# Oral argument — Norma Cisneros v. Nuance Communications, Inc. > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/argument%3A100993 ## Record - **Collection:** Oral argument - **Document type:** Oral argument - **Published:** October 27, 2025 ## Text before calling its final case. We're ready now for our final case of the morning, Cisneros v. Nuance Communications. Mr. Wise. May it please the Court, my name is Brandon Wise and I represent Plaintiff Appellant Norma Cisneros. Today we ask the Court to reverse and remand this matter as the lower court erred in granting a Rule 12b-6 dismissal of the case based on BIPA's 25c exemption for financial institutions as that term is subject to the Gramm-Leach-Bliley Act. We believe that the District Court erred in its interpretation of the Gramm-Leach-Bliley Act, which defines a financial institution under Section 6809-3A by incorporating activities that are set forth in the Bank Companies Holding Act. Now, counsel, let me get straight to my major worry about this case. Let's assume that you're right, that Nuance can't be treated as a financial institution itself. My question is, how can you prevail without requiring Schwab to do something? And you can see that Schwab is a financial institution. It's Schwab that has hired Nuance to do particular things. It's Schwab with whom the customers contact. And Schwab can't be required to comply with this state law. So how can you get anywhere in this case? So I think we do, for the record, concede that Schwab is a financial holding company and therefore subject to Gramm-Leach-Bliley. The difference is, especially looking at the different sections of BIPA, there are different requirements, one of which is 14-15-A, which would only require Nuance, not Schwab, to make publicly available postings regarding- And which we have held cannot be enforced in federal court because the plaintiffs lack standing to enforce 15-A. So if your answer to my question is, it's because we rely on Sub-A, you now have an Article 3 problem which you need to address. Yeah, that's my question for you. Is there Article 3 standing on the 15-A claim? I think there is. I think there are multiple courts that hold on the basis of something like unlawful retention of biometrics in addition to other types of violations of Sub-A. Yeah, don't worry about other courts for a minute. Sure. I mean, you can go back to other courts. Can you just focus on what allegations in the first amended complaint allege harm, injury in fact, actual or imminent, that would give your client standing on the 15-A claim? All I'm doing is trying to summarize the standing test for you. Sure, sure. No, I think that in the first amended complaint, we outline our 15-A claim. No question. There's no doubt about that. The question is what harm, what actual harm is alleged to have followed from the- forget 15-B, 15-A. I suppose the 15-A claim would be the failure to implement a 15-A policy and to abide by it. We have expressly held that failure to implement a policy under 15-A is not a source of standing. We have, let's just say, wavered on the question whether the retention schedule can itself be the source of standing. I agree. What allegations are you making that show the kind of harm that would pass muster under our decisions? That's the question. It's not a matter of do we understand 15-A. We understand it. You understand it. The question is what harm is alleged in connection with 15-A. And again, I believe that Seventh Circuit precedent has helped it. Don't worry about Seventh Circuit precedent. What's in the complaint? You might want to go on. The complaint, I guess, subject to 15-A that we've alleged the defendant has failed to abide by a policy. That is not sufficient for standing. We have held over and over and over that just failing to abide by the law does not produce standing. What's necessary to standing is injury in fact, traceable to the defendant's behavior and redressable by the court. We're asking you questions about injury. And so the injury wouldn't be the failure to abide by the law. It would be the failure to abide by Nuance's own policy, which it did not create, I guess. That is not injury. The Supreme Court has held, and as I say, we have held over and over and over that not following the law is not enough for standing. So how does your complaint allege injury? I think we also allege injury under Section 1415B. That is something that is on Schwab's tab or not. You really need to concentrate on the question you're being asked. I think that there are ways that Nuance, that are not related to Schwab in relation to Section 1415B. Whether or not Nuance is collecting biometric information such that it would be in violation of BIPA does not relate to, is not necessarily implicating any action on behalf of Schwab. Whether or not as a business-to-business relationship. Here's the problem. I'm going to try one more time. What you're relying upon, I think, is paragraph 97 of the First Amendment complaint. You may be relying upon it because it might be the best you can do. Where you say the defendant fails to comply with these BIPA mandates. That's basically saying the defendant fails to comply with law. What you have two members of the panel asking you is, yeah, we read it, we see it. It's not, we get it. What is the injury? You're not injured in an Article 3 standing sense by a defendant's failure to comply with law without more. And the question is, what more is there in the First Amendment complaint? Judge, I'm looking to how the district court assured itself that it was, that there was. You might want to use your rebuttal. Think about it before you come up with rebuttal. I mean, mindful that your time is running. Thank you. The question before that was, I believe, how does regulate, how does this case not implicitly regulate Schwab? And I do think that some of that turns on the requirements of Section 14B. And that's where there are a number of requirements that private entities who collect biometrics must perform, including getting written consent. But the district court did correctly hold that nothing in the complaint, especially at the motion to dismiss stage where Section 25C would function more as an affirmative defense, has to be read in light or can be read in light of necessarily requiring Schwab to take actions such that Section 25C should apply under a theory of indirect application. Could you be concrete? What action was Schwab required to take by the state law that you say it hasn't taken, given that Schwab is exempt from the state law? I don't believe that Schwab has to take any action specifically because it's exempt. It's Schwab. Correct. See, what's happening is if we're not looking at Schwab, we're looking at nuance. We've got to focus on how is nuance harmed? If you can't focus on Schwab, Schwab can't impose harm, right? Where is this coming from? The only thing nuance has done is to collect data, which it receives via Schwab, and retain it and not disclose its retention policy. We've been asking how those things harm the plaintiff. And so far, I don't think you've seen what the problem is. So I think under Section 14B, the failure to obtain the written collection of data. 1415B. The collection of data without informed consent does give rise to tangible harm. No, you have to show harm. A violation of law is not harm. It may lead to harm, and if it leads to harm, it may be actionable. But a violation of law is not itself harm. I think you're just- Maybe I'm missing- With that basic point. Sure, and I think I'm trying to square the question with cases like the Seventh Circus Compass Group case, where it found that Section 1415B, when a plaintiff's biometric information is captured without consent, that that is a traditional privacy-related harm that the court has found provides subject matter jurisdiction. I'm sorry if I completely missed- Schwab is a person who either does or doesn't get consent, and you've agreed that Schwab is not covered by the state law at all. And I think that is the basis of our case, that Nuance had an independent duty to obtain consent. Why? What in the state law requires Nuance to obtain consent when it's Schwab who deals with a customer? The law at HIPAA is agnostic whether or not it's- Let's suppose Schwab gathers this data and sends it straight to the KGB. Well, it's now no longer the KGB, but you get the idea. What in the law required the KGB to obtain anybody's consent? Because the KGB didn't deal with the plaintiffs. Only Schwab dealt with the plaintiffs. I think that the statutory text of HIPAA is agnostic as to whether or not you are a direct- there's no relationship or customer requirement. It is the act of having the biometric data in your possession- So you think that the KGB would be in violation of Illinois law? Is that remotely plausible? It's not something you want to stake your case on. So- You seem to be relying on retention in part. What's your best case after transunion that the mere retention would be an injury in fact? So I think after transunion, it's- and maybe I'm ineloquent in retention, but they had to collect the data at some point. And collection or taking of data without consent has been recognized in numerous cases. Post-transunion is a traditionally recognized type of harm. But it's Schwab that collects the data and sends it to Nuance. And so I think that that- I think that that oversimplifies what we have pled in the complaint. Because I think that there's no- It does indeed oversimplify. Between Schwab and Nuance, there are a bunch of actors on the internet, right? Maybe Amazon Data Services. Has Amazon Data Services violated this law by not getting the plaintiff's consent before it transmits the data through its data centers to Nuance? Yes. And I actually think that- You realize how many actors there are on the internet between Nuance and Schwab? There could be thousands. And you think they've all violated this Illinois statute? I think that if- On the basis of what's alleged in the complaint, when someone calls in to Schwab, if it is Nuance that first receives their biometric information, whether or not- No, it's not- Nuance is not the first recipient. You're not understanding my question. The first recipient will be the internet service provider for Schwab, which transmits it to another. The internet can have thousands of links. It may go through a data center at Amazon Data Services, which may actually be where it resides, but in the control of Nuance. I ask you whether you think that all of these entities- The internet service provider may be AT&T. Is it violating the statute? If AT&T would be collecting plaintiff's biometric information- No, Schwab collects it. It then moves through a series of steps over thousands of different wires, goes up to satellites that are run by still other companies, comes back down. Are they all violating this statute? I think that the text of BIPA is agnostic as to whether or not there is a customer relationship. BIPA applies to private entities who are in possession of biometric information. Do you have any state case suggesting that Amazon Data Services or AT&T violates this statute by not having and disclosing a data retention policy? I know that there are cases against companies like Amazon. I'm not sure about AT&T, but I think one analog that's very important is in the timekeeping context. There are cases against the time clock vendor who has no relationship with the employee who was using the biometric time clock. That's the same type of relationship where there is actually no relationship between the person- Okay, I think we have your position, counsel. Thank you, Your Honor. Ms. Kostanek. Thank you, and may it please the Court. As Your Honor's questions reflect, I do think that plaintiff is in quite a double bind here. We do believe that plaintiffs have limited Article III standing to the following extent. Paragraphs 37 through 39 allege that while Schwab offers voice ID in the course of which it collects the plaintiff's voice prints, Nuance stores that voice print. There are two claims in the complaint, and it seems like there's no dispute about standing for the 15B claim, so focusing on the 15A claim. The plaintiff alleges then in paragraphs, as Judge Scudder noted, paragraphs 96 and 97- Counsel, the complaint alleges that Schwab stores the data. That's probably wrong. It's probably Amazon Web Services stores the data in an account for which Schwab pays, but put that to one side. How does that part of the complaint allege injury in fact? Yes, Your Honor. I understand this court's opinion in Fox to hold that the allegations, not just that Nuance does not have a written policy, but that it doesn't act pursuant to that policy to delete, retain data constitutes an injury in fact. How is it an injury in fact? Well, I understand this court's analysis in Fox to say that- Can you explain in your own words why you think that that is an injury in fact? The allegations of retaining data beyond a period of time that's allowed and promising to delete that data is akin to an invasion of privacy, cause of action, which is- That doesn't sound- Retaining something is not the invasion of privacy. Getting something might be, but an invasion of privacy, if I get a secret fact about you and I never tell anybody, I've retained it in my memory and not purged it from my memory. The getting of it may be a legal wrong, but my retaining it in my head is not a legal wrong. There might be some harm alleged, but it being in my head is not such a harm. I'm trying to figure out why there is such a harm here. And I hate to take you back to the case law, but what a quote from this court's opinion in Fox is, the unlawful retention of biometric data inflicts a privacy injury in the same way that actual collection does, and the analogy was to the tort of trespass or an invasion of privacy tort. And so to the extent that the question is- So you think if I know a fact about you and I remember it for the rest of my life, I'm violating your rights for the rest of my life because you were injured for the rest of your life? I think that it creates the risk that there is- Ah, now that's what we've actually talked about. There is a risk of wrongful disclosure, right? So it would be interesting to know some facts about that risk. The complaint doesn't seem to have any. There is one paragraph in the complaint where the plaintiff talks about the risk of hacking. Anybody can use the word risk. Is this real or is it a fantasm? I understand, Your Honor. And to the extent that there is a question about whether the plaintiff's allegations of risk here rise to the level that it's cognizable post-transunion, I'm not sure that this court has addressed it. We would ask for the opportunity to do supplemental briefing on it to be able to analyze for this court to the extent that it's helpful as to whether it's something that is analogous to a common-law tort. We do believe that, turning to the merits, that the case does present a pretty straightforward question of statutory interpretation. To the extent that the plaintiff does have standing, it is for violations that require Schwab to take action. So I'll start with that alternative ground for affirmance that, Your Honors, we're talking to my friend on the other side about. I think we're past that. Your adversary agreed that the plaintiff is not asking for anything that would require Schwab to act. But they say otherwise, Your Honor. They specifically allege in the complaint that they're. . . I think we're past that. You heard Mr. Wise on his feet say they're not asking for anything that would require Schwab to act. But the complaint controls, Your Honor. That's completely wrong. Lawyers can give up allegations in the complaint. We are here in light of the arguments being presented to us. The arguments presented long ago in the complaint do not prevent the plaintiff from saying we are no longer arguing X. And the reason why I'm taking you back to that is because it just shows that there's no workable way in order to impose BIFA obligations on Nuance without also imposing them on Schwab. But maybe I'll take the district court's analysis here and the primary ground for affirmance then, which is that BIFA exempts from its scope a company like Nuance here that provides. . . I must say I cannot see how Nuance itself could possibly be exempt. You have a ruling by the Fed that Schwab can deal with Nuance. Fine. How does that make Nuance a financial institution? Schwab can deal with Amazon. I'm sure Schwab buys office equipment from Office Depot. Is Office Depot a financial institution? It is not, Your Honor. But that's because it doesn't fall within this clear set of statutory cross-references. So first, BIFA has the. . . I hate to tell you, but the Fed's regulations allow financial institutions to engage in the normal transactions of that business. And your argument is that by engaging in one particular kind of authorized transaction, that made the other party a financial institution, too, which would equally apply to office supplies and cars and computers. I disagree wholeheartedly with that, Your Honor. So the Fed's order in question here, the one from 1999, is not actually about the bank engaging in a transaction and authorizing the bank to engage in authentication services. It's actually about a joint venture called Indentris, in which the bank wanted to maintain a voting interest. And so the question before the Fed was, can there be a voting interest in a joint venture that engages in authentication services? And what the Fed held was, yes, it is closely related to and therefore properly incident to banking, and to the extent it provides authentication services to a bank, that we consider that to be financial activity. The GLBA specifically adopts orders of the FRB that predate the GLBA, including this one as to authentication services, and it was later codified into a regulation. So here's my question for you. I follow it just fine. Is there a limiting principle? Yes. So what is it? There are four limiting principles, I'll give you, all of which are tailored to the statute, so clean, text-anchored limits here. The first is it has to be an institution, as distinguished from an individual. It has to be engaged in financial activities, as defined by 1843K, which is a limited enumerated list, things like issuing annuities, providing investment advice, et cetera. And then with that catch-all of things that the FRB determined prior to 1999 were closely incident to banking, and it must be in the business of doing so, right? So it's not tangential to the business, as the regulations talk about. And then the fourth limit is a BIPA-specific one. So does it come into possession of biometric information in the course of conducting those responsibilities? And providing office services to a financial institution doesn't fall within any of those limits. It's not an institution engagement. So if ABC Healthcare System was using a voice identification system, are you with me on that? Yes. So all we're doing is we're taking Schwab out of it and we're parachuting in a hospital network. Yes. For patients to call in to check what they owe, check records, what have you, that way. What outcome there? I don't think unless that healthcare institution in some way is providing financial services, that wouldn't be closely incident to banking. So you see at one key limit is the nexus needs to be, it needs to all happen under the umbrella of the provision of financial services. Yes, Your Honor. That is the context of the FRB's 1999 order is it is a, the authentication is for customers who are accessing their financial accounts as Schwab is alleged to do here. There is a voice ID to allow them to access to conduct financial transactions. The FRB order does talk about both financial and non-financial transactions, but it is in the context of accessing a bank account. It is in the context of authentication for a bank, so that is a critical limit. So to the extent you could read the district court analysis in McGovern more broadly, you'd say don't read it more broadly. You, the Seventh Circuit, don't read it more broadly. Read it more narrowly because you limit it. You limit it textually by statute to 25C. 25C is clearly talking about financial institutions, and then you limit it within the four corners of the Federal Reserve Board order as well, which is all financial institution. It's all in that context. Yes, Your Honor, and I think that whether you, yes, it's very clearly talking about authenticating bank customers' access, so that provides a firm limit on the extent to which this exception applies. And assuming we're with you on that, how do we get there given the jurisdictional concerns and the concession opposing counsel made? That they're not requiring Schwab to do anything? Well, I think that actually that just emphasizes why you should get there is that what we have here is it makes pure policy sense in order to apply the GLBA to nuance under the allegations that are made here. So the GLBA is designed to protect information as it flows through the system, not just with the initial recipient of it but to the subsequent recipients too because otherwise what would happen is that the GLBA would apply to Schwab, but nuance, who is alleged to come into contact with that same data, whether that's true or not, and we think it's not true, but it is alleged in the complaint that they collect and retain those voice prints in their databases. Otherwise, nuance would be subject to 50 different state privacy laws, resulting in a terribly unworkable regulatory regime. And, of course, that can't be the result of the plaintiff's position here. That's not what the Illinois General Assembly intended in making a broad financial institution exception in 25C. If there are no further questions, we would renew our request to be able to supplement our briefing on standing issues, and we ask that this court affirm. Anything further, Mr. Wise? If not, why not? One quick point, if I may. Any limitation or any limiting principle has no basis in the text. Section 25C of BIPA references financial institutions under Gramm-Leach-Bliley, and the plain text of Gramm-Leach-Bliley merely incorporates financial activities as set forth in 1843K. There is nothing in Gramm-Leach-Bliley that says when a financial institution performs a financial activity for another financial institution, bank holding company, or financial holding company, that that is a limiting principle. And so I think that that is important, and this is what the ABA versus FTC case recognized, is that by having merely a definitional test, working backwards, simply meeting the definition is what would make one a financial institution, and that's the basis of our briefing that makes this a very, very broad and unworkable definition. The court directs both parties to file, within 14 days, supplemental memoranda addressing the question whether there is an Article III case or controversy here. When those memos have been received, the case will be taken under advisement, and the court will be in recess. Thank you. --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/argument%3A100993. Public record. Not legal advice.