# Stauffer v. Innovative Heights Fairview Heights, LLC

> District Court, S.D. Illinois · August 19, 2020

URL: https://www.frixlaw.com/law-library/cases/10152607

## Case

- **Court:** District Court, S.D. Illinois
- **Decided:** August 19, 2020
- **Opinion:** 100trialcourt
- **Cited by:** 0 later opinions in the Frix Law Library

## Citator (automated)

- No negative treatment found by the automated citator. That is not the same as a confirmation that the case is good law; read the citing cases.
- Full citator and citing cases: https://www.frixlaw.com/law-library/cases/10152607

## Opinion text

IN THE UNITED STATES DISTRICT COURT
FOR THE SOUTHERN DISTRICT OF ILLINOIS

MADISYN STAUFFER, on behalf of )
herself an all others similarly situated, )

)

)
Plaintiff, )
)
) Case No. 3:20 -CV-00046 -MAB
vs. )
)
)
INNOVATIVE HEIGHTS FAIRVIEW )
HEIGHTS, LLC, AND PATHFINDER )
SOFTWARE, LLC D/B/A PATHFINDER )
SOFTWARE, LLC, )
)
)
)
Defendants.
)

MEMORANDUM AND ORDER

BEATTY, Magistrate Judge:
Presently before the Court is Plaintiff Madisyn Stauffer’s Motion to Remand (Doc.
27) and Defendant Pathfinder Software, LLC’s Motion to Dismiss (Doc. 21). For the
reasons set forth below, Plaintiff’s Motion to Remand is GRANTED in part and DENIED
in part. Defendant Pathfinder’s Motion to Dismiss is DENIED.
FACTUAL AND PROCEDURAL BACKGROUND
In her Amended Complaint (Doc. 1-1, pp. 89-109), Plaintiff alleges, on behalf of
herself and a class of similarly situated individuals, that both Defendants Innovative
Heights, Fairview Heights, LLC (“Innovative Heights”) and Pathfinder Software, LLC,
d/b/a/ CenterEdge Software, LLC (“Pathfinder”) collected her biometric information,

specifically her fingerprints, in violation of The Illinois Biometric Information Privacy
Act, 740 ILCS 14/1, et seq. (“BIPA”) (Doc. 1-1, p. 91).
I. The Illinois Biometric Information Privacy Act
Illinois passed BIPA in 2008 to address concerns about the growing collection and
use of biometrics by private entities (Id. at 96). The Illinois General Assembly found that
while the use of biometrics has been growing, “[b]iometrics are unlike other unique

identifiers that are used to access finances or other sensitive information” in that unlike
social security numbers or other identifiers that can be changed when compromised,
biometrics are “biologically unique to the individual; therefore, once compromised, the
individual has no recourse…” (Id. at 96-97). See 740 ILCS 14/5(a)-(c). Under BIPA, a
biometric identifier includes an individual’s fingerprints (Doc. 1-1, p. 97). As the

ramifications of this emerging area of technology are unknown, the Illinois General
Assembly enacted BIPA to regulate the collection, use, handling, storage, retention, and
destruction of these identifiers and biometric information. Id. See 740 ILCS 14/5(f)-(g).
To regulate the use of these biometric identifiers, BIPA provides that a private
entity in possession of biometric information “must develop a written policy, made

available to the public, establishing a retention schedule and guidelines for permanently
destroying biometric identifiers and biometric information when the initial purpose for
collecting or obtaining such identifiers or information has been satisfied or within three
years of the individual’s last interaction with the private entity, whichever occurs first”
(Doc. 1-1, p. 97). See 740 ILCS 14/15(a) (“Section 15(a)”). BIPA also outlines that a private
entity may not “collect, capture, purchase, receive through trade, or otherwise obtain a

person’s or a customer’s biometric identifier or information” unless it first informs that
person, in writing, that such an identifier or information is being collected or stored and
informs that person, in writing, of the purpose and length for which a biometric identifier
or information is being used, collected, and stored (Doc. 1-1, p. 97). See 740 ILCS
14/15(b)(1) Additionally, BIPA provides that a private entity must receive a written
release executed by the person who is the subject of the biometric identifier or

information. Id. See 740 ILCS 14/15(b)(1)-(3) (“Section 15(b)”). Written release is defined
as “informed written consent or, in the context of employment, a release executed by an
employee as a condition of employment.” 740 ILCS 14/10.
II. Plaintiff’s Complaint and Procedural Background
On April 29, 2019, Plaintiff filed her Complaint in the Twentieth Judicial Circuit,

St. Clair County, Illinois (Doc. 1-1, p. 2). She brings this action individually and on behalf
of a class of similarly situated individuals who were employed by Defendant Innovative
Heights and worked at its “Sky Zone” facility in Fairview Heights, Illinois for alleged
violations of BIPA (Id at 15, 96).
Originally, Plaintiff brought this action solely against her employer, Defendant

Innovative Heights (Doc. 1, p. 1). Sky Zone is a recreational facility with indoor
trampolines that offers a variety of different activities, including, but not limited to,
Ultimate Dodgeball, SkyHoops, SkyJoust, and Laser Tag (Doc. 1-1, p. 4). As part of their
employment, employees are required to give their fingerprints to Defendant Innovative
Heights at the beginning of their employment and then scan their fingerprints for
timekeeping1 and other employment purposes (Id). Plaintiff alleges that she was never

informed by Defendant Innovative Heights, in writing, of the purpose and the period for
which her fingerprints were being collected, stored, or used (Id. at 98-99).
While still in state court, Plaintiff sought leave to amend her complaint on
November 19, 2019 after learning of Defendant Pathfinder’s relationship with her
employer through the first stages of discovery (Id. at 85, 93-94). Plaintiff alleges that
Defendant Pathfinder controls and operates the system and database in which Defendant

Innovative Heights’ employees’ fingerprints were stored (Id. at 94). Like Defendant
Innovative Heights, Plaintiff alleges that Defendant Pathfinder never informed her, in
writing, of the specific purpose of and the period for which her fingerprints were being
collected, stored, or used (Id. at 98-99). Plaintiff received leave on November 25, 2019 to
amend her complaint (Doc. 1, p. 2). Plaintiff filed her amended complaint on November

27, 2019 in which she named Defendant Pathfinder, for the first time, as a co-defendant
along with Defendant Innovative Heights (Id). In adding Defendant Pathfinder, Plaintiff
also alleges two separate classes of individuals—those that were employed by Defendant
Innovative Heights and worked at its SkyZone facility in Fairview Heights, Illinois and
those individuals who had their fingerprints collected, captured, purchased, received

through trade, or otherwise obtained by Defendant Pathfinder (Doc. 1-1, p. 91).

1 Employees use their fingerprints to “clock in” and “clock out” of their shifts throughout their
employment with Defendant Innovative Heights (Doc. 1-1, p. 5). In addition, they sometimes have to scan
their fingerprints during the day if they are locked out of the cash register. Id.
Plaintiff alleges that both Defendants Innovative Heights and Pathfinder have
violated Sections 15(a) and 15(b) of BIPA while scanning and storing her and other class

members’ fingerprints for timekeeping and other purposes (Doc. 1, p. 2). More
specifically, Plaintiff contends that Defendant Innovative Heights collected, captured,
obtained, and possessed Plaintiff’s fingerprints, but did not make available to the public
a written policy establishing a retention schedule and guidelines for permanently
destroying its employees’ fingerprints when the initial purpose for collecting such
fingerprints had been satisfied, which means that when Plaintiff or other employees leave

employment with Defendant Innovative Heights, they are unaware if and when their
biometric identifiers would be destroyed (Doc. 1-1, p. 99). According to Plaintiff, if
Defendant Innovative Heights were to be sold or go out of business, Plaintiff and the
putative class members would be left unaware as to who is in possession of their private
biometric identifiers, which Plaintiff argues is a violation of Section 15(a) of BIPA. Id.

Plaintiff alleges Defendant Innovative Heights violated Section 15(b) of BIPA because it
failed to notify Plaintiff and the putative class, in writing, that their fingerprints were
being collected, stored, and used before collecting this biometric information.
Additionally, Plaintiff notes Defendant Innovative Heights failed to obtain a written
release from herself and the other putative class members before collecting their

fingerprints (Id. at 99-100).
Defendant Pathfinder also violated Sections 15(a) of BIPA, according to Plaintiff,
by not making available, to the public, a written policy establishing a retention schedule
and guidelines for permanently destroying the biometric information once the initial
purpose for collecting had been satisfied (Id. at 100). Plaintiff alleges Defendant
Pathfinder violated Section 15(b) of BIPA by not first informing the class members, in

writing, of the purpose for which their fingerprints were being collected, stored, and
used, and for how long these fingerprints were being collected, stored, and used. Finally,
Plaintiff contends Defendant Pathfinder did not obtain a written release from Plaintiff or
the class members before collecting, capturing, or receiving their fingerprints (Id. at 100-
101).
After filing her amended complaint, Defendant Pathfinder removed this case on

January 10, 2020 to the Southern District of Illinois pursuant to the Class Action Fairness
Act (“CAFA”), which grants United States District Courts original jurisdiction over any
civil action in which, to summarize, the matter in controversy exceeds $5,000,000 and the
class of plaintiffs has any member that is a citizen of another state different from any
defendant (Doc. 1). See 28 U.S.C. § 1332(d)(2).

Soon after removal, Defendant Pathfinder filed a motion to dismiss on February 5,
2020 (Doc. 21). Plaintiff then filed a motion to remand this matter to state court on March
12, 2020 (Doc. 27). Both pending motions, and the responses and replies, are currently
before the Court.
PLAINTIFF’S MOTION TO REMAND

In her motion to remand, Plaintiff does not argue this case lacks the elements
necessary to satisfy removal under CAFA (28 U.S.C. § 1332(d)(2)). Rather, Plaintiff’s
motion to remand hinges on whether Plaintiff has alleged an actual injury to sustain
Article III standing. Plaintiff argues that Defendant Pathfinder based its motion to dismiss
(Doc. 21) on the argument that Plaintiff has failed to appropriately plead that she suffered
an injury; therefore, she cannot sustain Article III standing and the case must be

remanded because a crucial element of subject matter jurisdiction is absent. Defendant
Pathfinder, confusingly, seems to partially agree, and argues that while Plaintiff has
failed to allege an actual injury under BIPA aside from a statutory violation, Plaintiff
claims her privacy rights were violated when Defendant Innovative Heights
disseminated her biometric information to Defendant Pathfinder, which creates an injury
for Article III standing purposes (Doc. 32, p. 1-2). Plaintiff contends that Defendant’s

reiteration that she has not pled an actual injury, which Defendant argues in both the
motion to dismiss (Doc. 21) and its response to Plaintiff’s motion to remand (Doc. 32), is
a binding judicial admission and the Court’s analysis should end there (Doc. 33). In
addition, Plaintiff argues that she is bringing BIPA violation claims against both
Defendants Innovative Heights and Pathfinder that are not dependent on the

transmission of information from Defendant Innovative Heights to Defendant
Pathfinder; rather, her claims against both Defendants stand on their own. Id.
Subsequently, Defendant Pathfinder sought leave from the Court to supplement
its response in opposition to Plaintiff’s motion to remand to include a recent case from
the Seventh Circuit on the issue of Article III standing in BIPA cases (Doc. 39). As this is

an emerging area of the law, the Court granted Defendant Pathfinder’s motion and
allowed additional briefing on the issue of Article III standing from both Plaintiff and
Defendant Pathfinder (Docs. 39, 40). Defendant Pathfinder argued that a recent case,
Bryant v. Compass Group USA, Inc., 958 F.3d 617 (7th Cir. 2020),2 “moots all of Plaintiff’s
arguments in her Motion for Remand” (Doc. 39, p. 1). In her response, Plaintiff argues

that Bryant is instructive for determining whether Article III standing exists for a Plaintiff
bringing a BIPA Section 15(b) claim, but not a Section 15(a) claim (Doc. 40, p. 1).
LEGAL STANDARD
Before a court can adjudicate the merits of a case, it must first satisfy itself that it
has jurisdiction over the claims and parties that appear before it. Ruhrgas AG v. Marathon
Oil Co., 526 U.S. 574, 577 (1999). A federal court has subject matter jurisdiction only if the

plaintiff has Article III standing. MAO-MSO Recovery II, LLC v. State Farm Mut. Auto. Ins.
Co., 935 F.3d 573, 581 (7th Cir. 2019). Article III standing is a crucial element for District
Courts as it ensures the Court does not exceed its authority over cases and controversies
that the federal court cannot hear. Spokeo, Inc. v. Robins, 136 S.Ct. 1540, 1547 (2016).3 As
the party seeking to invoke federal jurisdiction, Defendant Pathfinder must establish that

Article III standing exists; however, the Court also has an independent responsibility to
ensure that it has subject matter jurisdiction. Collier v. SP Plus Corp., 889 F.3d 894, 896 (7th

2 The plaintiff in Bryant worked for a call center in Illinois. At that call center, in the workplace cafeteria,
employees had to establish an account using their fingerprints to operate the vending machines as they
would not accept cash. Bryant, 958 F.3d at 619. Plaintiff brought suit against the operator of this vending
machine fingerprint collection system, Compass, arguing that Compass violated Sections 15(a) and 15(b)
of BIPA.
3 The standing doctrine limits “the category of litigants empowered to maintain a lawsuit in federal court
to seek redress for a legal wrong” to ensure the that the federal courts maintain an appropriate role in
relation to the other branches of the government. Id., (citing Valley Forge Christian College v. Americans United
for Separation of Church and State, Inc., 454 U.S. 464, 473 (1982)); Warth v. Seldin, 422 U.S. 490, 498-99 (1975).
Cir. 2018); Lujan v. Def. of Wildlife, 504 U.S. 555, 560 (1992). See also Carroll v. Stryker Corp.,
658 F.3d 675, 680 (7th Cir. 2011)

To establish that a plaintiff has Article III standing, a defendant must demonstrate
that plaintiff has alleged an injury-in-fact that was caused by defendant and is redressable
by the court. Groshek v. Time Warner Cable, Inc., 865 F.3d 884, 886 (7th Cir. 2017). To qualify
as an injury-in-fact, the alleged injury must be “concrete and particularized” and “actual
and imminent and not conjectural or hypothetical.” Spokeo, 136 S.Ct. at 1548. To be
concrete, the injury must be de facto, or actually exist. Id. A “bare procedural violation

divorced from any concrete harm” does not qualify as an injury in fact. Id. at 1549. A
procedural statutory violation may constitute an injury-in-fact on its own if the
legislature has elevated a de facto injury that “was previously inadequate in law” to the
“status of illegally cognizable injury.” Id. But a statutory violation causes a concrete injury
for Article III standing only if it presents an “appreciable risk of harm to the underlying

interest the [legislature] sought to protect by enacting the statute.” Groshek, 865 F.3d at
887.
Until Bryant, BIPA cases removed to federal court were frequently remanded for
lack of Article III standing when the plaintiff alleged violations of Sections 15(a) and (b)
without alleging further harm.4 The courts found, in those cases, that the plaintiffs had

4 See Bryant, 958 F.3d at 623, citing cases including, but not limited to, Hunter v. Automated Health Sys.,
Inc., No: 19C2529, 2020 WL 833180 (N.D. Ill. Fed. 20, 2020); McGinnis v. United States Cold Storage, Inc., 382
F.Supp. 3d 813 (N.D. Ill. 2019); and Aguilar v. Rexnord LLC, No: 17CV9019, 2018 WL 3239715 (N.D. Ill. July
3, 2018). Many of these cases were also cited to by Plaintiff in her motion to remand. See generally Doc. 27.
not pleaded a particularized, concrete harm and had simply alleged a procedural
violation; therefore, they could not meet the Article III standing test. Bryant outlined that

if the plaintiff could show that the statutory violation demonstrated an “appreciative risk
of harm” to the statute’s underlying interest, as determined by the legislature, then
Article III standing exists.5 Bryant, 958 F.3d at 621, citing Groshek, 865 F.3d at 887.
Since the Bryant plaintiff brought both Section 15(a) and Section 15(b) claims, the
Seventh Circuit analyzed both for Article III standing.
Article III Standing under Section 15(b) of BIPA

In its analysis of the Bryant plaintiff’s Section 15(b) BIPA claims, the Seventh
Circuit found that “the injury inflicted by nondisclosure is concrete if the plaintiff
establishes that the withholding impaired her ability to use the information in a way the
statute envisioned.” Bryant, 958 F.3d at 624. By not abiding by the requirements of Section
15(b) before it collected the plaintiff’s biometric information, the Seventh Circuit found

that the defendant deprived her of the ability to give the informed consent Section 15(b)

5 Federal courts must defer to a state supreme court's interpretation of its own statutes. Guaranty Bank v.
Chubb Corp., 538 F.3d 587, 590 (7th Cir. 2008). The Illinois Supreme Court has held that BIPA “codified that
individuals possess a right to privacy in and control over their biometric identifiers and biometric
information.” Rosenbach v. Six Flags Entm't Corp., 129 N.E.3d 1197, 1206 (Ill. 2019)(emphasis added). Thus,
allegations of collection and possession of purported biometric information in violation of the requirements
of Sections 15(a) and (b) of BIPA, combined with an allegation of a loss of the right to control that
information, constitute allegations of harm to the particular interests the statute was intended to protect -
control over one’s biometric identifiers or biometric information. Even so, Bryant highlights that Article III
standing is not a “perfect overlap,” as standing requirements in Illinois courts are more lenient than those
in federal courts. Bryant, 958 F.3d at 622. See also Greer v. Illinois Hous. Dev. Auth., 524 N.E.2d 561 (Ill. 1988)
(citations omitted).
of BIPA mandates and envisioned by the legislature. Id. at 626. The Seventh Circuit held
that these types of violations of Section 15(b) of BIPA meet the Article III standing test.

To support its decision, the court examines how the Bryant plaintiff’s claims are
similar to those brought in another case, Robertson v. Allied Solutions, 902 F.3d 690 (7th Cir.
2018), in which a company failed to provide a prospective employee with a copy of her
background report, in violation of the Fair Credit Reporting Act, before rescinding her
employment offer on the basis of information contained in that report. The Seventh
Circuit held this omission constituted an injury-in-fact for Article III standing because she

was wholly deprived of the information necessary to respond in the way FCRA
contemplated. Bryant, 958 F.3d at 625-26. The Seventh Circuit contrasted this scenario
with another case—Casillas v. Madison Avenue Associates, 926 F.3d 329 (7th Cir. 2019). Id.
In Casillas, the court found there was purely a procedural flaw because no amount of notice
or information would have changed the plaintiff’s behavior. Id. When applied to Bryant, the

Seventh Circuit held that had the plaintiff known her information was being stored and
had the defendant appropriately received her written consent ahead of storing her
biometric information, she may have opted to not use the vending machine or bring her
own snacks. Her behavior may have been changed by the defendant appropriately
following Section 15(b); therefore, the harm was concrete for purposes of Article III

standing. Id.
Article III Standing under 15(a) of BIPA
Alleged violations of Section 15(a) are different, however, because this section of
BIPA does not outline an entity’s duty to an individual; rather, this section outlines a duty
to the public generally. In Bryant, the Seventh Circuit emphasizes that 15(a) requires the
holder of the biometric information to develop a written policy about the retention

schedule and guidelines to destroying the information that is made available to the
public. Bryant, 958 F.3d at 626. Because the plaintiff did not advance a particularized harm
under Section 15(a), and because this provision is not part of the informed-consent regime
analyzed above, the Seventh Circuit determined plaintiff lacked Article III standing for
her Section 15(a) claims and those claims had to be remanded to state court. Id. It
appears, though, that the Seventh Circuit left the door open for potential Section 15(a)

Article III standing if the plaintiff advances a particularized harm under 15(a). Id. at 626-
627.
In fact, courts prior to and after Bryant have found Article III standing for
violations of Section 15(a), which requires a fact-specific analysis, focusing on the
relationship of the parties and the nature of the pleadings. The Northern District of

Illinois found that Section 15(a) creates an arguable individual right in the language that
requires entities to destroy the biometric data once the purpose of the collection is
satisfied or within three years after the last interaction with the relevant person. See
Cothron v. White Castle System, Inc., No: 19 CV00382, 2020 WL 3250706 *3 (N.D. Ill. June
16, 2020). The Cothron Court did not examine this theory beyond this statement, though.

Miller v. Southwest Airlines Co., a 2019 pre-Bryant case, makes it clear that there is
Article III standing for both Section 15(a) and Section 15(b) BIPA claims when a plaintiff
class brings a lawsuit against an employer and the company with control over the
technology that collects and manages the biometric data when the plaintiffs are part of a
union. 926 F.3d 898 (7th Cir. 2019). The rationale, here, is that not being able to negotiate
workplace terms and issues related to Sections 15(a) and (b) is an injury for purposes of

Article III standing. It is worth noting the Miller Court relied on the Railway Labor Act in
addition to BIPA. Id. “The prospect of a material change in workers’ terms and conditions
of employment gives these suits a concrete dimension that Spokeo…[and other cases]
lacked.” Id. at 903.
Article III Standing for Plaintiff Stauffer’s Claims
Plaintiff brings both Section 15(a) and Section 15(b) claims against both Defendants

Innovative Heights and Pathfinder. Although Defendant Innovative Heights has not filed
anything in response to Plaintiff’s motion to remand, the Court must ensure that all
parties and claims have standing before proceeding.
Bryant makes fairly easy work of the analysis for Section 15(b) claims for the matter
presently before the Court. Section 15(b) outlines that private entities must make certain

disclosures to and receive informed consent from consumers before obtaining and storing
their biometric information. Like in Bryant, Plaintiff alleges that both Defendants,
essentially, “deprived her of the ability to give the informed consent section 15(b)
mandates.” Bryant, 958 F.3d at 626. Plaintiff pleads that both Defendants never requested
or received her consent before collecting her fingerprints and never informed her of the

purpose of and circumstances surrounding the collection of her biometric information.
Accordingly, like in Bryant, Plaintiff has Article III standing for both of her Section 15(b)
claims against both Defendants .
Analysis for standing under Section 15(a) is not as straight forward. When viewed
in totality, the analysis for Article III standing under Section 15(a) seems to hinge more

on the relationship of the parties since Section 15(a) covers a duty to the public as opposed
to the individual. Section 15(a) dictates that private entities that collect biometric
information must make available a data retention schedule and guidelines for
permanently destroying collected biometric identifiers and information. While Bryant did
not find that the plaintiff had Article III standing for her Section 15(a) claims, the court in
Miller did. The court in Cothron entertained the idea of Article III standing for Section

15(a), but declined to address it further because plaintiff had pleaded facts demonstrating
that no violation occurred. Here, the question is whether Plaintiff’s Section 15(a)
pleadings against both Defendants describe more than a simple procedural violation.
For Defendant Pathfinder, Plaintiff alleges that “[Pathfinder] did not make
available to the public a written policy establishing a retention schedule and guidelines

for permanently destroying any such fingerprints when the initial purpose for collecting
such fingerprints has been satisfied” (Doc. 1-1, p. 100). Plaintiff has not included
additional facts about how Defendant Pathfinder’s alleged violation of Section 15(a)
injured her. Plaintiff has not enumerated how Defendant Pathfinder’s alleged Section
15(a) violation impacted her thinking or potentially changed her behavior. Her

allegations seem to mirror the sparse allegations in Bryant; therefore, Plaintiff has not
articulated an additional injury, beyond a violation of the statute, to satisfy the
requirements for Article III standing of her Section 15(a) claims against Defendant
Pathfinder.
Plaintiff pleaded that Defendant Innovative Heights violated Section 15(a) by not
having a published written policy for the retention of this biometric information.

Defendant Innovative Heights’ failure to publish such a policy means that when “Plaintiff
and Innovative Heights Class Members left or leave the employment of Innovative
Heights, they were or are left unaware if and when their biometric identifiers would be
destroyed” (Doc. 1-1, p. 99). Furthermore, if Innovative Heights were to be sold or go
out of business, Plaintiff and Innovative Heights Class Members would be left unaware
as to who is in possession of their biometric identifiers (Doc. 1-1, p.99).

Bryant held that the defendant’s Section 15(a) requirement to make available a
written retention and destruction policy was a harm to the public and not a particular
harm to the plaintiff because of the plaintiff’s theory she invoked. Bryant, 958 F.3d at 626.
In that case, the plaintiff was a consumer, as opposed to an employee of the entity she
sued. After Bryant, in Cothron v. White Castle, an employee of White Castle brought suit

against her employer for violations of Sections 15(a), 15(b), and 15(d) of BIPA after her
employer collected her biometric information, specifically fingerprints, as part of their
“clock-in, clock-out” timekeeping system. The court held that the second requirement of
15(a) “arguably creates an individual right to have personal data deleted,” but
determined that the court need not address this novel issue because the plaintiff

continued to work at White Castle with the same biometric collection process in place.
Since she was still working at White Castle with this same system when she filed her
lawsuit, the court determined that neither of Section 15(a)’s conditions requiring
destruction of biometric data could be used to advance an Article III standing argument.
Cothron, 2020 WL 3250706 at *3.

The Cothron court determined that the second part of Section 15(a), which requires
private entities in possession of biometric information to permanently destroy the
information when the initial purpose has been satisfied or within three years of the
individuals’ last interaction with the private entity (whichever comes first), may create an
individualized right. See 740 ILCS 14/15(a). If there is a duty to the individual and not
just the public, Article III standing is more likely. In the present matter, unlike Cothron,

Plaintiff left her employment with Defendant Innovative Heights in May 2018, and
Plaintiff alleged in her Complaint that when employees leave, they have no idea when
and how their biometric information will be destroyed, if it will be destroyed at all (Doc.
1-1, p. 98). While Plaintiff has advanced some additional facts discussing the impact of
Defendant Innovative Heights’ Section 15(a) violation, she has still not described a

concrete and particularized harm for Article III standing. She has not described how the
Section 15(a) violations have impacted her thinking or if those violations were the reason
for her leaving, for example; rather, her description is more hypothetical and describes
what could happen if one left employment while Defendant Innovative Heights still
improperly retained their biometric information. The fact that Plaintiff has left

employment is not enough if she has not pled how the alleged Section 15(a) violation
impacted her.
Accordingly, Plaintiff has Article III standing for her Section 15(b) claims against
both Defendants Pathfinder and Innovative Heights. Plaintiff does not have Article III
standing for her Section 15(a) claims against either Defendant. Plaintiff’s Section 15(a)
claims against Defendant Pathfinder and Defendant Innovative Heights are remanded to

the Twentieth Judicial Circuit, St. Clair County, Illinois.
DEFENDANT PATHFINDER’S MOTION TO DISMISS
In addition to Plaintiff’s motion to remand, the Court must address Defendant
Pathfinder’s motion to dismiss (Doc. 23).
A motion to dismiss under Rule 12(b)(6) addresses the legal sufficiency of the
plaintiff’s claim for relief, not the merits of the case or whether the plaintiff will ultimately

prevail. Camasta v. Jos. A. Bank Clothiers, Inc., 761 F.3d 732, 736 (7th Cir. 2014); Gibson v.
City of Chicago, 910 F.2d 1510, 1520 (7th Cir. 1990). In reviewing a motion to dismiss, the
court must construe the complaint in the light most favorable to the plaintiff, accept as
true all well-pleaded facts, and draw all possible inferences in the plaintiff’s
favor. E.g., Hecker v. Deere & Co., 556 F.3d 575, 580 (7th Cir. 2009) (citation omitted). The

complaint will survive the motion to dismiss only if it alleges facts sufficient to “state a
claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 556
(2007). “A claim has facial plausibility when the plaintiff pleads factual content that
allows the court to draw the reasonable inference that the defendant is liable for the
misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). A plaintiff does not need

“detailed factual allegations,” but must plead more than “labels and conclusions” and “a
formulaic recitation of the elements of a cause of action.” Twombly, 550 U.S. at 555.
Determining whether a complaint plausibly states a claim for relief is a “context-specific
task that requires the reviewing court to draw on its judicial experience and common
sense.” Iqbal, 556 U.S. at 679. The structure outlined here for the complaint will ensure
that the defendant receives “fair notice of what the ... claim is and the grounds upon

which it rests.” Twombly, 550 U.S. at 1959.
Defendant Pathfinder makes a series of five arguments in its motion to dismiss,
arguing that Plaintiff has failed to plead sufficient facts for the case to survive beyond
this early stage of litigation. Plaintiff opposes each of these arguments in her response to
Defendant Pathfinder’s motion to dismiss (Doc. 23).
I. BIPA is Special Legislation in Violation of the Illinois Constitution

First, Pathfinder argues that BIPA is unconstitutional special legislation because it
imposes strict compliance requirements on some employers, but then exempts “the entire
financial industry” and state and local government contractors “arbitrarily,” so BIPA
“should be struck down” as unconstitutional (Doc. 21, pp. 4-7). Plaintiff disagrees,
arguing that Defendant Pathfinder has failed to cite to any precedent in which a court has

declared BIPA as unconstitutional and that excluding financial institutions and
government entities is not arbitrary because the exempt financial institutions are subject
to a separate set of standards under the Gramm-Leach-Bliley Act of 1999 (“GLBA”),
which has strict data protection standards (Doc. 23, pp. 11-15). Furthermore, Plaintiff
argues that BIPA was enacted to regulate private companies, which is why government

entities are exempt from the law (Id. at 12-13).
The Illinois Constitution's Special Legislation Clause prohibits a “special or local
law when a general law is or can be made applicable.” Ill. Const. 1970, art. IV, § 13. More
specifically, it prohibits the General Assembly from conferring “a special benefit or
privilege upon one person or group and excluding others that are similarly situated.”
Crusius v. Illinois Gaming Board, 837 N.E.2d 88, 94 (Ill. 2005). The legislature has discretion

to make statutory classifications; however, the special legislation clause prevents it from
making classifications that arbitrarily discriminate in favor of a selected group. Id.; Big
Sky Excavating, Inc. v. Illinois Bell Telephone Co., 840 N.E.2d 1174, 1183 (Ill. 2005). There is
a two-part test to determine whether a law constitutes special legislation: (1) whether the
statutory classification at issue discriminates in favor of a select group and against a
similarly situated group; and (2) if the classification does so discriminate, whether the

classification is arbitrary. Id. See also Protect our Parks, Inc. v. Chicago Park Dist., 385 F. Supp.
3d 662, 692 (N.D. Ill. 2019). Illinois courts use the rational basis test to determine whether
the statutory classification is rationally related to a legitimate state interest. Piccioli v. Bd.
Of Trustees of Teachers’ Ret. Sys., 137 N.E.3d 745, 751 (Ill. 2019). In this analysis, the court
may “hypothesize reasons for the legislation…any conceivable basis for finding a rational

relationship” will uphold the law in question. Id. See also People ex. rel. Lumpkin v. Cassidy,
703 N.E.2d 1, 5-9 (Ill. 1998).
Defendant Pathfinder first argues that BIPA excludes “nearly the entire financial
sector” and argues that a vast number of employers qualify as financial institutions and,
therefore, are unregulated by BIPA since they fall into this exclusionary provision (Doc.

21, p. 5). Defendant Pathfinder’s argument is a bit hyperbolic. As Plaintiff argues, the
financial institution exemption is for “financial institution[s] or an affiliate of a financial
institution that [are] subject to Title V of the federal Gram-Leach Bliley Act of 1999” (Doc. 23,
p. 12). See also 730 ILCS 14/25(c). The financial institution exemption is not for all
financial institutions; rather, it is for those that are already covered by another law similar
to BIPA that requires financial institutions to explain their information-gathering

practices and how they safeguard sensitive data to their customers (Doc. 23, pp. 15-17).
When the Court examines financial institutions subject to BIPA and those that are exempt
under the two part test highlighted above, it is clear that they are similarly situated
groups; however; it does not appear that BIPA differentiates between these two groups
in a discriminatory fashion since both sets of financial institutions are subjected to
stringent reporting requirements through either a state or federal law.6 Plaintiff also

makes a compelling argument that the Illinois legislature may have, rationally, concluded
that failing to exclude those financial institutions subjected to GLBA’s reporting
standards risked federal preemption of BIPA (Doc. 23, p. 12). Courts have invalidated
legislative classifications under the special legislation clause when they have an
“artificially narrow focus” and are “designed primarily to confer a benefit on a particular

private group without a reasonable basis, rather than to promote the general welfare.”
Best v. Taylor Machine Works, 689 N.E.2d 1057, 1072 (Ill. 1997). The financial institution
distinction made by BIPA cannot be found to be “artificially narrow” in its focus since
both exempt and non-exempt financial institutions are subject to data reporting laws,
with neither group receiving a benefit the other does not.

Similarly, Defendant Pathfinder argues that exempting government employers
from BIPA cannot survive rational basis scrutiny and “the arbitrariness of these carve-

6 Plaintiff includes a portion of the debate transcript from the Illinois House, detailing that some banks,
covered under Federal Law, are exempt (Doc. 23, p. 12).
outs should not be permitted to stand” (Doc. 21, p. 7). Plaintiff argues, rightfully, that the
Illinois legislature enacted BIPA to regulate the private sector and argues that courts have

previously upheld classifications differentiating between the government and private
entities (Doc. 23, p. 13).
Plaintiff mentions, and the Court finds it important to note, that BIPA was enacted
in 2008, approximately twelve years ago, and there have been a number of BIPA cases
both in federal and state court. Defendant Pathfinder did not cite to a single BIPA case to
support its argument and while that is not dispositive of Defendant’s arguments alone, it

is noteworthy that not a single other case has found BIPA to be unconstitutional in those
twelve years. For purposes of a 12(b)(6) motion, Plaintiff has pled sufficient facts to
conclude that BIPA is not special legislation and is, therefore, not unconstitutional.
II. Defendant Pathfinder is Exempt from BIPA because it is Classified as a
Financial Institution
Second, Pathfinder argues that it should be classified as a financial institution in
the aforementioned financial exemption and, therefore, Defendant Pathfinder is exempt
from BIPA’s requirements (Doc. 21, pp. 7-9). Plaintiff argues that Defendant Pathfinder
is not a financial institution as defined by BIPA and is not exempt (Doc. 23, pp. 8-10).
Plaintiff elaborates that the financial institutions exempt from BIPA are exempt because

they are subject to GLBA and are defined as “significantly engaged in financial activities,”
which Plaintiff argues is not the case for Defendant Pathfinder (Doc. 23, p. 15). See 16
C.F.R. § 313.3(k)(1). In addition, Plaintiff highlights that Defendant Pathfinder has
improperly relied on materials outside of the pleadings, specifically a declaration of
Defendant Pathfinder’s Chief Financial Officer re-attached from the notice of removal
(Doc. 1-2) to its motion to dismiss, to argue this point (Doc. 23, p. 16).

Based on the pleadings, it seems doubtful that Defendant Pathfinder could be
designated as a “financial institution” and, therefore, exempt from BIPA. BIPA’s financial
institution exemption is explicit in that BIPA does not apply to financial institutions
already subjected to GLBA. See 740 ILCS 14/25(c). The Federal Trade Commission
describes the type of financial institutions that must comply with GLBA, which includes
“all businesses, regardless of size, that are ‘significantly engaged’ in providing financial

products or services. This includes, for example, check-cashing businesses, payday
lenders, mortgage brokers, nonbank lenders, personal property or real estate appraisers,
professional tax preparers, and courier services.”7 Defendant Pathfinder, on its website,
describes itself as a “leader in the entertainment software industry,” and states that it
“operate[s] as a processor of personal information for our customers, including via the

Advantage Access Control App” (Doc. 1-1, p. 95). Defendant Pathfinder controls and/or
runs the system and/or database in which Defendant Innovative Heights’ employees’
fingerprints are stored (Doc. 1-1, p. 93). Nowhere in the Complaint is Defendant
Pathfinder described as a financial institution, mainly, that is engaged in any of the
aforementioned activities that would subject it to GLBA, such as appraising real estate or

preparing taxes.

7 See Federal Trade Commission, Gramm-Leach-Bliley Act, https://www.ftc.gov/tips-advice/business-
center/guidance/financial-institutions-customer-information-complying (last accessed August 17, 2020).
Defendant Pathfinder re-attaches a declaration it submitted with its notice of
removal from the Chief Financial Officer, which Defendant Pathfinder alleges proves that

Defendant Pathfinder is an exempt financial institution. This affidavit is not even
appropriate for the Court’s consideration on a 12(b)(6) motion. Geinosky v. City of Chicago,
675 F.3d 743, 745 n.1 (7th Cir. 2012) (“A motion under Rule 12(b)(6) can be based only on
the complaint itself, documents attached to the complaint, documents that are critical to
the complaint and referred to in it, and information that is subject to proper judicial
notice.”). And even if it was, the affidavit doesn’t move the needle as it does not indicate

whether Defendant Pathfinder is subjected to the reporting requirements of GLBA;
therefore, the Court cannot find that Defendant Pathfinder is exempt from BIPA (See
generally Doc. 1-2).
The Court finds that Plaintiff has sufficiently pled her claims against Defendant
Pathfinder for purposes of a 12(b)(6) motion because at this time, the Court cannot find

that Defendant Pathfinder is exempt from BIPA because it is a financial institution
subjected to the reporting requirements of GLBA.
III. Plaintiff’s Claims are Time-Barred by the Statute of Limitations
Third, Defendant Pathfinder argues that Plaintiff’s complaint is time-barred since
she did not bring the claim in the appropriate statute of limitations, which Defendant

Pathfinder claims is one year (Doc. 21, pp. 9-10). Plaintiff argues that Defendant
Pathfinder relies on the incorrect statute of limitations and that almost every other BIPA
case has held that BIPA claims are subject to the five-year catchall statute of limitations
(Doc. 23, p. 18).
BIPA itself does not include a statute of limitations. Under Illinois law, “all civil
actions not otherwise provided for, shall be commenced within five years next after the

cause of action accrued.” 735 ILCS 5/13-205. To determine whether there is a more
specifically applicable statute of limitations, Illinois courts analyze “the type of injury at
issue, irrespective of the pleader’s designation of the nature of the action.” Travelers Cas.
& Sur. Co. v. Bowman, 893 N.E.2d 583, 587 (Ill. 2008). “[G]eneral rules of statutory
construction” govern this analysis. See Hernon v. E.W. Corrigan Const. Co., 595 N.E.2d 561,
562 (Ill. 1992).

Defendant Pathfinder argues that BIPA violations like the ones alleged by Plaintiff
are, essentially, related to invasion of privacy and traditional invasion of privacy claims
have a one-year statute of limitations from the date the privacy right is invaded. 735 ILCS
5/13-201; see also Blair v. Nevada Landing P’ship, 859 N.E.2d 1188, 1192 (Ill. 2006). To further
the argument, Defendant Pathfinder argues that the Rosenbach court determined that

BIPA is fundamentally a privacy statute (Doc. 21, p. 9-10). Since Plaintiff did not file her
original Complaint within one year of when she began using the clock-in, clock-out
system at Defendant Innovative Heights, Defendant Pathfinder moves for dismissal since
Plaintiff’s claims are not timely.
Plaintiff contends this argument was dispelled by the one Illinois court to have

addressed this issue in a published decision. See Robertson v. Hostmark Hospitality Group,
Inc., 2019 WL 8640568, at *4 (Ill. Cir. Ct. 2019). In Robertson, the court held that the five-
year statute of limitations applies to BIPA claims, which the Court finds persuasive
because, as Plaintiff argues, a series of BIPA cases have found similarly.8 As the Court
has previously noted, BIPA precedent is developing, and while many of the cases Plaintiff

cites to are state-court decisions and non-binding on this Court’s decision, they are
instructive for how state courts interpret this state law, particularly since the Court must
apply “the law of Illinois as [it] believe[s] the Illinois Supreme Court would apply it”
(Doc. 23, p. 20) See also Liberty Mut. Fire. Ins. Co. v. Statewide Ins. Co., 352 F.3d 1098, 1100
(7th Cir. 2003).
Additionally, a “plaintiff is not required to plead elements in his or her complaint

that overcome affirmative defenses, such as statute-of-limitations defenses.” NewSpin
Sports, LLC v. Arrow Elecs., Inc., 910 F.3d 293, 299 (7th Cir. 2018). As long as the Court can
“imagine” a scenario in which the claim is timely, it is improper to dismiss it on the
pleadings. See U.S. Gypsum Co. v. Ind. Gas Co., Inc., 350 F.3d 623, 628 (7th Cir.
2003) (holding that the “right question” is not whether the plaintiff has alleged “facts that

tend to defeat affirmative defenses,” but “whether it is possible to imagine proof of the
critical facts consistent with the allegations in the complaint” that would fall within the
period of limitations). Accordingly, Plaintiff has pled sufficient facts for purposes of a
12(b)(6) motion that her BIPA claims are timely.

8 Plaintiff lists a series of at least six post-Rosenbach decisions, also upholding that the five-year catch-all
statute of limitations applies to BIPA cases, in her response to Defendant Pathfinder’s motion to dismiss.
See Doc. 23, p. 19.
IV. Plaintiff’s Claims are Barred by Waiver or Equitable Estoppel
Fourth, Defendant Pathfinder argues that Plaintiff voluntarily waived her right to
sue because Plaintiff implicitly consented to the collection of her fingerprints for the

purpose of clocking in and out of work; accordingly, the doctrine of equitable estoppel
applies and Plaintiff cannot bring BIPA claims now (Doc. 21, pp. 10-12). According to
Defendant Pathfinder, Plaintiff remained silent and never complained while continuing
to use the fingerprint collecting system throughout her course of employment with
Defendant Innovative Heights, which “demonstrates that she voluntarily relinquished a

known right” (Doc. 21, p. 12). Plaintiff argues that Defendant Pathfinder incorrectly
conflated waiver and equitable estoppel, and that she is not barred from bringing her
BIPA claims under either doctrine (Doc. 23, p. 22).
Equitable estoppel and waiver are similar, but distinct doctrines. Lumbermen's
Mut. Cas. Co. v. Sykes, 890 N.E.2d 1086, 1097 (Ill. 2008). “Waiver is commonly defined as

‘the intentional relinquishment of a known right.’” Hahn v. Cty. Of Kane, 991 N.E.2d 373,
378-379 (Ill. 2013). Equitable estoppel is “the effect of a person’s conduct ‘whereby the
person is barred from asserting rights that might otherwise have existed against the other
party who, in good faith, relied upon such conduct and has been thereby led to change
his or her position for the worse.’” Id.

In contrast to waiver, equitable estoppel “may arise even though there was no
intention on the part of the party estopped to relinquish any existing right.” Vaughn v.
Speaker, 533 N.E.2d 885, 890 (Ill. 1988). Additionally, unlike with waiver, the party
claiming estoppel must act in order to complete the estoppel. Lumbermen's Mut. Cas.
Co., 890 N.E.2d at 1097. “Questions of estoppel and waiver are left to the trier of fact
where the material facts are in dispute or where reasonable people might draw different

conclusions from the evidence.” Safeway Ins. Co. v. Ebijimi, 117 N.E.3d 1227, 1240 (Ill.
2018) (internal quotation marks and citation omitted).
A. Equitable Estoppel
“In order to raise a successful defense of equitable estoppel, the party claiming
estoppel must show (1) the other party misrepresented or concealed material facts, (2) the
other party knew, at the time the representations were made, that those representations

were false, (3) the party claiming estoppel did not know of the falsity of the
representations when they were made or when they were acted upon, (4) the other party
intended or reasonably expected the representations to be acted upon by the party
claiming estoppel, (5) the party claiming estoppel reasonably relied upon the
representations in good faith to his detriment, and (6) the party claiming estoppel has

been prejudiced by his reliance on the representations.” Ruiz v. Cal-Ful Condominium
Ass’n, 144 N.E.3d 1229, 1234 (Ill. 2019).
Defendant Pathfinder does not identify any material facts that Plaintiff has
concealed or misrepresented. The Complaint alleges only that Defendant failed to provide
the necessary disclosures and obtain the necessary consents before making Plaintiff use

her fingerprints to clock in and out of work. Defendant does not attempt to explain how
the elements of equitable estoppel have been satisfied, so the Court cannot find that
Plaintiff is estopped from bringing her claims.
B. Waiver
Defendant also asserts a theory of waiver. “Individuals generally may waive
substantive rules of law, statutory rights, and even constitutional rights enacted for their

benefit,” if “the waiver is knowing, voluntary, and intentional.” In re Estate of Ferguson,
730 N.E.2d 1205, 1210 (Ill. 2000); See also RTP LLC v. Orix Real Estate Capital, Inc., No: 2013-
CV-0350, 2014 WL 12696867 *1 (N.D. Ill. 2014).
The Court cannot say, based on the pleadings and the minimal arguments
provided by Defendant Pathfinder, that the only conclusion logically drawn from

Plaintiff’s actions while employed at Defendant Innovative Heights is that she
knowingly, voluntarily, and intentionally waived any right to bring a BIPA claim by
continuing to scan her fingerprints at her place of work. In fact, Defendant Pathfinder has
seemingly forgotten that Plaintiff did not know of Defendant Pathfinder’s involvement
until filing her case in state court and starting discovery. To claim that she knowingly

compromised her biometric information and continued to do so, thereby supporting a
claim of either waiver or estoppel, in regards to Defendant Pathfinder is wholly
unsupported by the pleadings. Further, practically speaking, if the Court were to
conclude that based on the complaint, Plaintiff’s rights were estopped or waived,
practically no BIPA cases could ever move forward, which is not the intention of BIPA’s

enforcement provision. See 740 ILCS 14/20 . The Court therefore concludes that it would
be inappropriate, at this early stage of the case, to dismiss Plaintiff’s claims due to either
doctrine.
V. Plaintiff has not Pled Sufficient Facts Related to Defendant’s Negligent or
Reckless Violations

Finally, Defendant Pathfinder argues that this case should be dismissed because
Plaintiff has not pled sufficient facts to support her cause of action, specifically that she
has not asserted that Defendant Pathfinder negligently, recklessly or intentionally
violated BIPA, specifically 740 ILCS 14/20(1) (Doc. 21, pp. 12-14). Defendant argues that
Plaintiff has not pled any facts relating to how Defendant Pathfinder collected her
fingerprints or if that was done negligently. Plaintiff argues that she is not required to
assert facts regarding Defendant Pathfinder’s negligent, reckless, or intentional actions to

bring a BIPA cause of action (Doc. 23, pp. 26). Plaintiff is correct.
It appears that Defendant Pathfinder mistakenly read and quoted the incorrect
part of BIPA when making this argument in its motion to dismiss, as Plaintiff outlined
(Doc. 23, pp. 25-27). BIPA provides for a private right of action for “[a]ny person
aggrieved by a violation” of the statute. 740 ILCS § 14/20 (emphasis added). The Illinois

Supreme Court has explained that “when a private entity fails to comply with one of
Section 15’s requirements, that violation constitutes an invasion, impairment, or denial
of the statutory rights of any person or customer whose biometric identifier or biometric
information is subject to the breach.” Rosenbach, 129 N.E.3d at 1206. “The violation, in
itself, is sufficient to support the individual’s or customer’s statutory cause of

action.” Id. The “negligent” and “intentionally and recklessly” standards come into play
when determining remedies, with negligent violations worth $1,000 in liquidated
damages (or actual damages, if greater) and intentional or reckless violations worth
$5,000 in liquidated damages (or actual damages, if greater). 740 ILCS § 14/20(1), (2).
Additional remedies of attorneys’ fees, costs, and injunctive relief are also available, and

the statutory language does not limit these remedies to only negligent, intentional, or
reckless violations. Id. § 14/20(3), (4); see also Cothron, 2020 WL 3250706 at *5 (“[I]f the
complaint plausibly pleads violations of Section 15(b) and Section 15(d)—which the
Court finds that it does—then, even absent specific allegations about White Castle’s
mental state with respect to each of those claims, it has stated a claim entitling Ms.
Cothron to litigation expenses and injunctive relief under Section 20, whether or not she

proves an entitlement to damages based on negligent, reckless, or intentional conduct.”).
Plaintiff’s argument mirrors the analysis above. To allege a claim that Defendant
Pathfinder violated BIPA, all she must do is allege that Defendant collected, captured,
purchased, received, or obtained her fingerprints without complying with BIPA’s
requirements (Doc. 23, p. 26). As Plaintiff explained, and as other courts have outlined,

the references to negligent, reckless, and intentional violations only relate to what the
prevailing party may recover for each violation, which is not before the Court presently.
Id. Accordingly, for purposes of a 12(b)(6) motion, Plaintiff has pled sufficient facts to
state a cause of action against Defendant Pathfinder.
CONCLUSION

For the aforementioned reasons, Plaintiff Stauffer’s motion to remand is DENIED
in part and GRANTED in part. The Court retains jurisdiction over Plaintiff’s BIPA
Section 15(b) claims as they pertain to both Defendants Innovative Heights and
Pathfinder. The Court REMANDS Plaintiff’s BIPA Section 15(a) claims as they pertain to
Defendants Pathfinder and Innovative Heights to the Twentieth Judicial Circuit, St. Clair

County, Illinois as this Court does not have jurisdiction over those claims.
Defendant Pathfinder’s motion to dismiss is DENIED.

IT IS SO ORDERED.
DATED: August 19, 2020
s/ Mark A. Beatty
MARK A. BEATTY
United States Magistrate Judge

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/cases/10152607. Public record. Not legal advice.