably creates an individual right to have personal data deleted,” but

determined that the court need not address this novel issue because the plaintiff

continued to work at White Castle with the same biometric collection process in place.

Since she was still working at White Castle with this same system when she filed her

lawsuit, the court determined that neither of Section 15(a)’s conditions requiring

destruction of biometric data could be used to advance an Article III standing argument.

Cothron, 2020 WL 3250706 at *3.

The Cothron court determined that the second part of Section 15(a), which requires

private entities in possession of biometric information to permanently destroy the

information when the initial purpose has been satisfied or within three years of the

individuals’ last interaction with the private entity (whichever comes first), may create an

individualized right. See 740 ILCS 14/15(a). If there is a duty to the individual and not

just the public, Article III standing is more likely. In the present matter, unlike Cothron,

Plaintiff left her employment with Defendant Innovative Heights in May 2018, and

Plaintiff alleged in her Complaint that when employees leave, they have no idea when

and how their biometric information will be destroyed, if it will be destroyed at all (Doc.

1-1, p. 98). While Plaintiff has advanced some additional facts discussing the impact of

Defendant Innovative Heights’ Section 15(a) violation, she has still not described a

concrete and particularized harm for Article III standing. She has not described how the

Section 15(a) violations have impacted her thinking or if those violations were the reason

for her leaving, for example; rather, her description is more hypothetical and describes

what could happen if one left employment while Defendant Innovative Heights still

improperly retained their biometric information. The fact that Plaintiff has left

employment is not enough if she has not pled how the alleged Section 15(a) violation

impacted her.

Accordingly, Plaintiff has Article III standing for her Section 15(b) claims against

both Defendants Pathfinder and Innovative Heights. Plaintiff does not have Article III

standing for her Section 15(a) claims against either Defendant. Plaintiff’s Section 15(a)

claims against Defendant Pathfinder and Defendant Innovative Heights are remanded to

the Twentieth Judicial Circuit, St. Clair County, Illinois.

DEFENDANT PATHFINDER’S MOTION TO DISMISS

In addition to Plaintiff’s motion to remand, the Court must address Defendant

Pathfinder’s motion to dismiss (Doc. 23).

A motion to dismiss under Rule 12(b)(6) addresses the legal sufficiency of the

plaintiff’s claim for relief, not the merits of the case or whether the plaintiff will ultimately

prevail. Camasta v. Jos. A. Bank Clothiers, Inc., 761 F.3d 732, 736 (7th Cir. 2014); Gibson v.

City of Chicago, 910 F.2d 1510, 1520 (7th Cir. 1990). In reviewing a motion to dismiss, the

court must construe the complaint in the light most favorable to the plaintiff, accept as

true all well-pleaded facts, and draw all possible inferences in the plaintiff’s

favor. E.g., Hecker v. Deere & Co., 556 F.3d 575, 580 (7th Cir. 2009) (citation omitted). The

complaint will survive the motion to dismiss only if it alleges facts sufficient to “state a

claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 556

(2007). “A claim has facial plausibility when the plaintiff pleads factual content that

allows the court to draw the reasonable inference that the defendant is liable for the

misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). A plaintiff does not need

“detailed factual allegations,” but must plead more than “labels and conclusions” and “a

formulaic recitation of the elements of a cause of action.” Twombly, 550 U.S. at 555.

Determining whether a complaint plausibly states a claim for relief is a “context-specific

task that requires the reviewing court to draw on its judicial experience and common

sense.” Iqbal, 556 U.S. at 679. The structure outlined here for the complaint will ensure

that the defendant receives “fair notice of what the ... claim is and the grounds upon

which it rests.” Twombly, 550 U.S. at 1959.

Defendant Pathfinder makes a series of five arguments in its motion to dismiss,

arguing that Plaintiff has failed to plead sufficient facts for the case to survive beyond

this early stage of litigation. Plaintiff opposes each of these arguments in her response to

Defendant Pathfinder’s motion to dismiss (Doc. 23).

I. BIPA is Special Legislation in Violation of the Illinois Constitution

First, Pathfinder argues that BIPA is unconstitutional special legislation because it

imposes strict compliance requirements on some employers, but then exempts “the entire

financial industry” and state and local government contractors “arbitrarily,” so BIPA

“should be struck down” as unconstitutional (Doc. 21, pp. 4-7). Plaintiff disagrees,

arguing that Defendant Pathfinder has failed to cite to any precedent in which a court has

declared BIPA as unconstitutional and that excluding financial institutions and

government entities is not arbitrary because the exempt financial institutions are subject

to a separate set of standards under the Gramm-Leach-Bliley Act of 1999 (“GLBA”),

which has strict data protection standards (Doc. 23, pp. 11-15). Furthermore, Plaintiff

argues that BIPA was enacted to regulate private companies, which is why government

entities are exempt from the law (Id. at 12-13).

The Illinois Constitution's Special Legislation Clause prohibits a “special or local

law when a general law is or can be made applicable.” Ill. Const. 1970, art. IV, § 13. More

specifically, it prohibits the General Assembly from conferring “a special benefit or

privilege upon one person or group and excluding others that are similarly situated.”

Crusius v. Illinois Gaming Board, 837 N.E.2d 88, 94 (Ill. 2005). The legislature has discretion

to make statutory classifications; however, the special legislation clause prevents it from

making classifications that arbitrarily discriminate in favor of a selected group. Id.; Big

Sky Excavating, Inc. v. Illinois Bell Telephone Co., 840 N.E.2d 1174, 1183 (Ill. 2005). There is

a two-part test to determine whether a law constitutes special legislation: (1) whether the

statutory classification at issue discriminates in favor of a select group and against a

similarly situated group; and (2) if the classification does so discriminate, whether the

classification is arbitrary. Id. See also Protect our Parks, Inc. v. Chicago Park Dist., 385 F. Supp.

3d 662, 692 (N.D. Ill. 2019). Illinois courts use the rational basis test to determine whether

the statutory classification is rationally related to a legitimate state interest. Piccioli v. Bd.

Of Trustees of Teachers’ Ret. Sys., 137 N.E.3d 745, 751 (Ill. 2019). In this analysis, the court

may “hypothesize reasons for the legislation…any conceivable basis for finding a rational

relationship” will uphold the law in question. Id. See also People ex. rel. Lumpkin v. Cassidy,

703 N.E.2d 1, 5-9 (Ill. 1998).

Defendant Pathfinder first argues that BIPA excludes “nearly the entire financial

sector” and argues that a vast number of employers qualify as financial institutions and,

therefore, are unregulated by BIPA since they fall into this exclusionary provision (Doc.

21, p. 5). Defendant Pathfinder’s argument is a bit hyperbolic. As Plaintiff argues, the

financial institution exemption is for “financial institution[s] or an affiliate of a financial

institution that [are] subject to Title V of the federal Gram-Leach Bliley Act of 1999” (Doc. 23,

p. 12). See also 730 ILCS 14/25(c). The financial institution exemption is not for all

financial institutions; rather, it is for those that are already covered by another law similar

to BIPA that requires financial institutions to explain their information-gathering

practices and how they safeguard sensitive data to their customers (Doc. 23, pp. 15-17).

When the Court examines financial institutions subject to BIPA and those that are exempt

under the two part test highlighted above, it is clear that they are similarly situated

groups; however; it does not appear that BIPA differentiates between these two groups

in a discriminatory fashion since both sets of financial institutions are subjected to

stringent reporting requirements through either a state or federal law.6 Plaintiff also

makes a compelling argument that the Illinois legislature may have, rationally, concluded

that failing to exclude those financial institutions subjected to GLBA’s reporting

standards risked federal preemption of BIPA (Doc. 23, p. 12). Courts have invalidated

legislative classifications under the special legislation clause when they have an

“artificially narrow focus” and are “designed primarily to confer a benefit on a particular

private group without a reasonable basis, rather than to promote the general welfare.”

Best v. Taylor Machine Works, 689 N.E.2d 1057, 1072 (Ill. 1997). The financial institution

distinction made by BIPA cannot be found to be “artificially narrow” in its focus since

both exempt and non-exempt financial institutions are subject to data reporting laws,

with neither group receiving a benefit the other does not.

Similarly, Defendant Pathfinder argues that exempting government employers

from BIPA cannot survive rational basis scrutiny and “the arbitrariness of these carve-

6 Plaintiff includes a portion of the debate transcript from the Illinois House, detailing that some banks,

covered under Federal Law, are exempt (Doc. 23, p. 12).

outs should not be permitted to stand” (Doc. 21, p. 7). Plaintiff argues, rightfully, that the

Illinois legislature enacted BIPA to regulate the private sector and argues that courts have

previously upheld classifications differentiating between the government and private

entities (Doc. 23, p. 13).

Plaintiff mentions, and the Court finds it important to note, that BIPA was enacted

in 2008, approximately twelve years ago, and there have been a number of BIPA cases

both in federal and state court. Defendant Pathfinder did not cite to a single BIPA case to

support its argument and while that is not dispositive of Defendant’s arguments alone, it

is noteworthy that not a single other case has found BIPA to be unconstitutional in those

twelve years. For purposes of a 12(b)(6) motion, Plaintiff has pled sufficient facts to

conclude that BIPA is not special legislation and is, therefore, not unconstitutional.

II. Defendant Pathfinder is Exempt from BIPA because it is Classified as a

Financial Institution

Second, Pathfinder argues that it should be classified as a financial institution in

the aforementioned financial exemption and, therefore, Defendant Pathfinder is exempt

from BIPA’s requirements (Doc. 21, pp. 7-9). Plaintiff argues that Defendant Pathfinder

is not a financial institution as defined by BIPA and is not exempt (Doc. 23, pp. 8-10).

Plaintiff elaborates that the financial institutions exempt from BIPA are exempt because

they are subject to GLBA and are defined as “significantly engaged in financial activities,”

which Plaintiff argues is not the case for Defendant Pathfinder (Doc. 23, p. 15). See 16

C.F.R. § 313.3(k)(1). In addition, Plaintiff highlights that Defendant Pathfinder has

improperly relied on materials outside of the pleadings, specifically a declaration of

Defendant Pathfinder’s Chief Financial Officer re-attached from the notice of removal

(Doc. 1-2) to its motion to dismiss, to argue this point (Doc. 23, p. 16).

Based on the pleadings, it seems doubtful that Defendant Pathfinder could be

designated as a “financial institution” and, therefore, exempt from BIPA. BIPA’s financial

institution exemption is explicit in that BIPA does not apply to financial institutions

already subjected to GLBA. See 740 ILCS 14/25(c). The Federal Trade Commission

describes the type of financial institutions that must comply with GLBA, which includes

“all businesses, regardless of size, that are ‘significantly engaged’ in providing financial

products or services. This includes, for example, check-cashing businesses, payday

lenders, mortgage brokers, nonbank lenders, personal property or real estate appraisers,

professional tax preparers, and courier services.”7 Defendant Pathfinder, on its website,

describes itself as a “leader in the entertainment software industry,” and states that it

“operate[s] as a processor of personal information for our customers, including via the

Advantage Access Control App” (Doc. 1-1, p. 95). Defendant Pathfinder controls and/or

runs the system and/or database in which Defendant Innovative Heights’ employees’

fingerprints are stored (Doc. 1-1, p. 93). Nowhere in the Complaint is Defendant

Pathfinder described as a financial institution, mainly, that is engaged in any of the

aforementioned activities that would subject it to GLBA, such as appraising real estate or

preparing taxes.

7 See Federal Trade Commission, Gramm-Leach-Bliley Act, https://www.ftc.gov/tips-advice/business-

center/guidance/financial-institutions-customer-information-complying (last accessed August 17, 2020).

Defendant Pathfinder re-attaches a declaration it submitted with its notice of

removal from the Chief Financial Officer, which Defendant Pathfinder alleges proves that

Defendant Pathfinder is an exempt financial institution. This affidavit is not even

appropriate for the Court’s consideration on a 12(b)(6) motion. Geinosky v. City of Chicago,

675 F.3d 743, 745 n.1 (7th Cir. 2012) (“A motion under Rule 12(b)(6) can be based only on

the complaint itself, documents attached to the complaint, documents that are critical to

the complaint and referred to in it, and information that is subject to proper judicial

notice.”). And even if it was, the affidavit doesn’t move the needle as it does not indicate

whether Defendant Pathfinder is subjected to the reporting requirements of GLBA;

therefore, the Court cannot find that Defendant Pathfinder is exempt from BIPA (See

generally Doc. 1-2).

The Court finds that Plaintiff has sufficiently pled her claims against Defendant

Pathfinder for purposes of a 12(b)(6) motion because at this time, the Court cannot find

that Defendant Pathfinder is exempt from BIPA because it is a financial institution

subjected to the reporting requirements of GLBA.

III. Plaintiff’s Claims are Time-Barred by the Statute of Limitations

Third, Defendant Pathfinder argues that Plaintiff’s complaint is time-barred since

she did not bring the claim in the appropriate statute of limitations, which Defendant

Pathfinder claims is one year (Doc. 21, pp. 9-10). Plaintiff argues that Defendant

Pathfinder relies on the incorrect statute of limitations and that almost every other BIPA

case has held that BIPA claims are subject to the five-year catchall statute of limitations

(Doc. 23, p. 18).

BIPA itself does not include a statute of limitations. Under Illinois law, “all civil

actions not otherwise provided for, shall be commenced within five years next after the

cause of action accrued.” 735 ILCS 5/13-205. To determine whether there is a more

specifically applicable statute of limitations, Illinois courts analyze “the type of injury at

issue, irrespective of the pleader’s designation of the nature of the action.” Travelers Cas.

& Sur. Co. v. Bowman, 893 N.E.2d 583, 587 (Ill. 2008). “[G]eneral rules of statutory

construction” govern this analysis. See Hernon v. E.W. Corrigan Const. Co., 595 N.E.2d 561,

562 (Ill. 1992).

Defendant Pathfinder argues that BIPA violations like the ones alleged by Plaintiff

are, essentially, related to invasion of privacy and traditional invasion of privacy claims

have a one-year statute of limitations from the date the privacy right is invaded. 735 ILCS

5/13-201; see also Blair v. Nevada Landing P’ship, 859 N.E.2d 1188, 1192 (Ill. 2006). To further

the argument, Defendant Pathfinder argues that the Rosenbach court determined that

BIPA is fundamentally a privacy statute (Doc. 21, p. 9-10). Since Plaintiff did not file her

original Complaint within one year of when she began using the clock-in, clock-out

system at Defendant Innovative Heights, Defendant Pathfinder moves for dismissal since

Plaintiff’s claims are not timely.

Plaintiff contends this argument was dispelled by the one Illinois court to have

addressed this issue in a published decision. See Robertson v. Hostmark Hospitality Group,

Inc., 2019 WL 8640568, at *4 (Ill. Cir. Ct. 2019). In Robertson, the court held that the five-

year statute of limitations applies to BIPA claims, which the Court finds persuasive

because, as Plaintiff argues, a series of BIPA cases have found similarly.8 As the Court

has previously noted, BIPA precedent is developing, and while many of the cases Plaintiff

cites to are state-court decisions and non-binding on this Court’s decision, they are

instructive for how state courts interpret this state law, particularly since the Court must

apply “the law of Illinois as [it] believe[s] the Illinois Supreme Court would apply it”

(Doc. 23, p. 20) See also Liberty Mut. Fire. Ins. Co. v. Statewide Ins. Co., 352 F.3d 1098, 1100

(7th Cir. 2003).

Additionally, a “plaintiff is not required to plead elements in his or her complaint

that overcome affirmative defenses, such as statute-of-limitations defenses.” NewSpin

Sports, LLC v. Arrow Elecs., Inc., 910 F.3d 293, 299 (7th Cir. 2018). As long as the Court can

“imagine” a scenario in which the claim is timely, it is improper to dismiss it on the

pleadings. See U.S. Gypsum Co. v. Ind. Gas Co., Inc., 350 F.3d 623, 628 (7th Cir.

2003) (holding that the “right question” is not whether the plaintiff has alleged “facts that

tend to defeat affirmative defenses,” but “whether it is possible to imagine proof of the

critical facts consistent with the allegations in the complaint” that would fall within the

period of limitations). Accordingly, Plaintiff has pled sufficient facts for purposes of a

12(b)(6) motion that her BIPA claims are timely.

8 Plaintiff lists a series of at least six post-Rosenbach decisions, also upholding that the five-year catch-all

statute of limitations applies to BIPA cases, in her response to Defendant Pathfinder’s motion to dismiss.

See Doc. 23, p. 19.

IV. Plaintiff’s Claims are Barred by Waiver or Equitable Estoppel

Fourth, Defendant Pathfinder argues that Plaintiff voluntarily waived her right to

sue because Plaintiff implicitly consented to the collection of her fingerprints for the

purpose of clocking in and out of work; accordingly, the doctrine of equitable estoppel

applies and Plaintiff cannot bring BIPA claims now (Doc. 21, pp. 10-12). According to

Defendant Pathfinder, Plaintiff remained silent and never complained while continuing

to use the fingerprint collecting system throughout her course of employment with

Defendant Innovative Heights, which “demonstrates that she voluntarily relinquished a

known right” (Doc. 21, p. 12). Plaintiff argues that Defendant Pathfinder incorrectly

conflated waiver and equitable estoppel, and that she is not barred from bringing her

BIPA claims under either doctrine (Doc. 23, p. 22).

Equitable estoppel and waiver are similar, but distinct doctrines. Lumbermen's

Mut. Cas. Co. v. Sykes, 890 N.E.2d 1086, 1097 (Ill. 2008). “Waiver is commonly defined as

‘the intentional relinquishment of a known right.’” Hahn v. Cty. Of Kane, 991 N.E.2d 373,

378-379 (Ill. 2013). Equitable estoppel is “the effect of a person’s conduct ‘whereby the

person is barred from asserting rights that might otherwise have existed against the other

party who, in good faith, relied upon such conduct and has been thereby led to change

his or her position for the worse.’” Id.

In contrast to waiver, equitable estoppel “may arise even though there was no

intention on the part of the party estopped to relinquish any existing right.” Vaughn v.

Speaker, 533 N.E.2d 885, 890 (Ill. 1988). Additionally, unlike with waiver, the party

claiming estoppel must act in order to complete the estoppel. Lumbermen's Mut. Cas.

Co., 890 N.E.2d at 1097. “Questions of estoppel and waiver are left to the trier of fact

where the material facts are in dispute or where reasonable people might draw different

conclusions from the evidence.” Safeway Ins. Co. v. Ebijimi, 117 N.E.3d 1227, 1240 (Ill.

2018) (internal quotation marks and citation omitted).

A. Equitable Estoppel

“In order to raise a successful defense of equitable estoppel, the party claiming

estoppel must show (1) the other party misrepresented or concealed material facts, (2) the

other party knew, at the time the representations were made, that those representations

were false, (3) the party claiming estoppel did not know of the falsity of the

representations when they were made or when they were acted upon, (4) the other party

intended or reasonably expected the representations to be acted upon by the party

claiming estoppel, (5) the party claiming estoppel reasonably relied upon the

representations in good faith to his detriment, and (6) the party claiming estoppel has

been prejudiced by his reliance on the representations.” Ruiz v. Cal-Ful Condominium

Ass’n, 144 N.E.3d 1229, 1234 (Ill. 2019).

Defendant Pathfinder does not identify any material facts that Plaintiff has

concealed or misrepresented. The Complaint alleges only that Defendant failed to provide

the necessary disclosures and obtain the necessary consents before making Plaintiff use

her fingerprints to clock in and out of work. Defendant does not attempt to explain how

the elements of equitable estoppel have been satisfied, so the Court cannot find that

Plaintiff is estopped from bringing her claims.

B. Waiver

Defendant also asserts a theory of waiver. “Individuals generally may waive

substantive rules of law, statutory rights, and even constitutional rights enacted for their

benefit,” if “the waiver is knowing, voluntary, and intentional.” In re Estate of Ferguson,

730 N.E.2d 1205, 1210 (Ill. 2000); See also RTP LLC v. Orix Real Estate Capital, Inc., No: 2013-

CV-0350, 2014 WL 12696867 *1 (N.D. Ill. 2014).

The Court cannot say, based on the pleadings and the minimal arguments

provided by Defendant Pathfinder, that the only conclusion logically drawn from

Plaintiff’s actions while employed at Defendant Innovative Heights is that she

knowingly, voluntarily, and intentionally waived any right to bring a BIPA claim by

continuing to scan her fingerprints at her place of work. In fact, Defendant Pathfinder has

seemingly forgotten that Plaintiff did not know of Defendant Pathfinder’s involvement

until filing her case in state court and starting discovery. To claim that she knowingly

compromised her biometric information and continued to do so, thereby supporting a

claim of either waiver or estoppel, in regards to Defendant Pathfinder is wholly

unsupported by the pleadings. Further, practically speaking, if the Court were to

conclude that based on the complaint, Plaintiff’s rights were estopped or waived,

practically no BIPA cases could ever move forward, which is not the intention of BIPA’s

enforcement provision. See 740 ILCS 14/20 . The Court therefore concludes that it would

be inappropriate, at this early stage of the case, to dismiss Plaintiff’s claims due to either

doctrine.

V. Plaintiff has not Pled Sufficient Facts Related to Defendant’s Negligent or

Reckless Violations

Finally, Defendant Pathfinder argues that this case should be dismissed because

Plaintiff has not pled sufficient facts to support her cause of action, specifically that she

has not asserted that Defendant Pathfinder negligently, recklessly or intentionally

violated BIPA, specifically 740 ILCS 14/20(1) (Doc. 21, pp. 12-14). Defendant argues that

Plaintiff has not pled any facts relating to how Defendant Pathfinder collected her

fingerprints or if that was done negligently. Plaintiff argues that she is not required to

assert facts regarding Defendant Pathfinder’s negligent, reckless, or intentional actions to

bring a BIPA cause of action (Doc. 23, pp. 26). Plaintiff is correct.

It appears that Defendant Pathfinder mistakenly read and quoted the incorrect

part of BIPA when making this argument in its motion to dismiss, as Plaintiff outlined

(Doc. 23, pp. 25-27). BIPA provides for a private right of action for “[a]ny person

aggrieved by a violation” of the statute. 740 ILCS § 14/20 (emphasis added). The Illinois

Supreme Court has explained that “when a private entity fails to comply with one of

Section 15’s requirements, that violation constitutes an invasion, impairment, or denial

of the statutory rights of any person or customer whose biometric identifier or biometric

information is subject to the breach.” Rosenbach, 129 N.E.3d at 1206. “The violation, in

itself, is sufficient to support the individual’s or customer’s statutory cause of

action.” Id. The “negligent” and “intentionally and recklessly” standards come into play

when determining remedies, with negligent violations worth $1,000 in liquidated

damages (or actual damages, if greater) and intentional or reckless violations worth

$5,000 in liquidated damages (or actual damages, if greater). 740 ILCS § 14/20(1), (2).

Additional remedies of attorneys’ fees, costs, and injunctive relief are also available, and

the statutory language does not limit these remedies to only negligent, intentional, or

reckless violations. Id. § 14/20(3), (4); see also Cothron, 2020 WL 3250706 at *5 (“[I]f the

complaint plausibly pleads violations of Section 15(b) and Section 15(d)—which the

Court finds that it does—then, even absent specific allegations about White Castle’s

mental state with respect to each of those claims, it has stated a claim entitling Ms.

Cothron to litigation expenses and injunctive relief under Section 20, whether or not she

proves an entitlement to damages based on negligent, reckless, or intentional conduct.”).

Plaintiff’s argument mirrors the analysis above. To allege a claim that Defendant

Pathfinder violated BIPA, all she must do is allege that Defendant collected, captured,

purchased, received, or obtained her fingerprints without complying with BIPA’s

requirements (Doc. 23, p. 26). As Plaintiff explained, and as other courts have outlined,

the references to negligent, reckless, and intentional violations only relate to what the

prevailing party may recover for each violation, which is not before the Court presently.

Id. Accordingly, for purposes of a 12(b)(6) motion, Plaintiff has pled sufficient facts to

state a cause of action against Defendant Pathfinder.

CONCLUSION

For the aforementioned reasons, Plaintiff Stauffer’s motion to remand is DENIED

in part and GRANTED in part. The Court retains jurisdiction over Plaintiff’s BIPA

Section 15(b) claims as they pertain to both Defendants Innovative Heights and

Pathfinder. The Court REMANDS Plaintiff’s BIPA Section 15(a) claims as they pertain to

Defendants Pathfinder and Innovative Heights to the Twentieth Judicial Circuit, St. Clair

County, Illinois as this Court does not have jurisdiction over those claims.

Defendant Pathfinder’s motion to dismiss is DENIED.

IT IS SO ORDERED.

DATED: August 19, 2020

s/ Mark A. Beatty

MARK A. BEATTY

United States Magistrate Judge