Stauffer v. Innovative Heights Fairview Heights, LLC ( 2020 )

IN THE UNITED STATES DISTRICT COURT FOR THE SOUTHERN DISTRICT OF ILLINOIS MADISYN STAUFFER, on behalf of ) herself an all others similarly situated, ) ) ) Plaintiff, ) ) ) Case No. 3:20 -CV-00046 -MAB vs. ) ) ) INNOVATIVE HEIGHTS FAIRVIEW ) HEIGHTS, LLC, AND PATHFINDER ) SOFTWARE, LLC D/B/A PATHFINDER ) SOFTWARE, LLC, ) ) ) ) Defendants. ) MEMORANDUM AND ORDER BEATTY, Magistrate Judge: Presently before the Court is Plaintiff Madisyn Stauffer’s Motion to Remand (Doc. 27) and Defendant Pathfinder Software, LLC’s Motion to Dismiss (Doc. 21). For the reasons set forth below, Plaintiff’s Motion to Remand is GRANTED in part and DENIED in part. Defendant Pathfinder’s Motion to Dismiss is DENIED. FACTUAL AND PROCEDURAL BACKGROUND In her Amended Complaint (Doc. 1-1, pp. 89-109), Plaintiff alleges, on behalf of herself and a class of similarly situated individuals, that both Defendants Innovative Heights, Fairview Heights, LLC (“Innovative Heights”) and Pathfinder Software, LLC, d/b/a/ CenterEdge Software, LLC (“Pathfinder”) collected her biometric information, specifically her fingerprints, in violation of The Illinois Biometric Information Privacy Act, 740 ILCS 14/1, et seq. (“BIPA”) (Doc. 1-1, p. 91). I. The Illinois Biometric Information Privacy Act Illinois passed BIPA in 2008 to address concerns about the growing collection and use of biometrics by private entities (Id. at 96). The Illinois General Assembly found that while the use of biometrics has been growing, “[b]iometrics are unlike other unique identifiers that are used to access finances or other sensitive information” in that unlike social security numbers or other identifiers that can be changed when compromised, biometrics are “biologically unique to the individual; therefore, once compromised, the individual has no recourse…” (Id. at 96-97). See 740 ILCS 14/5(a)-(c). Under BIPA, a biometric identifier includes an individual’s fingerprints (Doc. 1-1, p. 97). As the ramifications of this emerging area of technology are unknown, the Illinois General Assembly enacted BIPA to regulate the collection, use, handling, storage, retention, and destruction of these identifiers and biometric information. Id. See 740 ILCS 14/5(f)-(g). To regulate the use of these biometric identifiers, BIPA provides that a private entity in possession of biometric information “must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within three years of the individual’s last interaction with the private entity, whichever occurs first” (Doc. 1-1, p. 97). See 740 ILCS 14/15(a) (“Section 15(a)”). BIPA also outlines that a private entity may not “collect, capture, purchase, receive through trade, or otherwise obtain a person’s or a customer’s biometric identifier or information” unless it first informs that person, in writing, that such an identifier or information is being collected or stored and informs that person, in writing, of the purpose and length for which a biometric identifier or information is being used, collected, and stored (Doc. 1-1, p. 97). See 740 ILCS 14/15(b)(1) Additionally, BIPA provides that a private entity must receive a written release executed by the person who is the subject of the biometric identifier or information. Id. See 740 ILCS 14/15(b)(1)-(3) (“Section 15(b)”). Written release is defined as “informed written consent or, in the context of employment, a release executed by an employee as a condition of employment.” 740 ILCS 14/10. II. Plaintiff’s Complaint and Procedural Background On April 29, 2019, Plaintiff filed her Complaint in the Twentieth Judicial Circuit, St. Clair County, Illinois (Doc. 1-1, p. 2). She brings this action individually and on behalf of a class of similarly situated individuals who were employed by Defendant Innovative Heights and worked at its “Sky Zone” facility in Fairview Heights, Illinois for alleged violations of BIPA (Id at 15, 96). Originally, Plaintiff brought this action solely against her employer, Defendant Innovative Heights (Doc. 1, p. 1). Sky Zone is a recreational facility with indoor trampolines that offers a variety of different activities, including, but not limited to, Ultimate Dodgeball, SkyHoops, SkyJoust, and Laser Tag (Doc. 1-1, p. 4). As part of their employment, employees are required to give their fingerprints to Defendant Innovative Heights at the beginning of their employment and then scan their fingerprints for timekeeping1 and other employment purposes (Id). Plaintiff alleges that she was never informed by Defendant Innovative Heights, in writing, of the purpose and the period for which her fingerprints were being collected, stored, or used (Id. at 98-99). While still in state court, Plaintiff sought leave to amend her complaint on November 19, 2019 after learning of Defendant Pathfinder’s relationship with her employer through the first stages of discovery (Id. at 85, 93-94). Plaintiff alleges that Defendant Pathfinder controls and operates the system and database in which Defendant Innovative Heights’ employees’ fingerprints were stored (Id. at 94). Like Defendant Innovative Heights, Plaintiff alleges that Defendant Pathfinder never informed her, in writing, of the specific purpose of and the period for which her fingerprints were being collected, stored, or used (Id. at 98-99). Plaintiff received leave on November 25, 2019 to amend her complaint (Doc. 1, p. 2). Plaintiff filed her amended complaint on November 27, 2019 in which she named Defendant Pathfinder, for the first time, as a co-defendant along with Defendant Innovative Heights (Id). In adding Defendant Pathfinder, Plaintiff also alleges two separate classes of individuals—those that were employed by Defendant Innovative Heights and worked at its SkyZone facility in Fairview Heights, Illinois and those individuals who had their fingerprints collected, captured, purchased, received through trade, or otherwise obtained by Defendant Pathfinder (Doc. 1-1, p. 91). 1 Employees use their fingerprints to “clock in” and “clock out” of their shifts throughout their employment with Defendant Innovative Heights (Doc. 1-1, p. 5). In addition, they sometimes have to scan their fingerprints during the day if they are locked out of the cash register. Id. Plaintiff alleges that both Defendants Innovative Heights and Pathfinder have violated Sections 15(a) and 15(b) of BIPA while scanning and storing her and other class members’ fingerprints for timekeeping and other purposes (Doc. 1, p. 2). More specifically, Plaintiff contends that Defendant Innovative Heights collected, captured, obtained, and possessed Plaintiff’s fingerprints, but did not make available to the public a written policy establishing a retention schedule and guidelines for permanently destroying its employees’ fingerprints when the initial purpose for collecting such fingerprints had been satisfied, which means that when Plaintiff or other employees leave employment with Defendant Innovative Heights, they are unaware if and when their biometric identifiers would be destroyed (Doc. 1-1, p. 99). According to Plaintiff, if Defendant Innovative Heights were to be sold or go out of business, Plaintiff and the putative class members would be left unaware as to who is in possession of their private biometric identifiers, which Plaintiff argues is a violation of Section 15(a) of BIPA. Id. Plaintiff alleges Defendant Innovative Heights violated Section 15(b) of BIPA because it failed to notify Plaintiff and the putative class, in writing, that their fingerprints were being collected, stored, and used before collecting this biometric information. Additionally, Plaintiff notes Defendant Innovative Heights failed to obtain a written release from herself and the other putative class members before collecting their fingerprints (Id. at 99-100). Defendant Pathfinder also violated Sections 15(a) of BIPA, according to Plaintiff, by not making available, to the public, a written policy establishing a retention schedule and guidelines for permanently destroying the biometric information once the initial purpose for collecting had been satisfied (Id. at 100). Plaintiff alleges Defendant Pathfinder violated Section 15(b) of BIPA by not first informing the class members, in writing, of the purpose for which their fingerprints were being collected, stored, and used, and for how long these fingerprints were being collected, stored, and used. Finally, Plaintiff contends Defendant Pathfinder did not obtain a written release from Plaintiff or the class members before collecting, capturing, or receiving their fingerprints (Id. at 100- 101). After filing her amended complaint, Defendant Pathfinder removed this case on January 10, 2020 to the Southern District of Illinois pursuant to the Class Action Fairness Act (“CAFA”), which grants United States District Courts original jurisdiction over any civil action in which, to summarize, the matter in controversy exceeds $5,000,000 and the class of plaintiffs has any member that is a citizen of another state different from any defendant (Doc. 1). See 28 U.S.C. § 1332(d)(2). Soon after removal, Defendant Pathfinder filed a motion to dismiss on February 5, 2020 (Doc. 21). Plaintiff then filed a motion to remand this matter to state court on March 12, 2020 (Doc. 27). Both pending motions, and the responses and replies, are currently before the Court. PLAINTIFF’S MOTION TO REMAND In her motion to remand, Plaintiff does not argue this case lacks the elements necessary to satisfy removal under CAFA (28 U.S.C. § 1332(d)(2)). Rather, Plaintiff’s motion to remand hinges on whether Plaintiff has alleged an actual injury to sustain Article III standing. Plaintiff argues that Defendant Pathfinder based its motion to dismiss (Doc. 21) on the argument that Plaintiff has failed to appropriately plead that she suffered an injury; therefore, she cannot sustain Article III standing and the case must be remanded because a crucial element of subject matter jurisdiction is absent. Defendant Pathfinder, confusingly, seems to partially agree, and argues that while Plaintiff has failed to allege an actual injury under BIPA aside from a statutory violation, Plaintiff claims her privacy rights were violated when Defendant Innovative Heights disseminated her biometric information to Defendant Pathfinder, which creates an injury for Article III standing purposes (Doc. 32, p. 1-2). Plaintiff contends that Defendant’s reiteration that she has not pled an actual injury, which Defendant argues in both the motion to dismiss (Doc. 21) and its response to Plaintiff’s motion to remand (Doc. 32), is a binding judicial admission and the Court’s analysis should end there (Doc. 33). In addition, Plaintiff argues that she is bringing BIPA violation claims against both Defendants Innovative Heights and Pathfinder that are not dependent on the transmission of information from Defendant Innovative Heights to Defendant Pathfinder; rather, her claims against both Defendants stand on their own. Id. Subsequently, Defendant Pathfinder sought leave from the Court to supplement its response in opposition to Plaintiff’s motion to remand to include a recent case from the Seventh Circuit on the issue of Article III standing in BIPA cases (Doc. 39). As this is an emerging area of the law, the Court granted Defendant Pathfinder’s motion and allowed additional briefing on the issue of Article III standing from both Plaintiff and Defendant Pathfinder (Docs. 39, 40). Defendant Pathfinder argued that a recent case, Bryant v. Compass Group USA, Inc., 958 F.3d 617 (7th Cir. 2020),2 “moots all of Plaintiff’s arguments in her Motion for Remand” (Doc. 39, p. 1). In her response, Plaintiff argues that Bryant is instructive for determining whether Article III standing exists for a Plaintiff bringing a BIPA Section 15(b) claim, but not a Section 15(a) claim (Doc. 40, p. 1). LEGAL STANDARD Before a court can adjudicate the merits of a case, it must first satisfy itself that it has jurisdiction over the claims and parties that appear before it. Ruhrgas AG v. Marathon Oil Co., 526 U.S. 574, 577 (1999). A federal court has subject matter jurisdiction only if the plaintiff has Article III standing. MAO-MSO Recovery II, LLC v. State Farm Mut. Auto. Ins. Co., 935 F.3d 573, 581 (7th Cir. 2019). Article III standing is a crucial element for District Courts as it ensures the Court does not exceed its authority over cases and controversies that the federal court cannot hear. Spokeo, Inc. v. Robins, 136 S.Ct. 1540, 1547 (2016).3 As the party seeking to invoke federal jurisdiction, Defendant Pathfinder must establish that Article III standing exists; however, the Court also has an independent responsibility to ensure that it has subject matter jurisdiction. Collier v. SP Plus Corp., 889 F.3d 894, 896 (7th 2 The plaintiff in Bryant worked for a call center in Illinois. At that call center, in the workplace cafeteria, employees had to establish an account using their fingerprints to operate the vending machines as they would not accept cash. Bryant, 958 F.3d at 619. Plaintiff brought suit against the operator of this vending machine fingerprint collection system, Compass, arguing that Compass violated Sections 15(a) and 15(b) of BIPA. 3 The standing doctrine limits “the category of litigants empowered to maintain a lawsuit in federal court to seek redress for a legal wrong” to ensure the that the federal courts maintain an appropriate role in relation to the other branches of the government. Id., (citing Valley Forge Christian College v. Americans United for Separation of Church and State, Inc., 454 U.S. 464, 473 (1982)); Warth v. Seldin, 422 U.S. 490, 498-99 (1975). Cir. 2018); Lujan v. Def. of Wildlife, 504 U.S. 555, 560 (1992). See also Carroll v. Stryker Corp., 658 F.3d 675, 680 (7th Cir. 2011) To establish that a plaintiff has Article III standing, a defendant must demonstrate that plaintiff has alleged an injury-in-fact that was caused by defendant and is redressable by the court. Groshek v. Time Warner Cable, Inc., 865 F.3d 884, 886 (7th Cir. 2017). To qualify as an injury-in-fact, the alleged injury must be “concrete and particularized” and “actual and imminent and not conjectural or hypothetical.” Spokeo, 136 S.Ct. at 1548. To be concrete, the injury must be de facto, or actually exist. Id. A “bare procedural violation divorced from any concrete harm” does not qualify as an injury in fact. Id. at 1549. A procedural statutory violation may constitute an injury-in-fact on its own if the legislature has elevated a de facto injury that “was previously inadequate in law” to the “status of illegally cognizable injury.” Id. But a statutory violation causes a concrete injury for Article III standing only if it presents an “appreciable risk of harm to the underlying interest the [legislature] sought to protect by enacting the statute.” Groshek, 865 F.3d at 887. Until Bryant, BIPA cases removed to federal court were frequently remanded for lack of Article III standing when the plaintiff alleged violations of Sections 15(a) and (b) without alleging further harm.4 The courts found, in those cases, that the plaintiffs had 4 See Bryant, 958 F.3d at 623, citing cases including, but not limited to, Hunter v. Automated Health Sys., Inc., No: 19C2529, 2020 WL 833180 (N.D. Ill. Fed. 20, 2020); McGinnis v. United States Cold Storage, Inc., 382 F.Supp. 3d 813 (N.D. Ill. 2019); and Aguilar v. Rexnord LLC, No: 17CV9019, 2018 WL 3239715 (N.D. Ill. July 3, 2018). Many of these cases were also cited to by Plaintiff in her motion to remand. See generally Doc. 27. not pleaded a particularized, concrete harm and had simply alleged a procedural violation; therefore, they could not meet the Article III standing test. Bryant outlined that if the plaintiff could show that the statutory violation demonstrated an “appreciative risk of harm” to the statute’s underlying interest, as determined by the legislature, then Article III standing exists.5 Bryant, 958 F.3d at 621, citing Groshek, 865 F.3d at 887. Since the Bryant plaintiff brought both Section 15(a) and Section 15(b) claims, the Seventh Circuit analyzed both for Article III standing. Article III Standing under Section 15(b) of BIPA In its analysis of the Bryant plaintiff’s Section 15(b) BIPA claims, the Seventh Circuit found that “the injury inflicted by nondisclosure is concrete if the plaintiff establishes that the withholding impaired her ability to use the information in a way the statute envisioned.” Bryant, 958 F.3d at 624. By not abiding by the requirements of Section 15(b) before it collected the plaintiff’s biometric information, the Seventh Circuit found that the defendant deprived her of the ability to give the informed consent Section 15(b) 5 Federal courts must defer to a state supreme court's interpretation of its own statutes. Guaranty Bank v. Chubb Corp., 538 F.3d 587, 590 (7th Cir. 2008). The Illinois Supreme Court has held that BIPA “codified that individuals possess a right to privacy in and control over their biometric identifiers and biometric information.” Rosenbach v. Six Flags Entm't Corp., 129 N.E.3d 1197, 1206 (Ill. 2019)(emphasis added). Thus, allegations of collection and possession of purported biometric information in violation of the requirements of Sections 15(a) and (b) of BIPA, combined with an allegation of a loss of the right to control that information, constitute allegations of harm to the particular interests the statute was intended to protect - control over one’s biometric identifiers or biometric information. Even so, Bryant highlights that Article III standing is not a “perfect overlap,” as standing requirements in Illinois courts are more lenient than those in federal courts. Bryant, 958 F.3d at 622. See also Greer v. Illinois Hous. Dev. Auth., 524 N.E.2d 561 (Ill. 1988) (citations omitted). of BIPA mandates and envisioned by the legislature. Id. at 626. The Seventh Circuit held that these types of violations of Section 15(b) of BIPA meet the Article III standing test. To support its decision, the court examines how the Bryant plaintiff’s claims are similar to those brought in another case, Robertson v. Allied Solutions, 902 F.3d 690 (7th Cir. 2018), in which a company failed to provide a prospective employee with a copy of her background report, in violation of the Fair Credit Reporting Act, before rescinding her employment offer on the basis of information contained in that report. The Seventh Circuit held this omission constituted an injury-in-fact for Article III standing because she was wholly deprived of the information necessary to respond in the way FCRA contemplated. Bryant, 958 F.3d at 625-26. The Seventh Circuit contrasted this scenario with another case—Casillas v. Madison Avenue Associates, 926 F.3d 329 (7th Cir. 2019). Id. In Casillas, the court found there was purely a procedural flaw because no amount of notice or information would have changed the plaintiff’s behavior. Id. When applied to Bryant, the Seventh Circuit held that had the plaintiff known her information was being stored and had the defendant appropriately received her written consent ahead of storing her biometric information, she may have opted to not use the vending machine or bring her own snacks. Her behavior may have been changed by the defendant appropriately following Section 15(b); therefore, the harm was concrete for purposes of Article III standing. Id. Article III Standing under 15(a) of BIPA Alleged violations of Section 15(a) are different, however, because this section of BIPA does not outline an entity’s duty to an individual; rather, this section outlines a duty to the public generally. In Bryant, the Seventh Circuit emphasizes that 15(a) requires the holder of the biometric information to develop a written policy about the retention schedule and guidelines to destroying the information that is made available to the public. Bryant, 958 F.3d at 626. Because the plaintiff did not advance a particularized harm under Section 15(a), and because this provision is not part of the informed-consent regime analyzed above, the Seventh Circuit determined plaintiff lacked Article III standing for her Section 15(a) claims and those claims had to be remanded to state court. Id. It appears, though, that the Seventh Circuit left the door open for potential Section 15(a) Article III standing if the plaintiff advances a particularized harm under 15(a). Id. at 626- 627. In fact, courts prior to and after Bryant have found Article III standing for violations of Section 15(a), which requires a fact-specific analysis, focusing on the relationship of the parties and the nature of the pleadings. The Northern District of Illinois found that Section 15(a) creates an arguable individual right in the language that requires entities to destroy the biometric data once the purpose of the collection is satisfied or within three years after the last interaction with the relevant person. See Cothron v. White Castle System, Inc., No: 19 CV00382, 2020 WL 3250706 *3 (N.D. Ill. June 16, 2020). The Cothron Court did not examine this theory beyond this statement, though. Miller v. Southwest Airlines Co., a 2019 pre-Bryant case, makes it clear that there is Article III standing for both Section 15(a) and Section 15(b) BIPA claims when a plaintiff class brings a lawsuit against an employer and the company with control over the technology that collects and manages the biometric data when the plaintiffs are part of a union. 926 F.3d 898 (7th Cir. 2019). The rationale, here, is that not being able to negotiate workplace terms and issues related to Sections 15(a) and (b) is an injury for purposes of Article III standing. It is worth noting the Miller Court relied on the Railway Labor Act in addition to BIPA. Id. “The prospect of a material change in workers’ terms and conditions of employment gives these suits a concrete dimension that Spokeo…[and other cases] lacked.” Id. at 903. Article III Standing for Plaintiff Stauffer’s Claims Plaintiff brings both Section 15(a) and Section 15(b) claims against both Defendants Innovative Heights and Pathfinder. Although Defendant Innovative Heights has not filed anything in response to Plaintiff’s motion to remand, the Court must ensure that all parties and claims have standing before proceeding. Bryant makes fairly easy work of the analysis for Section 15(b) claims for the matter presently before the Court. Section 15(b) outlines that private entities must make certain disclosures to and receive informed consent from consumers before obtaining and storing their biometric information. Like in Bryant, Plaintiff alleges that both Defendants, essentially, “deprived her of the ability to give the informed consent section 15(b) mandates.” Bryant, 958 F.3d at 626. Plaintiff pleads that both Defendants never requested or received her consent before collecting her fingerprints and never informed her of the purpose of and circumstances surrounding the collection of her biometric information. Accordingly, like in Bryant, Plaintiff has Article III standing for both of her Section 15(b) claims against both Defendants . Analysis for standing under Section 15(a) is not as straight forward. When viewed in totality, the analysis for Article III standing under Section 15(a) seems to hinge more on the relationship of the parties since Section 15(a) covers a duty to the public as opposed to the individual. Section 15(a) dictates that private entities that collect biometric information must make available a data retention schedule and guidelines for permanently destroying collected biometric identifiers and information. While Bryant did not find that the plaintiff had Article III standing for her Section 15(a) claims, the court in Miller did. The court in Cothron entertained the idea of Article III standing for Section 15(a), but declined to address it further because plaintiff had pleaded facts demonstrating that no violation occurred. Here, the question is whether Plaintiff’s Section 15(a) pleadings against both Defendants describe more than a simple procedural violation. For Defendant Pathfinder, Plaintiff alleges that “[Pathfinder] did not make available to the public a written policy establishing a retention schedule and guidelines for permanently destroying any such fingerprints when the initial purpose for collecting such fingerprints has been satisfied” (Doc. 1-1, p. 100). Plaintiff has not included additional facts about how Defendant Pathfinder’s alleged violation of Section 15(a) injured her. Plaintiff has not enumerated how Defendant Pathfinder’s alleged Section 15(a) violation impacted her thinking or potentially changed her behavior. Her allegations seem to mirror the sparse allegations in Bryant; therefore, Plaintiff has not articulated an additional injury, beyond a violation of the statute, to satisfy the requirements for Article III standing of her Section 15(a) claims against Defendant Pathfinder. Plaintiff pleaded that Defendant Innovative Heights violated Section 15(a) by not having a published written policy for the retention of this biometric information. Defendant Innovative Heights’ failure to publish such a policy means that when “Plaintiff and Innovative Heights Class Members left or leave the employment of Innovative Heights, they were or are left unaware if and when their biometric identifiers would be destroyed” (Doc. 1-1, p. 99). Furthermore, if Innovative Heights were to be sold or go out of business, Plaintiff and Innovative Heights Class Members would be left unaware as to who is in possession of their biometric identifiers (Doc. 1-1, p.99). Bryant held that the defendant’s Section 15(a) requirement to make available a written retention and destruction policy was a harm to the public and not a particular harm to the plaintiff because of the plaintiff’s theory she invoked. Bryant, 958 F.3d at 626. In that case, the plaintiff was a consumer, as opposed to an employee of the entity she sued. After Bryant, in Cothron v. White Castle, an employee of White Castle brought suit against her employer for violations of Sections 15(a), 15(b), and 15(d) of BIPA after her employer collected her biometric information, specifically fingerprints, as part of their “clock-in, clock-out” timekeeping system. The court held that the second requirement of 15(a) “arguably creates an individual right to have personal data deleted,” but determined that the court need not address this novel issue because the plaintiff continued to work at White Castle with the same biometric collection process in place. Since she was still working at White Castle with this same system when she filed her lawsuit, the court determined that neither of Section 15(a)’s conditions requiring destruction of biometric data could be used to advance an Article III standing argument. Cothron, 2020 WL 3250706 at *3. The Cothron court determined that the second part of Section 15(a), which requires private entities in possession of biometric information to permanently destroy the information when the initial purpose has been satisfied or within three years of the individuals’ last interaction with the private entity (whichever comes first), may create an individualized right. See 740 ILCS 14/15(a). If there is a duty to the individual and not just the public, Article III standing is more likely. In the present matter, unlike Cothron, Plaintiff left her employment with Defendant Innovative Heights in May 2018, and Plaintiff alleged in her Complaint that when employees leave, they have no idea when and how their biometric information will be destroyed, if it will be destroyed at all (Doc. 1-1, p. 98). While Plaintiff has advanced some additional facts discussing the impact of Defendant Innovative Heights’ Section 15(a) violation, she has still not described a concrete and particularized harm for Article III standing. She has not described how the Section 15(a) violations have impacted her thinking or if those violations were the reason for her leaving, for example; rather, her description is more hypothetical and describes what could happen if one left employment while Defendant Innovative Heights still improperly retained their biometric information. The fact that Plaintiff has left employment is not enough if she has not pled how the alleged Section 15(a) violation impacted her. Accordingly, Plaintiff has Article III standing for her Section 15(b) claims against both Defendants Pathfinder and Innovative Heights. Plaintiff does not have Article III standing for her Section 15(a) claims against either Defendant. Plaintiff’s Section 15(a) claims against Defendant Pathfinder and Defendant Innovative Heights are remanded to the Twentieth Judicial Circuit, St. Clair County, Illinois. DEFENDANT PATHFINDER’S MOTION TO DISMISS In addition to Plaintiff’s motion to remand, the Court must address Defendant Pathfinder’s motion to dismiss (Doc. 23). A motion to dismiss under Rule 12(b)(6) addresses the legal sufficiency of the plaintiff’s claim for relief, not the merits of the case or whether the plaintiff will ultimately prevail. Camasta v. Jos. A. Bank Clothiers, Inc., 761 F.3d 732, 736 (7th Cir. 2014); Gibson v. City of Chicago, 910 F.2d 1510, 1520 (7th Cir. 1990). In reviewing a motion to dismiss, the court must construe the complaint in the light most favorable to the plaintiff, accept as true all well-pleaded facts, and draw all possible inferences in the plaintiff’s favor. E.g., Hecker v. Deere & Co., 556 F.3d 575, 580 (7th Cir. 2009) (citation omitted). The complaint will survive the motion to dismiss only if it alleges facts sufficient to “state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 556 (2007). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). A plaintiff does not need “detailed factual allegations,” but must plead more than “labels and conclusions” and “a formulaic recitation of the elements of a cause of action.” Twombly, 550 U.S. at 555. Determining whether a complaint plausibly states a claim for relief is a “context-specific task that requires the reviewing court to draw on its judicial experience and common sense.” Iqbal, 556 U.S. at 679. The structure outlined here for the complaint will ensure that the defendant receives “fair notice of what the ... claim is and the grounds upon which it rests.” Twombly, 550 U.S. at 1959. Defendant Pathfinder makes a series of five arguments in its motion to dismiss, arguing that Plaintiff has failed to plead sufficient facts for the case to survive beyond this early stage of litigation. Plaintiff opposes each of these arguments in her response to Defendant Pathfinder’s motion to dismiss (Doc. 23). I. BIPA is Special Legislation in Violation of the Illinois Constitution First, Pathfinder argues that BIPA is unconstitutional special legislation because it imposes strict compliance requirements on some employers, but then exempts “the entire financial industry” and state and local government contractors “arbitrarily,” so BIPA “should be struck down” as unconstitutional (Doc. 21, pp. 4-7). Plaintiff disagrees, arguing that Defendant Pathfinder has failed to cite to any precedent in which a court has declared BIPA as unconstitutional and that excluding financial institutions and government entities is not arbitrary because the exempt financial institutions are subject to a separate set of standards under the Gramm-Leach-Bliley Act of 1999 (“GLBA”), which has strict data protection standards (Doc. 23, pp. 11-15). Furthermore, Plaintiff argues that BIPA was enacted to regulate private companies, which is why government entities are exempt from the law (Id. at 12-13). The Illinois Constitution's Special Legislation Clause prohibits a “special or local law when a general law is or can be made applicable.” Ill. Const. 1970, art. IV, § 13. More specifically, it prohibits the General Assembly from conferring “a special benefit or privilege upon one person or group and excluding others that are similarly situated.” Crusius v. Illinois Gaming Board, 837 N.E.2d 88, 94 (Ill. 2005). The legislature has discretion to make statutory classifications; however, the special legislation clause prevents it from making classifications that arbitrarily discriminate in favor of a selected group. Id.; Big Sky Excavating, Inc. v. Illinois Bell Telephone Co., 840 N.E.2d 1174, 1183 (Ill. 2005). There is a two-part test to determine whether a law constitutes special legislation: (1) whether the statutory classification at issue discriminates in favor of a select group and against a similarly situated group; and (2) if the classification does so discriminate, whether the classification is arbitrary. Id. See also Protect our Parks, Inc. v. Chicago Park Dist., 385 F. Supp. 3d 662, 692 (N.D. Ill. 2019). Illinois courts use the rational basis test to determine whether the statutory classification is rationally related to a legitimate state interest. Piccioli v. Bd. Of Trustees of Teachers’ Ret. Sys., 137 N.E.3d 745, 751 (Ill. 2019). In this analysis, the court may “hypothesize reasons for the legislation…any conceivable basis for finding a rational relationship” will uphold the law in question. Id. See also People ex. rel. Lumpkin v. Cassidy, 703 N.E.2d 1, 5-9 (Ill. 1998). Defendant Pathfinder first argues that BIPA excludes “nearly the entire financial sector” and argues that a vast number of employers qualify as financial institutions and, therefore, are unregulated by BIPA since they fall into this exclusionary provision (Doc. 21, p. 5). Defendant Pathfinder’s argument is a bit hyperbolic. As Plaintiff argues, the financial institution exemption is for “financial institution[s] or an affiliate of a financial institution that [are] subject to Title V of the federal Gram-Leach Bliley Act of 1999” (Doc. 23, p. 12). See also 730 ILCS 14/25(c). The financial institution exemption is not for all financial institutions; rather, it is for those that are already covered by another law similar to BIPA that requires financial institutions to explain their information-gathering practices and how they safeguard sensitive data to their customers (Doc. 23, pp. 15-17). When the Court examines financial institutions subject to BIPA and those that are exempt under the two part test highlighted above, it is clear that they are similarly situated groups; however; it does not appear that BIPA differentiates between these two groups in a discriminatory fashion since both sets of financial institutions are subjected to stringent reporting requirements through either a state or federal law.6 Plaintiff also makes a compelling argument that the Illinois legislature may have, rationally, concluded that failing to exclude those financial institutions subjected to GLBA’s reporting standards risked federal preemption of BIPA (Doc. 23, p. 12). Courts have invalidated legislative classifications under the special legislation clause when they have an “artificially narrow focus” and are “designed primarily to confer a benefit on a particular private group without a reasonable basis, rather than to promote the general welfare.” Best v. Taylor Machine Works, 689 N.E.2d 1057, 1072 (Ill. 1997). The financial institution distinction made by BIPA cannot be found to be “artificially narrow” in its focus since both exempt and non-exempt financial institutions are subject to data reporting laws, with neither group receiving a benefit the other does not. Similarly, Defendant Pathfinder argues that exempting government employers from BIPA cannot survive rational basis scrutiny and “the arbitrariness of these carve- 6 Plaintiff includes a portion of the debate transcript from the Illinois House, detailing that some banks, covered under Federal Law, are exempt (Doc. 23, p. 12). outs should not be permitted to stand” (Doc. 21, p. 7). Plaintiff argues, rightfully, that the Illinois legislature enacted BIPA to regulate the private sector and argues that courts have previously upheld classifications differentiating between the government and private entities (Doc. 23, p. 13). Plaintiff mentions, and the Court finds it important to note, that BIPA was enacted in 2008, approximately twelve years ago, and there have been a number of BIPA cases both in federal and state court. Defendant Pathfinder did not cite to a single BIPA case to support its argument and while that is not dispositive of Defendant’s arguments alone, it is noteworthy that not a single other case has found BIPA to be unconstitutional in those twelve years. For purposes of a 12(b)(6) motion, Plaintiff has pled sufficient facts to conclude that BIPA is not special legislation and is, therefore, not unconstitutional. II. Defendant Pathfinder is Exempt from BIPA because it is Classified as a Financial Institution Second, Pathfinder argues that it should be classified as a financial institution in the aforementioned financial exemption and, therefore, Defendant Pathfinder is exempt from BIPA’s requirements (Doc. 21, pp. 7-9). Plaintiff argues that Defendant Pathfinder is not a financial institution as defined by BIPA and is not exempt (Doc. 23, pp. 8-10). Plaintiff elaborates that the financial institutions exempt from BIPA are exempt because they are subject to GLBA and are defined as “significantly engaged in financial activities,” which Plaintiff argues is not the case for Defendant Pathfinder (Doc. 23, p. 15). See 16 C.F.R. § 313.3(k)(1). In addition, Plaintiff highlights that Defendant Pathfinder has improperly relied on materials outside of the pleadings, specifically a declaration of Defendant Pathfinder’s Chief Financial Officer re-attached from the notice of removal (Doc. 1-2) to its motion to dismiss, to argue this point (Doc. 23, p. 16). Based on the pleadings, it seems doubtful that Defendant Pathfinder could be designated as a “financial institution” and, therefore, exempt from BIPA. BIPA’s financial institution exemption is explicit in that BIPA does not apply to financial institutions already subjected to GLBA. See 740 ILCS 14/25(c). The Federal Trade Commission describes the type of financial institutions that must comply with GLBA, which includes “all businesses, regardless of size, that are ‘significantly engaged’ in providing financial products or services. This includes, for example, check-cashing businesses, payday lenders, mortgage brokers, nonbank lenders, personal property or real estate appraisers, professional tax preparers, and courier services.”7 Defendant Pathfinder, on its website, describes itself as a “leader in the entertainment software industry,” and states that it “operate[s] as a processor of personal information for our customers, including via the Advantage Access Control App” (Doc. 1-1, p. 95). Defendant Pathfinder controls and/or runs the system and/or database in which Defendant Innovative Heights’ employees’ fingerprints are stored (Doc. 1-1, p. 93). Nowhere in the Complaint is Defendant Pathfinder described as a financial institution, mainly, that is engaged in any of the aforementioned activities that would subject it to GLBA, such as appraising real estate or preparing taxes. 7 See Federal Trade Commission, Gramm-Leach-Bliley Act, https://www.ftc.gov/tips-advice/business- center/guidance/financial-institutions-customer-information-complying (last accessed August 17, 2020). Defendant Pathfinder re-attaches a declaration it submitted with its notice of removal from the Chief Financial Officer, which Defendant Pathfinder alleges proves that Defendant Pathfinder is an exempt financial institution. This affidavit is not even appropriate for the Court’s consideration on a 12(b)(6) motion. Geinosky v. City of Chicago, 675 F.3d 743, 745 n.1 (7th Cir. 2012) (“A motion under Rule 12(b)(6) can be based only on the complaint itself, documents attached to the complaint, documents that are critical to the complaint and referred to in it, and information that is subject to proper judicial notice.”). And even if it was, the affidavit doesn’t move the needle as it does not indicate whether Defendant Pathfinder is subjected to the reporting requirements of GLBA; therefore, the Court cannot find that Defendant Pathfinder is exempt from BIPA (See generally Doc. 1-2). The Court finds that Plaintiff has sufficiently pled her claims against Defendant Pathfinder for purposes of a 12(b)(6) motion because at this time, the Court cannot find that Defendant Pathfinder is exempt from BIPA because it is a financial institution subjected to the reporting requirements of GLBA. III. Plaintiff’s Claims are Time-Barred by the Statute of Limitations Third, Defendant Pathfinder argues that Plaintiff’s complaint is time-barred since she did not bring the claim in the appropriate statute of limitations, which Defendant Pathfinder claims is one year (Doc. 21, pp. 9-10). Plaintiff argues that Defendant Pathfinder relies on the incorrect statute of limitations and that almost every other BIPA case has held that BIPA claims are subject to the five-year catchall statute of limitations (Doc. 23, p. 18). BIPA itself does not include a statute of limitations. Under Illinois law, “all civil actions not otherwise provided for, shall be commenced within five years next after the cause of action accrued.” 735 ILCS 5/13-205. To determine whether there is a more specifically applicable statute of limitations, Illinois courts analyze “the type of injury at issue, irrespective of the pleader’s designation of the nature of the action.” Travelers Cas. & Sur. Co. v. Bowman, 893 N.E.2d 583, 587 (Ill. 2008). “[G]eneral rules of statutory construction” govern this analysis. See Hernon v. E.W. Corrigan Const. Co., 595 N.E.2d 561, 562 (Ill. 1992). Defendant Pathfinder argues that BIPA violations like the ones alleged by Plaintiff are, essentially, related to invasion of privacy and traditional invasion of privacy claims have a one-year statute of limitations from the date the privacy right is invaded. 735 ILCS 5/13-201; see also Blair v. Nevada Landing P’ship, 859 N.E.2d 1188, 1192 (Ill. 2006). To further the argument, Defendant Pathfinder argues that the Rosenbach court determined that BIPA is fundamentally a privacy statute (Doc. 21, p. 9-10). Since Plaintiff did not file her original Complaint within one year of when she began using the clock-in, clock-out system at Defendant Innovative Heights, Defendant Pathfinder moves for dismissal since Plaintiff’s claims are not timely. Plaintiff contends this argument was dispelled by the one Illinois court to have addressed this issue in a published decision. See Robertson v. Hostmark Hospitality Group, Inc., 2019 WL 8640568, at *4 (Ill. Cir. Ct. 2019). In Robertson, the court held that the five- year statute of limitations applies to BIPA claims, which the Court finds persuasive because, as Plaintiff argues, a series of BIPA cases have found similarly.8 As the Court has previously noted, BIPA precedent is developing, and while many of the cases Plaintiff cites to are state-court decisions and non-binding on this Court’s decision, they are instructive for how state courts interpret this state law, particularly since the Court must apply “the law of Illinois as [it] believe[s] the Illinois Supreme Court would apply it” (Doc. 23, p. 20) See also Liberty Mut. Fire. Ins. Co. v. Statewide Ins. Co., 352 F.3d 1098, 1100 (7th Cir. 2003). Additionally, a “plaintiff is not required to plead elements in his or her complaint that overcome affirmative defenses, such as statute-of-limitations defenses.” NewSpin Sports, LLC v. Arrow Elecs., Inc., 910 F.3d 293, 299 (7th Cir. 2018). As long as the Court can “imagine” a scenario in which the claim is timely, it is improper to dismiss it on the pleadings. See U.S. Gypsum Co. v. Ind. Gas Co., Inc., 350 F.3d 623, 628 (7th Cir. 2003) (holding that the “right question” is not whether the plaintiff has alleged “facts that tend to defeat affirmative defenses,” but “whether it is possible to imagine proof of the critical facts consistent with the allegations in the complaint” that would fall within the period of limitations). Accordingly, Plaintiff has pled sufficient facts for purposes of a 12(b)(6) motion that her BIPA claims are timely. 8 Plaintiff lists a series of at least six post-Rosenbach decisions, also upholding that the five-year catch-all statute of limitations applies to BIPA cases, in her response to Defendant Pathfinder’s motion to dismiss. See Doc. 23, p. 19. IV. Plaintiff’s Claims are Barred by Waiver or Equitable Estoppel Fourth, Defendant Pathfinder argues that Plaintiff voluntarily waived her right to sue because Plaintiff implicitly consented to the collection of her fingerprints for the purpose of clocking in and out of work; accordingly, the doctrine of equitable estoppel applies and Plaintiff cannot bring BIPA claims now (Doc. 21, pp. 10-12). According to Defendant Pathfinder, Plaintiff remained silent and never complained while continuing to use the fingerprint collecting system throughout her course of employment with Defendant Innovative Heights, which “demonstrates that she voluntarily relinquished a known right” (Doc. 21, p. 12). Plaintiff argues that Defendant Pathfinder incorrectly conflated waiver and equitable estoppel, and that she is not barred from bringing her BIPA claims under either doctrine (Doc. 23, p. 22). Equitable estoppel and waiver are similar, but distinct doctrines. Lumbermen's Mut. Cas. Co. v. Sykes, 890 N.E.2d 1086, 1097 (Ill. 2008). “Waiver is commonly defined as ‘the intentional relinquishment of a known right.’” Hahn v. Cty. Of Kane, 991 N.E.2d 373, 378-379 (Ill. 2013). Equitable estoppel is “the effect of a person’s conduct ‘whereby the person is barred from asserting rights that might otherwise have existed against the other party who, in good faith, relied upon such conduct and has been thereby led to change his or her position for the worse.’” Id. In contrast to waiver, equitable estoppel “may arise even though there was no intention on the part of the party estopped to relinquish any existing right.” Vaughn v. Speaker, 533 N.E.2d 885, 890 (Ill. 1988). Additionally, unlike with waiver, the party claiming estoppel must act in order to complete the estoppel. Lumbermen's Mut. Cas. Co., 890 N.E.2d at 1097. “Questions of estoppel and waiver are left to the trier of fact where the material facts are in dispute or where reasonable people might draw different conclusions from the evidence.” Safeway Ins. Co. v. Ebijimi, 117 N.E.3d 1227, 1240 (Ill. 2018) (internal quotation marks and citation omitted). A. Equitable Estoppel “In order to raise a successful defense of equitable estoppel, the party claiming estoppel must show (1) the other party misrepresented or concealed material facts, (2) the other party knew, at the time the representations were made, that those representations were false, (3) the party claiming estoppel did not know of the falsity of the representations when they were made or when they were acted upon, (4) the other party intended or reasonably expected the representations to be acted upon by the party claiming estoppel, (5) the party claiming estoppel reasonably relied upon the representations in good faith to his detriment, and (6) the party claiming estoppel has been prejudiced by his reliance on the representations.” Ruiz v. Cal-Ful Condominium Ass’n, 144 N.E.3d 1229, 1234 (Ill. 2019). Defendant Pathfinder does not identify any material facts that Plaintiff has concealed or misrepresented. The Complaint alleges only that Defendant failed to provide the necessary disclosures and obtain the necessary consents before making Plaintiff use her fingerprints to clock in and out of work. Defendant does not attempt to explain how the elements of equitable estoppel have been satisfied, so the Court cannot find that Plaintiff is estopped from bringing her claims. B. Waiver Defendant also asserts a theory of waiver. “Individuals generally may waive substantive rules of law, statutory rights, and even constitutional rights enacted for their benefit,” if “the waiver is knowing, voluntary, and intentional.” In re Estate of Ferguson, 730 N.E.2d 1205, 1210 (Ill. 2000); See also RTP LLC v. Orix Real Estate Capital, Inc., No: 2013- CV-0350, 2014 WL 12696867 *1 (N.D. Ill. 2014). The Court cannot say, based on the pleadings and the minimal arguments provided by Defendant Pathfinder, that the only conclusion logically drawn from Plaintiff’s actions while employed at Defendant Innovative Heights is that she knowingly, voluntarily, and intentionally waived any right to bring a BIPA claim by continuing to scan her fingerprints at her place of work. In fact, Defendant Pathfinder has seemingly forgotten that Plaintiff did not know of Defendant Pathfinder’s involvement until filing her case in state court and starting discovery. To claim that she knowingly compromised her biometric information and continued to do so, thereby supporting a claim of either waiver or estoppel, in regards to Defendant Pathfinder is wholly unsupported by the pleadings. Further, practically speaking, if the Court were to conclude that based on the complaint, Plaintiff’s rights were estopped or waived, practically no BIPA cases could ever move forward, which is not the intention of BIPA’s enforcement provision. See 740 ILCS 14/20 . The Court therefore concludes that it would be inappropriate, at this early stage of the case, to dismiss Plaintiff’s claims due to either doctrine. V. Plaintiff has not Pled Sufficient Facts Related to Defendant’s Negligent or Reckless Violations Finally, Defendant Pathfinder argues that this case should be dismissed because Plaintiff has not pled sufficient facts to support her cause of action, specifically that she has not asserted that Defendant Pathfinder negligently, recklessly or intentionally violated BIPA, specifically 740 ILCS 14/20(1) (Doc. 21, pp. 12-14). Defendant argues that Plaintiff has not pled any facts relating to how Defendant Pathfinder collected her fingerprints or if that was done negligently. Plaintiff argues that she is not required to assert facts regarding Defendant Pathfinder’s negligent, reckless, or intentional actions to bring a BIPA cause of action (Doc. 23, pp. 26). Plaintiff is correct. It appears that Defendant Pathfinder mistakenly read and quoted the incorrect part of BIPA when making this argument in its motion to dismiss, as Plaintiff outlined (Doc. 23, pp. 25-27). BIPA provides for a private right of action for “[a]ny person aggrieved by a violation” of the statute. 740 ILCS § 14/20 (emphasis added). The Illinois Supreme Court has explained that “when a private entity fails to comply with one of Section 15’s requirements, that violation constitutes an invasion, impairment, or denial of the statutory rights of any person or customer whose biometric identifier or biometric information is subject to the breach.” Rosenbach, 129 N.E.3d at 1206. “The violation, in itself, is sufficient to support the individual’s or customer’s statutory cause of action.” Id. The “negligent” and “intentionally and recklessly” standards come into play when determining remedies, with negligent violations worth $1,000 in liquidated damages (or actual damages, if greater) and intentional or reckless violations worth $5,000 in liquidated damages (or actual damages, if greater). 740 ILCS § 14/20(1), (2). Additional remedies of attorneys’ fees, costs, and injunctive relief are also available, and the statutory language does not limit these remedies to only negligent, intentional, or reckless violations. Id. § 14/20(3), (4); see also Cothron, 2020 WL 3250706 at *5 (“[I]f the complaint plausibly pleads violations of Section 15(b) and Section 15(d)—which the Court finds that it does—then, even absent specific allegations about White Castle’s mental state with respect to each of those claims, it has stated a claim entitling Ms. Cothron to litigation expenses and injunctive relief under Section 20, whether or not she proves an entitlement to damages based on negligent, reckless, or intentional conduct.”). Plaintiff’s argument mirrors the analysis above. To allege a claim that Defendant Pathfinder violated BIPA, all she must do is allege that Defendant collected, captured, purchased, received, or obtained her fingerprints without complying with BIPA’s requirements (Doc. 23, p. 26). As Plaintiff explained, and as other courts have outlined, the references to negligent, reckless, and intentional violations only relate to what the prevailing party may recover for each violation, which is not before the Court presently. Id. Accordingly, for purposes of a 12(b)(6) motion, Plaintiff has pled sufficient facts to state a cause of action against Defendant Pathfinder. CONCLUSION For the aforementioned reasons, Plaintiff Stauffer’s motion to remand is DENIED in part and GRANTED in part. The Court retains jurisdiction over Plaintiff’s BIPA Section 15(b) claims as they pertain to both Defendants Innovative Heights and Pathfinder. The Court REMANDS Plaintiff’s BIPA Section 15(a) claims as they pertain to Defendants Pathfinder and Innovative Heights to the Twentieth Judicial Circuit, St. Clair County, Illinois as this Court does not have jurisdiction over those claims. Defendant Pathfinder’s motion to dismiss is DENIED. IT IS SO ORDERED. DATED: August 19, 2020 s/ Mark A. Beatty MARK A. BEATTY United States Magistrate Judge