Case Information
UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION
COREY HEARD, individually and on behalf of )
all others similarly situated, )
)
Plaintiff, )
) v. ) Case No. 19 C 4158
) BECTON, DICKINSON & CO. ) Judge Rebecca R. Pallmeyer
)
Defendant. )
MEMORANDUM OPINION AND ORDER
Since 2015, Plaintiff Corey Heard has worked as a respiratory therapist at several hospitals in Illinois that use the Pyxis MedStation system—an automated medication dispensing system manufactured by Defendant Becton, Dickinson and Company ("BD"). A user gains access to Pyxis devices by scanning his fingerprint. Heard alleges that he "was required" to access Pyxis devices with his fingerprint "[a]s a condition of his employment" at the hospitals. (Compl. [1- 1] ¶ 50.) He has sued BD on behalf of a putativе class for allegedly collecting, storing, and disseminating biometric data—specifically, fingerprints—in violation of the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq . (the "BIPA"). Heard initially filed this lawsuit in the Circuit Court of Cook County, Illinois. BD removed the action to this court on the basis of diversity jurisdiction and the Class Action Fairness Act ( see Notice of Removal [1], 1), and now moves for dismissal of all claims under Federal Rule of Civil Procedure 12(b)(6). In addition, BD has moved to strike Heard's class allegations. For the following reasons, BD's motion to dismiss is granted and its motion to strike the class allegations is terminated as moot.
BACKGROUND
The court recounts the following facts from Heard's Complaint. BD is a leading manufacturer and seller of medical technology, including the Pyxis MedStation system and related Pyxis devices (hereinafter, "Pyxis" or "Pyxis devices"). (Compl. ¶ 1.) As noted, Pyxis devices "require . . . users to scan a fingerprint" for access to the system and the medication it dispenses. ( Id. ¶¶ 1-2.) "[W]hen an employee first begins work at a company that uses a Pyxis device," he is "required to have [his] fingerprint or palm print scanned in order to enroll [him] in the Pyxis database." ( Id. ¶ 38.) Once the employee has done so, he has "access to multiple Pyxis devices" at his place of employment. ( Id. ¶ 2.) BD "markets its Pyxis devices . . . as superior" to other medication-disbursement methods by emphasizing that they "improve[] precision and accuracy of user access via biometriс information." ( Id. ¶ 42.) BD "provides Pyxis devices to dozens of hospitals" in Illinois. ( Id. ¶ 1.)
Between 2015 and the present, Heard has worked for at least five hospitals (the "Hospitals") that use Pyxis devices. ( Id. ¶ 49.) "As a condition of employment" at the Hospitals, Heard "was required to scan his fingerprint so it could be used as an authentication method to access the Pyxis devices." ( Id. ¶ 50.) BD "subsequently stored [Heard's] fingerprint data in their systems." ( Id. ¶ 51; see also id. ¶ 44 (alleging that BD has "assembl[ed] a database of biometric dаta through broadly deployed fingerprint scanners").) The Hospitals, too, "subsequently stored [Heard's] fingerprint data in their systems." ( Id. ¶ 52.) Heard was "required to scan his fingerprint each time he accessed the Pyxis devices." ( Id. ¶ 53.) Heard alleges "[u]pon information and belief" that BD "improperly discloses Pyxis user's [sic] fingerprint data to other, currently unknown, third parties, including but not limited to third parties that host biometric data in their data center(s)." ( Id. ¶ 11.)
The BIPA "imposes numerous restrictions on how private entities collect, retain, disclose
and destroy biometric identifiers," including fingerprints.
Rosenbach v. Six Flags Entm't Corp.
,
In recent months, employees who have been subject to fingerprint scans have brought suit against their employers under the BIPA. [1] In this case, Heard sues the manufacturer of the fingerprint scanning device itself, Defendant BD. He alleges that BD never informed him or similarly situated individuals that it was collecting, using, or storing their biometric data, and never stated the purpose and length of time for which it was doing so, in violation of Section 15(b). ( See, e.g. , Compl. ¶¶ 10, 39, 94.) He also аlleges that BD failed to obtain an executed written release from him or similarly situated individuals authorizing the collection of their biometric data, in violation of Section 15(b). ( See, e.g. , id. ¶¶ 10, 93.) In addition, Heard alleges that BD never provided him or similarly situated individuals with a publicly available retention schedule for permanent destruction of the biometric data it collected, in violation of Section 15(a). ( See, e.g. , id. ¶¶ 10, 84.) Finally, Heard alleges "[u]pon information and belief" that BD disclosed his biometric data and that of similarly situated individuals to "unknown" third parties without obtaining consent, in violation of Section 15(d). ( Id. ¶ 11; see also id. ¶ 103.) Heard seeks to represent a class defined as "[a]ll individuals working in the State of Illinois who had their fingerprints collected, captured, received, or otherwise obtained or disclosed by Defendant during the applicable statutory period." ( Id. ¶ 68.)
DISCUSSION
A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) tests the sufficiency of
the complaint.
See, e.g.
,
Bell v. City of Country Club Hills
,
A. Whether thе BIPA's "Health Care Exemption" Is Limited to Patient Information
BD argues that the court should dismiss Heard's claims outright because, according to BD, the biometric data at issue falls under a "health care exemption" to the BIPA, which can be found in the Act's definition of biometric identifiers. (BD Mem. in Supp. of Mot. to Dismiss ("BD Mot.") [16], 4.) The definition states, in relevant part, that "[b]iometric identifiers do not include information captured from a patient in a health care setting or information collected, usеd, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996 ["HIPAA"]." 740 ILCS 14/10 (emphasis added). BD contends that the latter clause—"information collected, used, or stored for health care treatment, payment, or operations under" HIPAA—"must be read to reach information other than that collected from a patient so as to avoid rendering it superfluous." ( See BD Mot. 4.) It then emphasizes that according to Heard's Complaint, Pyxis users scan their fingerprints in order to access medication (presumably for patients, considering that Heard is a hospital employee). Thus, in BD's view, Heard's "purported biometric data is exempted [from the BIPA] as 'information collected, used, or stored for health care treatment, payment, or operations' under HIPAA." ( Id. (quoting 740 ILCS 14/10).)
The court is aware of only two other cases in which defendants havе advanced this theory.
Both were in Illinois circuit courts, and the courts reached opposite conclusions concerning the
theory's viability. ( Ex. A to BD Reply in Supp. of Mot. to Dismiss [29-1],
Diaz v. Silver Cross
Hosp. & Med. Ctrs.
, No. 2018 CH 001327 (Cir. Ct. of Ill. Will Cnty.), Aug. 29, 2019 Hrg. Tr. 4:1-6,
19:16-18, 21:11-24 (determining that HIPAA protects not only data that is "patient-driven," but
also data that "relates to the patient" in a "secondary" sense; finding that a plaintiff-nurse's
fingerprint was "information collected, used, or stored for health care treatment"; agreeing that the
BIPA exempts suсh information; and dismissing the plaintiff's claims on that basis); Ex. 1 to Heard
Opp. to BD Mot. to Dismiss [25-1],
Bruhn v. New Alberton's, Inc.
, No. 2018 CH 01737 (Cir. Ct. of
Ill. Cook Cnty.), July 2, 2019 Hrg. Tr. 53:1-22 (stating that interpreting the statute in the same
manner BD proposes here would be "nonsensical" because it would leave "large categories" of
health care workers—whose biometric information is
not
protected under HIPAA—without
recourse to protect that information under the BIPA, and stating if the Illinois legislature had
intended to create such a significant "doughnut hole," it would have said so in clearer terms).)
The court finds the reasoning in
Bruhn
more persuasive, particularly considering the Illinois
Supreme Court's recent statement that the Illinois legislature "codified [in the BIPA] that
individuals possess a right to privacy in and control over their biometric" data.
Rosenbach
, 129
N.E.3d at 1206,
B. Section 15(b) of the BIPA
Unlike Sections 15(a), (c), (d), and (e) of the BIPA—all of which apply to entities "in
possession of" biometric data—Section 15(b) applies to entities that "collect, capture, purchase,
receive through trade, or otherwise obtain" biometric data. 740 ILCS 14/15(a)-(e). Recognizing
this distinction, the parties agree that mere possession of biometric data is insufficient to trigger
Section 15(b)'s requirements. (
See
BD Mot. 8; Heard Opp. to BD Mot. to Dismiss ("Heard Opp.")
[25], 10.) This interpretation of Section 15(b) finds ample support in case law.
See Namuwonge
v. Kronos, Inc.
, No. 1:19-cv-03239,
The parties dispute, however, whether Section 15(b) applies only to entities that "actively" collect biometric data. (BD Mot. 8.) BD argues that it does and contends that Heard's allegаtions do not sufficiently plead that BD itself actively collected his biometric data (or that of the putative class members). ( See id. at 7-10.) Heard maintains that BD is reading a nonexistent requirement into the statute. ( Heard Opp. 10.) Pointing to the "otherwise obtain" language in Section 15(b), Heard contends that the provision applies to "any entity that obtains biometric data, no matter the source or the manner of collection." ( Id. ) He also emphasizes that the bankruptcy of a company called Pay By Touch—which allegedly "provided major retailers . . . with fingerprint scanners to facilitate consumer transactions"—motivated the Illinois legislature to pass the BIPA. ( Compl. ¶¶ 25-26 (alleging, inter alia , that Pay By Touch's bankruptcy "was alarming to the Illinois Legislature because suddenly there was a serious risk that millions of fingerprint records" could be "sold, distributed, or otherwise shared through the bankruptcy proceedings without adequate protеctions for Illinois citizens"); Heard Opp. 11 (citing same).) Heard contends that because "it was Pay By Touch's clients that 'actively collected' individuals' fingerprints," active collection cannot be "the touchstone of liability under Section 15(b)." (Heard Opp. 11 (emphasis added).)
Heard's arguments are flawed. First, Heard agrees that Section 15(b) requires something more than mere possession of biometric data, but does not explain what that "something more" is, if not an affirmаtive act of collection. In this vein, Heard does not specify how an entity could "otherwise obtain" biometric information without taking an active step to do so. And as BD points out, Black's Law Dictionary defines "obtain" as "[t]o bring into one's own possession; to procure, esp. through effort ." ( Obtain , B LACK ' S L AW D ICTIONARY (11th ed. 2019) (emphasis added); see BD Mot. 8 (quoting same).) Second, the fact that Pay By Touch's bankruptcy may have influenced the Illinois legislature's decision to enact the BIPA does not mean that the legislature drafted every provision with Pay By Touch in mind, or that it intended for every provision to cover entities that operate exactly as Pay By Touch did. Moreover, it is not clear from Heard's own allegations that Pay By Touch did not engage in an affirmative act of collection. The court concludes that for Section 15(b)'s requirements to apply, an entity must, at a minimum, take an active step to "collect, capture, purchase, reсeive through trade, or otherwise obtain" biometric data. 740 ILCS 14/15(b).
Heard has not adequately pleaded that BD took such any such step. For example, Heard repeatedly alleges that BD "collected" his biometric data without alleging how, when, or any other factual detail. ( See, e.g. , Compl. ¶¶ 9, 37, 39-40, 54, 68, 82, 91, 94, 95, 101; see also id. ¶ 93 (alleging that BD "systematically and automatically collected" Heard's and the putative class members' biometric data).) These allegations "merely parrot" the BIPA's stаtutory language; they do not provide any "specific facts to ground [Heard's] legal claims." Brooks , 578 F.3d at 581. Heard also alleges that "[a]s a condition of employment" at the Hospitals, he "was required to scan his fingerprint" to use Pyxis—and that BD "subsequently stored [his] fingerprint data in their systems." (Compl. ¶¶ 50-51.) But Heard does not allege how the data made its way to BD's systems. Nor does he argue or allege that there is a difference between storage and mere possession.
Heard's allegations are much like those in
Namuwonge
, where a court dismissed the
plaintiff's Section 15(b) claims under Rule 12(b)(6).
Notably, in
Neals v. PAR Technology Corp.
, a court in this district determined that to state
a claim for a Section 15(b) violation, the plaintiff did not need to "substantiate her allegation that
[the defendant] collected her biometric information."
Neals
, No. 19 C 5660,
The court concludes that Heard has not plausibly alleged that BD "collect[ed], capture[d], purchase[d], receive[d] through trade, or otherwise obtain[ed]" biometric data from Heard or the putative class members. 740 ILCS 14/15(b). The court therefore grants BD's motion to dismiss Heard's Section 15(b) claim and declines to address BD's alternative argument that because it "is not [Heard's] employer," it "does not have to (and could not) comply with Section 15(b)'s notice and consent provisions." (BD Mot. 6.)
C. Sections 15(a) and 15(d) of the BIPA
Sections 15(a) and 15(d) of the BIPA apply to entities "in possession of" biometric data.
740 ILCS 14/15(a), (d). The BIPA does not define "possession."
See
740 ILCS 14/10.
Accordingly, the court "assumes [that] the legislature intended for [the term] to have its popularly
understood meaning," or its "settled legal meaning" if one exists.
Rosenbach
, 129 N.E.3d at
1205,
Nonetheless, the court agrees with BD that Heard has not adequately pleaded
"possession" because he fails to allege that BD "exercised
any
dominion or control over [his]
biometric data." (BD Mot. 11.) Like Heard's allegations concerning collection, most of his
allegations concerning possession merely parrot the statutory language. ( Compl. ¶¶ 9, 37,
39-40, 54, 68, 93-95 (alleging, without more, that BD "stored" biometric information).) Only one
paragraph of the Complaint provides more detail: it states that at some time after the hospitals
required Heard to scan his fingerprint into Pyxis devices, BD "subsequently stored [Heard's]
fingerprint data in their systems." (
Id.
¶ 51.) This allegation does not plead that BD exercised
any form of control over the data or that it held the data "at [its] disposal."
Ward
,
The court also dismisses Heard's claim under Section 15(d) for an independent reason:
Heard offers no basis for the allegation that BD disclosed his biometric data (or that of the putative
class members).
See
740 ILCS 14/15(d) (providing that entities "in possession оf" biometric data
cannot disclose it except in limited circumstances). Heard concedes that he relies solely on
"information and belief" in alleging that BD violated Section 15(d), but argues that he is permitted
to do so because the "facts of necessity" are within BD's exclusive control. ( Heard Opp. 13;
Compl. ¶ 11.) "The
Twombly
plausibility standard . . . does not prevent a plaintiff from pleading
facts alleged upon information and belief where the facts arе peculiarly within the possession and
control of the defendant."
Arista Records, LLC v. Doe 3
,
For the rеasons stated above, the court grants BD's motion to dismiss Heard's claims for violations of Sections 15(a), 15(b), and 15(d) of the BIPA. The dismissal is without prejudice. If Heard wishes to file an amended complaint, he must do so by March 31, 2020. Because the court is dismissing Heard's Complaint in its entirety, it terminates BD's motion to strike the class allegations as moot, without prejudice to refiling in the event that Heard files an amended complaint.
CONCLUSION
For the foregoing reasons, the court grants Defendant Becton, Dickinson and Company's Motion to Dismiss [15] and terminates Defendant Becton, Dickinson and Company's Motion to Strike Class Allegations [18] as moot, without prejudice to refiling. If Heard wishes to file an amended complaint, he must do so by March 31, 2020.
ENTER:
Dated: February 24, 2020 _________________________________________
REBECCA R. PALLMEYER United States District Judge
Notes
[1] Heard himself is a lead plaintiff in at least four other putative class actions brought under the BIPA in Illinois state courts. ( BD Mem. in Supp. of Mot. to Strike Class Allegations [19], 1 n.1 (referencing Heard v. Omnicell, Inc. , No. 2019-CH-06817 (Cir. Ct. of Ill. Cook Cnty.); Heard v. Weiss Mem'l Hosp. , No. 2019-CH-06763 (Cir. Ct. of Ill. Cook Cnty.); Heard v. St. Bernard Hosp. , No. 2017-CH-16828 (Cir. Ct. of Ill. Cook Cnty.); Heard v. TCH-North Shore, Inc. , No. 2017- CH-16918 (Cir. Ct. of Ill. Cook Cnty.)).)
[2] Namuwonge was issued after the parties had fully briefed BD's motion to dismiss.
[3] Neals , too, was decided after the parties had fully briefed BD's motion to dismiss.
