467 F.Supp.3d 604
N.D. Ill.2020Background:
- Cothron began working for White Castle in 2004; around 2007 the employer implemented a fingerprint-based system required for manager access and paystubs.
- White Castle stored/transferred fingerprints to third parties (Cross Match, Digital Persona, other data hosts) and did not obtain written releases or provide BIPA disclosures or a public retention/destruction policy until 2018.
- Cothron sued under Illinois’ Biometric Information Privacy Act (BIPA), alleging violations of sections 15(a) (retention/destruction policy and deletion), 15(b) (written notice and informed consent), and 15(d) (dissemination to third parties) and sought statutory damages, injunctive and declaratory relief.
- White Castle moved to dismiss under Rule 12(b)(6), asserting waiver/equitable estoppel, failure to plead state of mind for damages, and preemption by the Illinois Workers’ Compensation Act (IWCA); it also challenged the sufficiency of the dissemination allegations.
- The court held Cothron lacked Article III standing for the Section 15(a) claim (dismissed without prejudice) but found she adequately pleaded Article III standing and plausible claims under Sections 15(b) and 15(d); the motion to dismiss those claims was denied.
Issues:
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Standing under §15(a) (retention/destruction) | White Castle failed to publish retention/destruction policy and delete data as required, causing injury | §15(a) violations are public-rights, not particularized injuries; no Article III standing | Dismissed for lack of standing: plaintiff’s ongoing employment meant deletion trigger not met and injury was not particularized |
| Standing under §15(b) (notice & consent) | White Castle failed to provide written notice of collection, purpose, length and to obtain written consent; informational injury is personal | Either no concrete informational injury or plaintiff waived rights via consent forms | Standing exists: statutory informational deprivation is substantive/personal and could affect choice to opt in |
| Standing and pleading under §15(d) (dissemination) | White Castle disseminated biometric data to third parties without consent (Cross Match, Digital Persona, data hosts) | Transfers authorized as transmissions under §15(e); consent not required in advance; pleadings insufficient/too conclusory | Standing and claim alleged: §15(e) doesn't authorize dissemination, pleadings (including third-party vendor allegations) sufficiently plausible |
| Affirmative defenses: waiver/equitable estoppel, scienter for damages, IWCA preemption | Consent form(s) do not bar suit for past violations; scienter pertains to damages tiers and need not be pleaded now; privacy harms not IWCA-compensable | Plaintiff waived rights by signing consent(s); failure to plead mental state; injuries are workplace harms preempted by IWCA | Waiver/estoppel not proven at pleading stage; scienter need not be pleaded to state a claim for injunctive/declatory relief; IWCA does not preempt BIPA privacy claims |
Key Cases Cited
- Bryant v. Compass Group USA, Inc., 958 F.3d 617 (7th Cir. 2020) (distinguishing §15(a) public-right injury from §15(b) informational injury and analyzing BIPA standing)
- Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (U.S. 2016) (statutory violations must cause a concrete injury to satisfy Article III)
- Rosenbach v. Six Flags Entm’t Corp., 129 N.E.3d 1197 (Ill. 2019) (recognizing BIPA’s protections and private right of action)
- Crabtree v. Experian Info. Sols., Inc., 948 F.3d 872 (7th Cir. 2020) (deprivation of an opportunity can constitute a concrete injury)
- Groshek v. Time Warner Cable, Inc., 865 F.3d 884 (7th Cir. 2017) (informational-injury standing framework)
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (U.S. 1992) (Article III standing requirements explained)