480 F.Supp.3d 888
S.D. Ill.2020Background
- Plaintiff Madisyn Stauffer sued her employer Innovative Heights (Sky Zone) and vendor Pathfinder under the Illinois Biometric Information Privacy Act (BIPA) for collecting and storing employee fingerprints used for timekeeping without required disclosures or written consent.
- Plaintiff amended to add Pathfinder after discovery, alleging Pathfinder operated the database/system storing fingerprints.
- Pathfinder removed the case to federal court under CAFA; Plaintiff moved to remand for lack of Article III standing. Pathfinder moved to dismiss on multiple grounds (constitutional challenge, exemption, limitations, waiver/estoppel, pleading sufficiency).
- Key legal dispute: whether Plaintiff has Article III standing for claims under BIPA § 15(b) (informed consent) and § 15(a) (public retention/destruction policy).
- The court held Plaintiff has Article III standing for § 15(b) claims against both defendants, but lacks standing for § 15(a) claims and remanded those claims to state court.
- The court denied Pathfinder’s motion to dismiss in full (declining to resolve constitutional/exemption/limitations defenses on the pleadings and finding BIPA violations pleaded sufficiently for liability and remedies).
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Article III standing for BIPA § 15(b) (lack of disclosures/consent) | Stauffer says nondisclosure deprived her of the informed-consent right and therefore a concrete injury | Pathfinder argued plaintiff failed to plead concrete injury | Held: plaintiff has Article III standing for § 15(b) claims against both defendants; federal court retains jurisdiction |
| Article III standing for BIPA § 15(a) (public retention/destruction policy) | Stauffer alleges uncertainty about destruction/possession after leaving employment, claiming individualized harm | Pathfinder argued § 15(a) is a public-facing duty and plaintiff pleaded only a procedural violation | Held: no Article III standing for § 15(a) claims as pleaded; those claims remanded to state court |
| Constitutional challenge: BIPA special legislation (exemptions for some financial institutions and government) | Stauffer: exemptions rationally related to GLBA coverage and legislative intent to target private entities | Pathfinder: exemptions are arbitrary, rendering BIPA unconstitutional | Held: court rejects challenge at Rule 12(b)(6) stage and declines to invalidate BIPA |
| Financial-institution exemption (Pathfinder is exempt) | Stauffer: Pathfinder is not a GLBA-covered financial institution and complaint contains no facts to show exemption | Pathfinder: contends it qualifies as exempt; relied on removal filings | Held: court will not resolve exemption on the pleadings; dismissal denied |
| Statute of limitations | Stauffer: BIPA claims governed by Illinois five-year catchall; pleadings can survive | Pathfinder: claims time-barred (one-year privacy limitation) | Held: court declines to dismiss on limitations ground at pleading stage (plaintiff plausibly timely) |
| Waiver / equitable estoppel and mental-state pleading | Stauffer: did not knowingly waive rights; mental-state not required to plead liability under BIPA | Pathfinder: plaintiff implicitly consented by continued use; failed to plead negligent/intentional conduct | Held: waiver/estoppel rejected on pleadings; plaintiff need not plead negligent/intentional state to state a BIPA claim; motion to dismiss denied |
Key Cases Cited
- Bryant v. Compass Group USA, Inc., 958 F.3d 617 (7th Cir. 2020) (held nondisclosure under § 15(b) can be a concrete injury where it deprives the plaintiff of informed-consent protections; § 15(a) claims may lack Article III standing absent particularized harm)
- Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (U.S. 2016) (statutory violations must cause a concrete and particularized injury to confer Article III standing)
- Groshek v. Time Warner Cable, Inc., 865 F.3d 884 (7th Cir. 2017) (statutory procedural violations can support standing if they present appreciable risk of harm to the protected interest)
- Rosenbach v. Six Flags Entm't Corp., 129 N.E.3d 1197 (Ill. 2019) (Illinois Supreme Court: BIPA codified an individual right of privacy and control over biometric identifiers; violation itself supports a private right of action)
- Miller v. Southwest Airlines Co., 926 F.3d 898 (7th Cir. 2019) (found Article III standing for BIPA claims in a union/collective-bargaining context where inability to negotiate gave the dispute a concrete employment-focused dimension)