Illinois federal court dismisses two biometric privacy lawsuits on similar grounds
A U.S. federal judge dismissed a lawsuit alleging injury under the Illinois Biometric Privacy Act (BIPA) this past week on grounds it lacked standing under Article III of the U.S. Constitution and remanded it back to a lower state court.
Meanwhile, and similarly, another Illinois federal judge rejected respiratory therapist Corey Heard’s federal lawsuit alleging medical supplier Becton Dickinson & Co. (BD) also violated BIPA by requiring his fingerprint to unlock a medication dispensing system.
Both cases are very similar and were tossed out of federal court for similar reasons.
In the U.S. District Court for the Northern District of Illinois Eastern Division, Judge Robert Gettleman’s Memorandum Opinion and Order in the case of Hunter v. Automated Health Systems, Inc. (AHS) ruled the suits lacks standing, as it only claims a bare procedural violation with alleging dissemination of the data.
U.S. District Judge Rebecca R. Pallmeyer ruled in Corey Heard v. Becton, Dickinson & Co. that Heard had failed to provide sufficient details alleging that Becton Dickinson & Co. had violated BIPA by requiring him to access the Pyxis MedStation automated medication dispensing system manufactured by the company – which users can only access by a fingerprint scan – used by hospitals where had worked since 2015. BD argued that employee fingerprint data was covered by a healthcare exemption.
Heard alleged that he was required to access Pyxis MedStation devices with his fingerprint “[a]s a condition of his employment” at the hospitals. As in the AHS case, Pallmeyer pointed out that “Heard [also] initially filed [his] lawsuit in the Circuit Court of Cook County, Illinois,” but that “BD removed the action to this court on the basis of diversity jurisdiction and the Class Action Fairness Act and now moves for dismissal of all claims under Federal Rule of Civil Procedure 12(b)(6). In addition, BD has moved to strike Heard’s class allegations.”
It did not go unnoticed by Pallmeyer, as she granted the dismissal, that many suits have been brought against employers in recent months by employees subject to fingerprint scans on very similar grounds.
In the amended Hunter v. Automated Health Systems, Inc. complaint, the plaintiff “admitted that she has no information to support her allegation that the defendant disseminated her biometric information to a payroll vendor. And, plaintiff acknowledges that” the case of McGinnis v. the United States Cold Storage “held that a bare allegation of disclosure to a payroll vendor without any allegation that such disclosure created an increased risk of harm that BIPA was designed to protect, such as identity theft, is insufficient to allege a concrete injury, Gettleman ruled.
Hunter “does not allege, and admits that she cannot allege, that the unknown payroll vendor does not have any data security controls,” Gettleman said, remanding the case to the Circuit Court of Cook County for lack of federal standing.
AHS had removed the case to federal court and, “after the plaintiff filed an amended complaint, moved to dismiss arguing that plaintiff’s claims are barred by the statute of limitations or preempted by the Illinois Workers Compensation Act.”
Gettleman wrote that “During the court’s review of the parties’ briefs on the motion to dismiss, it became apparent to the court that there is a serious question as to subject matter jurisdiction, and the court ordered the parties to submit briefs addressing whether plaintiff has alleged an injury-in-fact sufficient to establish Article III standing to proceed in federal court.”
But after “having reviewed those briefs, the court concludes that the plaintiff has not alleged an injury-in-fact, and remands the case to the Circuit Court of Cook County, Illinois,” Gettleman ruled, dismissing the civil suit from federal jurisdiction.
Gettleman explained that the plaintiff took on the burden of establishing jurisdiction, and therefore standing, by removing the case to federal court.
In order “To qualify as an injury-in-fact, the alleged injury must be ‘concrete and particularized’ and ‘actual and imminent and not conjectural or hypothetical,’” Gettleman ruled, citing case law. And “To be concrete, the injury must be de facto or actually exist. A ‘bare procedural violation divorced from any concrete harm’ does not qualify as an injury in fact.”
“A procedural statutory violation may constitute an injury-in-fact on its own if the [state] legislature has elevated a de facto injury that ‘was previously inadequate in law’ to the ‘statues of illegally cognizable injury,’” Gettleman wrote in his dismissal of the case from the federal court, noting, “a statutory violation causes a concrete injury for Article III standing only if it presents an ‘appreciable risk of harm’ to the underlying interest the [legislature] sought to protect by enacting the statute.”
Hunter did not allege a failure to obtain consent, a risk to her biometric data, and claims that data was disseminated to a payroll company were not consistent between the original complaint, the amended complaint, and the brief on standing.
Gettleman pointed out that in the case of Crabtree v. Experian Information Solutions, Inc., in January the Seventh Circuit Court “summarized its decisions … with respect to consumer protection cases, concluding that the ‘mere retention of private consumer information absent any dissemination, did not constitute a concrete injury for Article III standing purposes.’”
“Not surprisingly,” Gettleman added, “several district courts within this circuit have addressed the precise issue before this court, and have concluded that allegations of violation of BIPA’s procedural requirements absent allegations of dissemination, or at least an appreciable risk of dissemination, do not suffice to support Article III standing,” and sided with AHS’s argument that “jurisdiction is proper based on the Illinois Supreme Court’s decision in Rosenbach v. Six Flags Entertainment, Corp., … which held that a plaintiff may qualify as an aggrieved party entitled to relief under BIPA without alleging any ‘actual injury or damage beyond infringement of the rights afforded under the law.’”
He cited the case of Rosenbach as having “established only that it is the policy of the Illinois courts to allow parties to sue under BIPA even if they cannot demonstrate that ‘they have sustained some compensable injury beyond violation of their statutory rights before they may seek recourse. But, it is the policy of the federal courts, by contrast, that a plaintiff must allege an ‘actual or imminent’ injury to establish Article III standing, and the Illinois Supreme Court explicitly indicated that BIPA procedural violations are not themselves actual injuries.”
Gettleman referenced the case of Patel v. Facebook in which the Ninth Circuit Court “held that procedural violations of BIPA can constitute concrete injuries, but [that] in Patel, the plaintiffs posted images of themselves on Facebook, and Facebook used those images to create user face templates which it then used to suggest ‘tagging.’ Facebook created those templates without the users’ written consent, and thus used the plaintiffs ’ images in ways that the plaintiffs had no reason to anticipate.”
However, in Hunter’s lawsuit against AHS, the complaint does not allege an increased risk of harm, and does not meet the criteria for concrete injury.
Hunter had asked the court to remand the case to Cook County Circuit Court “in light of the uncertainty in the law and the weight of authority favoring remand.”
“We wanted the case in state court; that’s why we filed it there,” David Fish of The Fish Law Firm, which represents Hunter and the proposed class, was quoted saying by Law360.
Hunter had told the court that that unlike other BIPA cases, hers did not allege any wrongful disclosure to a third party, such as a payroll company, and that “(t)here is a significant concern that this case could remain pending for years and when it ends up before the Seventh Circuit, all the work would be wasted if no Article III standing” is granted.
The Seventh Circuit has yet to become involved. Gettleman did, however, require the parties in January to address the question of standing in light of U.S. District Court for the Northern District of Illinois Judge Edmond Chang’s decision in McGinnis v. United States Cold Storage Inc. that a violation of BIPA can’t confer Article III standing unless there is an appreciable “risk of future harm to the privacy interests that BIPA seeks to protect.”
Similarly, in Rivera v. Google, the plaintiffs alleged Google’s technology violated BIPA because “Google unlawfully collected, stored, and exploited their face-geometry scans via Google Photos …”
Google swiftly moved for summary judgment on all of the plaintiffs’ claims against it, arguing that plaintiffs could not establish standing under Article III of the U.S. Constitution; plaintiffs were not “aggrieved” within the meaning of the Act; and that the plaintiffs were not entitled to monetary or injunctive relief under the Act because they suffered no harm.
Chang agreed and dismissed the case, concluding, “Google’s motion for summary judgment is granted,” saying “the court lacks subject matter jurisdiction because plaintiffs have not suffered concrete injuries for Article III purposes. In light of that holding, there is no need to opine on the statutory interpretation arguments (and, in any event, the Illinois Supreme Court has the issue under advisement).”
In Corey Heard v. Becton, Dickinson & Co. case, Heard also sued the manufacturer of the fingerprint scanning device, alleging “that BD never informed him or similarly situated individuals that it was collecting, using, or storing their biometric data, and never stated the purpose and length of time for which it was doing so, in violation of Section 15(b)” of BIPA, Pallmeyer wrote. The plaintiff alleges BD failed to obtain valid consent, did not provide the necessary policy information, and that it disclosed biometric data to ‘unknown’ third parties.
Judge Pallmeyer concluded that “Heard’s arguments are flawed. First, Heard agrees that Section 15(b) [of BIPA] requires something more than mere possession of biometric data, but does not explain what that ‘something more’ is, if not an affirmative act of collection. In this vein, Heard does not specify how an entity could ‘otherwise obtain’ biometric information without taking an active step to do so. And as BD points out, Black’s Law Dictionary defines ‘obtain’ as ‘[t]o bring into one’s own possession; to procure, esp. through effort.’ Second, the fact that Pay By Touch’s bankruptcy may have influenced the Illinois legislature’s decision to enact the BIPA does not mean that the legislature drafted every provision with Pay By Touch in mind, or that it intended for every provision to cover entities that operate exactly as Pay By Touch did. Moreover, it is not clear from Heard’s own allegations that Pay By Touch did not engage in an affirmative act of collection. The court concludes that for Section 15(b)’s requirements to apply, an entity must, at a minimum, take an active step to ‘collect, capture, purchase, receive through trade, or otherwise obtain’ biometric data.”
Pallmeyer ruled “Heard has not adequately pleaded that BD took such any such step.”
With a huge volume of cases under court review, as noted by Pallmeyer, the details of standing in federal and circuit court and novel defenses like the healthcare exemption alleged by BD will surely be further tested in the near future.