382 F. Supp. 3d 813
E.D. Ill.2019Background
- McGinnis sued U.S. Cold Storage under the Illinois Biometric Information Privacy Act (BIPA), alleging the employer required employees to scan fingerprints/handprints for timekeeping and failed to obtain written consent or provide required disclosures.
- McGinnis worked for U.S. Cold Storage from 2011–2015 and alleges he knew the prints were collected and stored via the timeclock system.
- He claims invasion of privacy and mental anguish from the statutory notice-and-consent violations and indefinite retention of biometric data.
- The district court paused the defendant’s Rule 12(b)(6) limitations motion to evaluate Article III standing and treated briefing as a Rule 12(b)(1) challenge to subject-matter jurisdiction.
- The court found multiple recent Northern District of Illinois decisions on BIPA instructive and concluded McGinnis failed to plead a concrete injury-in-fact, dismissing the case for lack of Article III standing.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether notice-and-consent violations under BIPA constitute Article III injury-in-fact | McGinnis: statutory privacy invasion and resulting mental anguish suffice as concrete injury | U.S. Cold Storage: absent disclosure to third party or risk of compromise, mere known collection/retention is a bare procedural violation | Held: No. Known collection and retention without a substantial risk of disclosure or actual compromise is not a concrete Article III injury |
| Whether fear of future disclosure or indefinite retention establishes standing | McGinnis: anxiety and mental anguish from possible disclosure/unknown retention are concrete harms | U.S. Cold Storage: speculative fear is insufficient; must show substantial risk of future harm | Held: No. Speculative fear of future disclosure/retention is too remote to confer standing |
| Whether statutory status of BIPA alone satisfies concreteness after Spokeo | McGinnis: BIPA creates a protected interest; statutory violation enough | U.S. Cold Storage: legislative protection is relevant but not automatically dispositive under Spokeo | Held: Legislative judgment is instructive but does not automatically create Article III standing; concreteness still required |
| Whether alleged facts warrant jurisdictional discovery on disclosure risk | McGinnis: did not request such discovery in briefing | U.S. Cold Storage: no disclosure alleged; discovery not requested | Held: Court declined jurisdictional discovery and dismissed for lack of standing |
Key Cases Cited
- United States v. $304,980.00 in U.S. Currency, 732 F.3d 812 (7th Cir.) (courts must ensure subject-matter jurisdiction sua sponte)
- Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (U.S. 2016) (statutory violations require a concrete injury-in-fact under Article III)
- Clapper v. Amnesty Int'l USA, 568 U.S. 398 (2013) (speculative or contingent future harm does not confer standing)
- Gubala v. Time Warner Cable, Inc., 846 F.3d 909 (7th Cir. 2017) (mere retention of known personal information without risk of disclosure is not an Article III injury)
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) (injury-in-fact must be concrete and particularized)
- Lewert v. P.F. Chang's China Bistro, Inc., 819 F.3d 963 (7th Cir.) (actual data breach can establish imminent risk and concrete harm)