382 F. Supp. 3d 813
E.D. Ill.
2019
Honorable Edmond E. Chang, United States District Judge

Richard McGinnis filed this class-action complaint against his former employer, United States Cold Storage, Inc., alleging violations of the Illinois Biometric Information Privacy Act.1 740 ILCS 14/1, et seq. R. 1, Compl.2 The Act prohibits private entities from collecting a person's "biometric identifier"-including fingerprints-unless that person has consented and the private entity has provided certain disclosures. 740 ILCS 14/15. McGinnis's claims arise out of U.S. Cold Storage's requirement that employees scan their fingerprints or handprints3 in U.S. Cold Storage's time-clock system as part of its time-tracking system. Compl. ¶ 2. McGinnis alleges that U.S. Cold Storage negligently violated the Act by collecting, storing, and using McGinnis's biometric identifiers and biometric information without obtaining written releases and without providing required information to McGinnis.

Id. ¶¶ 55-58, 69. U.S. Cold Storage initially moved to dismiss under Federal Rule of Civil Procedure 12(b)(6), contending that McGinnis's claims are time-barred by the applicable statute of limitations. R. 12, Def.'s Mot. Dismiss at 1. Because this Court has an independent obligation to ensure that it has subject matter jurisdiction over a case before deciding the merits, United States v. $304,980.00 in U.S. Currency , 732 F.3d 812, 817-18 (7th Cir. 2013), it terminated that motion (with leave to renew it if subject matter jurisdiction indeed existed) and requested that the parties submit position papers on whether McGinnis adequately alleged Article III standing. R. 24, 09/30/2018 Order. U.S. Cold Storage filed а position paper contending McGinnis had not established standing, R. 25, Def.'s Pos. Paper, whereas McGinnis (unsurprisingly) took the position that standing exists, R. 27, Pl.'s Pos. Paper. For the reasons below, the case is dismissed for lack of Article III standing.

I. Background

For purposes of evaluating the dismissal motion, the Court must accept as true the allegations in the Complaint. Erickson v. Pardus , 551 U.S. 89, 94, 127 S.Ct. 2197, 167 L.Ed.2d 1081 (2007). McGinnis worked for U.S. Cold Storage between 2011 and 2015, at several of its Illinois locations. Compl. ¶ 30. When U.S. Cold Storage started using a time-tracking system based on biometrics in around mid-2012, McGinnis and other employees were required to scan their fingerprints at the beginning and end of each work day as an authenticаtion method to track the time worked. Id. ¶¶ 2, 32. McGinnis's fingerprint was stored in U.S. Cold Storage's databases. Id. ¶ 33. U.S. Cold Storage failed to inform McGinnis of the specific purpose of collecting his fingerprint, did not tell him how long it would store or use his fingerprint, and did not otherwise provide him a copy of U.S. Cold Storage's biometric data-retention policy. Id. ¶¶ 35-36. McGinnis also never signed a written release allowing U.S. Cold Storage to collect or store his fingerprint. Id. ¶ 37.

In support of Article III standing, McGinnis alleges that his privacy interests have been violated by U.S. Cold Storage's violation of the Act, and that he has experienced mental anguish as a result. Id. ¶¶ 4, 6, 29, 39, 59. U.S. Cold Storage argues that these alleged injuries are insufficient to establish Article III standing. Def.'s Pos. Paper.

II. Standard of Review

The Court evaluates U.S. Cold Storage's position paper as a motion under Federal Rule of Civil Procedure 12(b)(1). A Rule 12(b)(1) motion tests whether the Court has subject matter jurisdiction, Hallinan v. Fraternal Order of Police of Chi. Lodge No. 7 , 570 F.3d 811, 820 (7th Cir. 2009) ; Long v. ShoreBank Dev. Corp. , 182 F.3d 548, 554 (7th Cir. 1999). In order to survive a Rule 12(b)(1) motion, the plaintiff ‍​​​​‌​‌​​‌​​​‌‌​‌‌​​​​‌‌​​​‌​‌​​​‌‌‌​​‌‌​​​‌‌‌​‌‍must establish thаt the district court has subject matter jurisdiction. United Phosphorus, Ltd. v. Angus Chem. Co. , 322 F.3d 942, 946 (7th Cir. 2011), overruled on other grounds , Minn-Chem, Inc. v. Agrium, Inc. , 683 F.3d 845 (7th Cir. 2012). "If subject matter jurisdiction is not evident on the face of the complaint, [then] the ... Rule 12(b)(1) [motion is] analyzed [like] any other motion to dismiss, by assuming for purposes of the motion that the allegations in the complaint are true." Id.

III. Analysis

This case is one of several filed in this District alleging violations of the Act. See, e.g. , Miller v. Sw. Airlines Co. , 2018 WL 4030590 (N.D. Ill. Aug. 23, 2018) ; Johnson v. United Air Lines, Inc. , 2018 WL 3636556 (N.D. Ill. July 31, 2018) ; Aguilar v. Rexnord LLC , 2018 WL 3239715 (N.D. Ill. July 3, 2018) ;

Goings v. UGN, Inc. , 2018 WL 2966970 (N.D. Ill. June 13, 2018) ; Dixon v. Washington & Jane Smith Cmty.-Beverly , 2018 WL 2445292 (N.D. Ill. May 31, 2018). Indeed, the allegations here are substantially similar to those advanced in other actions that have been dismissed (or remanded to state court) for failure to sufficiently plead an Article III injury-in-fact. See Aguilar , 2018 WL 3239715, at *1 ; Goings , 2018 WL 2966970, at *1 ; Howe v. Speedway LLC , 2018 WL 2445541, at *1 (N.D.Ill. May 31, 2018). McGinnis does not actually attempt to distinguish the reasoning of these cases and has essentially forfeited the Article III standing argument in his two-page position paper. The position paper confuses two separate legal issues: what it means to be "aggrieved" under the Illinois Biometric Privacy Act-which is a question of state statutory interpretation-versus what it means to have suffered an Article III injury-in-fact. McGinnis's position paper relies entirely on a state court opinion that deals solely with the state statutory interpretation issue. Pl.'s Pos. Paper (citing Sekura v. Krishna Schaumburg Tan, Inc. , 2018 WL 4699213, *1-2 (Ill. App. Ct. 2018) (holding that allegations of mental anguish are sufficient to render a person "aggrieved" under the Act) ). "Standing to sue in any Article III court is, of course, a federal quеstion which does not depend on the party's prior standing in state court." Phillips Petroleum Co. v. Shutts , 472 U.S. 797, 804, 105 S.Ct. 2965, 86 L.Ed.2d 628 (1985) ; see also Howe , 2018 WL 2445541, at *3 (noting that although similar, the statutory requirement that a plaintiff be "aggrieved" is different than the Article III standing requirement); Soto v. Great Am. LLC , 2018 WL 2364916, at *4-5 (N.D. Ill. May 24, 2018) (collecting cases and noting the differences between state and federal standing requirements). So Sekura is of very limited relevаnce to the Article III standing analysis. That said, for the sake of completeness, this Court will engage in an analysis of why McGinnis has failed to allege a concrete injury for Article III purposes.

To establish standing, a plaintiff "must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo, Inc. v. Robins , --- U.S. ----, 136 S.Ct. 1540, 1547, 194 L.Ed.2d 635 (2016). Here, the dispute over standing turns on whether U.S. Cold Storage's alleged violations of the Act's notice-and-consent provisions resulted in an injury-in-fact. A plaintiff establishes an injury-in-fact by showing that he or she "suffered an invasion of a legally protectеd interest that is concrete and particularized." Id. at 1548 (cleaned up).4 The Court explained, "[a]lthough tangible injuries are perhaps easier to recognize, we have confirmed in many of our previous cases that intangible injuries can nevertheless be concrete."5 Id. at 1549 (emphasis added).

In determining which intangible injuries are sufficient ‍​​​​‌​‌​​‌​​​‌‌​‌‌​​​​‌‌​​​‌​‌​​​‌‌‌​​‌‌​​​‌‌‌​‌‍to confer standing and which are not, Spokeo set out basic principles: a "bare procedural violation" of a statute is not automatically enough to satisfy Artiсle III's concreteness requirement. 136 S.Ct. at 1549. To be sure, "[i]n determining whether an intangible harm constitutes injury in fact, both history and the judgment of Congress play important roles." Id. When Congress has created a cause of action for a statutory violation, by definition it has created a legally protected interest that Congress, at least, deems important enough for a lawsuit. Going beyond federal statutes, the Seventh Circuit has recognized the importance of state legislative judgments as well. See Scanlan v. Eisenberg , 669 F.3d 838, 845 (7th Cir. 2012) (noting the importance of federal congressional judgments and reasoning "the same must also be true of legal rights growing out of state law") (cleaned up). Spokeo explained that the legislative branch, with its fact-finding ability and responsiveness to public interest, "is well positioned to identify intangible harms that meet minimum Article III requirements," so Congress's (or the state legislature's) judgment on the nature of the injury is "instructive and important." 136 S.Ct. at 1549. Still, the legislature's "role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right.... Article III standing requires a concrete injury even in the context of a statutory violation." Id. (emphasis added). And the concrete injury, if based on a risk of harm, must present an "appreciable risk of harm." Groshek v. Time Warner Cable, Inc. , 865 F.3d 884, 886-87, 889 (7th Cir. 2017) (plaintiff lacked standing to sue for a violation of the Fair Credit Reporting Act where the defendant obtained a credit report without providing the required disclosures; although the defendant's action violated plaintiff's privacy, it was merely a "statutory violation completely removed from any concrete harm оr appreciable risk of harm").6 So the question is whether the notice-and-consent violations pled by McGinnis create an "appreciable risk of harm" to the interests that the statute was enacted to protect.

The Illinois legislature found that (1) biometrics are uniquely sensitive and when compromised, put individuаls at a heightened risk for identity theft; (2) biometric technology is cutting edge, and "[t]he full ramifications of biometric technology are not fully known"; (3) the public is "weary"7 of using biometrics when tied to personal information; and (4) regulating biometric collection, use, and storage serves the public interest. 740 ILCS 14/5(c) - (g). To those ends, the Act requires that any private entity that possesses biometric information or identifiers must develop and make available a retention schedule and guidelines for destroying that information. 740 ILCS 14/15(a). And even before collecting or storing biometric information or identifiers, the private entity must provide certain information to and obtain the consent of the person whose information is being collected. Id. § 14/15(b).

But U.S. Cold Storage's failure to provide and obtain the statutorily required notice or consent when collecting and retaining McGinnis's fingerprint-without more-does not constitute ‍​​​​‌​‌​​‌​​​‌‌​‌‌​​​​‌‌​​​‌​‌​​​‌‌‌​​‌‌​​​‌‌‌​‌‍a concrete injury for Article III purposes. To be sure, disclosing a biometric identifier to a third-party might very well constitute a concrete injury to an individual's privacy. See Dixon , 2018 WL 2445292, at *9 ("Obtaining or disclosing a person's biometric identifiers or information without her consent or knowledge necessarily violates that person's right to privacy in her biometric information."). U.S. Cold Storage questions whеther all disclosures to any third-party really present a concrete injury, arguing that "[p]ayroll vendors typically are privy to all kinds of confidential information ... and have strong protocols and practices in place to protect such data," so it was not clear that Dixon was harmed by the alleged violation. Def.'s Pos. Paper at 6 (discussing Dixon , 2018 WL 2445292, at *8-9 ). There is some force to that line of reasoning when the third-party is a payroll vendor, but this Court need not determine whether that sort of disclosure qualifies as a sufficient concrete injury, because McGinnis does not allege any such disclosure (nor did he ask for jurisdictional discоvery). The Seventh Circuit has held that the mere retention of personally identifying information that was obtained with the person's knowledge is insufficient to confer Article III standing if there is no risk of unauthorized disclosure. Gubala v. Time Warner Cable, Inc. , 846 F.3d 909, 912-13 (7th Cir. 2017) ; see also Aguilar , 2018 WL 3239715, at *3 ("[N]otice and consent violations [of the Act] do not without more create a risk of disclosure....").

Here, there is no allegation that McGinnis did not know that his fingerprint was being collected. Rather, he alleges that after U.S. Cold Storage implemented its biometric time-tracking system in 2012, he was "required to scan his fingerprint and/or handprint so that [U.S.] Cold could use it as an authentication method to track his time." Compl. ¶ 32. McGinnis knew his fingerprints were being collected because he scanned them in every time he clocked in or out of work, and he knew they were being stored because the time-clock-scanned prints were obviously being compared to a stored set of prints. All other courts in this District that have considered whether a person suffers a concrete injury from the known collection and retention of a fingerprint, without disclosure to a third-party, have answered the question no. See Johnson , 2018 WL 3636556 ; Aguilar , 2018 WL 3239715 ; Goings , 2018 WL 2966970 ; Howe , 2018 WL 2445541 ; McCollough v. Smarte Carte, Inc. , 2016 WL 4077108 (N.D. Ill. Aug. 1, 2016). This Court agrees.8

Finally, as noted above, McGinnis does not plead any facts suggesting that there is a risk of disclosure, either intentionally to a third-party vendor as in Dixon , or via a data breach of U.S. Cold Storage's system. For a plaintiff to rely on a risk of future harm to satisfy Article III's concrete injury requirement, the plаintiff must establish a "substantial risk" that the future harm will occur. Clapper v. Amnesty Int'l USA , 568 U.S. 398, 414 n.5, 133 S.Ct. 1138, 185 L.Ed.2d 264 (2013). Nowhere in the complaint is there any allegation of disclosure, other than a speculative note that "[U.S.] Cold fails to inform its workers ... to whom the [biometric] data is disclosed, if at all. " Compl. ¶ 26 (emphasis added). That allegation does not come close to the kind of situаtion in which the risk of future harm satisfies Article III concreteness requirements. See, e.g. , Lewert v. P.F. Chang's China Bistro, Inc. , 819 F.3d 963, 968-69 (7th Cir. 2016) (hackers already had breached the defendant's database and stolen customers' payment-card information, so the risk of identity theft and the precautions customers took to mitigate the risk constituted a concrete injury). The mental anguish alleged by McGinnis arises from the pоssible disclosure of his biometric data, as well as the unknown period of retention. Compl. ¶ 39. But as discussed, McGinnis does not allege that his data was already-or is even likely to be-compromised or disclosed, so any emotional injury he suffers from that fear is a product of the sort of hypothetical injury the Supreme Court has held cannot support Article III standing. Clapper , 568 U.S. at 402, 133 S.Ct. 1138 ("[R]espondents cannot manufacture standing by choosing to make expenditures based on hypothetical future harm that is not certainly impending."). His anxiety about "whether [U.S.] Cold will ever delete his biometric information" Compl. ¶ 39, does not on its own constitute a concrete injury because the mere retention of data does not in itself cause an injury-in-fact absent a substantial risk of disclosure. Gubala , 846 F.3d at 912. What's more, that fear of indefinite retention arises out of the same underlying fear that the fingerprints will be compromised or disclosed, which is too speculative to satisfy the requirement of cоncrete injury under Article III.9

IV. Conclusion

The Court lacks subject matter jurisdiction because McGinnis has not alleged a concrete injury sufficient to satisfy Article III. The case is dismissed for lack of subject matter jurisdiction. The status hearing of January 11, 2019 is vacated.

Notes

The Court has diversity jurisdiction over ‍​​​​‌​‌​​‌​​​‌‌​‌‌​​​​‌‌​​​‌​‌​​​‌‌‌​​‌‌​​​‌‌‌​‌‍McGinnis's state-law claims under 28 U.S.C. § 1332. McGinnis is a citizen of Illinоis. Compl. ¶¶ 8, 11. U.S. Cold Storage is a citizen of New Jersey (its place of incorporation and principal place of business). R. 14, Def.'s Answer ¶ 10. The amount in controversy requirement is satisfied. Based on the potential class action, the aggregate claims of hundreds of class members could exceed $ 5,000,000, exclusive of interest and costs. 28 U.S.C. § 1332(d)(6). Even setting aside the class allegation, it is not "legally impossible" for McGinnis alone to recover more than $ 75,000 in this action. Back Doctors Ltd. v. Metro. Prop. & Cas. Ins. Co. , 637 F.3d 827, 830 (7th Cir. 2011) (amount-in-controversy requirement satisfied unless it is "legally impossible" for a plaintiff to recover that amount).

That said, a plaintiff must also satisfy Article III's requirements to establish subject matter jurisdiction over a case, in addition to statutorily conferred jurisdiction. See Moore v. Olson , 368 F.3d 757, 760 (7th Cir. 2004) ("If Congress has authorized federal courts to resolve particular claims, and if the claim presents a case or controversy within the scope of Article III, then federal courts have subject-matter jurisdiction.") (emphasis added). As discussed in this Opinion, Article III's standing requirement is not met in this case.

Citations to the record are noted as "R." followed by the docket number and the page or paragraph number.

For brevity's sake, the Opinion will refer just to the collection of fingerprints, although that is meant to include handprints as well as fingerprints.

This Opinion uses (cleaned up) to indicаte that internal quotation marks, alterations, and citations have been omitted from quotations. See Jack Metzler, Cleaning Up Quotations , 18 Journal of Appellate Practice and Process 143 (2017).

At the same time, concreteness is indeed a requirement that is separate and apart from the Article III requirement that the injury be "particularized" to the individual plaintiff. Spokeo , 136 S.Ct. at 1548. Specifically, "[t]o establish injury in fact, a plаintiff must show that he or she suffered 'an invasion of a legally protected interest' that is 'concrete and particularized.' " Id. at 1548 (emphasis added) (quoting Lujan v. Defs. of Wildlife , 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) ).

As this Court detailed in Rivera v. Google , 2018 WL 6830332, at *7-11 (N.D. Ill. Dec. 29, 2018), the examples offered in Spokeo of cases involving common law torts or purely procedural violations of information-access statutes are distinguishable from the notice-and-consent violatiоns of the Act as pled here.

It is possible that the word "weary" in the Act, ‍​​​​‌​‌​​‌​​​‌‌​‌‌​​​​‌‌​​​‌​‌​​​‌‌‌​​‌‌​​​‌‌‌​‌‍740 ILCS 14/5(d), was intended to be "wary."

This Court recently held that even if a plaintiff does not know that biometric information is being collected, then the plaintiff still might fail to adequately allege a concrete injury if there is no risk of identity theft. See Rivera , 2018 WL 6830332, at *8-11 (holding that the creation and retention of face templates created from photographs of plaintiffs' faces without their knowledge did not constitute an injury-in-fact where there was no disclosure to a third-party and no imminent risk of identity theft). But it is a much easier question here, because McGinnis does not allege that his biometric informаtion was collected without his knowledge.

In its answer, U.S. Cold Storage stated that it destroyed McGinnis's biometric data as required by Section 15(a) of the Act. Answer ¶¶ 35-36. Whether U.S. Cold Storage complied with the Act's destruction requirements is not at issue for purposes of determining standing, but that representation supports a holding that any emotional injury based on a fear of future disclosure of his biometric data is purely speculative.
Read the detailed case summary