Cothron v. White Castle Sys., Inc.

• Decision Date: 16 June 2020
• Docket Number: No. 19 CV 00382,19 CV 00382
• Parties: Latrina COTHRON, Individually and on behalf of similarly situated individuals, Plaintiff, v. WHITE CASTLE SYSTEM, INC. d/b/a White Castle, Defendant.
• Court: U.S. District Court — Northern District of Illinois

467 F.Supp.3d 604

Latrina COTHRON, Individually and on behalf of similarly situated individuals, Plaintiff,

v.WHITE CASTLE SYSTEM, INC. d/b/a White Castle, Defendant.

No. 19 CV 00382

United States District Court, N.D. Illinois, Eastern Division.

Signed June 16, 2020

Andrew C. Ficzko, James B. Zouras, Ryan F. Stephan, Stephan Zouras, LLP, Chicago, IL, for Plaintiff.

Alexander M. Misakian, Kenneth Daniel Walsh, Mary A. Smigielski, Lewis Brisbois Bisgaard & Smith LLP, Benjamin Sedrish, Erin Bolan Hines, Melissa Anne Siebert, Shook, Hardy & Bacon L.L.P., Chicago, IL, Melissa Dunlap Palmisciano, White Castle System, Inc., Columbus, OH, for Defendant.

MEMORANDUM OPINION AND ORDER

John J. Tharp, Jr., United States District Judge

The present case is one of many recent suits concerning Illinois’ Biometric Information Privacy Act (BIPA). Plaintiff Latrina Cothron brings suit against her employer, White Castle System, Inc. ("White Castle"), alleging violations of BIPA Section 15(a), Section 15(b), and Section 15(d). White Castle has moved to dismiss Ms. Cothron's claims under Rule 12(b)(6). Because the Court finds that Ms. Cothron lacks standing to pursue her Section 15(a) claim, that claim is dismissed without prejudice. Ms. Cothron has, however, adequately alleged violations of Section 15(b) and Section 15(d) and White Castle's motion to dismiss those claims is therefore denied.

BACKGROUND¹

Latrina Cothron began working for White Castle in 2004 and is still employed by the restaurant-chain as a manager. Sec. Am. Compl. ¶ 39, ECF No. 44. Roughly three years after Ms. Cothron was hired, White Castle introduced a fingerprint-based computer system that required Cothron, as a condition of continued employment, to scan and register her fingerprint in order "to access the computer as a manager and access her paystubs as an hourly employee." Id. ¶ 40. According to Ms. Cothron, White Castle's system involved transferring the fingerprints to two third-party vendors—Cross Match and Digital Persona—as well as storing the fingerprints at other separately owned and operated data-storage facilities. Id. ¶¶ 28-31. Perhaps unsurprisingly—given that the Illinois Biometric Information Privacy Act ("BIPA") did not exist yet—White Castle did not receive a written release from Ms. Cothron to collect her fingerprints or to transfer them to third parties before implementing the system. Id. ¶ 41. White Castle also did not provide Ms. Cothron with information regarding the purpose of collection or the length of storage and did not make its data retention policy publicly available. Id.

When the Illinois legislature passed BIPA in mid-2008, the legal landscape changed but White Castle's practices did not—at least not for roughly ten years. Id. ¶¶ 27-28. White Castle continued to use its fingerprint system in the years following BIPA's passage and continued to disseminate that data to the same third parties. Id. ¶¶ 28-31. It was not until October 2018 that White Castle provided Ms. Cothron with a consent form. Id. ¶ 45. Similarly, White Castle did not post a publicly available retention schedule and guidelines for destroying fingerprint data until near the end of 2018. Id. ¶ 48; see also Resp. Mot. Dismiss 7, ECF No. 60.

DISCUSSION

BIPA "imposes numerous restrictions on how private entities collect, retain, disclose and destroy biometric identifiers"—a category that includes fingerprints. Rosenbach v. Six Flags Entm't Corp. , 432 Ill. Dec. 654, 656, 129 N.E.3d 1197, 1199 (Ill. 2019) ; see also 740 ILCS 14/10 (" ‘Biometric identifier’ means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry."). Ms. Cothron has alleged that White Castle violated the restrictions contained in Section 15(a), Section 15(b), and Section 15(d) of BIPA. Section 15(a) requires that a private entity "in possession of" biometric data (1) develop a written, publicly available policy that includes a retention schedule and destruction guidelines and (2) permanently destroy data upon the satisfaction of the "initial purpose for collecting or obtaining" it or "within 3 years" of the entity's last interaction with the person, whichever comes first. 740 ILCS 14/15(a). Section 15(b) provides that, prior to collecting biometric data, entities must first (1) inform the person in writing that the information is being collected or stored; (2) state the "specific purpose and length of term for which" the data "is being collected, stored, and used"; and (3) receive a written release from the person. 740 ILCS 14/15(b). Finally, Section 15(d) states that entities in possession of biometric data may only disclose or "otherwise disseminate" a person's data upon obtaining the person's consent or in limited other circumstances inapplicable here. 740 ILCS 14/15(d). BIPA creates a private right of action for "[a]ny person aggrieved by a violation." 740 ILCS 14/20.

I. Standing

Even when the parties do not raise the issue of subject-matter jurisdiction, the Court must "satisfy [itself] that jurisdiction is secure." See Carroll v. Stryker Corp. , 658 F.3d 675, 680 (7th Cir. 2011). In light of the Seventh Circuit's recent holding in Bryant v. Compass Group USA, Inc. , the jurisdictional prerequisite in question is Article III standing. 958 F.3d 617 (7th Cir. 2020). For Cothron to have Article III standing to advance each of her BIPA claims, three requirements must be satisfied as to each: "(1) she must have suffered an actual or imminent, concrete and particularized injury-in-fact; (2) there must be a causal connection between her injury and the conduct complained of; and (3) there must be a likelihood that this injury will be redressed by a favorable decision." Id. at 620-21 (citing Lujan v. Defs. of Wildlife , 504 U.S. 555, 560-61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) ). "Only the first of those criteria is at issue here: any injury [Cothron] suffered was caused directly by [White Castle's] failure to comply with BIPA, and the prospect of statutory damages shows that such an injury is redressable." Id. at 621. To be particularized, the injury "must affect the plaintiff in a personal and individual way." Lujan , 504 U.S. at 561 n.1, 112 S.Ct. 2130. To be concrete, the injury "must actually exist but need not be tangible." Bryant , 958 F.3d at 621. A legislature may "elevate to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law." Spokeo, Inc. v. Robins , ––– U.S. ––––, 136 S. Ct. 1540, 1549, 194 L.Ed.2d 635 (2016). But this legislative power is not without limits: even if contrary to statute, "a bare procedural violation, divorced from any concrete harm" will not "satisfy the injury-in-fact requirement." Id. "Instead, the plaintiff must show that the statutory violation presented an ‘appreciable risk of harm’ to the underlying concrete interest that [the legislature] sought to protect by enacting the statute." Groshek v. Time Warner Cable, Inc. , 865 F.3d 884, 887 (7th Cir. 2017).

As relevant here, many statutes create a right to receive information and therefore give rise to "informational injuries" potentially cognizable under Article III. Bryant , 958 F.3d at 624. The Seventh Circuit has distinguished between concrete informational injuries—where the alleged violation deprives a person of substantive information that could plausibly alter future decision-making, see Robertson v. Allied Solutions, LLC , 902 F.3d 690 (7th Cir. 2018) —and bare procedural ones—where the alleged violation goes only to the form of the information provided, Groshek , 865 F.3d 884, or where the information would not impact future decision-making, Casillas v. Madison Avenue Associates , 926 F.3d 329 (7th Cir. 2019). See also Bryant , 958 F.3d at 625-26 (discussing these cases and drawing this distinction).

In Bryant , the Seventh Circuit found that the alleged violations of Section 15(b) satisfied the injury-in-fact requirement, but the alleged violations of Section 15(a) were insufficiently particularized. See id. at 626. In that case, the biometric data collector was a workplace cafeteria vending machine that "did not accept cash; instead, a user had to establish an account using her fingerprint." Id. at 619. In assessing the Section 15(b) claim, the court reasoned that "the informed-consent regime laid out in section 15(b) is the heart of BIPA" and that "its purpose is to ensure that consumers understand, before providing their biometric data, how that information will be used, who will have access to it, and for how long it will be retained." Id. at 626. A failure to adhere to that regime inflicted a concrete injury because the relevant information was "substantive and personal" and, "[e]quipped with the missing information," a person might opt to forgo use of the relevant information-collecting device. Id. By contrast, the claim under Section 15(a) was "a separate matter" because Section 15(a) is not part of the informed-consent regime: "the duty to disclose under section 15(a) is owed to the public generally, not to particular persons whose biometric information the entity collects." Id. As a result, even if the missing information were substantive and could have informed future action, Bryant had not alleged a "particularized harm that resulted from [ ] violation of section 15(a)." Id.²

The facts of the present case differ from those at issue in Bryant , but the bottom-line standing analysis does not. The assessment of Ms. Cothron's standing to pursue her Section 15(b) claim follows most directly from Bryant . Ms. Cothron's alleged Section 15(b) injury is concrete and particularized for the reasons summarized above: White Castle failed to provide her with substantive, personal information about the collection, storage, and use of her fingerprint data and, armed with this information, Ms. Cothron may well have chosen to forgo the automated system. The Section 15(a) analysis, on the other hand, requires traversing some new...