King v. PeopleNet Corp.
| Decision Date | 28 October 2021 |
| Docket Number | 21 CV 2774 |
| Parties | Sharena King, Plaintiff, v. PeopleNet Corporation, Defendant. |
| Court | U.S. District Court — Northern District of Illinois |
Plaintiff Sharena King's employer required her to clock in and out of work each day using a face scanner. That scanner was part of biometric technology and services that defendant PeopleNet Corporation provided to King's employer, along with other clients in Illinois. PeopleNet's scanner collected King's biometric data and sent it to PeopleNet, which stored and used the information. King sued PeopleNet in state court, alleging violations of § 15(a), (b), and (c) of the Illinois Biometric Information Privacy Act. PeopleNet removed the case to federal court and moves to dismiss for lack of personal jurisdiction and failure to state a claim. King moves to remand two of her three claims. For the reasons discussed below, plaintiff's motion is granted, and defendant's motion is denied.
A defendant can remove a lawsuit filed in state court to federal court if the federal court has original jurisdiction over the dispute. 28 U.S.C. § 1441(a). Federal district courts have original jurisdiction over any class action where at least one plaintiff is diverse from at least one defendant, the amount in controversy exceeds $5 million in the aggregate, and there are 100 or more class members. 28 U.S.C. § 1332(d); Sabrina Travelers Com. Ins. Co., 869 F.3d 568, 578 (7th Cir. 2017) (citations omitted). The party invoking federal jurisdiction must also prove that Article III standing existed at the time of removal. See Collier v SP Plus Corp., 889 F.3d 894, 896 (7th Cir. 2018) (citing Lujan v. Def. of Wildlife, 504 U.S. 555, 561 (1992)). If it appears that the court lacks subject-matter jurisdiction over a claim before final judgment, that claim shall be remanded. 28 U.S.C. §§ 1441(c)(2), 1447(c); see Bergquist v. Mann Bracken, LLP, 592 F.3d 816, 819 (7th Cir. 2010) (citations omitted).
Federal Rule of Civil Procedure 12(b)(2) governs dismissals based on lack of personal jurisdiction. A plaintiff need not include facts alleging personal jurisdiction in the complaint, but once a defendant moves to dismiss for lack of personal jurisdiction, the plaintiff bears the burden of establishing it. Curry v. Revolution Lab'ys, LLC, 949 F.3d 385, 392 (7th Cir. 2020) (quoting Purdue Rsch. Found. v Sanofi-Synthelabo, S.A., 338 F.3d 773, 782 (7th Cir. 2003)). Where the determination is made solely on the basis of written materials and not an evidentiary hearing, the plaintiff only needs to make a prima facie showing of personal jurisdiction. Matlin v. Spin Master Corp., 921 F.3d 701, 705 (7th Cir. 2019) (citation omitted). I take plaintiff's asserted facts as true and resolve any factual disputes in her favor. See uBID, Inc. v. GoDaddy Grp., Inc., 623 F.3d 421, 423-24 (7th Cir. 2010) (citations omitted).
To survive a motion to dismiss under Rule 12(b)(6), a complaint must state a claim upon which relief may be granted. Fed.R.Civ.P. 12(b)(6). The complaint must contain “sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.'” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). In reviewing a motion to dismiss, I construe all factual allegations as true and draw all reasonable inferences in plaintiff's favor. Calderone v. City of Chicago, 979 F.3d 1156, 1161 (7th Cir. 2020) ).
PeopleNet, a Delaware corporation with its principal place of business in Massachusetts, sold time and attendance solutions to Illinois employers. [18-1] ¶¶ 4, 15, 22.[1] To perform workforce management services (including timekeeping and work scheduling), PeopleNet supplied its clients with biometric-enabled hardware such as fingerprint and facial recognition scanners. Id. ¶¶ 4-5, 19. The devices captured employee data and transmitted it to defendant's cloud-based time and attendance systems, hosted on PeopleNet's servers. Id. ¶¶ 4-5, 19-20, 25. PeopleNet marketed its devices and software as superior to traditional time clocks, and gained a competitive advantage and made profits from the use of biometric data. Id. ¶ 45.
Beginning in 2006, PeopleNet provided technology and services to Paramount Staffing, an Illinois corporation based in Northbrook, Illinois. [18-1] ¶ 21. Sharena King worked for Paramount in Chicago. Id. ¶ 23. As part of her job, King was required to clock in and out of shifts using PeopleNet's face scanner, or timeclock. Id. ¶¶ 24- 25. During each scan, PeopleNet's device collected King's biometric identifiers, converted them into an electronic format, and transmitted that information to PeopleNet. Id. ¶ 25. PeopleNet didn't tell King that her biometrics were being collected and stored, id. ¶ 43, didn't get informed written consent from King before using her biometrics, id. ¶¶ 26, 43, didn't provide written disclosures describing why it was using King's biometrics or how long the use would last, id., and failed to make a biometric retention or destruction policy publicly available. Id. ¶¶ 26, 41. In addition to King, thousands of other people in Illinois were scanned by PeopleNet's systems, and defendant collected, stored, transmitted, and disseminated their biometric data. Id. ¶¶ 28, 30.
Federal courts may resolve only “cases” or “controversies.” U.S. Const. art. III, § 2, cl. 1. Standing doctrine “limits the category of litigants empowered to maintain a lawsuit in federal court” so as to “ensure that federal courts do not exceed their authority” under Article III. Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (citations omitted). The requirements of standing guarantee that the plaintiff has a “personal stake” in the litigation. TransUnion LLC v. Ramirez, 141 S.Ct. 2190, 2203 (2021) (quoting Raines v. Byrd, 521 U.S. 811, 819 (1997)). Without that, there's no Article III case or controversy, and federal courts lack jurisdiction. See id.
To establish Article III standing, the party who wants the federal forum must show “(1) that [the plaintiff] suffered an injury-in-fact that is concrete, particularized, and actual or imminent, (2) that the injury was caused by the defendant, and (3) that the injury would likely be redressed by the requested judicial relief.” Thornley v. Clearview AI, Inc., 984 F.3d 1241, 1244 (7th Cir. 2021) (quoting Thole v. U.S. Bank N.A., 140 S.Ct. 1615, 1618 (2020)). While PeopleNet bears the burden of showing standing in this case, see [1], the court also has an independent obligation to confirm that it has subject-matter jurisdiction before proceeding to the merits. See Carroll v. Stryker Corp., 658 F.3d 675, 680 (7th Cir. 2011) (citations omitted).
King argues that she hasn't suffered an injury in fact that will support her claims under § 15(a) and (c) of BIPA, 740 ILCS 14/15(a), (c). [18]. An injury in fact that satisfies the requirements of Article III “must be both concrete and particularized.” Thornley, 984 F.3d at 1245-46 (citing Spokeo, 578 U.S. at 340). A legislature can “elevat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law, ” Spokeo, 578 U.S. at 341 (quoting Lujan v. Def. of Wildlife, 504 U.S. 555, 578 (1992)), but violations of duties “owed to the public generally, not to particular persons, ” are not particularized injuries, and cannot be the basis for standing. Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020), as amended on denial of reh'g and reh'g en banc (June 30, 2020); see Thornley, 984 F.3d at 1247.
Section 15(a) of BIPA requires covered private entities to do two things. 740 ILCS 14/15(a); see Fox v. Dakkota Integrated Sys., 980 F.3d 1146, 1154-55 (7th Cir. 2020). First, they must “develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information.” 740 ILCS 14/15(a). Second, covered private entities must comply with that policy: retain and destroy biometric information in accordance with the law. Id. Because the first of these duties- publishing the policy-is “owed to the public generally, not to particular persons whose biometric information the entity collects, ” a violation of just that part of § 15(a) is not an injury in fact under Article III because the resulting harm is not particularized. Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020); Fox, 980 F.3d at 1154-56. Where a plaintiff has been injured by a defendant's failure to comply with a policy, however, the resulting “unlawful retention of biometric data inflicts a privacy injury” sufficient to support a plaintiff's § 15(a) claim in federal court. Fox, 980 F.3d at 1154-56.
The issue here is the precise claim alleged. King argues that she is not suing on the basis of PeopleNet's unlawful retention of her biometrics, but only alleging that PeopleNet violated § 15(a)'s publication requirement. [18] at 3-6. According to PeopleNet, the complaint alleges violations of all of § 15's duties. [20] at 7.
King is right. She has alleged that PeopleNet violated its duty to publish a policy, and also that defendant retained her biometric information. [18-1]. But plaintiff hasn't alleged that PeopleNet's retention of her data was unlawful. See id. The complaint has a conclusory allegation that PeopleNet “[violated King's] biometric privacy rights under BIPA.” Id. ¶ 10. But the specific claim is that defendant collected and stored King's biometrics, id. ¶¶ 4-5, 19-25,...
To continue reading
Request your trial