Heard v. Becton, Dickinson and Company
440 F.Supp.3d 960
N.D. Ill.2020Background:
- Plaintiff Corey Heard, a respiratory therapist, worked at multiple Illinois hospitals that use BD’s Pyxis MedStation, which requires fingerprint scans for user access.
- Heard alleges the hospitals required fingerprint enrollment as a condition of employment and that BD collected, stored, and (on information and belief) disclosed those fingerprints.
- Heard sued BD under the Illinois Biometric Information Privacy Act (BIPA), asserting violations of Sections 15(a) (retention/destruction policy), 15(b) (notice/consent), and 15(d) (prohibition on disclosure), and sought class certification.
- BD removed the case to federal court and moved to dismiss under Rule 12(b)(6) and to strike the class allegations.
- The district court found Heard’s complaint failed to plead facts plausibly showing BD collected or possessed the biometric data or that BD disclosed it; it granted dismissal without prejudice and terminated the motion to strike as moot, with leave to amend.
Issues:
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Scope of BIPA's HIPAA-related healthcare exemption | Heard: BIPA protects employees' biometrics; exemption should not swallow employee claims | BD: fingerprints used for patient care are "information collected, used, or stored for health care" under HIPAA and thus exempt | Court declined to resolve exemption; found it unnecessary because complaint failed on other grounds |
| Whether BD "collected" biometric data under §15(b) | Heard: BD obtained fingerprints (alleges BD collected/stored data) and §15(b) covers those who "otherwise obtain" data | BD: §15(b) requires an active step to collect/capture/obtain; supplying devices alone is insufficient | Court: §15(b) requires an active collection step; Heard failed to plausibly allege BD collected the data → §15(b) claim dismissed |
| Whether BD "possessed" biometric data under §§15(a) and 15(d) | Heard: BD stored the biometric data in its systems (allegation of possession) | BD: possession requires dominion or control; mere allegation of storage without facts is insufficient | Court: allegations did not show BD exercised control or held data at its disposal → §§15(a) and 15(d) claims dismissed |
| Adequacy of "information and belief" allegations of disclosure under §15(d) | Heard: may plead disclosure on information and belief because facts are uniquely within BD’s control | BD: speculative allegations without factual basis are insufficient | Court: no basis shown that facts are exclusively within BD’s control; disclosure on information and belief is speculative and insufficient → §15(d) dismissal reinforced |
Key Cases Cited
- Rosenbach v. Six Flags Entm't Corp., 129 N.E.3d 1197 (Ill. 2019) (BIPA creates private right of action and protects biometric privacy)
- Bell Atl. Corp. v. Twombly, 550 U.S. 544 (U.S. 2007) (plausibility standard for pleading)
- Ashcroft v. Iqbal, 556 U.S. 662 (U.S. 2009) (legal conclusions not entitled to factual assumption; plausibility required)
- Brooks v. Ross, 578 F.3d 574 (7th Cir. 2009) (pleading must include more than statutory recitation)
- People v. Ward, 830 N.E.2d 556 (Ill. 2005) (ordinary meaning of "possession" as control or holding at disposal)
- Arista Records, LLC v. Doe 3, 604 F.3d 110 (2d Cir. 2010) (permitting information-and-belief pleading only when facts are peculiarly within defendant’s control)
- Bell v. City of Country Club Hills, 841 F.3d 713 (7th Cir. 2016) (Rule 12(b)(6) standard and treatment of well-pleaded facts)