Figueroa v. Kronos Inc.

• Citation: 454 F.Supp.3d 772
• Decision Date: 13 April 2020
• Docket Number: 19 C 1306
• Parties: Charlene FIGUEROA and Jermaine Burton, individually and on behalf of all others similarly situated, Plaintiffs, v. KRONOS INCORPORATED, Defendant.
• Court: U.S. District Court — Northern District of Illinois

454 F.Supp.3d 772

Charlene FIGUEROA and Jermaine Burton, individually and on behalf of all others similarly situated, Plaintiffs,

v.KRONOS INCORPORATED, Defendant.

19 C 1306

United States District Court, N.D. Illinois, Eastern Division.

Signed April 13, 2020

David J. Fish, Kimberly A. Hilton, John C. Kunze, The Fish Law Firm, P.C., Naperville, IL, James B. Zouras, Andrew C. Ficzko, Haley Renee Jenkins, Ryan F. Stephan, Stephan Zouras, LLP, Jay Edelson, Benjamin Harris Richman, J. Eli Wade Scott, Edelson PC, Chicago, IL, for Plaintiffs.

Quatisha Marshall, pro se.

Art Arcangelo, pro se.

Melissa Anne Siebert, Erin Bolan Hines, Ian MacAulay Hansen, Shook, Hardy & Bacon L.L.P., Debra Rae Bernard, Perkins Coie LLP, Chicago, IL, for Defendant.

MEMORANDUM OPINION AND ORDER

Gary Feinerman, United States District Judge

Charlene Figueroa and Jermaine Burton brought this putative class action in the Circuit Court of Cook County, Illinois, against Kronos, Inc., alleging violations of the Illinois Biometric Information Privacy Act ("BIPA"), 740 ILCS 14/1 et seq. Doc. 1-1. Kronos timely removed the suit under 28 U.S.C. § 1453(b), premising jurisdiction on the Class Action Fairness Act, 28 U.S.C. § 1332(d). Doc. 1. Kronos moves under Civil Rule 12(b)(6) to dismiss the complaint, Doc. 29, and, in the alternative, under Civil Rule 23(c)(1)(A) to strike its class allegations, Doc. 32. Both motions are denied, though the court orders supplemental briefing regarding Plaintiffs’ standing to pursue their claim under Section 15(a) of BIPA, 740 ILCS 14/15(a).

Background

In resolving a Rule 12(b)(6) motion, the court assumes the truth of the operative complaint's well-pleaded factual allegations, though not its legal conclusions. See Zahn v. N. Am. Power & Gas, LLC , 815 F.3d 1082, 1087 (7th Cir. 2016). The court must also consider "documents attached to the complaint, documents that are critical to the complaint and referred to in it, and information that is subject to proper judicial notice," along with additional facts set forth in Plaintiffs’ brief opposing dismissal, so long as those additional facts "are consistent with the pleadings." Phillips v. Prudential Ins. Co. of Am. , 714 F.3d 1017, 1020 (7th Cir. 2013) (internal quotation marks omitted). The facts are set forth as favorably to Plaintiffs as those materials allow. See Pierce v. Zoetis, Inc. , 818 F.3d 274, 277 (7th Cir. 2016). In setting forth the facts at the pleading stage, the court does not vouch for their accuracy. See Goldberg v. United States , 881 F.3d 529, 531 (7th Cir. 2018).

Kronos is a provider of human resource management software and services. Doc. 1-1 at ¶ 1. As part of its business, Kronos provides timekeeping systems to thousands of employers in Illinois. Ibid. Those systems include biometric-based time clocks, which require employees to use their biometric information to punch in and out of work. Id. at ¶ 2.

When beginning work for an employer that uses a Kronos biometric timekeeping device, an employee must have her fingerprint or palm print scanned to enroll in the Kronos database. Id. at ¶ 25. Kronos does not inform those employees that it is collecting, storing, or using their biometric data. Id. at ¶¶ 26-27. Nor does Kronos inform them of the purposes for collecting their data or to whom the data is or will be disclosed. Ibid. Kronos does not maintain retention schedules or guidelines for permanently destroying the data. Id. at ¶¶ 28, 32. Kronos has not destroyed biometric data when the initial purpose for obtaining it has been satisfied or within three years of an employee's last interaction with her employer. Id. at ¶ 32. Employees are not told whether and to whom Kronos discloses their data or what would happen to the data in the event of a Kronos merger or bankruptcy. Id. at ¶ 33.

Figueroa worked as an hourly employee at Tony's Finer Food Enterprises Inc. from March 2017 through September 2018. Id. at ¶ 35. Burton worked for BWAY from January 2017 through April 2017. Id. at ¶ 49. Both were required, as a condition of their employment, to scan their fingerprints using a Kronos device to track their time. Id. at ¶¶ 35, 49. Both scanned their fingerprints when clocking in or out of work, id. at ¶¶ 37, 51, and Figueroa did so when clocking in and out for lunch, id. at ¶ 38.

Kronos stored Plaintiffs’ fingerprint data in its database or databases. Id. at ¶¶ 36, 50. At no point were Plaintiffs informed of the purposes or length of time for which Kronos was collecting, storing, using, or disseminating their data. Id. at ¶¶ 39, 52, 80. Nor were Plaintiffs informed of any biometric data retention policy developed by Kronos or whether it would ever permanently delete their data. Id. at ¶¶ 40, 53, 81. That is because Kronos lacked such a policy when Plaintiffs were hired, id. at ¶¶ 28, 81, which means that it failed to adhere to or publish such a policy at that time, id. at ¶¶ 73-74—though "years later" it implemented and published a policy, "long after being sued in other BIPA actions," Doc. 50 at 14-15.

At no point did Plaintiffs receive or sign a release allowing Kronos to collect, store, use, or disseminate their biometric data. Doc. 1-1 at ¶¶ 41, 54. Nonetheless, Kronos disseminated their data to other firms, including firms hosting the data in data centers. Id. at ¶¶ 45, 79. Plaintiffs would not have provided their data to Kronos had they known it would retain the data for an indefinite time period without their consent. Id. at ¶¶ 43, 56.

Discussion

BIPA "regulat[es] the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information." 740 ILCS 14/5(g). "Biometric identifier" is defined to include a "fingerprint." 740 ILCS 14/10. A biometric identifier is particularly sensitive because, unlike a social security number, it cannot be "changed," which means that "once [it is] compromised, the individual has no recourse[ and] is at heightened risk for identity theft." 740 ILCS 14/5(c). Recognizing this concern, Illinois adopted BIPA to protect the privacy of biometric data. See Rosenbach v. Six Flags Entm't Corp. , 432 Ill.Dec. 654, 129 N.E.3d 1197, 1206-07 (Ill. 2019).

The complaint alleges violations of Sections 15(a), 15(b), and 15(d) of BIPA. Section 15(a) requires private entities that possess biometric data to develop and publish a written policy that includes a retention schedule and destruction guidelines. 740 ILCS 14/15(a). Section 15(b) provides that, in order to collect a person's biometric data, a private entity must first (1) inform the person that the data is being collected or stored; (2) inform the person of the "specific purpose and length of term" for which the data is being collected, stored, and used; and (3) receive a written release from the person. 740 ILCS 14/15(b). Section 15(d) provides that, in order to disclose or otherwise disseminate a person's biometric data, a private entity must, absent exceptions inapplicable here, obtain the person's consent. 740 ILCS 14/15(d). BIPA allows a private right of action by "[a]ny person aggrieved by a violation." 740 ILCS 14/20.

I. Plaintiffs’ Standing

Where, as here, a case is removed from state court, "[i]f at any time before final judgment it appears that the district court lacks subject matter jurisdiction, the case shall be remanded." 28 U.S.C. § 1447(c). Although no party raises a jurisdictional issue, the court has an independent responsibility to ensure that it has subject matter jurisdiction. See Carroll v. Stryker Corp. , 658 F.3d 675, 680 (7th Cir. 2011). The issue is close enough to warrant discussion.

A federal court has subject matter jurisdiction only if the plaintiff has Article III standing. See MAO-MSO Recovery II, LLC v. State Farm Mut. Auto. Ins. Co. , 935 F.3d 573, 581 (7th Cir. 2019). "[T]he irreducible constitutional minimum of standing consists of three elements. The plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo, Inc. v. Robins , ––– U.S. ––––, 136 S. Ct. 1540, 1547, 194 L.Ed.2d 635 (2016) (citation and internal quotation marks omitted). "To establish injury in fact, a plaintiff must show that he or she suffered an invasion of a legally protected interest that is concrete and particularized and actual or imminent, not conjectural or hypothetical." Id. at 1548 (internal quotation marks omitted).

To be concrete, a plaintiff's injury "must be de facto; that is, it must actually exist," meaning that it must be "real" and not "abstract." Id. at 1548 (internal quotation marks omitted). Both "tangible" and "intangible" injuries, even those that are "difficult to prove or measure," can be concrete. Id. at 1549. Concreteness requires at least some "appreciable risk of harm" to the plaintiff. Meyers v. Nicolet Rest. of De Pere, LLC , 843 F.3d 724, 727 (7th Cir. 2016) ; see also Spokeo , 136 S. Ct. at 1550 (holding that an injury is not concrete where the defendant's conduct does not "cause harm or present any material risk of harm"); Gubala v. Time Warner Cable, Inc. , 846 F.3d 909, 911 (7th Cir. 2017) (holding that the plaintiff lacked standing where he identified no "plausible (even if attenuated) risk of harm to himself").

As the Seventh Circuit explained in Robertson v. Allied Solutions, LLC , 902 F.3d 690 (7th Cir. 2018), a defendant's "withholding information when a statute requires its publication" inflicts an "informational injury." 902 F.3d at 694. "An informational injury is concrete" for standing purposes "if the plaintiff establishes that concealing information impaired her ability to use it for a substantive purpose that the statute envisioned." Ibid. While a failure to disclose "substantive information" "harm[s] the concrete interest that the [relevant] statute protect[s]," whether the failure to disclose information that merely "give[s] notice of" the plaintiff's...