# Oral argument — Raven Fox v. Dakkota Integrated Systems > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/argument%3A72630 ## Record - **Collection:** Oral argument - **Document type:** Oral argument - **Published:** October 29, 2020 ## Text Good afternoon, everyone. Can you hear me? Yes, Your Honor. That's great. Our sole case for argument this afternoon is Fox v. Dakkota Integrated Systems. Ms. Sievert, whenever you're ready. Good afternoon. May it please the Court. This case is no different than the pleasure to argue before the Court last year. As in Miller, there is standing here for a federal court to consider all of Plaintiff Raven Fox's claims brought against Dakkota under the Illinois Biometric Information Privacy Act. So Ms. Sievert, I have a question for you really building off Miller. The Court in Miller was focusing, of course, on whether this was a major or minor dispute in union representation and whether the possibility of some kind of collective bargaining was enough to give the kind of concrete injury that we need in Article III. But I'm looking at 15A, and I don't see what there is for anyone, either an individual or a union, to bargain about. I don't see how a union could first sentence, and I don't see how a union or an individual could bargain away the private entity's duty to comply with its retention schedule. Now, there may be plenty to talk about under B and D because they both refer to the subjects acting either by themselves or through their authorized representatives. But I read 15A to impose mandatory duties on the possessor of the information. If I may, in Miller, Miller did address this issue. I'm looking at Miller. I mean, could you just answer my question? Do you think a union could bargain in a collective bargaining agreement to tell a private entity that it's okay with us if you don't develop a written policy? I think the issue, Your Honor, is more that... Yes or no. Could they bargain over either of the things in 15A? Yes. What would that look like? You don't have to develop a written policy? You don't need to comply with retention guidelines? It's that I can't implement in a unionized work environment that policy. That's B and D. That's a different part of the statute. Actually, I would say... Excuse me, Your Honor. Show me the language. I have Miller right here. I don't see where this gets you as far as you need to go. Certainly, Your Honor. In Miller... In Miller, when the court is addressing the allegations that were made by the plaintiffs on page 901, there are three contentions that were made by the Miller plaintiffs. First, they contended that the air carriers implemented the systems without their consent, and second, that they failed to publish protocols. So what I'm saying is that may or may not be true, but that looks like B to me. That's not A. That doesn't look like A. A is addressed exclusively to the private entity. When you look at Miller at page 903... Let me go to the direct quote here, if I may. I'm looking at page 903. Sorry. I'm trying to find the exact page because I pulled the quote out. Okay. Erin, can you find me the quote that says similarly? Because, I mean, while you're looking, I'll just say, as I have been staring at this statute trying to get ready for this argument, I absolutely see and have no problem with the fact that Miller holds that a union is a legally authorized representative, that Miller holds that there can be bargaining, whether it's a management rights clause or something else, over the way in which a workplace either does or does not use biometric data, that there are non-disclosure requirements, which is what D covers. And, of course, this case isn't about B and D because the district court found that they were preempted by the LMRA. Fine. No issue there. But what I just don't see is where bargaining can happen with a mandatory duty on only the private entity with the individual not even singled out as somebody with any rights under A. Ms. Sieber, further to Judge Wood's question, wouldn't that be an illegal contract? It wouldn't be possible for that type of a contract to be entered into, correct? No, Your Honor. Respectfully incorrect. And the reason why, in the quote I'm looking for from Miller is, quote, similarly, the retention and destruction schedules for biometric data are topics between workers and management. And states cannot, Miller also notes, that states cannot bypass the mechanisms of the RLA and authorize direct negotiation between workers and management. Or bypass negotiation. But, you see, there's nothing in A that requires that. I have no quarrel with that statement in Miller. But notice that B talks about no private entity may collect, capture, purchase, whatever, whatever, the biometric data unless certain things happen. And then D is talking about disclosing, re-disclosing, all the rest of that. That's what you bargain about. I don't see how you can bargain away, as an individual worker, the duty of the private entity to comply with its established retention and destruction schedule. I think you're a third party at best. And I just don't see where the private right of action has anything to do with the individual in that last sentence of A. Well, and the distinction here, Your Honor, is that the duty to disclose retention and destruction schedules is not only a duty owed to the public generally in this case, it's also a duty owed to the union representing Dakota's employees. Why isn't that fully covered by B? Because Section 15B is about notice of use and storage and collection. It's not about the destruction and retention guidelines, which would be implementing a policy. But do you think a private party can relieve a company of the duty to establish and comply with retention schedules? How can you do that? No, but I do not think that Dakota could implement a policy that implicated or impacted the possession of its own employees' biometric data without negotiating that retention and destruction schedule and that policy with the union. Well, where do you get that, though? Where is that sourced? Because I don't think that Miller's very clear. It's one of the I'm finding it, again, I'm looking at page 903, almost toward page 904 of Miller itself. Similarly, the retention and destruction schedules, but I can see that in B and D as it runs to the individual, the person, the subject, or the subject's legally authorized representative. What I don't see, at least in any immediate sense, maybe three or four steps removed, which would have a real standing problem, I just don't see it in A. Anyway, why don't you go on? I think I've made the point. Certainly. Your Honor, to further answer, and I'm just making sure that I answered all of your questions, section B and section D of BIPA do not address retention and destruction schedules for those in possession of biometric data. And what Miller said and what Bryant confirmed was that there was standing to hear the section 15A claim in federal court, because in this particular instance, Dakota would have to make a policy regarding biometric retention and destruction that impacted union members. That does not mean that the union could... Let me try a different way. I have a completely independent problem with what we're going to call the second sentence of A, because, of course, Bryant drew a distinction and said we're not saying anything about the second part because it's not here. Yes. The theory seems to be, I'm afraid that if you don't comply with your retention schedule and destruction guidelines, there might come some time in the future when something bad might happen to me. And what that reminds me of is the Supreme Court's decision in Clapper against Amnesty International, which was, I mean, not BIPA, but it was about a policy of monitoring telephone calls. It actually arose out of national security interests. But the important thing that the Supreme Court says in Clapper is that the fear is just too remote to support Article III standing. It's not concrete enough. It may be individualized. These people are saying, I think it's my calls that are going to be monitored. But we know from Spokio that it's got to be both individual and concrete. You can't dispense with either branch of those. And I look at that last sentence and, boy, I have trouble thinking of anything that's other than quite speculative and long-term. So the grounds for standing under Section 15A are based on the allegations in her complaint. And what the court said in Bryant was that the allegations that Ms. Bryant had, that simply alleged the failure to make a publicly available policy, didn't provide a concrete and particularized injury. In contrast here, Ms. Fox alleges several factors that directly create this concrete and particularized injury. First of all— And Ms. Siebert, could you identify where in the complaint she does that? Yes. By paragraph number or by cause of action? Yes. If you look at the complaint, paragraph 31 and 32— And should I wait for your honor to— No, you can go ahead. Okay. Ms. Fox alleges that Dakota uses a third-party vendor for its timekeeping and that it discloses her biometric data to that third-party vendor and to possibly other third-party vendors. This is the factor that was missing, for example, in Gubala, where while the plaintiff alleged that there was a risk that their data might be disseminated, he failed to allege that the data was actually being disclosed. It's also consistent with what this court said in both Bryant and Miller, which originally District Court Judge Aspen found there was standing on the basis of retaining the data indefinitely. Ms. Fox alleges that, on paragraph 35 of the complaint, that Dakota has not and will not destroy her and other similarly situated individuals' biometric data within those statutory timelines set forth in 15A. She also alleges in paragraph 38 that those violations have raised a material risk that her and the other similarly situated plaintiffs' data would be unlawfully accessed by third parties. Again, while the court has twice commented on that risk of dissemination, there's this additional element that she is a risk of breach due to the time of indefinitely retaining the data. She's gone farther and actually alleged that Dakota discloses her data, biometric data, without her permission. So in a third counsel, Ms. Siebert, there's a privacy injury here, like the Ninth Circuit's decision in Patel. Yes. Both sections of the statute, sub A and sub B, protect privacy interests in biometric data comprehensively, and there is alleged here a privacy injury in the sense of a wrongful retention and an allegation of a wrongful disclosure in addition to a wrongful detention or retention of her data. That in itself is an injury separate and apart from the risk of wrongful disclosure. Absolutely, Judge Sykes, and that's what you noted in your analysis, the court noted in its analysis in Bryant v. Compass, that there's this idea of a trespass. What Ms. Fox is essentially alleging is that we've taken her property and we're wrongfully maintaining it, retaining it without her permission. That's an element, again, that was missing in Dakota and gives her standing under 15A separate and apart from the federal labor law issues that we identify in our brief. Also, in paragraph 50, Ms. Fox alleges that she was not sufficiently compensated by Dakota for retaining her data and the data of all the other similarly situated plaintiffs. Again, here she's alleging a monetary injury. When you talk about particular to her, she says she would not have agreed to work for Dakota for the money that she received if she knew that they would retain her data indefinitely. She is, again, alleging an actual injury particular to her. Now, looking at it in the labor law context, this is a quintessential mandatory subject of bargaining. She is alleging that she should have received more compensation from Dakota for allowing it to retain her data and use her data, but it's the retention piece that gives her standing under section 15A. If, as we argue, the actual compensation for her implementation of the retention and destruction schedule is a mandatory topic of bargaining, so too are allegations such as these, that Dakota has breached its retention and destruction obligations, and those issues would need to be raised through a union grievance, because there would be a question as to whether Dakota had the authority under its management rights clause or pursuant to its past practices to develop or not develop the retention and destruction policy that it did with respect to these employees, and whether it in fact violated or exceeded those management rights in applying or not applying that schedule to these employees here. And if an arbitrator found that Dakota did not have the ability to implement a schedule or to retain the data in violation of the requirements of section 15A, then it could order a change in conditions. It could order that the practice be stopped, and it could result in the union demanding wage concessions in order to allow those retention and destruction schedules to be implemented. All I am saying is that your time has expired, so we'll have to end it there. Thank you. Mr. Zuros, it's your turn. Zuras, I'm sorry. I think I mispronounced it. That's all right. May it please the Court. My name is Jim Zuras, and I represent the plaintiff, Appalee Raven Fox. There's no dispute in this case, I don't think, that if Ms. Fox were never in a union, we wouldn't be here. That's because under this Court's holding in the Bryant v. Compass Group case, a plaintiff bringing a section 15A claim under the Illinois Biometric Information Privacy Act has no Article III standing. Well, I'm going to stop you right there, Mr. Zuros. I think you've over-read the case. There was a qualifier at the end of the case in the modification that was issued. Right. That the district judge didn't address in the motion for reconsideration here, so perhaps you could focus on that. So, section 15A appears to have two components. Component one is that a private entity, a collector, has to comply with that policy. Component two indicates that the private entity, that's a collector, has to comply with that policy. With respect to the first component, the Court in Bryant did state that there's no standing because that is a duty that the collector would owe to the public at large. In the context of that case, not globally, the context of that case was very different than here. The employer was not the defendant there. The vending machine owner was the defendant there, and the vending machine owner owed those duties to the public at large, anybody who used vending machines. This is, we're in the employer-employee context, and setting aside the union, non-union point, I don't understand the argument that the plaintiff has no standing to bring a 15A claim because she has not suffered an injury. She's clearly suffered, or she's alleging at least, a privacy injury, and both subsections of the statute protect privacy interests. That's the whole point of mandating retention protocols, destruction protocols, and then requiring compliance with retention protocols and destruction protocols. It's to protect the privacy interest in the biometric. That manifests on the paper statute, and that's the kind of injury that you've alleged. This is one of those odd cases where you're arguing against yourself for standing when plaintiffs are usually arguing for standing in federal court. We are not unmindful of that position we are now in, Your Honor. We're doing our best to try to reconcile Miller and Bryant. Miller did not have the benefit of Bryant. Bryant says what it says. It does hold that there are two subsections. It does hold that the duty owed under the first subsection of A is to the public. That applies inside and outside the workplace. Well, let me stop you there for a moment. The statute casts a very wide net. It imposes these obligations on, what's the language, a private entity, which could be anything. It's not always going to be an employer. And in that case, it was a vending machine owner. And so it makes sense to understand those duties in the context of the public at large that has privacy interests and biometrics that are being used to access vending machines. And it may be the case that that occurs in a controlled environment like a workplace. That wasn't the fact that was decisive in Bryant in that section of the opinion. Here we've got an employer defendant, and the employer owes duties to the workforce under this statute, not to the general public at large, because it only collects its employees biometrics. And so we have to understand the alleged injury in that context. And that context, you're saying my client didn't get her biometrics destroyed when she left the company. And so that's a privacy injury at its foundation, according to what we said in Miller, what we said in Bryant, and the rationale of the Patel case that was influential to this court's decision. And I think it is not open to reasonable debate. That's the whole point of this statutory scheme. We're on the same page with respect to all that as far as that goes. And as we tried to lay out in our papers, if this were just under the destruction component of 15A, I think it's probably likely the case that they're standing. But there's also the other components and Bryant went to pains to point out that there are two aspects of it. And under that aspect, we have a duty that's been spelled out, not just to employees, because of course, you know, BIPA is not just a workplace statute. It's not just a employment statute. It's a statute of general. And I do think even in the Bryant case, it did arise in an employment setting. I recognize it's different from this case on the facts, but we still had an employee in that case. And, you know, But you can't read the two sentences in 15A independently. They work together. You don't have a wrongful retention under the second sentence, unless you have a set of protocols that sets forth what is a wrongful retention. And so they work together. You can't separate them as you're arguing. You're arguing that there's two species of claims and one can stay, you know, they're standing under one in federal court, or at least potentially standing under one in federal court, but not the other. They can't be disconnected that way. They must work together. Although I will express some sympathy for you, because when the amendment to Bryant came out, it went out of its way to say even though we found no standing on the first part of A, we're not saying anything about the second part of A. So that's certainly not holding. But I wonder, if you look at this from a different point of view, do you think there is a private right of action for the individual whose data is being collected to sue to enforce some or all of part A? I believe so. I believe so. I think that's under the explicit language of BIPA, that it does provide for a private right of action. It doesn't distinguish between the various components. You know, we have always looked at that statute in a certain way, that there's generally, not always, but generally an A, 15A component. There is then the 15B component and a 15D. So B and D sort of are related to each other, we always thought, because they talk about this informed consent regime. And it also talks about how an authorized representative, this is explicitly in the statute, like a union, could consent on behalf of an employee. And that's where Miller comes in. So we understand that. 15A, on the other hand, doesn't talk about how the subject of the collection, in this case employees, have to do anything. They are not really provided a choice under 15A. They don't really need to do anything. It is the collector that simply has to act or not. They have to act, number one, by establishing a public, public schedule, not just a workplace schedule. Well, which complies with the criteria of A. Absolutely, correct. And it has to be made public. And then the other component of it, and this is where Brian comes in, is that they have to comply with it in terms of its retention and destruction schedule, because it sets forth specifics on timeframes. It says you have to destroy data when it's no longer of use, the reason for the collection is no longer applicable, or within three years, whichever comes first. And the question is, what does a private party, and in particular does this complaint, satisfy the burden of showing injury from an alleged failure to comply with that schedule? Is it the failure to comply with the schedule and the guidelines that causes injury, or is it just even an authorized disclosure might violate privacy interests? You know, something done in compliance with the statute? I'm just trying to figure out, what does the private action look like that isn't just relying on general duties owed to the public at large? Are we limiting it to just a 15A now? Yeah, I'm looking at 15A, and as Judge Sykes points out, you know, there were certain facts in Bryant, there were certain facts in Miller, you know, we can always look at the facts, but we also need to work with the language of the statute. So I think we could have a situation where there's a duty to have a public schedule, and that is for everybody, and that is universal. You've got to post this thing, and it's got to be compliant with the statute in terms of how you retain and how you destroy data. If you're a private entity, that collects. So that's the first step. Could a person, could somebody in the position of Ms. Fox successfully sue under A if Dakota had the most perfect policy in the world and complied with it scrupulously, but they forgot to make it public? I guess there may be a technical violation, Judge. I don't know that anybody would actually assert anything for that. I'm just trying to get into, you know, what is it that we're trying to enforce, and I think her real problem isn't even whatever the schedule may be. The schedule has limits, substantive limits, and A, it's got to, there's a three-year period of time that can last after the person's last interaction with the private entity and so on. But then there's this statement, unless there's a warrant or a court order, for example, the private entity has to comply with its own retention schedule and guidelines. And what if they didn't, but they did something equivalent or they did something better? Does the person have a right of action to complain about that violation? In the situation to describe, probably not. I don't think so. I can easily envision a situation, and I think this does happen, where an employer does have a great policy and is never implemented in practice. I think that happens. Or there's no policy, and then the practice is sort of either haphazard, it is not in compliance with what the statute mandates in terms of the three years or when the data is no longer present. I think what the statute tries to do is to provide some certainty, to provide some regulation here and some information, of course, to the subjects of any collection. Mr. Soares, going to this intersection between the components of 15A, in your complaint in the first cause of action, you've effectively included both components, correct? Yes, Your Honor. Failure to institute, maintain, and adhere to publicly available retention schedule. The adherence language, which you reference in the title of the cause of action, as well as, it looks like paragraph 75, that goes to the compliance with the schedule, is that correct? That's accurate, Your Honor. Yes, yes, yes. So we can conceive of ways where, you know, an entity could comply or not with the first aspect of Section 15A, and the same is true with regards to the second, which is why we do think you can split them up. I don't know that it's fair to say that, for example, the entity fully complied with the first part, but not the second, and therefore there's no liability, or vice versa. So I think, you know, there's multiple requirements here under 15A, and certainly we read Bryant several times, and there's language in there on how, you know, that is a duty to the public, and I think what we discussed earlier, you know, this idea that the union isn't really authorized to act on behalf of anyone with respect to a duty that is owed to the public, I think that holds true. It's very hard to see that, you know, unlike something that involves consent, which is something specifically provided by under BIPA, where the union is explicitly said, hey, you're an authorized representative, you can act on behalf of these folks. No such language is under Section 15A. I do think that is an important difference, and, of course, A has nothing to do with what timekeeping device they could use or how the employer records time. It's talking about posting a public schedule and then, of course, complying with it, and I see I'm out of time. Thank you very much. Thank you. Your time had expired. You can have a minute in rebuttal to sum up your argument. I think you're muted. Ms. Gordon-Miller, and again in Bryant, held that Section 15A claims regarding retention and destruction schedules, possession of employees' data, which is the key difference here. There's a duty to negotiate those schedules, retention and destruction schedules, with the union. That's in addition to having a duty to publicly post the policy. Dakota is not free to implement a policy with a union bargained workforce with respect to timekeeping practices, including retention and destruction schedules, without going through the union. Separately, exactly what Ms. Fox's attorney said is true here. She is alleging injury due to retention and failure to destroy. That is Section 15A. Her allegations are sufficient and were contemplated in Bryant's opinion. For those reasons, we respectfully request that the district court's opinion be reversed and that the case be directed to be remanded consistent with Miller. Thank you very much, and our thanks to both counsel. The case is taken under advisement and the court is in recess. Thank you. Thank you. --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/argument%3A72630. Public record. Not legal advice.