Sekura v. Krishna Schaumburg Tan, Inc.

• Decision Date: 28 September 2018
• Docket Number: No. 1-18-0175,1-18-0175
• Citation: 2018 IL App (1st) 180175,115 N.E.3d 1080,426 Ill.Dec. 158
• Parties: Klaudia SEKURA, Individually and on Behalf of All Others Similarly Situated, Plaintiff-Appellant, v. KRISHNA SCHAUMBURG TAN, INC., an Illinois Corporation, Defendant-Appellee.
• Court: United States Appellate Court of Illinois

2018 IL App (1st) 180175

115 N.E.3d 1080

426 Ill.Dec. 158

Klaudia SEKURA, Individually and on Behalf of All Others Similarly Situated, Plaintiff-Appellant,

v.KRISHNA SCHAUMBURG TAN, INC., an Illinois Corporation, Defendant-Appellee.

No. 1-18-0175

Appellate Court of Illinois, First District, FOURTH DIVISION.

Opinion filed September 28, 2018

Ryan D. Andrews, Roger Perlstadt, and Alexander G. Tievsky, of Edelson PC, of Chicago, for appellant.

Daniel P. Costello and R. Andrew Smith, of Daniel P. Costello & Associates, LLC, of Chicago, for appellee.

JUSTICE GORDON delivered the judgment of the court, with opinion.

¶ 1 In this appeal, plaintiff Klaudia Sekura appeals the dismissal, pursuant to section 2-615 of the Code of the Civil Procedure, of one of her causes of action. 735 ILCS 5/2-615 (West 2016).¹ Although only one cause of action was dismissed, the trial court made an express written finding that there was no just reason for delaying an appeal from its order dismissing count I. Thus, we have jurisdiction to hear this appeal pursuant to Illinois Supreme Court Rule 304(a) (eff. Mar. 8, 2016).²

¶ 2 In count I, plaintiff Sekura alleged that defendant Krishna Schaumburg Tan, Inc. violated the Biometric Information Privacy Act (Act) ( 740 ILCS 14/1 et seq. (West 2016) ) by collecting plaintiff's fingerprints without providing the statutorily required disclosure concerning its retention policy and other topics, and by disclosing her fingerprints to an out-of-state third-party vendor. The purpose of the Act is to provide an "individual" with protections against his or her biometric information becoming "compromised" ( 740 ILCS 14/5(c) (West 2016) ), and the Act expressly authorizes a suit by "[a]ny person" who has been "aggrieved by a violation of this Act" ( 740 ILCS 14/20 (West 2016) ).

¶ 3 Initially, the trial court denied defendant's motion to dismiss, finding that under the plain language of the statute plaintiff was a person aggrieved by a violation of the Act. However, after the Second District found in Rosenbach v. Six Flags Entertainment Corp. , 2017 IL App (2d) 170317, ¶ 28, 2017 WL 6523910,³ that standing under the Act required an "injury or adverse effect" in addition to a violation of the Act, the trial court felt compelled to reverse its prior ruling and to dismiss plaintiff's claim under the Act.⁴ Subsequently, a federal district court distinguished Rosenbach on the ground that disclosure to a third-party vendor, which is also alleged in our case, constituted such an injury or adverse effect. Dixon v. Washington & Jane Smith Community-Beverly , No. 17 C 8033, 2018 WL 2445292, at *12 (N.D. Ill. May 31, 2018).

¶ 4 First, we find that the trial court was initially correct, and that, pursuant to both the plain language of the statute itself and its legislative history and purpose, plaintiff was a person aggrieved by a violation of the Act. Second, we find that, even if Rosenbach was correctly decided, it is distinguishable on the facts of this case, as the Dixon court similarly found, because disclosure to a third-party vendor is an injury or adverse effect. In addition, the mental anguish that plaintiff alleges in her complaint also constitutes an injury or adverse effect.

¶ 5 For the following reasons, we reverse the trial court's section 2-615 dismissal of count I and remand for further proceedings.

¶ 6 BACKGROUND

¶ 7 In her complaint, filed April 7, 2016, plaintiff alleges that defendant operates a tanning salon in Schaumburg, Illinois as a franchisee of L.A. Tan Enterprises, Inc. (L.A. Tan). When a customer first purchases services at defendant's tanning salon, he or she is enrolled in L.A. Tan's national membership database, which allows him or her to use his or her membership at any of L.A. Tan's locations. To enroll, customers are required to have their fingerprints scanned. In addition, defendant discloses its customer fingerprint data to an out-of-state third party vendor, namely, SunLync.

¶ 8 Specifically, plaintiff alleges that, in April 2015, she purchased a membership with defendant in order to use its tanning salon and paid defendant on a monthly basis for the membership. When she purchased the membership with defendant, defendant then enrolled plaintiff in L.A. Tan's corporate membership database and "required that she provide it with a scan of her fingerprint." Every time she visited defendant's tanning salon, "she was required to scan her fingerprint before using its services."

¶ 9 Plaintiff alleges (1) that she has never been informed of the specific purposes or length of time for which defendant collected, stored or used her fingerprints, (2) that she has never been informed of any biometric data retention policy developed by defendant or whether defendant will ever permanently delete her fingerprint data, (3) that she has never been provided with nor signed a written release allowing defendant to collect or store her fingerprints, and (4) that she has never been provided with nor signed a written release allowing defendant to disclose her biometric data to SunLync to or any other third party.

¶ 10 Plaintiff further alleges that, in 2013, more than 65% of L.A. Tan's salons were in foreclosure and that defendant's customers have not been advised what would happen to their biometric data if defendant's salon went out of business.⁵

¶ 11 Plaintiff alleges that she becomes emotionally upset and suffers from mental anguish when she thinks about what would happen to her biometric data if defendant went bankrupt or out of business or if defendant's franchisor, L.A. Tan, went bankrupt or out of business, or if defendant shares her biometric data with others. The allegation of mental anguish appears in the "Factual Background" section of plaintiff's complaint. Later, in count I, when plaintiff makes a specific claim about the Act, she states that she "incorporates the foregoing allegations as if fully set forth herein."

¶ 12 Plaintiff alleged three causes of action: (1) violation of the Act, (2) unjust enrichment, resulting from defendant's failure to comply with the Act, and (3) negligence. Only the first count is at issue in this appeal. In this first count, plaintiff alleges that defendant violated the Act because (1) it collected, used, stored and disclosed biometric information without first obtaining the written release that the Act requires; (2) it disclosed biometric information to SunLync, an out-of-state third party vendor; (3) it did not properly inform customers in writing that their biometric information was being collected and stored or of the specific purpose and length of time for which it was being collected and stored, as required by the Act; and (4) it did not provide a publicly available retention schedule or guidelines for permanently destroying its customers' biometric information, as required by the Act.

¶ 13 Plaintiff filed her suit as a class action alleging that a numerous class of other customers suffered from the same practices.

¶ 14 Instead of filing an answer, defendant moved on July 1, 2016, to dismiss plaintiff's first and second causes of action, for failing to allege sufficient facts to state a cause of action under the Act.

¶ 15 On February 9, 2017, the trial court granted defendant's motion to dismiss count II, the unjust enrichment claim, but denied the motion with respect to count I, the count alleging violations of the Act that is the subject of this appeal.

¶ 16 In its memorandum opinion, the trial court observed that defendant had argued that count I "must be dismissed because the plaintiff is not ‘aggrieved’ as required by the statute itself." In response to this argument, the trial court found:

"The language of [the Act] itself in this respect is brief and straightforward: it provides a cause of action for ‘any person aggrieved by its violation.’ 740 ILCS 14/20 [ (West 2016) ]. The most natural reading of this language alone is broad, suggesting in context that any person whose biometric data was mishandled in violation of [the Act] has a claim based on such violation. The plaintiff directs the court to a long history of cases which have generally reached a similar conclusion: the Illinois Supreme Court has long held that "[a] person is prejudiced or aggrieved * * * when a legal right is invaded by the act complained of.’ Glos v. People , 259 Ill. 332, 340, 102 N.E. 763 (1913) ; see also Am. Surety Co. v. Jones , 384 Ill. 222, 229, 51 N.E.2d 122 (1943) (‘We think the words "person who shall think himself aggrieved" mean a person who is immediately aggrieved * * * as by the refusal of a license * * * not one who is only consequently aggrieved.’ [ (citing The King v. The Justices of Middlesex , 3 B. & A. 983 (1833) ) ]. Courts have further applied this reasoning to privacy-related laws such as the federal Video Privacy Protection Act [cite omitted], which similarly provides a claim for ‘any person aggrieved by any act of a person in violation of this section.’ See e.g. Austin-Spearman v. AMC Network Entertainment L.L.C. , 98 F.Supp.3d 662 (S.D.N.Y. 2015) ; see also In re Facebook Internet Tracking Litig. , 140 F.Supp.3d 922 (N.D. Ill. 2015) (applying similar reasoning and allowing suit under other federal privacy laws without dangers)."

¶ 17 The trial court observed:

"Further, a review of other similar statutes provides further support for the broad intended reach of [the Act]. As the plaintiff points out in its supplemental brief on legislative history, both the Genetic Information Privacy Act, 410 ILCS 513/1, et seq. , [ (West 2016) ] and the AIDS Confidentiality Act, 410 ILCS 305/1, et seq. , [ (West 2016) ] provide for a substantially identical, ‘any person aggrieved’ right of recovery and have been interpreted as not requiring actual damages be pled. See e.g. Doe v. Chand , 335 Ill. App. 3d 809, 822, 269 Ill.Dec. 543, 781 N.E.2d 340, 781 N.E.2d 340 (5th Dist. 2002). Those statutes were also considered and amended during the same legislative session as enacted [the Act],

...