409 F.Supp.3d 612

N.D. Ill.

2019

RICHARD ROGERS, individually and on behalf of similarly situated individuals, Plaintiff, v. CSX INTERMODAL TERMINALS, INC., a Delaware corporation, Defendant.

No. 1:19 C 2937

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION

September 5, 2019

Hon. Marvin E. Aspen

MEMORANDUM OPINION AND ORDER

MARVIN E. ASPEN, District Judge:

Plaintiff Richard Rogers, individually and on behalf of a proposed class, alleges that Defendant CSX Intermodal Terminals, Inc. (“CSX“) violated the Illinois Biometric Information Privacy Act, 740 ILCS 14/1, et seq. (“BIPA“), by collecting his biometric information without obtaining a written release or providing him written disclosure of the purpose and duration for which his information was collected. (Compl. (Dkt. No. 1–1) ¶¶ 20, 35–36.) Presently before us is CSX‘s motion to dismiss Rogers’ complaint pursuant to Federal Rule of Civil Procedure 12(b)(6). (Dkt. No. 16.) For the reasons below, we deny in part and grant in part CSX‘s motion.

BACKGROUND

The following facts are taken from Rogers’ complaint and deemed true for the purposes of this motion. See Bell v. City of Chi., 835 F.3d 736, 738 (7th Cir. 2016); Tamayo v. Blagojevich, 526 F.3d 1074, 1081 (7th Cir. 2008). Rogers used to work as a truck driver and, as part of his work, visited rail terminals operated by CSX to pick up and deliver freight. (Compl. ¶¶ 17–18.) At CSX‘s facilities, Rogers was required to scan his fingerprints to gain access. (Id.) CSX collected and stored Rogers’ fingerprint information and “disseminat[ed]” it to its “technology vendors.” (Id. ¶¶ 19, 21.) Prior to obtaining Rogers’ fingerprints, CSX did not inform him in writing of the specific purpose or length of time for which his information was collected. (Id. ¶¶ 20, 35.) Rogers also did not sign a release regarding his fingerprint information or consent to its dissemination, nor does CSX have a publicly available policy regarding its retention of biometric data. (Id. ¶¶ 20–21, 35–36.)

Based on the forgoing, Rogers filed a class action against CSX in the Circuit Court of Cook County. See Rogers v. CSX Intermodal Terminals, Inc., No. 19 C 4168 (Ill. Cir. Ct. 2019). CSX then removed the case to this court based on diversity jurisdiction and the Class Action Fairness Act, 28 U.S.C § 1332(d).¹ (Notice of Removal (Dkt. No. 1).)

LEGAL STANDARD

A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) is meant to test the sufficiency of the complaint, not to decide the merits of the case. Gibson v. City of Chi., 910 F.2d 1510, 1520 (7th Cir. 1990) (citing Triad Assocs., Inc. v. Chi. Hous. Auth., 892 F.2d 583, 586 (7th Cir. 1989)). In evaluating a motion to dismiss, we “construe the complaint in the light most favorable to the plaintiff, accepting as true all well-pleaded facts alleged, and drawing all possible inferences in [plaintiff‘s] favor.” Tamayo, 526 F.3d at 1081. A court may grant a motion to dismiss under Rule 12(b)(6) only if a complaint lacks enough facts “to state a claim for relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S. Ct. 1937, 1949–50 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570, 127 S. Ct. 1955, 1974 (2007)). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678, 129 S. Ct. at 1949. Although a facially plausible complaint need not give “detailed factual allegations,” it must allege facts sufficient “to raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555, 127 S. Ct. at 1964–65. “Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Iqbal, 556 U.S. at 678, 129 S. Ct. at 1949. These requirements ensure that the defendant receives “fair notice of what the . . . claim is and the grounds upon which it rests.” Twombly, 550 U.S. at 555, 127 S. Ct. at 1964.

ANALYSIS

Rogers’ claim stems from CSX‘s alleged failure to follow BIPA‘s disclosure and release requirements. Section 15(b) states that private entities collecting biometric identifiers and information² must:

(1) inform[] the subject . . . in writing that a biometric identifier or biometric information is being collected or stored;

(2) inform[] the subject . . . in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and

(3) receive[] a written release executed by the subject of the biometric identifier or biometric information.

740 ILCS 14/15(b). A “[w]ritten release” is defined as “informed written consent or, in the context of employment, a release executed by an employee as a condition of employment.”

Id. 14/10. Private entities must also obtain consent before disseminating a person‘s biometric information and develop a publicly available written policy that “establish[es] a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information.” Id. 14/15(a), (d)(1). BIPA provides that “[a]ny person aggrieved by a violation” may bring an action to recover $1000 for a negligent violation or $5000 for an intentional or reckless violation. Id. 14/20.

Rogers asserts that he is an aggrieved person under BIPA and is entitled to liquidated damages for CSX‘s “knowing and willful” or, at least, negligent violations. (Compl. ¶¶ 32–38.) CSX attacks Rogers’ claim by arguing that the rights BIPA was designed to protect were not violated. (Def.‘s Mem. in Supp. of Mot. to Dismiss (“Mem.“) (Dkt. No. 17) at 7–8.) It also argues that its failure to develop a publicly available retention and destruction policy was not a BIPA violation because it did not need to create one before collection of Rogers’ fingerprints. (Id. at 9.) Finally, CSX argues that Rogers failed to adequately allege that CSX acted intentionally or recklessly. (Id. at 9–11.)

I. ROGERS’ BIPA CLAIM

CSX argues that BIPA was enacted to protect individuals’ control over their biometric information and identifiers by allowing them to withhold consent before collection, and this right was not violated because Rogers voluntarily provided his fingerprints to CSX. (Id. at 7–8; Def.‘s Reply to Pl.‘s Resp. to Mot. to Dismiss (Dkt. No. 23) at 5–6.) CSX‘s argument attacks Rogers’ status as an “aggrieved person” under the act and stems from the Illinois Supreme Court‘s recent decision in Rosenbach v. Six Flags Entm‘t Corp., 2019 IL 123186 (Ill. 2019), which addressed this very question. (Mem. at 7–8.)³ The Illinois Supreme Court concluded that “to qualify as an ‘aggrieved’ person” an “individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under [BIPA].” Id. ¶ 40. Individuals’ rights under BIPA include the “collection, retention, disclosure, and destruction” requirements of Section 15, which the court saw as a codification of individuals’ “right to privacy in and control over their biometric identifiers and information.” Id. ¶ 33. The Illinois Supreme Court also rejected the idea that a violation of the rights codified by BIPA is a mere technicality and found that “[w]hen a private entity fails to adhere to the statutory procedures . . . ‘the right of the individual to maintain his or her biometric privacy vanishes into thin air.‘” Id. ¶ 34 (quoting Patel v. Facebook, Inc., 290 F.Supp.3d 948, 954 (N.D. Cal. 2018)) (internal alterations omitted).

CSX‘s argument fails to appreciate the Illinois Supreme Court‘s holding. CSX argues that Rogers’ did not suffer any injury because he knew his fingerprints were being collected and could have withheld consent if he wanted. (Mem. at 7–8.) However, Rogers’ right to privacy in his biometric data includes the right to give up his biometric identifiers or information only after receiving written notice of the purpose and duration of collection and providing informed written consent. Rosenbach, 2019 IL 123186, ¶¶ 20, 33; 740 ILCS 14/10, 14/15(b). Rogers alleges

precisely these violations of his rights, infringements that the Illinois Supreme Court interpreted as real harms, not mere technicalities. Rosenbach, 2019 IL 123186, ¶ 34. The Illinois Supreme Court recognized that, according to the General Assembly, “biometrics are unlike other unique identifiers” because they are “biologically unique to the individual” and “once compromised, the individual has no recourse.” Id. ¶ 35 (quoting 740 ILCS 14/5(c)); see also Sekura v. Krishna Schaumburg Tan, Inc., 2018 IL App (1st) 180175, ¶ 59, 115 N.E.3d 1080, 1093 (1st Dist. 2018), appeal denied, 119 N.E.3d 1034 (Ill. 2019) (“A person cannot obtain new DNA or new fingerprints or new eyeballs for iris recognition . . . . Replacing a biometric identifier is not like replacing a lost key or a misplaced identification card or a stolen access code.“). The court reasoned that the “strategy adopted by the General Assembly” was to “head off . . . problems before they occur” by “imposing safeguards to insure that individuals’ and customers’ privacy rights in their biometric identifiers and biometric information are properly honored and protected to begin with” and by implementing an enforcement mechanism that subjects private entitles to “substantial potential liability” when they “fail to follow the statute‘s requirements.” Rosenbach, 2019 IL 123186, ¶ 36. Because Rogers’ alleges his BIPA rights were violated, his ability to maintain a claim is wholly consistent with holding and reasoning of Rosenbach. Id. ¶ 40; see also Rottner v. Palm Beach Tan, Inc., 2019 IL App (1st) 180691, ¶¶ 4, 12 (1st Dist. 2019) (post-Rosenbach case finding that plaintiff could maintain a BIPA action when the only allegations were that defendant never informed plaintiff of its data retention policy and plaintiff never signed a release permitting collection); Sekura, 2018 IL App (1st) 180175, ¶ 72, 115 N.E.3d at 1095 (pre-Rosenbach case finding that language and history of BIPA demonstrated that plaintiff could “sue for a violation of the Act without [alleging] additional harm“).

CSX‘s argument also ignores Rogers’ allegation that CSX did not receive his consent prior to “collecting and/or disseminating [his] biometric information to any of its technology vendors.” (Compl. ¶ 21.) Even before the Illinois Supreme Court decided Rosenbach, dissemination of biometric information without consent qualified as an injury that allowed plaintiffs to bring a BIPA action. See Dixon, 2018 WL 2445292, at *11 (denying motion to dismiss where information was disseminated to a third party). Thus, even if Rogers’ other allegations were insufficient, his allegation that his information was disseminated without consent is.

CSX argues that Rosenbach is distinguishable because the plaintiff was 14 years old and his mother did not know her son‘s information was being collected. (Mem. at 7–8.) While the age of the plaintiff in Rosenbach and Rogers are different, the plaintiff‘s age in Rosenbach did not play a role in the Illinois Supreme Court‘s decision. Indeed, the certified question was:

whether an individual is an aggrieved person under [BIPA], and may seek statutory liquidated damages . . . when the only injury he alleges is a violation of § 15(b) of the Act by a private entity who collected his biometric identifiers and/or biometric information without providing him the required disclosures and obtaining his written consent as required.

Rosenbach, 2019 IL 123186, ¶ 14. The court answered this question “in the affirmative,” id. ¶ 40, and did not make any mention of the plaintiff‘s age or status as a minor except when outlining the background of the case. See id. ¶¶ 5, 8.

In sum, Rogers qualifies as an aggrieved person under BIPA because his BIPA rights were violated. Accordingly, CSX‘s motion to dismiss Rogers’ BIPA claim is denied.

II. FAILURE TO MAINTAIN A PUBLICLY AVAILABLE RETENTION POLICY

Having concluded that Rogers qualifies as an aggrieved person, we briefly address CSX‘s argument that Rogers has not properly pled a violation of Section 15(a) of BIPA. (Mem. at 9.)

Section 15(a) requires private entities in possession of biometric identifiers or biometric information to develop a publicly available policy regarding the retention and destruction of biometric identifiers and information. 740 ILCS 14/15(a). CSX argues that Rogers’ claim fails because he only alleges that CSX did not create a publicly available policy before collection of his information, which is not required. (Mem. at 9.) CSX argues that it is only required to develop a policy after collection. (Id.)

We reject CSX‘s argument. While Rogers alleges that CSX failed to develop a policy before collecting his fingerprints (Compl. ¶ 36), he also alleges that despite collection, it “failed to make publicly available any retention or destruction policies.” (Id. ¶ 20.) This allegation is not temporally restricted and is sufficient to maintain a claim that CSX did not comply with Section 15(a) after his fingerprints were collected. Rogers’ claim is also consistent with Rosenbach, wherein the Illinois Supreme Court explained the importance of BIPA‘s private enforcement mechanism to make sure private entities comply with BIPA. See 2019 IL 123186, ¶ 37 (“Other than the private right of action . . . no other enforcement mechanism is available. It is clear that the legislature intended for this provision to have substantial force.“). Because Rogers qualifies as an aggrieved person by the allegations of his complaint and alleges that CSX failed to comply with Section 15(a) of the act, his claim may proceed. See Sekura, 2018 IL App (1st) 180175, ¶¶ 12, 76–77, 115 N.E.3d at 1085, 1096 (claim allowed to proceed where plaintiff qualified as an aggrieved person and alleged a violation of § 15(a)); Dixon, 2018 WL 2445292, at *1, *12 (same).

III. INTENTIONAL AND RECKLESS VIOLATION

In addition to asserting a claim for violation of BIPA, Rogers asserts that CSX‘s violations were “knowing and willful.” (Compl. ¶ 38.) BIPA allows plaintiffs to recover heightened damages from private entities that violate the act “intentionally or recklessly.” 740 ILCS 14/20(2). CSX argues that Rogers has failed to adequately allege that CSX‘s BIPA violations were anything more than negligent. (Mem. at 9–11.) Rogers counters that CSX‘s actions were willful and wanton because CSX has “taken no steps towards any compliance.” (Pl.‘s Resp. to Def.‘s Mot. to Dismiss (Dkt. No. 22) at 8–9 (emphasis in original).)

BIPA does not define “intentionally” or “recklessly.” Intentional conduct is conduct performed with a “desire to cause consequences or at least a substantially certain belief that the consequences will result.” Ziarko v. Soo Line R. Co., 161 Ill. 2d 267, 272, 641 N.E.2d 402, 405 (Ill. 1994) (quotation and internal alterations omitted). In general terms, “[r]ecklessness denotes ‘a course of action which shows an utter indifference to or a conscious disregard.‘” Resolution Tr. Corp. v. Franz, 909 F. Supp. 1128, 1141 (N.D. Ill. 1995) (quoting Ziarko, 161 Ill.2d at 279, 641 N.E.2d at 408) (internal alterations omitted). Recklessness is also, “at least in theory, determined based on the actor‘s ‘real or supposed state of mind.‘” Kirwan v. Lincolnshire-Riverwoods Fire Prot. Dist., 349 Ill. App. 3d 150, 155, 811 N.E.2d 1259, 1263 (2nd Dist. 2004) (quoting W. Keeton, Prosser & Keeton on Torts § 34, at 212 (5th ed. 1984)). Pursuant to Federal Rule of Civil Procedure 9(b) “[m]alice, intent, knowledge, and other conditions of a person‘s mind may be alleged generally.” See also Triad Assocs., Inc. v. Robinson, 10 F.3d 492, 497 (7th Cir. 1993) (“[O]n a motion to dismiss we require no more from plaintiffs’ allegations of intent than what would satisfy Rule 8‘s notice pleading minimum and Rule 9(b)‘s requirement that motive and intent be pleaded generally.“). This means alleging “sufficient underlying facts from which a court may reasonably infer that a party acted with the requisite state of mind.” Simonian v. MeadWestvaco Corp., 812 F. Supp. 2d 925, 929 (N.D. Ill. 2011) (quoting In re BP Lubricants USA Inc., 637 F.3d 1307, 1311 (Fed. Cir. 2011)); see also Iqbal, 556 U.S. at 678, 129 S. Ct. at 1949 (“A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.“).

Here Rogers only alleges that “CSX‘s violations of BIPA . . . were knowing and willful.” (Compl. ¶ 38.) The only other substantive allegations are that CSX violated BIPA. (See id. ¶¶ 17–21; 32–36.) Rogers’ conclusory statement of CSX‘s intent is insufficient to allow us to infer that CSX acted intentionally or recklessly and does nothing to distinguish this case from every possible BIPA case where the defendant is alleged to have failed to meet the strictures of Section 15. See Swanson v. Citibank, N.A., 614 F.3d 400, 405 (7th Cir. 2010) (“[C]onclusory legal statements . . . do nothing to distinguish the particular case that is before the court from every other hypothetically possible case in that field of law.“) (quotation omitted). Thus, Rogers’ claim of intentional and reckless conduct is dismissed. However, Rogers may amend his complaint regarding CSX‘s claimed intentional and reckless conduct within 30 days if he so chooses. See Barry Aviation Inc. v. Land O‘Lakes Mun. Airport Comm‘n, 377 F.3d 682, 687 (7th Cir. 2004).

CONCLUSION

For the foregoing reasons, Defendant‘s motion is granted in part with respect to Rogers’ allegations that CSX‘s actions were intentional and reckless but denied in all other respects. It is so ordered.

Honorable Marvin E. Aspen

United States District Judge

Dated: September 5, 2019

Chicago, Illinois

Notes

A defendant may remove a civil action to the federal district where an action is pending if the federal court meets the requirements for original jurisdiction. 28 U.S.C. §§ 1441, 1332. Rogers does not dispute that these requirements have been met.

A “[b]iometric identifier” is a “retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILCS 14/10. “Biometric information” is “any information, regardless of how it is captured, converted, stored, or shared, based on an individual‘s biometric identifier used to identify an individual.” Id.

CSX does not argue that Rogers lacks constitutional standing. Constitutional standing limits federal courts’ jurisdiction to “cases” and “controversies,” Art. III, § 2, and requires the plaintiff to allege an “‘injury in fact’ that is ‘fairly traceable’ to the defendant‘s conduct.” (quoting ). Constitutional standing is generally conferred in BIPA actions where biometric information is collected without the plaintiff‘s knowledge or disseminated to a third party without consent. See (standing where biometric information was collected by Facebook without users’ knowledge); (standing where fingerprint was disclosed to a third party). Here, there is no issue with constitutional standing because Rogers has alleged that CSX “failed to obtain [his] . . . informed consent prior to collecting and/or disseminating [his] biometric information to any of its technology vendors.” (Compl. ¶ 21.)

Read the detailed case summary