409 F.Supp.3d 612
N.D. Ill.2019Background
- Plaintiff Richard Rogers (former truck driver) visited CSX terminals where he was required to scan fingerprints for access.
- CSX collected, stored, and (allegedly) disseminated Rogers’ fingerprint data to technology vendors.
- Rogers alleges CSX never provided written disclosures of purpose/duration, never obtained a written release, and had no publicly available retention/destruction policy.
- Rogers filed a putative class action in Illinois state court asserting violations of the Illinois Biometric Information Privacy Act (BIPA); CSX removed to federal court.
- CSX moved to dismiss, arguing Rogers is not an “aggrieved person,” that a retention policy need only be created after collection, and that Rogers failed to plead intentional or reckless conduct.
- The court denied dismissal of the BIPA claims (including failure-to-disclose and dissemination allegations), allowed the §15(a) retention-policy claim to proceed, but dismissed allegations of intentional/reckless conduct (with leave to amend).
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether Rogers is an “aggrieved person” under BIPA when the asserted injury is only statutory violations of §15(b) | Rosenbach establishes a statutory violation alone suffices; Rogers’ rights were violated by lack of written disclosures and consent | Rogers voluntarily provided fingerprints, so no real injury; therefore not "aggrieved" | Rogers qualifies as aggrieved; statutory violations suffice—motion to dismiss denied on this ground |
| Whether CSX’s failure to have a publicly available retention/destruction policy violates §15(a) | Rogers alleges CSX never made any retention/destruction policy publicly available | CSX contends any policy is required only after collection and that Rogers only alleged absence before collection | Court rejects CSX’s timing argument; allegation that no policy exists is sufficient to proceed |
| Whether dissemination of biometric data to vendors without consent supports a BIPA claim | Rogers alleges CSX disseminated his biometric info to technology vendors without consent | CSX disputes injury or sufficiency of allegations | Allegation of dissemination without consent supports a BIPA claim and standing; claim may proceed |
| Whether plaintiff pleaded intentional or reckless conduct to obtain enhanced damages under BIPA | Rogers alleges CSX acted “knowing and willful” and took no steps toward compliance | CSX argues Rogers pleaded only negligence; conclusory allegation of intent is inadequate | Court dismisses the intentional/reckless claim for failure to plead sufficient facts but grants leave to amend within 30 days |
Key Cases Cited
- Rosenbach v. Six Flags Entm’t Corp., 2019 IL 123186 (Ill. 2019) (Illinois Supreme Court: a statutory violation of §15(b) suffices for BIPA plaintiff to be an “aggrieved person”)
- Sekura v. Krishna Schaumburg Tan, Inc., 115 N.E.3d 1080 (Ill. App. 2018) (supports allowing BIPA claims where plaintiff alleges lack of disclosures and retention policy)
- Ashcroft v. Iqbal, 556 U.S. 662 (U.S. 2009) (pleading standard: plausibility required; conclusory allegations insufficient)
- Bell Atl. Corp. v. Twombly, 550 U.S. 544 (U.S. 2007) (pleading standard for plausibility under Rule 12(b)(6))
- Ziarko v. Soo Line R. Co., 641 N.E.2d 402 (Ill. 1994) (definition and standard for intentional and reckless conduct under Illinois law)