Jones v. Microsoft Corp.

• Decision Date: 09 January 2023
• Docket Number: 22-cv-3437
• Parties: NATASHA R. JONES, Plaintiff, v. MICROSOFT CORPORATION, Defendant.
• Court: U.S. District Court — Northern District of Illinois

NATASHA R. JONES, Plaintiff,
v.
MICROSOFT CORPORATION, Defendant.

No. 22-cv-3437

United States District Court, N.D. Illinois, Eastern Division

January 9, 2023

MEMORANDUM OPINION AND ORDER

HON. JORGE ALONSO United States District Judge

Plaintiff Natasha Jones filed a complaint alleging that Defendant Microsoft Corp. violated the Illinois Biometric Information Privacy Act (“BIPA”). Jones initially filed her lawsuit in the Circuit Court of Cook County, Illinois, but Microsoft removed it based on diversity jurisdiction and the Class Action Fairness Act, 28 U.S.C. § 1332(d). See [1]. Microsoft now moves to dismiss counts II and IV of Jones's complaint under Federal Rule of Civil Procedure 12(b)(6). Jones also filed a motion to remand counts I and III back to the Circuit Court of Cook County. For the reasons below, the Court grants Jones's motion [13] and remands Counts I and III to the Circuit Court of Cook County. The Court also grants Microsoft's motion to dismiss [15] counts II and IV.

Background

The Court recounts the following facts from Jones's complaint. Microsoft provides a service called Azure, a cloud computing and storage platform. Cloud computing services, like Azure, allow users to store and access data through the internet rather than storing it locally.

1

Jones began working for Chicago Marriott Suites in October of 2015 and worked there for six years. During her employment, Chicago Marriot required its employees to register and scan their fingerprint for timekeeping purposes each time they clocked-in and out at work. To accomplish this, Chicago Marriot hired Paychex, a prominent biometric timekeeping provider in Illinois, to collect and store its employee's biometric data. Paychex hosts a variety of cloudbased apps supported by and stored on Microsoft's Azure platform.

Plaintiff alleges that even though Paychex uploaded her and others' biometric information onto the Azure platform, Microsoft never provided her with, nor did she ever sign, a release acknowledging that it could collect, store, use, or disseminate her biometric data. Nor did Microsoft publish any policies addressing retention or destruction schedules for this data.

Discussion

BIPA imposes certain restrictions on how “private entit[ies]” may collect, retain, use, disclose, and destroy “biometric identifiers” and “biometric information.” See 740 ILCS 14/15. “Biometric identifier” generally means “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry,” apart from various exclusions. 740 ILCS 14/10. “Biometric information” refers to “any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual,” except for information derived from “items or procedures excluded under the definition of biometric identifiers.” Id.

BIPA requires that, before collecting or obtaining an individual's biometric identifiers or information, a private entity must inform the individual in writing that it is collecting his data, 740 ILCS 14/15(b)(1); state the specific purpose of collecting or using the data, 740 ILCS 14/15(b)(2); and state the length of time for which it will collect, store, and use the data, id. The

2

entity must also get a signed “written release” from the individual before collecting their biometric data. 740 ILCS 14/15(b)(3). In addition, the entity must make publicly available the “retention schedule and guidelines” it uses for permanently destroying the biometric identifiers and information it collects. 740 ILCS 14/15(a).

BIPA further prohibits private entities from selling, leasing, trading, or otherwise profiting from a person's or customer's biometric identifier or information. 740 ILC 14/15(c). Lastly, BIPA prevents private entities from disclosing, redisclosing, or otherwise disseminating a person's or customer's biometric identifiers or information absent consent, a requirement by federal, state, or local law, or in accordance with a valid subpoena. 740 ILCS 14/15(d).

Here, Jones alleges violation of four BIPA provisions: 740 ILCS 14/15(a), (b), (c), and (d). After Microsoft removed this case to federal court, Jones filed a motion to remand her §15(a) and (c) claims. Microsoft stipulated to the remand of those claims but seeks to dismiss the other claims. The Court addresses each motion in turn.

I. Motion to Remand

Jones argues she lacks Article III standing to pursue her §15(a) or §15(c) BIPA claims in federal court. The party invoking federal jurisdiction, which in this case is Microsoft as the removing party, bears the burden of establishing Article III standing. Collier v. SP Plus Corp., 889 F.3d 894, 896 (7th Cir. 2018). To establish Article III standing, the complaint must allege three things: (1) the plaintiff suffered a concrete and particularized injury-in-fact; (2) a causal connection between the plaintiff's injury and the defendant's conduct; and (3) a favorable judicial decision is likely to redress the injury. Fox v. Dakkota Integrated Systems, LLC, 980 F.3d 1146, 1153 (7th Cir. 2020).

3

Microsoft, rather than respond to Jones's substantive arguments, stipulates to severance and remand of the §15(a) and (c) claims. The Court agrees with the parties that Jones's allegations do not satisfy the requirements of the standing doctrine for those claims, see Bryant v. Compass Group, USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020), Thornley v. Clearview AI, Inc., 984. F.3d 1241, 1247 (7th Cir. 2021), and, in the absence of any argument to the contrary, the Court grants the motion to remand. The Court severs counts I and III of the complaint and remands those counts to the Circuit Court of Cook County.

II. Motion to Dismiss

“A motion under Rule 12(b)(6) tests whether the complaint states a claim on which relief may be granted.” Richards v. Mitcheff, 696 F.3d 635, 637 (7th Cir. 2012). Under Rule 8(a)(2), a complaint must include “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed.R.Civ.P. 8(a)(2). This short and plain statement must “give the defendant fair notice of what the claim is and the grounds upon which it rests.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (internal quotation marks and alteration marks omitted). Under federal notice-pleading standards, “a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.'” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 570). “In reviewing the sufficiency of a complaint under the plausibility standard, [courts must] accept the well-pleaded facts in the complaint as true, but [they] ‘need[] not accept as true legal conclusions, or threadbare recitals of the elements of a cause of action, supported by mere conclusory statements.'” Alam v. Miller Brewing Co., 709 F.3d 662, 665-66 (7th Cir. 2013) (quoting Brooks v. Ross, 578 F.3d...