Jones v. Microsoft Corp.
| Decision Date | 09 January 2023 |
| Docket Number | 22-cv-3437 |
| Parties | NATASHA R. JONES, Plaintiff, v. MICROSOFT CORPORATION, Defendant. |
| Court | U.S. District Court — Northern District of Illinois |
Plaintiff Natasha Jones filed a complaint alleging that Defendant Microsoft Corp. violated the Illinois Biometric Information Privacy Act (“BIPA”). Jones initially filed her lawsuit in the Circuit Court of Cook County, Illinois, but Microsoft removed it based on diversity jurisdiction and the Class Action Fairness Act, 28 U.S.C. § 1332(d). See [1]. Microsoft now moves to dismiss counts II and IV of Jones's complaint under Federal Rule of Civil Procedure 12(b)(6). Jones also filed a motion to remand counts I and III back to the Circuit Court of Cook County. For the reasons below, the Court grants Jones's motion [13] and remands Counts I and III to the Circuit Court of Cook County. The Court also grants Microsoft's motion to dismiss [15] counts II and IV.
The Court recounts the following facts from Jones's complaint. Microsoft provides a service called Azure, a cloud computing and storage platform. Cloud computing services like Azure, allow users to store and access data through the internet rather than storing it locally.
Jones began working for Chicago Marriott Suites in October of 2015 and worked there for six years. During her employment Chicago Marriot required its employees to register and scan their fingerprint for timekeeping purposes each time they clocked-in and out at work. To accomplish this, Chicago Marriot hired Paychex, a prominent biometric timekeeping provider in Illinois, to collect and store its employee's biometric data. Paychex hosts a variety of cloudbased apps supported by and stored on Microsoft's Azure platform.
Plaintiff alleges that even though Paychex uploaded her and others' biometric information onto the Azure platform, Microsoft never provided her with, nor did she ever sign, a release acknowledging that it could collect, store, use, or disseminate her biometric data. Nor did Microsoft publish any policies addressing retention or destruction schedules for this data.
BIPA imposes certain restrictions on how “private entit[ies]” may collect, retain, use, disclose, and destroy “biometric identifiers” and “biometric information.” See 740 ILCS 14/15. “Biometric identifier” generally means “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry,” apart from various exclusions. 740 ILCS 14/10. “Biometric information” refers to “any information regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual,” except for information derived from “items or procedures excluded under the definition of biometric identifiers.” Id.
BIPA requires that, before collecting or obtaining an individual's biometric identifiers or information, a private entity must inform the individual in writing that it is collecting his data, 740 ILCS 14/15(b)(1); state the specific purpose of collecting or using the data, 740 ILCS 14/15(b)(2); and state the length of time for which it will collect, store, and use the data, id. The entity must also get a signed “written release” from the individual before collecting their biometric data. 740 ILCS 14/15(b)(3). In addition, the entity must make publicly available the “retention schedule and guidelines” it uses for permanently destroying the biometric identifiers and information it collects. 740 ILCS 14/15(a).
BIPA further prohibits private entities from selling, leasing, trading, or otherwise profiting from a person's or customer's biometric identifier or information. 740 ILC 14/15(c). Lastly, BIPA prevents private entities from disclosing, redisclosing, or otherwise disseminating a person's or customer's biometric identifiers or information absent consent, a requirement by federal, state, or local law, or in accordance with a valid subpoena. 740 ILCS 14/15(d).
Here, Jones alleges violation of four BIPA provisions: 740 ILCS 14/15(a), (b), (c), and (d). After Microsoft removed this case to federal court, Jones filed a motion to remand her §15(a) and (c) claims. Microsoft stipulated to the remand of those claims but seeks to dismiss the other claims. The Court addresses each motion in turn.
Jones argues she lacks Article III standing to pursue her §15(a) or §15(c) BIPA claims in federal court. The party invoking federal jurisdiction, which in this case is Microsoft as the removing party, bears the burden of establishing Article III standing. Collier v. SP Plus Corp., 889 F.3d 894, 896 (7th Cir. 2018). To establish Article III standing, the complaint must allege three things: (1) the plaintiff suffered a concrete and particularized injury-in-fact; (2) a causal connection between the plaintiff's injury and the defendant's conduct; and (3) a favorable judicial decision is likely to redress the injury. Fox v. Dakkota Integrated Systems, LLC, 980 F.3d 1146, 1153 (7th Cir. 2020).
Microsoft, rather than respond to Jones's substantive arguments, stipulates to severance and remand of the §15(a) and (c) claims. The Court agrees with the parties that Jones's allegations do not satisfy the requirements of the standing doctrine for those claims, see Bryant v. Compass Group, USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020), Thornley v. Clearview AI, Inc., 984. F.3d 1241, 1247 (7th Cir. 2021), and, in the absence of any argument to the contrary, the Court grants the motion to remand. The Court severs counts I and III of the complaint and remands those counts to the Circuit Court of Cook County.
“A motion under Rule 12(b)(6) tests whether the complaint states a claim on which relief may be granted.” Richards v. Mitcheff, 696 F.3d 635, 637 (7th Cir. 2012). Under Rule 8(a)(2), a complaint must include “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed.R.Civ.P. 8(a)(2). This short and plain statement must “give the defendant fair notice of what the claim is and the grounds upon which it rests.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (internal quotation marks and alteration marks omitted). Under federal notice-pleading standards, “a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.'” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 570). “In reviewing the sufficiency of a complaint under the plausibility standard, [courts must] accept the well-pleaded facts in the complaint as true, but [they] ‘need[] not accept as true legal conclusions, or threadbare recitals of the elements of a cause of action, supported by mere conclusory statements.'” Alam v. Miller Brewing Co., 709 F.3d 662, 665-66 (7th Cir. 2013) (quoting Brooks v. Ross, 578 F.3d 574, 581 (7th Cir. 2009)).
Microsoft argues that the Court should dismiss Jones's §15(b) claim because she does not allege that it took an “active step” to collect or obtain her biometric data and that, in any event, it had no practical way to obtain her consent because it did not have a direct relationship with her. Jones responds that BIPA contains no “active step” requirement, nor must a private entity have a direct relationship with the individual under the statute.
The Court begins its analysis by noting that the Illinois legislature used the term “possession” in certain BIPA sections but not in §15(b). “Where the legislature uses certain words in one instance and different words in another, it intended different results.” Dana Tank Container, Inc. v. Human Rights Comm'n, 292 Ill.App.3d 1022, 1026, 227 Ill.Dec. 179, 687 N.E.2d 102 (1st Dist. 1997). Thus, §15(b) does not penalize merely possessing biometric identifiers or information, unlike other BIPA sections. Compare 740 ILCS 14/15(b) with 740 ILCS 14/15(a), (c), (d). The Court is persuaded of this principle both by the statute's plain language as well as the fact that many other judges, including those within in this district, have reached the same conclusion. See Stauffer v. Innovative Heights Fairview Heights, LLC, Case No. 20-cv-046, 2022 WL 3139507, at *3-4 (S.D. Ill. Aug. 5, 2022); Ronquillo v. Doctor's Assoc., LLC, Case No. 21-cv-4903, 2022 WL 1016600, at *2 (N.D. Ill. April 4, 2022); Patterson v. Respondus, Inc., 593 F.Supp.3d 783, 824 (N.D. Ill. 2022); King v. People Net Corp., 21-cv-2774, 2021 WL 5006692, at *8 n.11 (N.D. Ill. Oct 28, 2021); Jacobs v. Hanwha Techwin Am., Inc., Case No. 21-cv-866, 2021 WL 3172967, at *2 (N.D. Ill. July 27, 2021); Heard v. Becton, Dickinson & Co., 440 F.Supp.3d 960, 965 (N.D. Ill. 2020) (“Heard I”); Namuwonge v. Kronos, Inc., 418 F.Supp.3d 279, 286 (N.D. Ill. 2019).
Having determined that §15(b) requires something beyond possession, the inquiry turns to what that is. Section 15(b) states that no private entity “may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information” absent consent. 740 ILCS § 14/15(b). Under a commonsense reading, this means that the private entity must undertake some effort to collect or obtain biometric identifiers or information. Courts sometimes refer to this as an “active step” requirement. See Heard I, 440 F.Supp.3d at 966; Jacobs, 2021 WL 3172967, at *2. Although BIPA does not say the words “active step,” this concept simply describes the unifying characteristic among the verbs in the statute.
Indeed even the catch-all phrase “otherwise obtain” contemplates some type of affirmative effort. See Obtain, BLACK'S LAW DICTIONARY (11th ed. 2019) (“defining “obtain” as “[t]...
To continue reading
Request your trial